last executing test programs:

12m40.601097681s ago: executing program 3 (id=858):
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0xa, 0x4, 0xdd, 0xa}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
close(0x3)
r1 = bpf$MAP_CREATE(0x0, 0x0, 0x0)
bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x3, 0x3, &(0x7f0000000080)=@framed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x94)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r1}, 0x38)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000940)='percpu_alloc_percpu\x00', r2}, 0x10)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000000)=@framed={{0x7a, 0xa, 0x0, 0xff00, 0x0, 0x71, 0x10, 0x43}}, &(0x7f0000000480)='syzkaller\x00'}, 0x80)

12m40.31788359s ago: executing program 3 (id=864):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_MSG_GETSETELEM(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x2c, 0xd, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000)

12m40.167572097s ago: executing program 3 (id=866):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000)
recvmmsg(r0, &(0x7f0000002c00)=[{{0x0, 0x0, 0x0}, 0x1200101}, {{0x0, 0x0, 0x0}, 0x2044}, {{0x0, 0x0, 0x0}, 0xffffffff}], 0x3, 0x40010020, 0x0)

12m39.694762992s ago: executing program 3 (id=872):
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x7, 0x10001, 0x8, 0x1}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r1}, 0x10)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000200)='fdb_delete\x00', r2}, 0x10)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000000)={'bridge_slave_0\x00', @random="010000201000"})

12m39.356803391s ago: executing program 3 (id=878):
r0 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vxcan1\x00', <r1=>0x0})
bind$can_j1939(r0, &(0x7f00000000c0)={0x1d, r1, 0x0, {0x0, 0x1}}, 0x18)
connect$can_j1939(r0, &(0x7f0000000140)={0x1d, r1, 0x0, {0x1, 0xff, 0xa8fe8ad4eea2351f}, 0x2}, 0x18)
sendmmsg(r0, &(0x7f0000003e40), 0x3fffffffffffe3d, 0xf5)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
write(0xffffffffffffffff, &(0x7f0000000040), 0x0)
r3 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, 0x0)
bind$can_j1939(r3, &(0x7f0000000100), 0x18)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'vxcan1\x00', @remote})

12m39.096169912s ago: executing program 3 (id=883):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0000000206030000000000000000000000000005000100070000000900020073797a31000000001400078005001500070000000800124000000000050005000200000005000400000000000d000300686173683a6e6574"], 0x5c}}, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10040047}, 0x240008c4)

12m23.939232451s ago: executing program 32 (id=883):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="5c0000000206030000000000000000000000000005000100070000000900020073797a31000000001400078005001500070000000800124000000000050005000200000005000400000000000d000300686173683a6e6574"], 0x5c}}, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10040047}, 0x240008c4)

1m23.359866185s ago: executing program 0 (id=2985):
pipe(&(0x7f0000000040)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x4, 0x0, 0x13f, 0x6}}, 0x20)
io_setup(0x3, &(0x7f00000000c0))
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e)
sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4)
r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r4}, 0x10)
r5 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0)
ioctl$DRM_IOCTL_SET_CLIENT_CAP(r5, 0x4010640d, &(0x7f0000000000)={0x3, 0x2})
ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r5, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000480)=[<r6=>0x0], 0x1})
ioctl$DRM_IOCTL_MODE_GETPLANE(r5, 0xc02064b6, &(0x7f00000001c0)={r6, <r7=>0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r5, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000400)=[<r8=>0x0], &(0x7f0000000280), 0x1, r7})
ioctl$DRM_IOCTL_MODE_ATOMIC(r5, 0xc03864bc, &(0x7f0000000040)={0x0, 0x1, &(0x7f00000000c0)=[r7], &(0x7f0000000280), &(0x7f0000000300)=[r8], &(0x7f0000000340)})
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)={<r9=>0xffffffffffffffff, <r10=>0xffffffffffffffff})
r11 = syz_io_uring_setup(0x88d, &(0x7f0000000140)={0x0, 0xcfe8, 0x0, 0xffffffff, 0x121}, &(0x7f0000000100)=<r12=>0x0, &(0x7f00000003c0)=<r13=>0x0)
syz_io_uring_submit(r12, r13, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x9048}})
io_uring_enter(r11, 0x47f6, 0x0, 0x0, 0x0, 0x0)
recvmsg(r9, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, 0x0}, 0x1f00)
sendmsg$tipc(r10, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{0x0}], 0x1}, 0x0)
ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000000)={0x110, @tick=0x1, 0x78, {0x4, 0x1}, 0x3a, 0x0, 0x2})
ioctl$VIDIOC_G_FMT(0xffffffffffffffff, 0xc0d05604, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/syz0\x00', 0x1ff)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680))

1m21.987008609s ago: executing program 0 (id=2989):
shmget$private(0x0, 0x7000, 0x2, &(0x7f0000ff7000/0x7000)=nil)
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
close(0x3)
r1 = socket(0x2, 0x80805, 0x0)
r2 = socket$inet6_sctp(0xa, 0x5, 0x84)
shutdown(r2, 0x0)
close(0x3)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={<r3=>0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e21, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10)
getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x7a, &(0x7f0000000340)={r3, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84)
sendmmsg$inet_sctp(r1, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30, 0x180}], 0x1, 0x0)
setsockopt(r0, 0x84, 0x23, &(0x7f0000000040)="020000000980ffff", 0x8)
recvfrom$rose(r1, &(0x7f0000000400)=""/151, 0x97, 0x10021, &(0x7f0000000300)=@full={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, 0x3, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @default, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast]}, 0x40)
r4 = add_key(&(0x7f0000000000)='asymmetric\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f0000000240)="32f8ae5486538dc19243251b10bf192a09505f1c9a0ca0f37b2d1290c6903704d038fa10a64ce08568e4bf3ec5562fa126185cccfc097037e3179df075a2a7477e8b7e3e0bd9f9bb0b359ddf20fa41857b03dbae158599e99c510fc754aadf9d45a4b50901e22eacd0d29842bd2f5d86214d3a803c3443544012762aff56e903d7cfa780df0e7bb470309b210f15bb5041895c466d7bbdc24366618dacccd73d13b9", 0xa2, 0xfffffffffffffff8)
fstat(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, <r5=>0x0})
getgroups(0x1, &(0x7f0000000180)=[<r6=>0xffffffffffffffff])
keyctl$chown(0x4, r4, r5, r6)

1m21.746850313s ago: executing program 0 (id=2992):
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc))
timer_settime(0x0, 0x1, &(0x7f0000000280)={{0x77359400}}, 0x0)
ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f00000000c0)=0xd)
read(0xffffffffffffffff, 0x0, 0x0)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r1 = syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f0000000000))
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000002c0)={0x44, 0x2, 0x6, 0x201, 0x0, 0x0, {0xc}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}]}, 0x44}}, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
r4 = syz_open_dev$tty1(0xc, 0x4, 0x1)
setresuid(0xee00, 0xee00, 0xee00)
ioctl$PIO_SCRNMAP(r4, 0x4b52, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
socket$nl_xfrm(0x10, 0x3, 0x6)
r5 = socket$inet6(0xa, 0x3, 0x7)
connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c)
r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYRES64=r1], 0x0}, 0x94)
sendmsg$NL80211_CMD_NEW_STATION(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001040)={0x0, 0x50}}, 0x4000004)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='mmap_lock_acquire_returned\x00', r6}, 0x10)
r7 = syz_open_procfs(0x0, &(0x7f0000000140)='task\x00')
getdents(r7, &(0x7f0000001fc0)=""/184, 0x9a)
sendmmsg(r5, &(0x7f0000000480), 0x2e9, 0xffe0)

1m17.327591484s ago: executing program 0 (id=2998):
unshare(0x2c020400)
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000380), 0x80000, 0x0)
unshare(0x0)
ioctl$RTC_SET_TIME(r0, 0x4024700a, 0x0)

1m16.351252337s ago: executing program 0 (id=3002):
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000005c0)={0xffffffffffffffff, 0xe0, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, &(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x5, &(0x7f00000002c0)=[0x0, 0x0, 0x0], &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0], <r0=>0x0, 0xcd, &(0x7f00000003c0)=[{}, {}], 0x10, 0x10, &(0x7f0000000400), &(0x7f0000000440), 0x8, 0x29, 0x8, 0x8, &(0x7f0000000480)}}, 0x10)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18010000120000000000000000000000850000006d000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000280)='contention_end\x00', r1}, 0x10)
bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000740)=@generic={&(0x7f0000000700)='./file0/file0\x00', r1}, 0x18)
r2 = syz_open_procfs(0x0, &(0x7f00000004c0)='map_files\x00')
getdents64(r2, &(0x7f0000000080)=""/101, 0x1d)
sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0)
pipe2$9p(&(0x7f0000000240)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff}, 0x0)
write$P9_RVERSION(r4, &(0x7f0000009ec0)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15)
r5 = dup(r4)
write$FUSE_BMAP(r5, &(0x7f0000000100)={0x18, 0x0, 0x0, {0x2}}, 0x18)
write$FUSE_DIRENTPLUS(r5, &(0x7f0000000440)=ANY=[@ANYBLOB="b0000000000000ab284dc9a94095f54e34f11a5a480d2115805745f8a24d"], 0xb0)
write$FUSE_NOTIFY_RETRIEVE(r5, &(0x7f00000000c0)={0x14c}, 0x137)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r3, @ANYBLOB=',wfdno=', @ANYRESHEX=r5])
connect$unix(r2, &(0x7f0000000780)=@abs={0x1, 0x0, 0x4e23}, 0x6e)
fdatasync(r4)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x4, 0x1, 0x101, 0x0, 0x0, {0x1, 0x0, 0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x200048e0}, 0x4)
sendmsg$NFNL_MSG_CTHELPER_GET(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x14, 0x1, 0x9, 0x301, 0x0, 0x0, {0x7, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x44891}, 0x4004000)

1m16.07216979s ago: executing program 0 (id=3004):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket(0x400000000010, 0x3, 0x0)
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0)
socket(0x400000000010, 0x3, 0x0)
r4 = socket$inet_sctp(0x2, 0x5, 0x84)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
r5 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000400)={'wlan0\x00', <r6=>0x0})
syz_usb_connect(0x3, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="120193010203010902120001070a80358a28c40900999fd306"], &(0x7f0000000680)={0x0, 0x0, 0x5, &(0x7f0000000380)={0x5, 0xf, 0x5}})
syz_usb_connect$cdc_ecm(0x5, 0x56, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x44, 0x1, 0x1, 0x70, 0xa0, 0x6, [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x2, 0x6, 0x0, 0x56, {{0x5}, {0x5, 0x24, 0x0, 0x6}, {0xd, 0x24, 0xf, 0x1, 0x2, 0xed9, 0x5, 0x8}}, {[{{0x9, 0x5, 0x81, 0x3, 0x0, 0x10, 0x7, 0x80}}], {{0x9, 0x5, 0x82, 0x2, 0x400, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x400, 0x6, 0x2, 0x2}}}}}]}}]}}, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0})
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$NL80211_CMD_TRIGGER_SCAN(r5, &(0x7f0000000e80)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f0000000000)={0x24, r7, 0x1, 0x70bd2b, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_SCAN_FLAGS={0x8, 0x9e, 0x10}]}, 0x24}, 0x1, 0x0, 0x0, 0x24004084}, 0x40000)
socket$rds(0x15, 0x5, 0x0)
socket$inet6(0xa, 0x400000000001, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r8 = getpid()
sched_setscheduler(r8, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r9=>0xffffffffffffffff, <r10=>0xffffffffffffffff})
connect$unix(r9, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x2000000}, 0x6e)
sendmmsg$unix(r10, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r9, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x0, 0x0)
r11 = socket$inet_sctp(0x2, 0x1, 0x84)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r11, 0x84, 0x64, &(0x7f0000000140)=[@in={0x2, 0x4e21, @local}], 0x10)

1m15.52664122s ago: executing program 2 (id=3006):
r0 = socket$inet_sctp(0x2, 0x5, 0x84)
syz_usb_connect(0x0, 0x36, 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x10, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1daa00000000000061101000040000009500000000000000"], &(0x7f0000000480)='syzkaller\x00'}, 0x80)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_COALESCE_SET(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000008c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000001400000008000f00fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000900fc000000080011000700000008000e00800000000800"], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x40010)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
connect$unix(r4, &(0x7f0000000800)=@abs, 0x6e)
sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000002c0)='./binderfs2/binder1\x00', 0x0, 0x0)
openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000007c0)={0x50, 0x0, &(0x7f0000000580)=[@reply={0x40406301, {0xb, 0x0, 0x0, 0x0, 0xd502382cb500202, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @dead_binder_done], 0x21, 0x0, &(0x7f0000000780)="6835e85a03c7d65a4e50ba989234fd30ef7a26f22eeb328d46740623d65d970ad4"})
syz_open_dev$vim2m(&(0x7f0000000080), 0xe2, 0x2)
fanotify_init(0x8, 0x80000)
r7 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="7000000002060500000000000000000000000000120003006269746d61703a69702c6d6163000000050004000000000009000200f3797a"], 0x70}}, 0x800)
sendmsg$IPSET_CMD_DESTROY(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000880)={0x20, 0x3, 0x6, 0x301, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x20}}, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x10, 0xe, &(0x7f0000000a80)=ANY=[@ANYBLOB="b7000000639d0000bca30000000000002403000030feffff720af0ffa4ffffff71a4f0ff000000001f030000000000002e100200000000002604f8ffffff000414010000000300001d130000000000007a0a00fe0020001f0f14000000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb150c537bf2085651d6dd6ce9bc461e91a7168e5181554a090f300020000fe275daf51efd601b6bf0134c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff61623604000000000000006a89adaf17b0a6041bdeebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4136dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101ab062cd54e67051d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91ff073e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48153baae244e7bf573eac34b781337ad5905c6bbf1137548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab51380d7b4ead35a385e0b4a26b702396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb11883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcd857ab15e355713767c536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ced301efeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef0900000000000000ff0f40b1888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fc08001011e32f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e3f753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30c1675767999d146aef7799738b292fd64bb25b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963342aece449a0d80010f5c653d22d49030a8c2a4ab000000000000003f8dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc090000000000000061563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ecab5d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9901010000b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba435926b61c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0aa81192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f0100e0eda300a43a13bd1b9f3322405d1efd78e5789c6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a43746979f99f6a1527f004f1e37a3926937e84fb478199dc1020f4beb98b8074bf7df8b5e783637da740800000000000000c55a4385e9a617aa6c8e10d4202c5afeb06eef98aee88ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a274000000000000000000000000000000000000000000000009dd14b38f2f4426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4100260ffcd8f1d04166d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06ee0ff698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb3928143be1c1023a375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10baa804a707f0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d34d3757b1450fdb0a9a69f432e277f3a0386eb2bd3305c821c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e913ac1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07618b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e040000003c3ffad44d2a376def42e41e9fc31678257e040fa7cf32c221aaac08000000000000001a00000000000000000000173570f0c11ae694b0f7a4f9c2f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d641ef02e495295d756e110522a7a945b93fb705b95b6aae27a8fb33732ce1da1c0b1af8eb9222a06e984ab1e6984c8bdc12360627137ab67b6b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481efe46a4ce86be0b1d8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0c6cb4bed8594a39bd76d3ef8a7ab014e787596db796bd93a36c2880423291e3bccc86f66ba792ff4d87b3f80e5908779e51c5e9055fc5b23605cd000c723187ef09dcf4b07b06a9342f3f62ee7acddff292082c1f4d8eb9561f80873a09a1ae0c9af1121175e5600f43a1179484502009759264a5729f07c2b218fa36ba2316a99aaad0130df83d0bda1e711290f78c143ea143967b00adcd77e6ad5e48d839ea61aadb83e4d071c54691924a3830d3e7b5c198bb0ed623153590000060000000000004b985ea1702f34f2f85b168c083e810ed567e3f1979b9ed1a4bf6a10dac825c96a0828b335de445a4880bb6474157efd1a72ca46ae4cbe3ab648c9bc4867a5a4cb87d7d6d55475b34b3cb6aa9e2337d4e04a37e35109752522ac9b186ddd80c47da6a2f4ef7bb909c97552606ffff97e86dc995604346262a177b06c634969a31b5717c416f8224662f4dd46d6081cb96dd607410ee222ec8f206c4b74"], &(0x7f00000001c0)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94)
getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000000), &(0x7f0000000040)=0x4)
r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0)
syz_usb_connect(0x3, 0x3d, &(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES64=r8], 0x0)

1m13.665684107s ago: executing program 5 (id=3010):
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
openat$audio(0xffffff9c, 0x0, 0x402, 0x0)
connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e)
r2 = socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, 0x0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x54, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000d0"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r3, 0x2000300, 0xe, 0x0, &(0x7f0000000180)="74fa40b249c0d585699ce70fac7b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50)
sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r4 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_NODELAY(r4, 0x84, 0x3, &(0x7f0000000000)=0x81, 0x4)
socket$netlink(0x10, 0x3, 0x10)
setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x29, 0x24, &(0x7f00000000c0), 0x4)
socket$kcm(0x10, 0x2, 0x4)
r5 = syz_open_dev$sndctrl(0x0, 0x1, 0x0)
syz_open_dev$sg(0x0, 0x0, 0x8002)
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r5, 0xc4c85512, &(0x7f0000000280)={{0x6, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x0, 0x0, 0x40000000000, 0xffffffffffffffff, 0xffffffefffffffff, 0x0, 0x4, 0x0, 0x0, 0x4, 0x0, 0x0, 0xfffffeffbfffffff, 0x0, 0x0, 0x0, 0x3, 0x80000000, 0x3, 0x0, 0x0, 0x4, 0x0, 0x6, 0x0, 0x40, 0x0, 0xfffffffffffffffd, 0x100200000, 0xb, 0x6, 0x0, 0x0, 0x0, 0x9, 0x0, 0x10000, 0x1000, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x7, 0x10000, 0x7785, 0x0, 0x4, 0x4, 0x8, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x80000000000, 0x0, 0x4, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x1000000000, 0x0, 0x80000000000000, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x100, 0x81, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x2, 0x100000000000, 0x0, 0x3, 0x2, 0x0, 0x7, 0xc0c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0xffffffffffeffffc, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x80]})
socket$netlink(0x10, 0x3, 0x4)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19)

1m13.196335325s ago: executing program 4 (id=3013):
syz_usb_connect$hid(0x2, 0x0, 0x0, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080))
bpf$MAP_CREATE(0x0, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1)
read$msr(r0, &(0x7f0000019680)=""/102391, 0x18ff7)
r1 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="100000002d000b02d25a806f8c6394f9101a04000a", 0x15}], 0x1}, 0x0)
pipe2$9p(&(0x7f00000000c0), 0x0)
r2 = syz_io_uring_setup(0x53b8, &(0x7f0000000240)={0x0, 0x8e7e, 0x800, 0x2, 0x38d}, &(0x7f0000000300), &(0x7f0000000100))
r3 = eventfd2(0xf32, 0x1)
io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r2, 0x7, &(0x7f0000001180)=r3, 0x1)
io_uring_enter(r2, 0x436d, 0x101, 0x45, 0x0, 0x0)
r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='fdinfo/3\x00')
read$eventfd(0xffffffffffffffff, &(0x7f0000000180), 0x8)
setsockopt$MRT_ADD_VIF(r4, 0x0, 0xca, &(0x7f0000000200)={0x0, 0x0, 0x2, 0xfffff1a4, @vifc_lcl_addr=@multicast2, @loopback}, 0xc)
r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f0000000200)={0xc, 0x0, <r6=>0x0})
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r5, 0x3ba0, &(0x7f0000000000)={0x48, 0x2, r6})
ioctl$IOMMU_IOAS_MAP$PAGES(r5, 0x3b85, &(0x7f0000000340)={0x28, 0x2, r6, 0x0, &(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x10})
ioctl$IOMMU_VFIO_SET_IOMMU(r5, 0x3b66, 0x1)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x7400}, 0x8810)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0, 0x0, 0x0, 0x5c8}, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b)
r7 = socket$kcm(0x10, 0x2, 0x0)
write$cgroup_subtree(r7, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33)
write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="563f000019"], 0xfe33)

1m12.512455782s ago: executing program 5 (id=3015):
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000f40)=[{{&(0x7f0000000000)={0xa, 0x4e24, 0x400004, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xb}, 0x1c, 0x0}}], 0x1, 0x40c4)
pipe2$9p(&(0x7f0000000000)={<r0=>0xffffffffffffffff}, 0x880)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000600)='rdma.current\x00', 0x275a, 0x0)
r4 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r4, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10)
r5 = socket$tipc(0x1e, 0x5, 0x0)
sendmsg$tipc(r5, &(0x7f0000000140)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x41}}}, 0x10, &(0x7f00000001c0)=[{&(0x7f0000000a40)="33223609b4be6fa63c", 0x9}], 0x1, 0x0, 0x0, 0x20000851}, 0x800)
recvmmsg(r5, &(0x7f0000002e80)=[{{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f00000002c0)=""/200, 0xc8}], 0x1, &(0x7f00000003c0)=""/71, 0x47}, 0x9}], 0x1, 0x40010000, 0x0)
write$binfmt_script(r3, &(0x7f0000000000), 0x208e24b)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$TEAM_CMD_NOOP(r6, &(0x7f0000000440)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="14000800", @ANYRES16=0x0, @ANYBLOB="000328bd7000fbdbdf2500000000"], 0x14}, 0x1, 0x0, 0x0, 0x4800}, 0x44050)
ioctl$BTRFS_IOC_RM_DEV(r0, 0x5000940b, &(0x7f0000001600)={{r1}, "b9b8ecf3c4eb02abecac023eddfa5b39b702f01a92579dbd903d0bd459108945a899d8a2c6eb385025e1cc101bcb6be034c23a28b20c110ba2e07b13cf8c0417933d42094bd80d5425fa689de667c57cb8d297498010e72d187f56e5874a73ccc93e05cf11c0de215996a0c82573b8e7e81dbc4966997dcf25a51f247c9e9c46945d592db0ee0550edb04ebf14ea7b8a152de0c8d6fe177c8492373ee523be8ebaa3d3c0b65357570d4360434222a7f1bf6fb9912217996d3027046e1fbe4608e471b46951a9a91bdc5dd99094b5e5c138adba1e3b8f62b38b4e7409b6bf0f51e0a6253f0f1983024443226eb52304b81c31c9919c1c308524a3da2b339ef2c14f936fbe77a66db5f726c675652b7605bea1ec80765611e9d7250135bdff54b5a666c1ce06615eaf7497bbd7c4bd7246adc930572832a7f5f9f5cd6e4535f928bd5f379ed6254b90b19b60ce3e243d4d2921b3ba7ceed0ce4b24b8a10e46bd9a6dd6505514f24dd725b121621cfb7903a8404cc172467b11da56d243d1657a573e5203329ce45514988cd698dccacc6ac4dc384f496dae4eee10792b2869b120cad19fe5e804f832d86f5f19ef93f06c93190b5e22229963a701fe40467a668675d3ee9ee237eeb2fb2d3150686700042188560a9c54e389d18f3d4d03bfd5886d7196089564ca5c8e96c16839208bb2c891b2d4cb532c135a5c03619a5d1734e998e57201b2d261836b2fd99251f04a277f6ba02f88af99042bf9199b497d7e9bc53f9a48483e53f9b09fb5b9a1d88aea00a3a60ae9421efa187a01d39f8f61fe2a40e9b6acf0f6e450ac52cecbe2659eefa6d57608e99d34fb36b451fbdbf705161478a67e99bd7b4d62959b697f759d5ef1e3acb1b0de1530867a72a640229c81e212adab96a0f3a666ed0e3c45af1a787ab53fadeff8f514a0a524e0e15fa707e6842757c1d44956ae5f93ede669f2611b1ff6cf3210b22f55e7646360b9ab98e81c1f0043f2fa48ca23b3ff624fa3321c54385f0613581a51adee04ae95627ab507f8a1a5d039204e52387f4aeab64e396d06ade04fefc6d4a68cf8af45569b51682822ab3a56bb9f4683414ed7a4a22a078a9b1f028888da4f98d859d4bbdce8bc49d9a48bf6ddbc8ece810bb52c55e47b29abfbcaa26dba5574c9f3b830103fb2c08eec87621d862f25d758ac92c8bbdd05e731149abe7bdff1c08d32f80ead1e7be4bde1c3fa709cdfc8019999f2968bcfb76770e37d831f95f01e26db5e2cf7440b612576d0074a38e5eceeeccdd80a4554a09096c015ab230865020e521751db8b3ea19355e3deca622e0b805bc26272f8260df802f8bca65188534043b62f1243a757c1d39171e2dd6608f9f7595b639a121e48cc8b9c882d56a0a2a665b9398e749f9f2eb32d78bb6e73729ac9ff74a7f094e1b24c76bce99f15bc55332271ffdfb9be4fdfc43a7c64425f61fa738ac185523c54fbe5c0eac8c4ab92410c3e784e1b30bad842b799dd7b5d12e785112c62761a342bc04ea4097827c35d7adff3078a6064d6f476ff7bbc49e2e40a05eda147e3667e208d3c0c4144773abd90d749b580c9980e31e10bb5b163aedda62a7dc20dbd130be55c479d5fd98cdfd30e0b612182323cc16d7a09267e0537e1862a5b3df1d1dbeac847ea182cb68fb6354a84e04213e377066d03f2b5278e59c428729cc90a35daa55a342195d368e00cb5a15b5b98942526c626b1312663e1c222bc87484e041823ff0389dc0a0606fa3a05c4aeba9ad9cedc71191c5ca566298669b340d4d70e591a167a581ef156367c3aea8f12e064a2539176d77529f1a40f91e8143643279a360fdb487e1973ceb3809a0677afe4223a6bf7c8e77a6c458ca7358167c747652e3ff61319e026b6fd9b966986633f998ebfc660306427bf43f650350b63ec2545d1589b4a0c2db027f70283ac0262dc14b1e46f7fc458afdad13e5a1931e78bb6c6919a20f8b74bb6749fc94be28cf11273f24354b68bced8adcedbd8a705b425ab196630c6c5ce0e8d78c321f6b34274d9b2d40abb76e849e4435c2104a404386611a0d3a27217a5eb6c0c65e9fddb3ff326b821a220487d991ede7a2d84444ca285de296a6f43e7988d8f9287ea0412ebd062e64f5ba78bd0c6da5adda23ed1ebc3316d3730a5ca1abf971e9f3a3c649b713dba91ea7c43743ce24cb831edf593d52d07876d99fbd1657a8519218ea32f0734a3e1b386ecfc4c26a3ffdd3bc3dc115c812108e0e42cd5e8afdf82b5d9a1dac0128e88174adf4ee3e0434ddeae4a14fa83a263077901452ff945e05168a532520ed5ceb202634bfe686ded2aa0bf44257bbe3da7cb0a8b169dd1cac50613d9791f322519c2d0a8cb899a8696693a3750bd33aa93583812a5d04ea781716f8efe7036b36715f2f4f7e4ae33c083b951ed929a93bf9ec9aedb6b53e6afb9e9cac07d7acdf0d9b2a880184b4644789eccb398f4b02ca99e1b511a3c9aff4e73208a160af19a9f24895f6b7c4f31ef2b1886f19d84a62b6b12dabed1e41042c3a0eabfc7fb581766e3caccf8459471863145a69b9da01d9ed0d47772def813a7c4fb90e94990558319b37e9d3d20912d0c113baadcee8bb1aa06c07ccebaacddf96d02e84a8f4a986caac0be399dcc54f9f9b268c40451356f60c344e5a07025228a247446739861167c7321e0166043edb16c82a481339d6ac3ae4d8f279598882ba0e803c94e008cf3dde436f905fd26f35946e823b5583a2f2ec8331455309b67b5e5f3ed89a96d1d08bc74ec52c90ad90b9de7db5e1875a0f9468a48716828d1b2eb4a6e91dc24c80d52de9d764b83ebb935c58364797cf462a53c59b86be1206923c289da787af4f820f1c0ab68d95151dbd9002717e8aa561ebfc40ba20023426886cd8a6fc834de62d61c765463748d32dea143847348b4cad48488973e52e8c7e31a393c7c4a02fbb62b9a9886ee66002c3128e312ac3a69a24f0c618ff260965167bf528b05e463bb9fa5700e67a5328d14a90a2f8a49fbfa9e393e91b48a9ce407798d18bb19f531db3445522911920d4244fedc9c9594af8346687791921f09917d7fc30dc38b895304a7f4094ca9c8e8f524e93cd3609a0f9adfbd3881e15d3302033b1a737ba7e25f6a2b1e0a19ec6cefcfd86762e80ddc92851b19aed950ea3eaa16de0de6712b08b58ea48fef9215791df3c299d717e5b04fc4a31dde4e87540d44058ee83ba693efbc9f5413b71bc1ec1d4a439fa1622f39664a880542eef21b0ecc598ade437d5c8f92bed6282497394b3388c5128f064014e1ee5a22b754ec048c94fb0e4d22544ad74799f38cb9558e97879cfb059fbb239cf8589acb56b2427e298a9a917a25e88190e53c7dd3d22c49d7c873fd62465acd2ea08aa47b8dd4fc838e906c246a83374f273d02a649628f2df8ed4583f941e3135b2263c55db15b3ad2b541b05279b33c6f0e95422886838991453630fd15f7f19738138061cfaafa0dfd676394d86fa145e6ae687163ff5e581c170781f54f92518c85ce054c4c8842ff6e1f7f36879c535b8387a86dc42b9d0e06c390e12e8c92b9e0160611d1a7d0d01ce2d7421ee9050204e08e3d73cec2fd91d62e577184470140c42f092607b78cf32b3a1272e76fe0a10667bc0813e4d250aba62d417d0845ba00bc025886666288db8a2bce16b4dd8730d0e06731d054c7b90375b4fb0922cd04344986b7795da66d780c7578d258c1e33e5d989ce84ea5337a482bea16b2c7ec9c070bacade5e951c6bae8ff0d42ce29efd689c65813180363bd6bfe3342763f2294658be32387de09e7a8e33f8c4b46d80aecc4dc22c1a23f45da498dd6cde7ce2e6ae74430eba63e64ba297eace21eb0ec18a5f5ab36a5f548620c864d603c812c7df49034505d5aab06e2a093d083aaa1e1e038c545d69711c9a7a6e4d9034ab6304fb4f112adb8992ed7557bae050042e43142e06bfc9f10c400463905071ca8b0ef76a45dfc024c628a70b3f0109d966c0f15941f794754c14b38591f4b1d45caee840fdb05394bbd31101ebed7f37f9b2f9e4b13d89f2d49ad653c329475d66f506d77e8b775a3c9c8b224e3b9227f8d2658db8ddfd4c2947abbc04addf20bb6237b2bcc02c20d0601123a4a0137cf8fd1be3deb2a66a8a94222c496bb2e7b6a84d4a5356c4e3a0404f2bffccccdb91c0186e9c24201a6e0007e0be2fd895633765e6d9ce68bc1d6bf860baa9f141705335a429232010c935bb423276ff2ac70a73561cfa1282d988a4989f3a99f105a75e1d6b7499f3ebe620404582e3505dbb495797598504a4d39b53b270189ce3fc195eb210fc2af8bc51069fc10d4aa3cf12ea943ffd40fb209e6f5a2776b1b07080b8eacdff151dfb317f681f65ce91fae0e83b39eb0cff114a7bce0c8b8e17167fc8bd36be668d84feaf135c4e8c4266c00bb2deb1bbe164faf691cc0d1e8a5314eff4e170fe72710c9f3e912c2498744b34c07c8f246aa035b5cc7b199fa1f9af5cbd77330048a0f46cc3b07048f56f5334718755634bf5d20a9f5679c95ad3bd99c5e39e203350e26bfc431165470955f2d563b4f761eb2583fee215a22f31bc504a1172fb6abec724ef746a620c4b318449459ede90ba09d834c16457c72c8ba4e65325e942ccbcdc0c8153e049b3e9969b4c1304721feee4f4b313821cab7d6571cb5dd2a94da108223f530f4b584f1809160747dd90971f287acfded50329c654f3948371c3857463123a3e80f983d5ceb068af8348046e7792c983eca5774545a4baf7a7697f980bf2b7ee93126590e398b0515402dcb98f63506cdf6694c6cb7cdfcdfbe5d88b471396981d81cd6abfc5064717298c4ba0386a82e599cd9d2c54e1cb492e35d7aa8e4f663e8a4aad0d111beed359a2e05a42e869fbff441471fb8a29fe12499533d6b3e0be61ab2c154d4dcabcbe8330a79e7b1a37bc870ec0d2bfee4f1d972a31ce02d11456e479206642436b8be27bc502f1635f182f1046ffa01962c2e65343e7b92af00476df0bab36d63991e8bca8c96cf5a0622275bacb66711489f09d14dd4876b982925733ea776b3e91be6ba22370c362810c784b2936d08d88d2d99627a596d9586936c067866e0c266c24af0d033fe5ef16ef4a68b44495a38849f15af3274f260d1eaecaa95fdb32cd2208249fabeaac7117b1efb3b90da5097c7a9cadf43be2412906b8cddaee9a5522a2bdd55708ae3aa828aeea24325898e45b1606fc8dd681f8c71751d0ec83a9f3d4261c667cbe52f7d3cb879963d1f8b63c98cf3ac0bc0af6e323b76b9ee918eb6130f54e43c341a00d863bc03bc95db1c1c3b3138e82e1578b4ff71a8e74c363954b6db4cac3b3a1e053668af46ff8a62c354bf6c2b25c90a79c52fc1f34dd75b9cda113febd9e4cc299db7a372c0dd50fba3ea40ef654f7d97fb2d85c3a0dff7f3a8f77b875e2dc68a6e5e22a05b6ade00c858d0e941545bdea07c79a976117ab0a7f6cc3550d4f89f650c92ac90278b602ed4cf3cf75b23b5d7d266474988d0d14ed1fc2cc8b7eda0cad42ad8c3aff515b23eb0429b48a2db9379149a4c421e73a6b830755b8a62c9b3c3fae740eb834dcfc56409c740968815e6d6c46b710871499f392052bc79d721ef94a6c2ba5f69c04af78d24f4680941cdb9c408b88299d059e915582c673c2e1b35167746fff07d902c0012df16503dd42f9b8050dfa2c56a8ad4c101dac7d1b3048c44c6de1d4b19"})
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x3]}, 0x8, 0x0)
r7 = syz_io_uring_setup(0x110, &(0x7f00000003c0)={0x0, 0xfad6, 0x100, 0x1}, &(0x7f00000029c0)=<r8=>0x0, &(0x7f0000002a00)=<r9=>0x0)
clock_gettime(0x7, &(0x7f0000000480))
syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x110, &(0x7f0000000080)=0xfffffffd, 0x0, 0x4)
syz_io_uring_submit(r8, r9, &(0x7f0000000500)=@IORING_OP_NOP={0x0, 0x5b})
io_uring_enter(r7, 0xdb4, 0x0, 0x0, 0x0, 0x0)
signalfd(r1, &(0x7f00000005c0)={[0x3]}, 0xfffffffffffffe37)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r3, 0x0)
syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000b00)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00'], 0x0, 0x0, 0x0, 0x0}, 0x0)
preadv(r3, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
io_uring_setup(0x6001, &(0x7f0000000000)={0x0, 0xeec2, 0x800, 0x2, 0x116})
r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000007100000085000000d00000009500000000000000"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r10, 0x0, 0x14, 0x0, &(0x7f0000000040)="f4b84de4115d64244a0e839e88a8", 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x4)

1m12.208526217s ago: executing program 2 (id=3017):
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01001f774d20611e032f1b00000010002e800600040000000000000000000c00060001"], 0x30}}, 0x0)
r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'lo\x00', <r4=>0x0})
r5 = socket$netlink(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001480)={0xffffffffffffffff, <r6=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', <r7=>0x0})
sendmsg$nl_route(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="3400000013000100000000000000000007000000", @ANYRES32=r7, @ANYBLOB="100a06000908010014001a80100004800c000680"], 0x34}, 0x1, 0x0, 0x0, 0x200080d0}, 0x14)
r8 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000007c0)=@newqdisc={0x148, 0x24, 0xd0f, 0x0, 0x25dfdbfb, {0x60, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_red={{0x8}, {0x11c, 0x2, [@TCA_RED_STAB={0x104, 0x2, "a08741d53c17fe788c52901a81d1b55cac4134f7a04b4912d6d32223ec53f0f61efb5e06a113b739419f64fb10e47d9a31b8e43cb652fe7c40ef95996b3f9594a9ac4287bd548b76af89a5f0eceb4373fefeba1adb94a86f2892f1654f6f6c47b0b4c6fc930a7a001394c1e1c7e45b3842f682f0e473b8d58e70b3e2017457a33a1a2f62915604ba172eb0e09f3d2249561e2faa3b6bd250eac2a9eafc22b0fd4d008fabbab0fe519afde99b517780d70c1c116a7f677f62aeb04b69b5b41e5323a3632b933e874af700b3b6b632f9c2f86f238d1f0404e8a273cb44f40ae977ae1220bd65705cd5a849c8df8464c6b7596b3b3c38545eeb7afc96f607f7b77d"}, @TCA_RED_PARMS={0x14, 0x1, {0x2, 0x8, 0x200, 0x9, 0x17, 0x12, 0x6}}]}}]}, 0x148}, 0x1, 0x0, 0x0, 0x801}, 0x0)
r9 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0)
r10 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r10, 0xaf01, 0x0)
ioctl$VHOST_SET_MEM_TABLE(r10, 0x4008af03, &(0x7f0000000140))
ioctl$VHOST_SET_FEATURES(r10, 0x4008af00, &(0x7f0000000080)=0x200000000)
ioctl$VHOST_SET_VRING_ADDR(r10, 0x4028af11, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f00000004c0)=""/243, 0x0, 0x80a0000})
r11 = dup2(r10, r10)
write$vhost_msg_v2(r11, &(0x7f0000000600)={0x2, 0x0, {&(0x7f00000001c0)=""/128, 0x80, 0x0, 0x2, 0x2}}, 0x48)
ioctl$VHOST_VSOCK_SET_RUNNING(r11, 0x4004af61, &(0x7f0000000380)=0x1)
getsockopt$inet6_mreq(r11, 0x29, 0x14, &(0x7f0000000180)={@empty}, &(0x7f00000001c0)=0x14)
write$RDMA_USER_CM_CMD_CREATE_ID(r9, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000000)={<r12=>0xffffffffffffffff}, 0x13f}}, 0x20)
write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r9, &(0x7f0000000100)={0xb, 0x10, 0xfa00, {0x0, r12, 0x2}}, 0x18)
r13 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18010000120000000000000000000000850000006d000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000280)='contention_end\x00', r13}, 0x18)
bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000600)={r2, 0x0, 0x0}, 0x10)

1m12.130870082s ago: executing program 4 (id=3018):
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={<r0=>0xffffffffffffffff})
r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x10)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000cc0)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc0200000000000000ae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff9af2551ce896165127cb3f011a7d06602e2fc40848228567ffb400000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7500d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df2624f56da648d28ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71400fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada10eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d32940000088dde499000000fdffffff00000000000f000000ef0000000000000000000000000c52f4ebd2c893bb97a068bd10734a83584898eccb26f7b789cfc4cd995fa3e11a5c74c85404e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18aba6b16455a66c3b84b138efc20a546d3d5227e23b03f2a834391ade2ff3e93ee296c4082ee73e7c353312c9d75711ce1623e9c54bdff59d2a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1ce6d0b2fea02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc0847a1ff2f7fc3c2b99a96fc4275ad107274e2934a87a4ddcdb112754ca5bdec0ead14b6c0f19a43a2f05c7f0be31491eb8c9ff68236c8600040000000000000000000066e034c81c3cab64e4fc8dc55ce0ada18dcbf31c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f224baf1221c15fa12313ffbfa7c2730309f66705b71e6205e7cbf3643561eabb9a63fcd604d5cc27e1317ad94cf438d71873e540be16b6ca205081173bd03c4754fc4674812daab482fd390a1c903b5d28a1eb247b5837d7603b92495d5c569f6433c3fca5206cb0000003fdbbd3892c52c2e7612e05de32322e980a3d69931e2c9312dd517c96f2ee90362476ed853c4c9b7d4ebf13cbaa795860e92a3d7d004f2c491db38eb769f094d5d48b262cc35c40682138cf13a49aa9f27abec00002f01ba1251aaf2385416ca719300"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10)
ppoll(&(0x7f0000000500), 0x0, 0x0, 0x0, 0x0)
pselect6(0x40, &(0x7f00000001c0)={0x0, 0x2, 0x3, 0xfffffffffffffffd}, 0x0, 0x0, 0x0, 0x0)
sendmsg$inet(r0, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0xa00120}], 0x1}, 0x3)

1m11.79904575s ago: executing program 2 (id=3020):
r0 = socket$kcm(0x2, 0x200000000000001, 0x106)
sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x0, @remote}, 0x10, 0x0}, 0x3000c041)
r1 = socket$kcm(0x10, 0x2, 0x4)
r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48)
r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48)
unshare(0x22020600)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000001c0)={r2, r3, 0x26, 0x0, @void}, 0x10)
sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000280)="89000000120081ae08061cdc030ec080000000000000000000e2ffca1b1f0000000004c00e72f750375ed08a567cc64d14100760be3312bf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec08120800030006010000bdad446b9bbc7a46e3988285dcdf12f2130809d78f0a947ee2b49e33538afa8af92347514f0356a20ff27fff00", 0x89}], 0x1}, 0x0)
socket$inet6_sctp(0xa, 0x5, 0x84)

1m11.081982795s ago: executing program 4 (id=3021):
syz_open_dev$ndb(&(0x7f0000000040), 0x0, 0x0)
io_uring_setup(0x2471, 0x0)
mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='f'])
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
getsockopt$inet_tcp_buf(r0, 0x6, 0x23, &(0x7f0000000040)=""/32, &(0x7f0000000000)=0x20)
r1 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_ADDFB(r1, 0xc01c64ae, &(0x7f0000000040)={0x0, 0x20000001, 0x9, 0x0, 0x18, 0x400018})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2)
sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r2, &(0x7f0000002000)=""/102400, 0x19000)
mount(&(0x7f0000000040)=@nullb, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000080)='cramfs\x00', 0x2a00000, 0x0)
openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0)
r3 = creat(&(0x7f00000002c0)='./file0\x00', 0x0)
r4 = open$dir(&(0x7f0000000100)='./file0\x00', 0x80000, 0x11b)
mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r4, 0x0)
r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, 0x0, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
write$qrtrtun(r3, &(0x7f0000000300)="ca0e808bb35bda", 0x7)
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r5, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)=[0x7], 0x0, 0x0, 0x1}}, 0x3c)
creat(&(0x7f00000001c0)='./file0\x00', 0x8)
mbind(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x2, &(0x7f0000000080)=0x3, 0x8, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000001c0)}], 0x1}, 0x0)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xaece, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0)

1m10.793642434s ago: executing program 5 (id=3022):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x400000f3, 0x0, 0xffffffffffffffff}]})
openat$comedi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/comedi4\x00', 0x101000, 0x0)
r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
r4 = fanotify_init(0x18, 0x0)
fanotify_mark(r4, 0x105, 0x4800003a, r3, 0x0)
r5 = inotify_init1(0x0)
inotify_add_watch(r5, &(0x7f0000000440)='.\x00', 0x12000021)
syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00')
socket$nl_generic(0x10, 0x3, 0x10)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8d}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x8002, 0x0)
read$msr(r6, &(0x7f0000019540)=""/102400, 0x19000)
r7 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0)
r8 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0)
sendmsg$IPSET_CMD_TEST(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000240)={0xffffffffffffff37, 0xb, 0x6, 0x301, 0x0, 0x0, {0x1, 0x0, 0x6}}, 0x28}, 0x1, 0x0, 0x0, 0x4c080}, 0x4000002)
socket$nl_route(0x10, 0x3, 0x0)
r9 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r9, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000001000)={&(0x7f0000000a40)=@newtaction={0x44, 0x32, 0x216822a75a8bdd29, 0xffe4, 0x0, {}, [{0x30, 0x1, [@m_ct={0x2c, 0x1, 0x0, 0x0, {{0x7}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x44}}, 0x0)
r10 = socket$rds(0x15, 0x5, 0x0)
mkdir(&(0x7f0000000280)='./file0\x00', 0xc8)
setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r10, 0x114, 0xa, 0x0, 0x0)
syz_io_uring_setup(0x6705, 0x0, &(0x7f0000000400), &(0x7f0000000040))

1m1.27504143s ago: executing program 2 (id=3024):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x280480, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x80002, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r3 = socket(0x400000000010, 0x3, 0x0)
r4 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0)
close(r0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000500))
ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast})
r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0)
ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
write$cgroup_devices(r6, &(0x7f0000000280)=ANY=[@ANYBLOB="1e030600bc5cb60128876360864666702c1ffe80000000000000", @ANYRESDEC], 0xffdd) (fail_nth: 2)

58.39571034s ago: executing program 4 (id=3025):
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x201, 0x0)
ioctl$DRM_IOCTL_MARK_BUFS(r0, 0x40206417, &(0x7f00000000c0)={0x8, 0xffffffbd, 0x998, 0x10000, 0x1, 0x4})
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f0000000740)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r4}, 0x10)
pipe(&(0x7f0000000280)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r7=>0xffffffffffffffff, <r8=>0xffffffffffffffff})
pipe(&(0x7f0000000000)={0xffffffffffffffff, <r9=>0xffffffffffffffff})
splice(r8, 0x0, r9, 0x0, 0xf3a, 0x0)
write(r6, &(0x7f0000000240)="94", 0x1)
tee(r5, r9, 0x8f5, 0x100000000000000)
write$cgroup_type(r9, &(0x7f0000000180), 0x9)
write(r7, 0x0, 0x0)

56.86644718s ago: executing program 5 (id=3026):
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
r0 = gettid()
sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x2)
syz_open_dev$swradio(0x0, 0x1, 0x2)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, 0x0, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1ff, 0x0)
ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000200)={0x8000, 0x2, 0x4})
r4 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f0000000700)={0x0, &(0x7f0000000640)=[<r5=>0x0], 0x0, 0x0, 0x0, 0x1})
r6 = socket$inet6_tcp(0xa, 0x1, 0x0)
sendto$inet6(r6, &(0x7f0000000740)="252237e8d16b294825d36199bdd8a817d15a4cc81eba8c7937db6461dbfe8c6518694e2a92266354a391b113bc6f896c9ed1e42a2562b1f1ba881503e297c0d36cb033ca6d08aa6ce9e4725936abfc8f08ac97f52f1abe077ccd58021e685926de948e9a17d9d9cbbc9c4cc10ee937e4dcb0ff01a6362c7d1fd0bd53860064e9ce17f371abfe9fc21865f71121fb33982d4a8bc98ec144a04594d659a71137c7677e37d0ac2fde95632aa8b80c3d5b70992df7e6a84e24ee80e3a8b4115a35c8b010e6f35fa415a3b5ff09697730ef022325104a290cc7aab0a3b96726e58af43175647aa112c6a1a93b31242f29", 0xee, 0x4008004, 0x0, 0x0)
ioctl$DRM_IOCTL_MODE_CURSOR(r3, 0xc01c64a3, &(0x7f0000000040)={0x3, r5, 0x10000000, 0x80000005, 0xb, 0x1fd, 0x1})
close_range(r3, 0xffffffffffffffff, 0x0)
syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4)
r7 = socket$pppl2tp(0x18, 0x1, 0x1)
syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r7, 0x0, 0x0})
r8 = socket$inet_smc(0x2b, 0x1, 0x0)
getsockopt$IPT_SO_GET_REVISION_MATCH(r8, 0x0, 0x42, &(0x7f0000000000)={'TPROXY\x00'}, 0x0)
r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000090f00080000000000000000850000000e000000850000007d00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94)
r10 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000500)='sys_exit\x00', r9}, 0x10)
dup3(r9, r10, 0x0)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0xa, 0x0, &(0x7f0000000500)="1cc1110ec1e9abc89b00", 0x0, 0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50)
io_uring_enter(0xffffffffffffffff, 0x7f33, 0x7c5b, 0x0, 0x0, 0xfffffe36)

56.699838006s ago: executing program 4 (id=3028):
prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
syz_open_dev$MSR(0x0, 0x7, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
syz_usb_connect$printer(0x2, 0x0, 0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
clock_gettime(0x0, 0x0)
pselect6(0x40, &(0x7f00000001c0)={0x3ffc0, 0x1656, 0x401, 0x5, 0xfffffffffffffff7, 0x7, 0x8d1, 0x3}, &(0x7f0000000200)={0xb66, 0x9, 0x3, 0x401, 0x4, 0x5b9d, 0x5, 0x4}, 0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)={[0x4]}, 0x8})
r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
sendmsg$netlink(r1, &(0x7f0000000040)={0x0, 0x2f, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010092fffffff100000006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0)
madvise(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x4)

49.826870984s ago: executing program 5 (id=3029):
r0 = socket(0x11, 0x3, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000000)={'team0\x00', <r2=>0x0})
bind$packet(r0, &(0x7f00000001c0)={0x11, 0x0, r2, 0x1, 0x2, 0x6, @broadcast}, 0x14)
r3 = socket$kcm(0x10, 0x2, 0x0)
r4 = openat$sysfs(0xffffff9c, &(0x7f0000000000)='/sys/kernel/uevent_helper', 0x42, 0x0)
pwritev(r4, &(0x7f0000000500)=[{&(0x7f0000000040)="394726cf", 0x4}, {0x0}], 0x2, 0xffffff01, 0x2)
sendmsg$IPSET_CMD_HEADER(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x68, 0xc, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x6}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x40800}, 0x44000)
sendmsg$kcm(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000002c0)="2e00000010008188040f80ec59acbc0413010048100000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x10, 0x16, &(0x7f0000000340)=ANY=[@ANYBLOB="61122800000000006113200000000000bf1000000000000025000200091bb0ff3d030000000000008701000000000000bc26000000000000bf67000000000000150300000ee600f0670200001400000015030000ffffffffbf050000000000000f650000000000006507f4ff02000400070700006b3128fe1f75000000000000bf540000000000000705000003001500ae430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a82983d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf719506d2d6b05fe70305863f970eac3590ac99b798f8125f1c322c2a154a8a8d"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48)
r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r5)
sendmsg$NLBL_CIPSOV4_C_ADD(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)={0x30, r6, 0x1, 0x0, 0x25dfdbfe, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x2}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x3}]}, 0x30}}, 0x0)
r7 = dup2(r3, r3)
ioctl$IOMMU_VFIO_IOAS$GET(r7, 0x3b88, &(0x7f0000000200)={0xc})

48.378984051s ago: executing program 2 (id=3030):
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={<r0=>0xffffffffffffffff})
r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x10)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000cc0)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc0200000000000000ae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff9af2551ce896165127cb3f011a7d06602e2fc40848228567ffb400000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7500d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df2624f56da648d28ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71400fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada10eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d32940000088dde499000000fdffffff00000000000f000000ef0000000000000000000000000c52f4ebd2c893bb97a068bd10734a83584898eccb26f7b789cfc4cd995fa3e11a5c74c85404e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18aba6b16455a66c3b84b138efc20a546d3d5227e23b03f2a834391ade2ff3e93ee296c4082ee73e7c353312c9d75711ce1623e9c54bdff59d2a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1ce6d0b2fea02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc0847a1ff2f7fc3c2b99a96fc4275ad107274e2934a87a4ddcdb112754ca5bdec0ead14b6c0f19a43a2f05c7f0be31491eb8c9ff68236c8600040000000000000000000066e034c81c3cab64e4fc8dc55ce0ada18dcbf31c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f224baf1221c15fa12313ffbfa7c2730309f66705b71e6205e7cbf3643561eabb9a63fcd604d5cc27e1317ad94cf438d71873e540be16b6ca205081173bd03c4754fc4674812daab482fd390a1c903b5d28a1eb247b5837d7603b92495d5c569f6433c3fca5206cb0000003fdbbd3892c52c2e7612e05de32322e980a3d69931e2c9312dd517c96f2ee90362476ed853c4c9b7d4ebf13cbaa795860e92a3d7d004f2c491db38eb769f094d5d48b262cc35c40682138cf13a49aa9f27abec00002f01ba1251aaf2385416ca719300"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10)
ppoll(&(0x7f0000000500), 0x0, 0x0, 0x0, 0x0)
pselect6(0x40, &(0x7f00000001c0)={0x0, 0x2, 0x3, 0xfffffffffffffffd}, 0x0, 0x0, 0x0, 0x0)
sendmsg$inet(r0, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0xa00120}], 0x1}, 0x3)

46.572129355s ago: executing program 1 (id=3031):
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async)
prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) (async)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) (async)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) (async)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
mkdir(&(0x7f0000000180)='./file0\x00', 0x0) (async)
syz_open_procfs(0x0, &(0x7f0000000080)='net/vlan/vlan0\x00') (async)
syz_open_procfs(0x0, &(0x7f0000000100)='net/vlan/vlan0\x00') (async, rerun: 32)
r1 = socket$pppl2tp(0x18, 0x1, 0x1) (rerun: 32)
ioctl$SIOCSIFMTU(r1, 0x8923, &(0x7f0000000040)={'vlan0\x00', 0x40}) (async)
r2 = memfd_create(&(0x7f0000000140)='\vem\xda\x99[R@M\xfc\xfe\x9b#*\xff', 0x0)
write(r2, &(0x7f0000000040)="0600", 0x2) (async, rerun: 64)
write$FUSE_NOTIFY_STORE(r2, &(0x7f0000000180)=ANY=[], 0xe) (rerun: 64)
sendfile(r2, r2, &(0x7f0000001000), 0xffff)
mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x80000000004, 0x11, r2, 0x0) (async)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f000001a000)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f000002eff0)={0x135, &(0x7f0000000000)=[{}]}, 0x10)

46.232316393s ago: executing program 4 (id=3032):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r1)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB, @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000000)="89e7ee2c7cdad9b4b47380c988ca", 0x140}], 0x1)

46.110441505s ago: executing program 5 (id=3033):
r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000100)={r0, &(0x7f0000000180), 0x0}, 0x20)
r1 = userfaultfd(0x1)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x614})
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2})
r2 = open(&(0x7f00009e1000)='./file0\x00', 0x8060, 0x0)
fcntl$setlease(r2, 0x400, 0x0)
ioctl$IOMMU_OPTION$IOMMU_OPTION_RLIMIT_MODE(r2, 0x3b87, &(0x7f0000000100)={0x18, 0x0, 0x1, 0x0, 0x0, 0x9})
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000779000/0x1000)=nil, 0x400000, 0x3, 0x2})
socket$xdp(0x2c, 0x3, 0x0)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
socket(0x400000000010, 0x3, 0x0)
openat$drirender128(0xffffffffffffff9c, &(0x7f0000000200), 0x400000, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x7)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f00000005c0))
socket$pppl2tp(0x18, 0x1, 0x1)
socket$inet6_udp(0xa, 0x2, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000240), 0xc01, 0x0)
keyctl$search(0xa, 0x0, &(0x7f0000000180)='asymmetric\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0)

46.110001308s ago: executing program 2 (id=3034):
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xf, 0x4, 0x4, 0x4}, 0x48)
bpf$MAP_LOOKUP_ELEM(0x1, 0x0, 0x0)
r0 = userfaultfd(0x1)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2})
r1 = open(&(0x7f00009e1000)='./file0\x00', 0x8060, 0x0)
fcntl$setlease(r1, 0x400, 0x0)
ioctl$IOMMU_OPTION$IOMMU_OPTION_RLIMIT_MODE(r1, 0x3b87, &(0x7f0000000100)={0x18, 0x0, 0x1, 0x0, 0x0, 0x9})
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000779000/0x1000)=nil, 0x400000, 0x3, 0x2})
socket$xdp(0x2c, 0x3, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
socket(0x400000000010, 0x3, 0x0)
openat$drirender128(0xffffffffffffff9c, &(0x7f0000000200), 0x400000, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x7)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f00000005c0))
socket$pppl2tp(0x18, 0x1, 0x1)
socket$inet6_udp(0xa, 0x2, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000240), 0xc01, 0x0)
keyctl$search(0xa, 0x0, &(0x7f0000000180)='asymmetric\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0)

42.097575288s ago: executing program 1 (id=3035):
r0 = socket(0x2, 0x80805, 0x0) (async)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)=ANY=[@ANYBLOB="480100001000130724bd7000fbdbdf2500000000000000000000ffffe0000002ff0100000000000000000000000000014e2200014e220003020000003a000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe8000000000000000000000000000bb00000000320000007f0000010000000000000000000000000000000000000000000000000000000008000000000000000a000000000000000600000000000000008cd05456140000000000000000000000000000000300000000000000000000000000000000000000000000000200000000000000f8ffffffffffffff0c000000000000000200000029bd7000000000000200050728000000000000004c001200726663343534332867636d286165736e29000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000c001c0051fc352082bd6cabffed477a23c0787e92c226ee8a83e306281711768e29a0e7be6aefdf3730942fc003aeb14738e3c6ea29ec0fc06993dda9df8db57a7cbf272c2dc5f8eda9dee5304924ad620457d81482e20c328f48b7373a524b2fc97a53d1615c448acc289a09ddda6300b0972cafaa386476e98e203a05f96ad173f0100110adebfd0325876b", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0x148}, 0x1, 0x0, 0x0, 0xc0}, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000c80)={0x1a, 0x2, &(0x7f00000001c0)=@raw=[@map_fd={0x18, 0x1}], &(0x7f00000004c0)='GPL\x00', 0x80000001, 0x6b, &(0x7f0000000580)=""/107, 0x40f00, 0x10, '\x00', 0x0, @tracing=0x17, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000500)={0x3, 0x6, 0x5157, 0x4}, 0x10, 0x0, 0xffffffffffffffff, 0x7, &(0x7f0000000980)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f0000000c00)=[{0x3, 0x3, 0x5, 0x3}, {0x4, 0x4, 0xb, 0x1}, {0x1, 0x2, 0xa, 0xa}, {0x1, 0x3, 0xb, 0x8}, {0x4, 0x2, 0x5, 0x3}, {0x0, 0x3, 0x7, 0xc}, {0x4, 0x4, 0x2, 0x3}], 0x10, 0x2}, 0x94)
setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000040)={0x84, @loopback, 0x4e25, 0x3, 'lblc\x00', 0x1, 0x2, 0x6e}, 0x2c)
openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x103902, 0x0) (async)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r2 = getpid()
sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) (async)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
connect$unix(r3, &(0x7f0000000400)=@abs={0x0, 0x0, 0x4e23}, 0x6e) (async)
sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) (async)
recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4)
r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r5}, 0x10)
socket$alg(0x26, 0x5, 0x0) (async)
r6 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r6, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x4e)
setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) (async, rerun: 32)
r7 = accept4(r6, 0x0, 0x0, 0x800) (rerun: 32)
recvmsg$qrtr(r7, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000001b00)=[{&(0x7f00000002c0)=""/8, 0x8}, {&(0x7f0000000700)=""/195, 0xc3}], 0x2, 0x0, 0x0, 0x10000}, 0x38, 0x10020)
syz_usb_connect(0x2, 0x41, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000d1253c40d11256eddd460102030109022f0001000000000904cf0000ff013700052406000105240057c90d240f010e000000f0cc67c80f9a3c0e018009"], 0x0)
mkdir(&(0x7f00000009c0)='./file0\x00', 0x0) (async)
mkdir(&(0x7f0000000400)='./file1\x00', 0x0) (async)
mkdir(&(0x7f0000000300)='./bus\x00', 0x0) (async, rerun: 64)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, 0x0) (async, rerun: 64)
chdir(&(0x7f0000000140)='./bus\x00')

36.13925758s ago: executing program 1 (id=3036):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000006c0), 0x240, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
r1 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000180)={0x4, 0xfd, 0x1, 0x6, 0x0, 0xfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x0, 0x96}, 0xe)
sendto$inet6(r1, &(0x7f0000000300)="8b", 0x34000, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
ioctl$IOMMU_VFIO_SET_IOMMU(0xffffffffffffffff, 0x3b66, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8)
shutdown(r1, 0x1)

30.253437239s ago: executing program 33 (id=3034):
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xf, 0x4, 0x4, 0x4}, 0x48)
bpf$MAP_LOOKUP_ELEM(0x1, 0x0, 0x0)
r0 = userfaultfd(0x1)
ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0)
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2})
r1 = open(&(0x7f00009e1000)='./file0\x00', 0x8060, 0x0)
fcntl$setlease(r1, 0x400, 0x0)
ioctl$IOMMU_OPTION$IOMMU_OPTION_RLIMIT_MODE(r1, 0x3b87, &(0x7f0000000100)={0x18, 0x0, 0x1, 0x0, 0x0, 0x9})
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000779000/0x1000)=nil, 0x400000, 0x3, 0x2})
socket$xdp(0x2c, 0x3, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
socket(0x400000000010, 0x3, 0x0)
openat$drirender128(0xffffffffffffff9c, &(0x7f0000000200), 0x400000, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x7)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f00000005c0))
socket$pppl2tp(0x18, 0x1, 0x1)
socket$inet6_udp(0xa, 0x2, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000240), 0xc01, 0x0)
keyctl$search(0xa, 0x0, &(0x7f0000000180)='asymmetric\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0)

29.909203698s ago: executing program 34 (id=3033):
r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000100)={r0, &(0x7f0000000180), 0x0}, 0x20)
r1 = userfaultfd(0x1)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x614})
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2})
r2 = open(&(0x7f00009e1000)='./file0\x00', 0x8060, 0x0)
fcntl$setlease(r2, 0x400, 0x0)
ioctl$IOMMU_OPTION$IOMMU_OPTION_RLIMIT_MODE(r2, 0x3b87, &(0x7f0000000100)={0x18, 0x0, 0x1, 0x0, 0x0, 0x9})
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000779000/0x1000)=nil, 0x400000, 0x3, 0x2})
socket$xdp(0x2c, 0x3, 0x0)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
socket(0x400000000010, 0x3, 0x0)
openat$drirender128(0xffffffffffffff9c, &(0x7f0000000200), 0x400000, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x7)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f00000005c0))
socket$pppl2tp(0x18, 0x1, 0x1)
socket$inet6_udp(0xa, 0x2, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000240), 0xc01, 0x0)
keyctl$search(0xa, 0x0, &(0x7f0000000180)='asymmetric\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0)

29.538586894s ago: executing program 35 (id=3032):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r1)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB, @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000000)="89e7ee2c7cdad9b4b47380c988ca", 0x140}], 0x1)

29.509767306s ago: executing program 1 (id=3040):
r0 = socket$inet_sctp(0x2, 0x5, 0x84)
syz_usb_connect(0x0, 0x36, 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x10, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1daa00000000000061101000040000009500000000000000"], &(0x7f0000000480)='syzkaller\x00'}, 0x80)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_COALESCE_SET(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000008c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000001400000008000f00fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000900fc000000080011000700000008000e00800000000800"], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x40010)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
connect$unix(r4, &(0x7f0000000800)=@abs, 0x6e)
sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000002c0)='./binderfs2/binder1\x00', 0x0, 0x0)
openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000007c0)={0x50, 0x0, &(0x7f0000000580)=[@reply={0x40406301, {0xb, 0x0, 0x0, 0x0, 0xd502382cb500202, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @dead_binder_done], 0x21, 0x0, &(0x7f0000000780)="6835e85a03c7d65a4e50ba989234fd30ef7a26f22eeb328d46740623d65d970ad4"})
syz_open_dev$vim2m(&(0x7f0000000080), 0xe2, 0x2)
fanotify_init(0x8, 0x80000)
r7 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="7000000002060500000000000000000000000000120003006269746d61703a69702c6d6163000000050004000000000009000200f3797a"], 0x70}}, 0x800)
sendmsg$IPSET_CMD_DESTROY(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000880)={0x20, 0x3, 0x6, 0x301, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x20}}, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x10, 0xe, &(0x7f0000000a80)=ANY=[@ANYBLOB="b7000000639d0000bca30000000000002403000030feffff720af0ffa4ffffff71a4f0ff000000001f030000000000002e100200000000002604f8ffffff000414010000000300001d130000000000007a0a00fe0020001f0f14000000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb150c537bf2085651d6dd6ce9bc461e91a7168e5181554a090f300020000fe275daf51efd601b6bf0134c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff61623604000000000000006a89adaf17b0a6041bdeebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4136dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101ab062cd54e67051d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91ff073e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48153baae244e7bf573eac34b781337ad5905c6bbf1137548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab51380d7b4ead35a385e0b4a26b702396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb11883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcd857ab15e355713767c536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ced301efeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef0900000000000000ff0f40b1888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fc08001011e32f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e3f753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30c1675767999d146aef7799738b292fd64bb25b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963342aece449a0d80010f5c653d22d49030a8c2a4ab000000000000003f8dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc090000000000000061563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ecab5d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9901010000b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba435926b61c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0aa81192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f0100e0eda300a43a13bd1b9f3322405d1efd78e5789c6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a43746979f99f6a1527f004f1e37a3926937e84fb478199dc1020f4beb98b8074bf7df8b5e783637da740800000000000000c55a4385e9a617aa6c8e10d4202c5afeb06eef98aee88ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a274000000000000000000000000000000000000000000000009dd14b38f2f4426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4100260ffcd8f1d04166d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06ee0ff698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb3928143be1c1023a375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10baa804a707f0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d34d3757b1450fdb0a9a69f432e277f3a0386eb2bd3305c821c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e913ac1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07618b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e040000003c3ffad44d2a376def42e41e9fc31678257e040fa7cf32c221aaac08000000000000001a00000000000000000000173570f0c11ae694b0f7a4f9c2f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d641ef02e495295d756e110522a7a945b93fb705b95b6aae27a8fb33732ce1da1c0b1af8eb9222a06e984ab1e6984c8bdc12360627137ab67b6b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481efe46a4ce86be0b1d8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0c6cb4bed8594a39bd76d3ef8a7ab014e787596db796bd93a36c2880423291e3bccc86f66ba792ff4d87b3f80e5908779e51c5e9055fc5b23605cd000c723187ef09dcf4b07b06a9342f3f62ee7acddff292082c1f4d8eb9561f80873a09a1ae0c9af1121175e5600f43a1179484502009759264a5729f07c2b218fa36ba2316a99aaad0130df83d0bda1e711290f78c143ea143967b00adcd77e6ad5e48d839ea61aadb83e4d071c54691924a3830d3e7b5c198bb0ed623153590000060000000000004b985ea1702f34f2f85b168c083e810ed567e3f1979b9ed1a4bf6a10dac825c96a0828b335de445a4880bb6474157efd1a72ca46ae4cbe3ab648c9bc4867a5a4cb87d7d6d55475b34b3cb6aa9e2337d4e04a37e35109752522ac9b186ddd80c47da6a2f4ef7bb909c97552606ffff97e86dc995604346262a177b06c634969a31b5717c416f8224662f4dd46d6081cb96dd607410ee222ec8f206c4b74"], &(0x7f00000001c0)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffff97, 0x10, &(0x7f00000000c0)={0x0, 0x0, 0xfffffffd}, 0x35861afe2a15ad58}, 0x48)
getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, 0x0, &(0x7f0000000040))
r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0)
syz_usb_connect(0x3, 0x3d, &(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES64=r8], 0x0)

24.870836455s ago: executing program 1 (id=3041):
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
socket$alg(0x26, 0x5, 0x0)
setsockopt(0xffffffffffffffff, 0x1, 0x20, &(0x7f0000000040), 0x0)
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x18, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000b00007910000000000000c310001001000000950074000000000031fb0d3a42319fa204399d17d34e075fdcda533ab1aa71ab1d764152e6cb25dadc7ded5dbe11b60ac5ea9fca11027d19e93adb603deb92de3141e8fd7ac5b87a2070213cdfdc5d6c4890cdeb50347c32060581172b94c6ba22a2b58eb6cbad46ed6e7965a2ba5fc4a5a17d103b0b36f790bb41931f9a3d4dd127c1b4e49f7468f5e603950c"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195}, 0x94)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x804}, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
getsockopt$IPT_SO_GET_REVISION_MATCH(0xffffffffffffffff, 0x0, 0x42, &(0x7f0000002340)={'HL\x00'}, &(0x7f0000002380)=0x1e)
r3 = syz_open_dev$dri(&(0x7f0000000040), 0x20000000, 0x40800)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f0000000000)={0x0, &(0x7f00000001c0), 0x0, 0x0})
ioctl$DRM_IOCTL_MODE_GETCRTC(r3, 0xc06864a1, &(0x7f0000000240)={0x0})
r4 = syz_open_procfs(0x0, &(0x7f00000042c0)='mounts\x00')
r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0)
read$FUSE(r5, &(0x7f0000000200)={0x2020}, 0x2020)
mount(&(0x7f0000000300), &(0x7f0000000080)='.\x00', &(0x7f0000000180)='devtmpfs\x00', 0x2200892, 0x0)
pread64(r4, &(0x7f0000002240)=""/237, 0xed, 0x4eb)
sendmsg$NFNL_MSG_ACCT_DEL(0xffffffffffffffff, &(0x7f0000002400)={0x0, 0x0, &(0x7f0000004a40)={&(0x7f00000023c0)={0x20, 0x3, 0x7, 0x101, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0xe000}]}, 0x20}, 0x1, 0x0, 0x0, 0x40005}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x2, 0x16, &(0x7f0000000180)=ANY=[@ANYBLOB="611230000000000061134c0000000000bf2000000000000016001000071b48013d030100000000000f02000000000000bc26100000000000bf67200000000000160200000fff07006702000007000000360600000ee600f0bf050000000000000f650000000000006507f4ff02000000070700004c0040001f75000000000000bf54000000000000070500000300f9ffad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a83683d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf5fe7030586"], &(0x7f0000000100)='GPL\x00'}, 0x48)
openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
syz_open_dev$usbfs(&(0x7f0000000000), 0x200, 0xe401)
syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301)

22.789257363s ago: executing program 1 (id=3042):
r0 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth0\x00', <r1=>0x0})
setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000040)={r1, 0x1, 0x6, @local}, 0x10)
setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f0000000100)={r1, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3c}}, 0x10)
r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0)
r3 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r3, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000780)=ANY=[@ANYBLOB="020d0000100000000000000000000000080012000200020000000000000000001200320002030000000000000000000000000000000000000000000000000000fc020000000000000000000000000000030005000000000002000000ac1414aa00000000fa000000030006000000000002"], 0x80}}, 0x0)
syz_usb_control_io(r2, 0x0, 0x0)
syz_usb_control_io$hid(r2, &(0x7f0000000180)={0x24, &(0x7f00000006c0)=ANY=[@ANYBLOB="00001c"], 0x0, 0x0, 0x0}, 0x0)

0s ago: executing program 36 (id=3042):
r0 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth0\x00', <r1=>0x0})
setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000040)={r1, 0x1, 0x6, @local}, 0x10)
setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f0000000100)={r1, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3c}}, 0x10)
r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0)
r3 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r3, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000780)=ANY=[@ANYBLOB="020d0000100000000000000000000000080012000200020000000000000000001200320002030000000000000000000000000000000000000000000000000000fc020000000000000000000000000000030005000000000002000000ac1414aa00000000fa000000030006000000000002"], 0x80}}, 0x0)
syz_usb_control_io(r2, 0x0, 0x0)
syz_usb_control_io$hid(r2, &(0x7f0000000180)={0x24, &(0x7f00000006c0)=ANY=[@ANYBLOB="00001c"], 0x0, 0x0, 0x0}, 0x0)

kernel console output (not intermixed with test programs):

05886][T15021]  ? __pfx_netlink_sendmsg+0x10/0x10
[  676.905913][T15021]  __sock_sendmsg+0x21c/0x270
[  676.905937][T15021]  ____sys_sendmsg+0x505/0x830
[  676.905970][T15021]  ? __pfx_____sys_sendmsg+0x10/0x10
[  676.906006][T15021]  ? import_iovec+0x74/0xa0
[  676.906032][T15021]  ___sys_sendmsg+0x21f/0x2a0
[  676.906060][T15021]  ? __pfx____sys_sendmsg+0x10/0x10
[  676.906130][T15021]  ? __fget_files+0x2a/0x420
[  676.906149][T15021]  ? __fget_files+0x3a0/0x420
[  676.906180][T15021]  __x64_sys_sendmsg+0x19b/0x260
[  676.906212][T15021]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  676.906252][T15021]  ? __pfx_ksys_write+0x10/0x10
[  676.906275][T15021]  ? do_syscall_64+0xbe/0x3b0
[  676.906301][T15021]  do_syscall_64+0xfa/0x3b0
[  676.906321][T15021]  ? lockdep_hardirqs_on+0x9c/0x150
[  676.906342][T15021]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  676.906359][T15021]  ? clear_bhb_loop+0x60/0xb0
[  676.906382][T15021]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  676.906407][T15021] RIP: 0033:0x7efcfdd8ebe9
[  676.906424][T15021] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  676.906440][T15021] RSP: 002b:00007efcfbff6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  676.906460][T15021] RAX: ffffffffffffffda RBX: 00007efcfdfb6090 RCX: 00007efcfdd8ebe9
[  676.906473][T15021] RDX: 00000000040040c4 RSI: 0000200000000000 RDI: 0000000000000005
[  676.906486][T15021] RBP: 00007efcfbff6090 R08: 0000000000000000 R09: 0000000000000000
[  676.906497][T15021] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  676.906508][T15021] R13: 00007efcfdfb6128 R14: 00007efcfdfb6090 R15: 00007ffcaec851f8
[  676.906545][T15021]  </TASK>
[  676.910156][T15020] syz.5.2590: vmalloc error: size 8192, failed to allocate pages, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null)
[  677.170215][ T6749] usb 3-1: new high-speed USB device number 19 using dummy_hcd
[  677.193850][T15020] ,cpuset=/,mems_allowed=0-1
[  677.199027][T15020] CPU: 0 UID: 0 PID: 15020 Comm: syz.5.2590 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) 
[  677.199052][T15020] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  677.199064][T15020] Call Trace:
[  677.199070][T15020]  <TASK>
[  677.199079][T15020]  dump_stack_lvl+0x189/0x250
[  677.199102][T15020]  ? __pfx_rcu_read_unlock_special+0x10/0x10
[  677.199127][T15020]  ? __pfx_dump_stack_lvl+0x10/0x10
[  677.199147][T15020]  ? __pfx__printk+0x10/0x10
[  677.199168][T15020]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[  677.199191][T15020]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[  677.199221][T15020]  warn_alloc+0x214/0x310
[  677.199261][T15020]  ? __pfx_warn_alloc+0x10/0x10
[  677.199281][T15020]  ? policy_nodemask+0x27c/0x720
[  677.199308][T15020]  ? alloc_pages_mpol+0x3cd/0x4a0
[  677.199340][T15020]  __vmalloc_node_range_noprof+0xfdf/0x12f0
[  677.199393][T15020]  ? __pfx___vmalloc_node_range_noprof+0x10/0x10
[  677.199418][T15020]  ? memcpy_and_pad+0x48/0x80
[  677.199441][T15020]  __vmalloc_node_noprof+0xc2/0x110
[  677.199462][T15020]  ? copy_process+0x544/0x3b80
[  677.199482][T15020]  ? copy_process+0x544/0x3b80
[  677.199516][T15020]  dup_task_struct+0x3e7/0x860
[  677.199543][T15020]  copy_process+0x544/0x3b80
[  677.199564][T15020]  ? __lock_acquire+0xab9/0xd20
[  677.199593][T15020]  ? __might_fault+0xb0/0x130
[  677.199624][T15020]  ? __pfx_copy_process+0x10/0x10
[  677.199649][T15020]  ? _copy_from_user+0x94/0xb0
[  677.199683][T15020]  kernel_clone+0x224/0x7f0
[  677.199708][T15020]  ? __pfx_kernel_clone+0x10/0x10
[  677.199728][T15020]  ? rcu_read_lock_any_held+0xb3/0x120
[  677.199772][T15020]  __se_sys_clone3+0x256/0x2d0
[  677.199799][T15020]  ? __pfx___se_sys_clone3+0x10/0x10
[  677.199817][T15020]  ? __mutex_unlock_slowpath+0x1cd/0x700
[  677.199852][T15020]  ? __fget_files+0x3a0/0x420
[  677.199891][T15020]  ? __pfx_ksys_write+0x10/0x10
[  677.199907][T15020]  ? rcu_is_watching+0x15/0xb0
[  677.199932][T15020]  ? do_syscall_64+0xbe/0x3b0
[  677.199958][T15020]  do_syscall_64+0xfa/0x3b0
[  677.199980][T15020]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  677.199998][T15020]  ? asm_sysvec_call_function_single+0x1a/0x20
[  677.200016][T15020]  ? clear_bhb_loop+0x60/0xb0
[  677.200039][T15020]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  677.200057][T15020] RIP: 0033:0x7fcfa618ebe9
[  677.200075][T15020] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  677.200091][T15020] RSP: 002b:00007fcfa6fdaf08 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3
[  677.200110][T15020] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007fcfa618ebe9
[  677.200124][T15020] RDX: 00007fcfa6fdaf20 RSI: 0000000000000058 RDI: 00007fcfa6fdaf20
[  677.200137][T15020] RBP: 00007fcfa6fdb090 R08: 0000000000000000 R09: 0000000000000058
[  677.200149][T15020] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[  677.200161][T15020] R13: 00007fcfa63b6128 R14: 00007fcfa63b6090 R15: 00007ffdf964f8e8
[  677.200190][T15020]  </TASK>
[  677.200279][T15020] Mem-Info:
[  677.506244][T15020] active_anon:6026 inactive_anon:22874 isolated_anon:0
[  677.506244][T15020]  active_file:14136 inactive_file:41869 isolated_file:0
[  677.506244][T15020]  unevictable:768 dirty:221 writeback:0
[  677.506244][T15020]  slab_reclaimable:10719 slab_unreclaimable:100791
[  677.506244][T15020]  mapped:31598 shmem:23436 pagetables:1513
[  677.506244][T15020]  sec_pagetables:0 bounce:0
[  677.506244][T15020]  kernel_misc_reclaimable:0
[  677.506244][T15020]  free:1286840 free_pcp:11734 free_cma:0
[  677.554496][T15020] Node 0 active_anon:24104kB inactive_anon:91496kB active_file:56344kB inactive_file:167476kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:126392kB dirty:884kB writeback:0kB shmem:92208kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:12816kB pagetables:5868kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[  677.591492][T15020] Node 1 active_anon:0kB inactive_anon:0kB active_file:200kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:64kB pagetables:184kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[  677.625047][T15020] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[  677.655233][T15020] lowmem_reserve[]: 0 2500 2502 2502 2502
[  677.663462][T15020] Node 0 DMA32 free:1227204kB boost:0kB min:34264kB low:42828kB high:51392kB reserved_highatomic:0KB free_highatomic:0KB active_anon:24100kB inactive_anon:91392kB active_file:54572kB inactive_file:167408kB unevictable:1536kB writepending:884kB present:3129332kB managed:2560996kB mlocked:0kB bounce:0kB free_pcp:30448kB local_pcp:14336kB free_cma:0kB
[  677.698662][T15020] lowmem_reserve[]: 0 0 1 1 1
[  677.703681][T15020] Node 0 Normal free:8kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0KB free_highatomic:0KB active_anon:4kB inactive_anon:44kB active_file:1772kB inactive_file:68kB unevictable:0kB writepending:0kB present:1048580kB managed:1904kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:8kB free_cma:0kB
[  677.736266][T15020] lowmem_reserve[]: 0 0 0 0 0
[  677.741183][T15020] Node 1 Normal free:3904788kB boost:0kB min:55612kB low:69512kB high:83412kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:200kB inactive_file:0kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:16744kB local_pcp:14184kB free_cma:0kB
[  677.774936][T15020] lowmem_reserve[]: 0 0 0 0 0
[  677.779744][T15020] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB
[  677.792967][T15020] Node 0 DMA32: 803*4kB (UME) 763*8kB (UME) 320*16kB (UME) 807*32kB (UME) 268*64kB (UME) 201*128kB (UME) 85*256kB (UME) 44*512kB (UM) 8*1024kB (UME) 5*2048kB (UME) 264*4096kB (UM) = 1227204kB
[  677.816705][T15020] Node 0 Normal: 0*4kB 1*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 8kB
[  677.830693][T15020] Node 1 Normal: 173*4kB (UME) 62*8kB (UME) 51*16kB (UME) 188*32kB (UME) 51*64kB (UME) 12*128kB (UME) 3*256kB (UM) 4*512kB (UME) 2*1024kB (ME) 2*2048kB (UE) 948*4096kB (M) = 3904788kB
[  677.851650][T15020] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
[  677.863576][T15020] Node 0 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB
[  677.873180][T15020] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
[  677.882954][T15020] Node 1 hugepages_total=1 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB
[  677.894771][T15020] 79437 total pagecache pages
[  677.899767][T15020] 0 pages in swap cache
[  677.904057][T15020] Free swap  = 124996kB
[  677.908410][T15020] Total swap = 124996kB
[  677.912630][T15020] 2097051 pages RAM
[  677.918728][T15020] 0 pages HighMem/MovableOnly
[  677.923457][T15020] 424695 pages reserved
[  677.927767][T15020] 0 pages cma reserved
[  678.420449][ T6749] usb 3-1: device descriptor read/64, error -71
[  678.966068][ T6749] usb 3-1: new high-speed USB device number 20 using dummy_hcd
[  679.107841][ T6749] usb 3-1: device descriptor read/64, error -71
[  679.175794][ T6752] usb 6-1: new high-speed USB device number 27 using dummy_hcd
[  679.506029][ T6749] usb usb3-port1: attempt power cycle
[  679.587684][ T6752] usb 6-1: Using ep0 maxpacket: 32
[  679.600454][ T6752] usb 6-1: config index 0 descriptor too short (expected 156, got 27)
[  679.609008][ T6752] usb 6-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30
[  679.622772][ T6752] usb 6-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7
[  679.765291][ T6752] usb 6-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144
[  679.842987][ T6752] usb 6-1: config 0 interface 0 has no altsetting 0
[  679.884614][ T6752] usb 6-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66
[  679.937361][T15065] ip6t_rpfilter: only valid in 'raw' or 'mangle' table, not 'ethtool'
[  680.035638][ T6752] usb 6-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172
[  680.044464][ T6752] usb 6-1: Product: syz
[  680.052747][ T6752] usb 6-1: Manufacturer: syz
[  680.061616][ T6752] usb 6-1: SerialNumber: syz
[  680.653429][ T6752] usb 6-1: config 0 descriptor??
[  680.665999][ T6752] ldusb 6-1:0.0: Interrupt out endpoint not found (using control endpoint instead)
[  680.746858][ T6752] ldusb 6-1:0.0: LD USB Device #0 now attached to major 180 minor 0
[  681.092385][T15074] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2596'.
[  683.207370][   T24] usb 6-1: USB disconnect, device number 27
[  683.246178][   T24] ldusb 6-1:0.0: LD USB Device #0 now disconnected
[  684.426078][T15121] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2611'.
[  685.816196][ T1302] ieee802154 phy0 wpan0: encryption failed: -22
[  686.674259][T15129] 9pnet_fd: Insufficient options for proto=fd
[  686.725046][   T24] usb 5-1: new high-speed USB device number 33 using dummy_hcd
[  686.770850][T15138] 9pnet_fd: Insufficient options for proto=fd
[  686.937365][   T24] usb 5-1: Using ep0 maxpacket: 32
[  686.960308][   T24] usb 5-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92
[  686.970202][   T24] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  687.445429][   T24] usb 5-1: config 0 descriptor??
[  687.468315][   T24] gspca_main: nw80x-2.14.0 probing 055f:d001
[  687.955564][ T6749] usb 2-1: new high-speed USB device number 24 using dummy_hcd
[  688.175818][   T24] gspca_nw80x: reg_r err -110
[  688.180616][   T24] nw80x 5-1:0.0: probe with driver nw80x failed with error -110
[  689.670226][ T5903] usb 5-1: USB disconnect, device number 33
[  689.705961][ T6749] usb 2-1: Using ep0 maxpacket: 32
[  689.734136][ T6749] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  689.770323][ T6749] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  689.834864][ T6749] usb 2-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00
[  689.865788][ T6749] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  689.896148][ T6749] usb 2-1: config 0 descriptor??
[  689.999458][T15179] syzkaller0: create flow: hash 3649158032 index 1
[  690.110271][T15172] syzkaller0: entered promiscuous mode
[  690.156403][T15172] syzkaller0: entered allmulticast mode
[  690.171451][ T6816] syzkaller0: tun_net_xmit 48
[  690.271819][T15185] MTD: Attempt to mount non-MTD device "/dev/nullb0"
[  690.290839][T15185] cramfs: wrong magic
[  690.513652][ T6749] ft260 0003:0403:6030.0006: chip code: 6424 8183
[  690.605565][T15179] syzkaller0: delete flow: hash 3649158032 index 1
[  690.620058][T15189] tmpfs: Bad value for 'mpol'
[  690.714921][ T6749] ft260 0003:0403:6030.0006: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.1-1/input0
[  691.195566][ T6749] ft260 0003:0403:6030.0006: failed to retrieve status: -32, no wakeup
[  691.224786][ T6749] ft260 0003:0403:6030.0006: i2c bus error: 0x22
[  691.419652][ T6749] ft260 0003:0403:6030.0006: failed to reset I2C controller: -71
[  691.530760][ T6749] usb 2-1: USB disconnect, device number 24
[  691.768433][T15203] 9pnet_fd: Insufficient options for proto=fd
[  692.664577][T15221] --map-set only usable from mangle table
[  693.261859][T15232] nfs4: Unknown parameter '
dev/cpu/#/msr'
[  696.626265][T15249] 9p: Unknown Cache mode or invalid value fsca´ÂI
[  697.075156][ T6752] usb 5-1: new high-speed USB device number 34 using dummy_hcd
[  697.156449][T15207] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  697.269404][ T6752] usb 5-1: Using ep0 maxpacket: 8
[  697.278409][ T6752] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0
[  697.302262][ T6752] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0
[  697.347746][ T6752] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32
[  697.372526][ T6752] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  697.391722][ T6752] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23
[  697.402154][ T6752] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  697.843420][T15252] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2638'.
[  698.335126][T15271] netlink: 'syz.0.2641': attribute type 1 has an invalid length.
[  699.453012][ T6752] usb 5-1: usb_control_msg returned -71
[  699.516392][ T6752] usbtmc 5-1:16.0: can't read capabilities
[  699.516403][T15290] smb3: Unexpected value for 'rdma'
[  699.584681][ T6752] usb 5-1: USB disconnect, device number 34
[  699.866324][   T24] usb 6-1: new high-speed USB device number 28 using dummy_hcd
[  700.036050][   T24] usb 6-1: Using ep0 maxpacket: 16
[  700.115104][   T24] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 7
[  700.199844][T15299] netlink: 'syz.4.2650': attribute type 1 has an invalid length.
[  700.208157][T15299] netlink: 92 bytes leftover after parsing attributes in process `syz.4.2650'.
[  700.687029][T15298] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  700.697275][   T24] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1
[  700.706585][   T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  700.716658][   T24] usb 6-1: Product: syz
[  700.725032][   T24] usb 6-1: Manufacturer: syz
[  700.729774][   T24] usb 6-1: SerialNumber: syz
[  700.746768][   T24] usb 6-1: config 0 descriptor??
[  700.897083][T15302] netlink: 'syz.2.2652': attribute type 1 has an invalid length.
[  701.018463][T15305] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2653'.
[  701.070123][ T6752] usb 6-1: USB disconnect, device number 28
[  701.119801][T15308] bond5: (slave gretap1): making interface the new active one
[  701.155192][T15308] bond5: (slave gretap1): Enslaving as an active interface with an up link
[  702.372468][T15321] erofs (device loop4): cannot find valid erofs superblock
[  702.521427][T15265] delete_channel: no stack
[  705.525404][T15354] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2665'.
[  705.585382][T15356] input: syz1 as /devices/virtual/input/input12
[  707.113962][T15375] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2672'.
[  707.461406][T15377] smb3: Unexpected value for 'rdma'
[  707.476678][T15374] netlink: 'syz.4.2672': attribute type 12 has an invalid length.
[  708.069587][ T6752] usb 1-1: new high-speed USB device number 43 using dummy_hcd
[  708.255269][ T6752] usb 1-1: Using ep0 maxpacket: 16
[  708.278660][ T6752] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 7
[  708.316933][ T6752] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1
[  708.326333][ T6752] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  708.351933][ T6752] usb 1-1: Product: syz
[  708.370243][ T6752] usb 1-1: Manufacturer: syz
[  708.386832][ T6752] usb 1-1: SerialNumber: syz
[  708.419367][ T6752] usb 1-1: config 0 descriptor??
[  708.568406][T15396] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes.
[  708.605417][T15396] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  708.723687][ T6752] usb 1-1: USB disconnect, device number 43
[  709.790790][ T6749] usb 5-1: new full-speed USB device number 35 using dummy_hcd
[  710.150112][ T6749] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0
[  710.162791][ T6749] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  710.207736][ T6749] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23
[  710.378779][ T6749] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  710.500620][T15411] 9pnet_fd: Insufficient options for proto=fd
[  710.637082][ T6749] usb 5-1: GET_CAPABILITIES returned 0
[  710.645135][ T6749] usbtmc 5-1:16.0: can't read capabilities
[  710.704816][T15420] lo speed is unknown, defaulting to 1000
[  711.026836][ T6749] usb 5-1: USB disconnect, device number 35
[  712.247564][T15429] erofs (device loop2): cannot find valid erofs superblock
[  712.285732][T15429] netlink: 45 bytes leftover after parsing attributes in process `syz.2.2685'.
[  712.881867][T15459] affs: No valid root block on device nullb0
[  715.101152][T15473] syz.0.2691 (15473): attempted to duplicate a private mapping with mremap.  This is not supported.
[  715.416846][T15474] 9pnet_fd: Insufficient options for proto=fd
[  716.136488][T15488] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2696'.
[  716.290001][T15491] ntfs3(nullb0): Primary boot signature is not NTFS.
[  716.290986][T15488] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2696'.
[  716.306279][T15491] ntfs3(nullb0): try to read out of volume at offset 0x3e7ffffe00
[  716.815874][T15502] /dev/sg0: Can't lookup blockdev
[  716.836955][T15504] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  717.389532][T15510] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2705'.
[  717.873369][T15515] 9pnet_fd: Insufficient options for proto=fd
[  719.628047][T15532] tipc: Enabling of bearer <eth:syzkaller0> rejected, already enabled
[  719.669410][T15532] tipc: Resetting bearer <eth:syzkaller0>
[  719.833816][T15540] netlink: 'syz.1.2713': attribute type 4 has an invalid length.
[  720.771679][T15562] netlink: 'syz.5.2723': attribute type 3 has an invalid length.
[  721.967770][T15576] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2725'.
[  722.618844][T15567] fuse: Unknown parameter '`fd'
[  725.222386][T15601] FAULT_INJECTION: forcing a failure.
[  725.222386][T15601] name failslab, interval 1, probability 0, space 0, times 0
[  725.285983][T15601] CPU: 0 UID: 0 PID: 15601 Comm: syz.1.2732 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) 
[  725.286011][T15601] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  725.286023][T15601] Call Trace:
[  725.286031][T15601]  <TASK>
[  725.286039][T15601]  dump_stack_lvl+0x189/0x250
[  725.286068][T15601]  ? __pfx____ratelimit+0x10/0x10
[  725.286088][T15601]  ? __pfx_dump_stack_lvl+0x10/0x10
[  725.286110][T15601]  ? __pfx__printk+0x10/0x10
[  725.286138][T15601]  ? __pfx___might_resched+0x10/0x10
[  725.286159][T15601]  ? fs_reclaim_acquire+0x7d/0x100
[  725.286189][T15601]  should_fail_ex+0x414/0x560
[  725.286212][T15601]  should_failslab+0xa8/0x100
[  725.286233][T15601]  __kmalloc_noprof+0xcb/0x4f0
[  725.286251][T15601]  ? rds_info_getsockopt+0x1db/0x470
[  725.286279][T15601]  rds_info_getsockopt+0x1db/0x470
[  725.286305][T15601]  ? __pfx_rds_info_getsockopt+0x10/0x10
[  725.286330][T15601]  ? __might_fault+0xb0/0x130
[  725.286355][T15601]  ? rds_getsockopt+0x2b4/0x500
[  725.286383][T15601]  ? __pfx_rds_getsockopt+0x10/0x10
[  725.286412][T15601]  do_sock_getsockopt+0x36f/0x450
[  725.286444][T15601]  ? __pfx_do_sock_getsockopt+0x10/0x10
[  725.286471][T15601]  ? do_syscall_64+0x20/0x3b0
[  725.286493][T15601]  ? __fget_files+0x3a0/0x420
[  725.286512][T15601]  ? __fget_files+0x2a/0x420
[  725.286545][T15601]  __x64_sys_getsockopt+0x1a5/0x250
[  725.286571][T15601]  ? do_syscall_64+0x20/0x3b0
[  725.286591][T15601]  ? do_syscall_64+0x20/0x3b0
[  725.286615][T15601]  do_syscall_64+0xfa/0x3b0
[  725.286634][T15601]  ? lockdep_hardirqs_on+0x9c/0x150
[  725.286653][T15601]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  725.286672][T15601]  ? clear_bhb_loop+0x60/0xb0
[  725.286695][T15601]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  725.286714][T15601] RIP: 0033:0x7f93e238ebe9
[  725.286731][T15601] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  725.286749][T15601] RSP: 002b:00007f93e327b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000037
[  725.286770][T15601] RAX: ffffffffffffffda RBX: 00007f93e25b5fa0 RCX: 00007f93e238ebe9
[  725.286785][T15601] RDX: 0000000000002711 RSI: 0000200000000114 RDI: 0000000000000003
[  725.286798][T15601] RBP: 00007f93e327b090 R08: 0000200000000000 R09: 0000000000000000
[  725.286812][T15601] R10: 0000200000032580 R11: 0000000000000246 R12: 0000000000000001
[  725.286826][T15601] R13: 00007f93e25b6038 R14: 00007f93e25b5fa0 R15: 00007ffc2076c918
[  725.286858][T15601]  </TASK>
[  725.675164][ T5974] usb 3-1: new full-speed USB device number 22 using dummy_hcd
[  725.833652][T15613] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2735'.
[  725.851236][ T5974] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0
[  725.863482][ T5974] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0
[  725.880075][ T5974] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0
[  726.063253][ T5974] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0
[  726.605389][T15616] erofs (device loop4): cannot find valid erofs superblock
[  727.022474][ T5974] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0
[  727.418016][ T5974] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0
[  727.440603][ T5974] usb 3-1: New USB device found, idVendor=0451, idProduct=5152, bcdDevice=c0.b9
[  727.451698][ T5974] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  727.466595][ T5974] usb 3-1: Product: syz
[  727.581881][ T5974] usb 3-1: Manufacturer: syz
[  727.586873][ T5974] usb 3-1: SerialNumber: syz
[  727.612760][ T5974] usb 3-1: config 0 descriptor??
[  727.634112][ T5974] ti_usb_3410_5052 3-1:0.0: TI USB 5052 2 port adapter converter detected
[  727.650602][ T5974] ti_usb_3410_5052 3-1:0.0: missing endpoints
[  727.739967][T15623] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2738'.
[  728.140642][ T5974] usb 3-1: USB disconnect, device number 22
[  728.349335][T15627] binder: 15625:15627 unknown command 0
[  728.419728][T15627] binder: 15625:15627 ioctl c0306201 200000000080 returned -22
[  728.463423][T15627] binder: 15625:15627 ioctl c0306201 2000000001c0 returned -14
[  728.965189][ T6752] usb 6-1: new high-speed USB device number 29 using dummy_hcd
[  728.994234][T15632] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2743'.
[  729.186034][ T5974] usb 5-1: new high-speed USB device number 36 using dummy_hcd
[  729.190152][T15632] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  729.204973][T15632] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  729.213784][T15632] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  729.222968][T15632] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  729.265006][ T6752] usb 6-1: Using ep0 maxpacket: 8
[  729.360383][ T6752] usb 6-1: unable to get BOS descriptor or descriptor too short
[  729.445380][ T5974] usb 5-1: Using ep0 maxpacket: 32
[  729.505067][ T6752] usb 6-1: config 4 interface 0 has no altsetting 0
[  729.545474][ T5974] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  729.581007][ T6752] usb 6-1: string descriptor 0 read error: -22
[  729.587613][ T6752] usb 6-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05
[  729.604579][ T6752] usb 6-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3
[  729.616367][ T5974] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40
[  729.648362][ T5974] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  729.733394][ T6752] usb 6-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state
[  729.738953][   T49] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  729.764167][ T6752] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer
[  729.776156][ T5974] usb 5-1: config 0 descriptor??
[  729.906177][ T6752] dvbdev: DVB: registering new adapter (Sigmatek DVB-110)
[  729.913404][ T6752] usb 6-1: media controller created
[  729.942130][ T6752] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[  729.944441][   T49] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  729.964089][ T5974] hub 5-1:0.0: bad descriptor, ignoring hub
[  729.980589][ T5974] hub 5-1:0.0: probe with driver hub failed with error -5
[  730.080569][ T5974] usbhid 5-1:0.0: couldn't find an input interrupt endpoint
[  730.297133][T15647] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  730.421598][   T49] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  730.465832][   T49] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  730.533508][T14734] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[  730.546392][T14734] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[  730.562298][T14734] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[  730.571563][T15649] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2749'.
[  730.692009][T14734] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[  730.896020][T14734] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[  730.969824][   T49] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  731.025634][   T49] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  731.026205][ T6752] usb 5-1: USB disconnect, device number 36
[  731.558886][   T49] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  731.584857][   T49] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  732.046630][ T6752] usb 1-1: new full-speed USB device number 44 using dummy_hcd
[  732.110925][T15650] lo speed is unknown, defaulting to 1000
[  732.177247][ T5974] usb 6-1: USB disconnect, device number 29
[  732.418292][ T6752] usb 1-1: config 0 has an invalid interface number: 207 but max is 0
[  732.434603][ T6752] usb 1-1: config 0 has no interface number 0
[  732.874543][T15673] overlayfs: failed to resolve './file0': -2
[  732.919074][ T6752] usb 1-1: New USB device found, idVendor=12d1, idProduct=ed56, bcdDevice=46.dd
[  732.933494][ T5848] Bluetooth: hci4: command tx timeout
[  733.128077][ T6752] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  733.185242][ T6752] usb 1-1: Product: syz
[  733.189475][ T6752] usb 1-1: Manufacturer: syz
[  733.247611][ T6752] usb 1-1: SerialNumber: syz
[  733.322158][ T6752] usb 1-1: config 0 descriptor??
[  733.354365][ T6752] qmi_wwan 1-1:0.207: bogus CDC Union: master=0, slave=1
[  733.442187][   T49] bridge_slave_1: left allmulticast mode
[  733.453694][   T49] bridge_slave_1: left promiscuous mode
[  733.463407][   T49] bridge0: port 2(bridge_slave_1) entered disabled state
[  733.479440][   T49] bridge_slave_0: left allmulticast mode
[  733.488705][   T49] bridge_slave_0: left promiscuous mode
[  733.494563][   T49] bridge0: port 1(bridge_slave_0) entered disabled state
[  733.547013][ T6749] usb 5-1: new high-speed USB device number 37 using dummy_hcd
[  733.565798][T15660] overlayfs: missing 'lowerdir'
[  733.570143][   T49] batman_adv: batadv0: Interface deactivated: ip6gretap1
[  733.717401][ T6744] usb 3-1: new high-speed USB device number 23 using dummy_hcd
[  733.746462][ T6749] usb 5-1: Using ep0 maxpacket: 8
[  733.754610][ T6749] usb 5-1: config 0 has an invalid interface number: 239 but max is 0
[  733.784814][ T6749] usb 5-1: config 0 has no interface number 0
[  733.807601][ T6749] usb 5-1: config 0 interface 239 altsetting 0 has an endpoint descriptor with address 0x64, changing to 0x4
[  733.827973][ T6749] usb 5-1: config 0 interface 239 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 8
[  733.858318][ T6749] usb 5-1: New USB device found, idVendor=04da, idProduct=390d, bcdDevice=99.1a
[  733.874234][ T6749] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  733.903871][ T6749] usb 5-1: Product: syz
[  733.916359][ T6749] usb 5-1: Manufacturer: syz
[  733.926622][ T6749] usb 5-1: SerialNumber: syz
[  733.960026][ T6749] usb 5-1: config 0 descriptor??
[  733.983230][T15679] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22
[  734.000648][   T49] batman_adv: batadv0: Removing interface: ip6gretap1
[  734.224796][ T6749] ath6kl: Failed to submit usb control message: -71
[  734.237635][ T6749] ath6kl: unable to send the bmi data to the device: -71
[  734.257068][ T6749] ath6kl: Unable to send get target info: -71
[  734.288823][ T6749] ath6kl: Failed to init ath6kl core: -71
[  734.323345][ T6749] ath6kl_usb 5-1:0.239: probe with driver ath6kl_usb failed with error -71
[  734.383111][ T6749] usb 5-1: USB disconnect, device number 37
[  734.660871][ T6752] qmi_wwan 1-1:0.207: probe with driver qmi_wwan failed with error -22
[  734.709340][ T6752] usb 1-1: USB disconnect, device number 44
[  735.016001][ T5848] Bluetooth: hci4: command tx timeout
[  737.224858][ T5848] Bluetooth: hci4: command tx timeout
[  737.259484][ T6744] usb 3-1: unable to get BOS descriptor or descriptor too short
[  737.285981][ T6744] usb 3-1: unable to read config index 0 descriptor/start: -71
[  737.303568][ T6744] usb 3-1: can't read configurations, error -71
[  737.512078][   T49] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  737.527851][   T49] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  737.576831][   T49] bond0 (unregistering): Released all slaves
[  738.305024][T15755] FAULT_INJECTION: forcing a failure.
[  738.305024][T15755] name failslab, interval 1, probability 0, space 0, times 0
[  738.317986][T15755] CPU: 0 UID: 0 PID: 15755 Comm: syz.5.2771 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) 
[  738.318011][T15755] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  738.318023][T15755] Call Trace:
[  738.318031][T15755]  <TASK>
[  738.318039][T15755]  dump_stack_lvl+0x189/0x250
[  738.318067][T15755]  ? __pfx____ratelimit+0x10/0x10
[  738.318098][T15755]  ? __pfx_dump_stack_lvl+0x10/0x10
[  738.318120][T15755]  ? __pfx__printk+0x10/0x10
[  738.318151][T15755]  ? __pfx___might_resched+0x10/0x10
[  738.318172][T15755]  ? fs_reclaim_acquire+0x7d/0x100
[  738.318200][T15755]  should_fail_ex+0x414/0x560
[  738.318226][T15755]  should_failslab+0xa8/0x100
[  738.318249][T15755]  __kmalloc_noprof+0xcb/0x4f0
[  738.318266][T15755]  ? kfree+0x4d/0x440
[  738.318291][T15755]  ? tomoyo_realpath_from_path+0xe3/0x5d0
[  738.318322][T15755]  tomoyo_realpath_from_path+0xe3/0x5d0
[  738.318348][T15755]  ? tomoyo_domain+0xda/0x130
[  738.318379][T15755]  ? tomoyo_path_number_perm+0x1bc/0x5a0
[  738.318400][T15755]  tomoyo_path_number_perm+0x1e8/0x5a0
[  738.318424][T15755]  ? __pfx_tomoyo_path_number_perm+0x10/0x10
[  738.318464][T15755]  ? __lock_acquire+0xab9/0xd20
[  738.318506][T15755]  ? __fget_files+0x2a/0x420
[  738.318531][T15755]  ? __fget_files+0x2a/0x420
[  738.318551][T15755]  ? __fget_files+0x3a0/0x420
[  738.318571][T15755]  ? __fget_files+0x2a/0x420
[  738.318605][T15755]  security_file_ioctl+0xcb/0x2d0
[  738.318630][T15755]  __se_sys_ioctl+0x47/0x170
[  738.318661][T15755]  do_syscall_64+0xfa/0x3b0
[  738.318681][T15755]  ? lockdep_hardirqs_on+0x9c/0x150
[  738.318701][T15755]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  738.318720][T15755]  ? clear_bhb_loop+0x60/0xb0
[  738.318744][T15755]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  738.318763][T15755] RIP: 0033:0x7fcfa618ebe9
[  738.318787][T15755] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  738.318804][T15755] RSP: 002b:00007fcfa6fba038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  738.318825][T15755] RAX: ffffffffffffffda RBX: 00007fcfa63b6180 RCX: 00007fcfa618ebe9
[  738.318840][T15755] RDX: 0000200000000040 RSI: 0000000080b06401 RDI: 000000000000000b
[  738.318853][T15755] RBP: 00007fcfa6fba090 R08: 0000000000000000 R09: 0000000000000000
[  738.318866][T15755] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  738.318878][T15755] R13: 00007fcfa63b6218 R14: 00007fcfa63b6180 R15: 00007ffdf964f8e8
[  738.318911][T15755]  </TASK>
[  738.561404][T15755] ERROR: Out of memory at tomoyo_realpath_from_path.
[  738.636952][   T49] tipc: Disabling bearer <eth:syzkaller0>
[  738.664184][   T49] tipc: Left network mode
[  738.686430][T15745] tipc: Enabling of bearer <eth:syzkall> rejected, failed to enable media
[  738.771648][T15747] syzkaller0: entered promiscuous mode
[  738.779629][T15747] syzkaller0: entered allmulticast mode
[  739.375299][ T5848] Bluetooth: hci4: command tx timeout
[  743.678307][T15799] syz.2.2785: attempt to access beyond end of device
[  743.678307][T15799] nbd2: rw=6144, sector=128, nr_sectors = 8 limit=0
[  743.692080][T15799] gfs2: error -5 reading superblock
[  745.429841][T15808] netlink: 'syz.0.2788': attribute type 4 has an invalid length.
[  745.444221][T15650] chnl_net:caif_netlink_parms(): no params data found
[  745.702917][T15812] FAULT_INJECTION: forcing a failure.
[  745.702917][T15812] name failslab, interval 1, probability 0, space 0, times 0
[  745.715722][T15812] CPU: 0 UID: 0 PID: 15812 Comm: syz.5.2789 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) 
[  745.715746][T15812] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  745.715759][T15812] Call Trace:
[  745.715766][T15812]  <TASK>
[  745.715775][T15812]  dump_stack_lvl+0x189/0x250
[  745.715802][T15812]  ? __pfx____ratelimit+0x10/0x10
[  745.715824][T15812]  ? __pfx_dump_stack_lvl+0x10/0x10
[  745.715846][T15812]  ? __pfx__printk+0x10/0x10
[  745.715877][T15812]  ? __pfx___might_resched+0x10/0x10
[  745.715897][T15812]  ? fs_reclaim_acquire+0x7d/0x100
[  745.715925][T15812]  should_fail_ex+0x414/0x560
[  745.715951][T15812]  should_failslab+0xa8/0x100
[  745.715973][T15812]  __kmalloc_noprof+0xcb/0x4f0
[  745.715991][T15812]  ? ethnl_default_doit+0x1f3/0xe90
[  745.716024][T15812]  ethnl_default_doit+0x1f3/0xe90
[  745.716067][T15812]  genl_family_rcv_msg_doit+0x215/0x300
[  745.716095][T15812]  ? __pfx_genl_family_rcv_msg_doit+0x10/0x10
[  745.716128][T15812]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  745.716170][T15812]  genl_rcv_msg+0x60e/0x790
[  745.716197][T15812]  ? __pfx_genl_rcv_msg+0x10/0x10
[  745.716217][T15812]  ? __pfx_ethnl_default_doit+0x10/0x10
[  745.716261][T15812]  netlink_rcv_skb+0x205/0x470
[  745.716288][T15812]  ? __pfx_genl_rcv_msg+0x10/0x10
[  745.716310][T15812]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  745.716355][T15812]  ? down_read+0x1ad/0x2e0
[  745.716380][T15812]  genl_rcv+0x28/0x40
[  745.716397][T15812]  netlink_unicast+0x75c/0x8e0
[  745.716440][T15812]  netlink_sendmsg+0x805/0xb30
[  745.716466][T15812]  ? __pfx_preempt_schedule_irq+0x10/0x10
[  745.716493][T15812]  ? __pfx_netlink_sendmsg+0x10/0x10
[  745.716529][T15812]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  745.716548][T15812]  ? __pfx_netlink_sendmsg+0x10/0x10
[  745.716576][T15812]  __sock_sendmsg+0x21c/0x270
[  745.716602][T15812]  ____sys_sendmsg+0x505/0x830
[  745.716637][T15812]  ? __pfx_____sys_sendmsg+0x10/0x10
[  745.716675][T15812]  ? import_iovec+0x74/0xa0
[  745.716705][T15812]  ___sys_sendmsg+0x21f/0x2a0
[  745.716736][T15812]  ? __pfx____sys_sendmsg+0x10/0x10
[  745.716773][T15812]  ? rcu_read_unlock_special+0x3fe/0x4c0
[  745.716831][T15812]  ? __fget_files+0x2a/0x420
[  745.716852][T15812]  ? __fget_files+0x3a0/0x420
[  745.716885][T15812]  __x64_sys_sendmsg+0x19b/0x260
[  745.716916][T15812]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  745.716942][T15812]  ? irqentry_exit+0x74/0x90
[  745.716982][T15812]  ? do_syscall_64+0xbe/0x3b0
[  745.717007][T15812]  do_syscall_64+0xfa/0x3b0
[  745.717029][T15812]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  745.717048][T15812]  ? asm_sysvec_reschedule_ipi+0x1a/0x20
[  745.717070][T15812]  ? clear_bhb_loop+0x60/0xb0
[  745.717093][T15812]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  745.717111][T15812] RIP: 0033:0x7fcfa618ebe9
[  745.717129][T15812] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  745.717145][T15812] RSP: 002b:00007fcfa6fba038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  745.717165][T15812] RAX: ffffffffffffffda RBX: 00007fcfa63b6180 RCX: 00007fcfa618ebe9
[  745.717179][T15812] RDX: 0000000000000000 RSI: 0000200000000a00 RDI: 0000000000000006
[  745.717191][T15812] RBP: 00007fcfa6fba090 R08: 0000000000000000 R09: 0000000000000000
[  745.717203][T15812] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  745.717214][T15812] R13: 00007fcfa63b6218 R14: 00007fcfa63b6180 R15: 00007ffdf964f8e8
[  745.717247][T15812]  </TASK>
[  746.058600][    C0] vkms_vblank_simulate: vblank timer overrun
[  746.684957][   T49] hsr_slave_0: left promiscuous mode
[  746.704258][   T49] hsr_slave_1: left promiscuous mode
[  747.248801][ T1302] ieee802154 phy0 wpan0: encryption failed: -22
[  747.393759][T15822] program syz.0.2793 is using a deprecated SCSI ioctl, please convert it to SG_IO
[  747.403926][   T49] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  747.411473][   T49] batman_adv: batadv0: Removing interface: batadv_slave_0
[  747.450030][   T49] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  747.489371][   T49] batman_adv: batadv0: Removing interface: batadv_slave_1
[  747.852247][   T49] team0: left allmulticast mode
[  747.881078][   T49] team_slave_0: left allmulticast mode
[  747.937774][   T49] team_slave_1: left allmulticast mode
[  748.047710][   T49] team0: left promiscuous mode
[  748.207071][   T49] team_slave_0: left promiscuous mode
[  748.212847][   T49] team_slave_1: left promiscuous mode
[  748.254735][T15843] delete_channel: no stack
[  748.256908][   T49] veth1_macvtap: left promiscuous mode
[  748.269059][   T49] veth0_macvtap: left promiscuous mode
[  748.296166][   T49] veth1_vlan: left promiscuous mode
[  748.318321][   T49] veth0_vlan: left promiscuous mode
[  748.434757][ T5848] Bluetooth: hci1: Malformed MSFT vendor event: 0x02
[  749.026935][T15857] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2797'.
[  749.945326][ T5935] usb 5-1: new high-speed USB device number 38 using dummy_hcd
[  750.117459][ T5935] usb 5-1: Using ep0 maxpacket: 32
[  750.134647][ T5935] usb 5-1: unable to read config index 0 descriptor/start: -61
[  750.146983][ T5935] usb 5-1: can't read configurations, error -61
[  750.200372][T15871] syz.2.2802: attempt to access beyond end of device
[  750.200372][T15871] nbd2: rw=6144, sector=128, nr_sectors = 8 limit=0
[  750.217161][T15871] gfs2: error -5 reading superblock
[  750.745221][ T5935] usb 5-1: new high-speed USB device number 39 using dummy_hcd
[  750.925559][ T5935] usb 5-1: Using ep0 maxpacket: 32
[  750.938889][ T5935] usb 5-1: unable to read config index 0 descriptor/start: -61
[  750.948945][ T5935] usb 5-1: can't read configurations, error -61
[  750.956365][ T5935] usb usb5-port1: attempt power cycle
[  751.332364][ T5935] usb 5-1: new high-speed USB device number 40 using dummy_hcd
[  751.418888][ T5935] usb 5-1: Using ep0 maxpacket: 32
[  751.466774][   T49] team0 (unregistering): Port device team_slave_1 removed
[  751.490702][ T5935] usb 5-1: unable to read config index 0 descriptor/start: -61
[  751.507314][ T5935] usb 5-1: can't read configurations, error -61
[  751.552554][   T49] team0 (unregistering): Port device team_slave_0 removed
[  751.701219][ T5935] usb 5-1: new high-speed USB device number 41 using dummy_hcd
[  751.735324][ T5935] usb 5-1: Using ep0 maxpacket: 32
[  751.742945][ T5935] usb 5-1: unable to read config index 0 descriptor/start: -61
[  751.751882][ T5935] usb 5-1: can't read configurations, error -61
[  751.760130][ T5935] usb usb5-port1: unable to enumerate USB device
[  751.815667][T15882] fuse: Unknown parameter 'rootmofe'
[  752.777134][T15650] bridge0: port 1(bridge_slave_0) entered blocking state
[  752.784363][T15650] bridge0: port 1(bridge_slave_0) entered disabled state
[  752.807160][T15650] bridge_slave_0: entered allmulticast mode
[  752.816387][T15650] bridge_slave_0: entered promiscuous mode
[  752.828046][T15650] bridge0: port 2(bridge_slave_1) entered blocking state
[  752.841239][T15650] bridge0: port 2(bridge_slave_1) entered disabled state
[  752.849339][T15650] bridge_slave_1: entered allmulticast mode
[  752.857767][T15650] bridge_slave_1: entered promiscuous mode
[  753.037765][ T6744] usb 6-1: new low-speed USB device number 30 using dummy_hcd
[  753.082144][T15650] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  753.110086][ T5935] usb 1-1: new full-speed USB device number 45 using dummy_hcd
[  753.119492][T15650] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  753.237962][ T6744] usb 6-1: config 0 has an invalid descriptor of length 50, skipping remainder of the config
[  753.275091][ T6744] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3
[  753.298855][T15650] team0: Port device team_slave_0 added
[  753.314668][ T6744] usb 6-1: New USB device found, idVendor=05ac, idProduct=0264, bcdDevice= 0.00
[  753.328487][T15650] team0: Port device team_slave_1 added
[  753.336425][   T49] IPVS: stop unused estimator thread 0...
[  753.351486][ T5935] usb 1-1: config 0 has no interfaces?
[  753.356276][ T6744] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  753.383309][ T6744] usb 6-1: config 0 descriptor??
[  753.402739][ T6744] input: bcm5974 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/input/input13
[  753.412697][ T5935] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  753.412728][ T5935] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  753.412749][ T5935] usb 1-1: Product: syz
[  753.412763][ T5935] usb 1-1: Manufacturer: syz
[  753.412777][ T5935] usb 1-1: SerialNumber: syz
[  753.618552][T15913] syz.4.2812: attempt to access beyond end of device
[  753.618552][T15913] nbd4: rw=6144, sector=128, nr_sectors = 8 limit=0
[  753.632169][T15913] gfs2: error -5 reading superblock
[  754.112416][ T5935] usb 1-1: config 0 descriptor??
[  754.228153][ T5191] bcm5974 6-1:0.0: could not read from device
[  754.239549][T15650] batman_adv: batadv0: Adding interface: batadv_slave_0
[  754.287610][ T5191] bcm5974 6-1:0.0: could not read from device
[  754.298489][ T6744] usb 6-1: USB disconnect, device number 30
[  754.304656][T15650] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  754.372141][T15916] bcm5974 6-1:0.0: could not read from device
[  754.410613][T15894] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  754.419137][T15650] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  754.432251][T15650] batman_adv: batadv0: Adding interface: batadv_slave_1
[  754.435924][ T5191] bcm5974 6-1:0.0: could not read from device
[  754.470879][T15894] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  754.482447][T15650] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  754.519665][T15916] udevd[15916]: Error opening device "/dev/input/event4": No such device
[  754.535529][T15916] udevd[15916]: Unable to EVIOCGABS device "/dev/input/event4"
[  754.564318][T15916] udevd[15916]: Unable to EVIOCGABS device "/dev/input/event4"
[  754.566163][T15650] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  754.596834][T15916] udevd[15916]: Unable to EVIOCGABS device "/dev/input/event4"
[  754.628653][T15916] udevd[15916]: Unable to EVIOCGABS device "/dev/input/event4"
[  754.638905][ T6745] usb 1-1: USB disconnect, device number 45
[  754.837686][T15650] hsr_slave_0: entered promiscuous mode
[  754.854669][T15650] hsr_slave_1: entered promiscuous mode
[  755.096679][T15933] Bluetooth: MGMT ver 1.23
[  755.284513][T15935] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  756.584472][T15952] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2819'.
[  756.655002][T15951] hfsplus: unable to find HFS+ superblock
[  756.910894][T15952] 8021q: adding VLAN 0 to HW filter on device bond0
[  756.923094][T15952] bond0: (slave rose0): Enslaving as an active interface with an up link
[  757.969705][T15961] syz.2.2822: attempt to access beyond end of device
[  757.969705][T15961] nbd2: rw=6144, sector=128, nr_sectors = 8 limit=0
[  757.982953][T15961] gfs2: error -5 reading superblock
[  758.542848][T15967] netlink: 'syz.2.2823': attribute type 13 has an invalid length.
[  758.825116][T15967] macvtap0: entered promiscuous mode
[  759.191453][T15967] macvtap0: refused to change device tx_queue_len
[  759.475511][T15650] netdevsim netdevsim1 netdevsim0: renamed from eth0
[  759.676585][T15650] netdevsim netdevsim1 netdevsim1: renamed from eth1
[  759.792005][T15650] netdevsim netdevsim1 netdevsim2: renamed from eth2
[  759.900186][T15650] netdevsim netdevsim1 netdevsim3: renamed from eth3
[  760.301604][T15650] 8021q: adding VLAN 0 to HW filter on device bond0
[  760.407165][T15650] 8021q: adding VLAN 0 to HW filter on device team0
[  760.501906][ T6816] bridge0: port 1(bridge_slave_0) entered blocking state
[  760.509192][ T6816] bridge0: port 1(bridge_slave_0) entered forwarding state
[  760.586181][ T6816] bridge0: port 2(bridge_slave_1) entered blocking state
[  760.593412][ T6816] bridge0: port 2(bridge_slave_1) entered forwarding state
[  761.270879][T16017] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  761.454554][T16025] FAULT_INJECTION: forcing a failure.
[  761.454554][T16025] name failslab, interval 1, probability 0, space 0, times 0
[  761.467802][T16025] CPU: 1 UID: 0 PID: 16025 Comm: syz.4.2831 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) 
[  761.467827][T16025] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  761.467839][T16025] Call Trace:
[  761.467847][T16025]  <TASK>
[  761.467856][T16025]  dump_stack_lvl+0x189/0x250
[  761.467883][T16025]  ? __pfx____ratelimit+0x10/0x10
[  761.467904][T16025]  ? __pfx_dump_stack_lvl+0x10/0x10
[  761.467926][T16025]  ? __pfx__printk+0x10/0x10
[  761.467967][T16025]  should_fail_ex+0x414/0x560
[  761.467993][T16025]  should_failslab+0xa8/0x100
[  761.468016][T16025]  kmem_cache_alloc_noprof+0x73/0x3c0
[  761.468035][T16025]  ? skb_clone+0x212/0x3a0
[  761.468059][T16025]  skb_clone+0x212/0x3a0
[  761.468082][T16025]  __netlink_deliver_tap+0x404/0x850
[  761.468132][T16025]  ? netlink_deliver_tap+0x2e/0x1b0
[  761.468160][T16025]  netlink_deliver_tap+0x19c/0x1b0
[  761.468188][T16025]  netlink_sendskb+0x68/0x140
[  761.468215][T16025]  netlink_rcv_skb+0x28c/0x470
[  761.468242][T16025]  ? __pfx_genl_rcv_msg+0x10/0x10
[  761.468264][T16025]  ? __pfx_netlink_rcv_skb+0x10/0x10
[  761.468309][T16025]  ? down_read+0x1ad/0x2e0
[  761.468336][T16025]  genl_rcv+0x28/0x40
[  761.468354][T16025]  netlink_unicast+0x75c/0x8e0
[  761.468389][T16025]  netlink_sendmsg+0x805/0xb30
[  761.468415][T16025]  ? finish_task_switch+0x266/0x950
[  761.468451][T16025]  ? __pfx_netlink_sendmsg+0x10/0x10
[  761.468488][T16025]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  761.468508][T16025]  ? __pfx_netlink_sendmsg+0x10/0x10
[  761.468535][T16025]  __sock_sendmsg+0x21c/0x270
[  761.468562][T16025]  ____sys_sendmsg+0x505/0x830
[  761.468597][T16025]  ? __pfx_____sys_sendmsg+0x10/0x10
[  761.468636][T16025]  ? import_iovec+0x74/0xa0
[  761.468667][T16025]  ___sys_sendmsg+0x21f/0x2a0
[  761.468699][T16025]  ? __pfx____sys_sendmsg+0x10/0x10
[  761.468736][T16025]  ? rcu_read_unlock_special+0x3fe/0x4c0
[  761.468794][T16025]  ? __fget_files+0x2a/0x420
[  761.468815][T16025]  ? __fget_files+0x3a0/0x420
[  761.468848][T16025]  __x64_sys_sendmsg+0x19b/0x260
[  761.468881][T16025]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  761.468920][T16025]  ? __pfx_ksys_write+0x10/0x10
[  761.468937][T16025]  ? rcu_is_watching+0x15/0xb0
[  761.468963][T16025]  ? do_syscall_64+0xbe/0x3b0
[  761.468989][T16025]  do_syscall_64+0xfa/0x3b0
[  761.469012][T16025]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  761.469030][T16025]  ? asm_sysvec_reschedule_ipi+0x1a/0x20
[  761.469048][T16025]  ? clear_bhb_loop+0x60/0xb0
[  761.469072][T16025]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  761.469091][T16025] RIP: 0033:0x7f252678ebe9
[  761.469108][T16025] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  761.469130][T16025] RSP: 002b:00007f2527660038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  761.469150][T16025] RAX: ffffffffffffffda RBX: 00007f25269b6090 RCX: 00007f252678ebe9
[  761.469165][T16025] RDX: 0000000000000000 RSI: 0000200000000380 RDI: 0000000000000009
[  761.469177][T16025] RBP: 00007f2527660090 R08: 0000000000000000 R09: 0000000000000000
[  761.469189][T16025] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  761.469201][T16025] R13: 00007f25269b6128 R14: 00007f25269b6090 R15: 00007ffc503d3a98
[  761.469234][T16025]  </TASK>
[  762.894990][T16039] syz.4.2832: attempt to access beyond end of device
[  762.894990][T16039] nbd4: rw=6144, sector=128, nr_sectors = 8 limit=0
[  762.909629][T16039] gfs2: error -5 reading superblock
[  763.453049][T15650] 8021q: adding VLAN 0 to HW filter on device batadv0
[  763.785716][T15650] veth0_vlan: entered promiscuous mode
[  763.858118][T15650] veth1_vlan: entered promiscuous mode
[  764.163807][T15650] veth0_macvtap: entered promiscuous mode
[  764.186972][T15650] veth1_macvtap: entered promiscuous mode
[  764.329301][T15650] batman_adv: batadv0: Interface activated: batadv_slave_0
[  764.427301][T15650] batman_adv: batadv0: Interface activated: batadv_slave_1
[  764.512023][T15650] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  764.569318][T15650] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  764.632376][T15650] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  764.656475][T15650] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  765.755046][ T6816] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  765.787808][ T6816] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  765.882796][ T6828] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  766.051355][ T6828] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  768.223625][T16100] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  768.661272][T16112] ntfs3(nullb0): Primary boot signature is not NTFS.
[  768.670534][T16112] ntfs3(nullb0): try to read out of volume at offset 0x3e7ffffe00
[  769.158078][T16109] smb3: Unexpected value for 'rdma'
[  769.587895][T14734] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  769.616019][T14734] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  769.638490][T14734] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  769.659930][T14734] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  769.675706][T14734] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  769.695903][ T6749] usb 2-1: new high-speed USB device number 25 using dummy_hcd
[  769.865759][ T6749] usb 2-1: Using ep0 maxpacket: 16
[  769.906175][ T6749] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 7
[  769.991398][ T6830] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  770.008915][ T6830] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  770.093487][T16131] ntfs3(nullb0): Primary boot signature is not NTFS.
[  770.102180][T16131] ntfs3(nullb0): try to read out of volume at offset 0x3e7ffffe00
[  770.274976][ T6749] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1
[  770.477523][ T6749] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  770.498018][ T6749] usb 2-1: Product: syz
[  770.537059][ T6749] usb 2-1: Manufacturer: syz
[  770.540109][T16118] lo speed is unknown, defaulting to 1000
[  770.545209][ T6749] usb 2-1: SerialNumber: syz
[  770.578465][ T6749] usb 2-1: config 0 descriptor??
[  770.583753][ T6830] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  770.608379][ T6830] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  770.866266][ T6830] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  770.892374][ T6830] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  770.936888][ T6749] usb 2-1: USB disconnect, device number 25
[  771.004007][ T6830] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  771.027224][ T6830] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  771.085749][ T5974] usb 6-1: new high-speed USB device number 31 using dummy_hcd
[  771.245372][ T5974] usb 6-1: device descriptor read/64, error -71
[  771.495282][ T5974] usb 6-1: new high-speed USB device number 32 using dummy_hcd
[  771.676014][ T5974] usb 6-1: device descriptor read/64, error -71
[  771.719521][ T6830] bridge_slave_1: left allmulticast mode
[  771.725462][ T5848] Bluetooth: hci2: command tx timeout
[  771.743108][ T6830] bridge_slave_1: left promiscuous mode
[  771.749710][ T6830] bridge0: port 2(bridge_slave_1) entered disabled state
[  771.787111][ T5974] usb usb6-port1: attempt power cycle
[  771.796252][ T6830] bridge_slave_0: left allmulticast mode
[  771.802150][ T6830] bridge0: port 1(bridge_slave_0) entered disabled state
[  772.054637][ T6745] usb 2-1: new high-speed USB device number 26 using dummy_hcd
[  772.145432][ T5974] usb 6-1: new high-speed USB device number 33 using dummy_hcd
[  772.194261][ T5974] usb 6-1: device descriptor read/8, error -71
[  772.225149][ T6745] usb 2-1: Using ep0 maxpacket: 16
[  772.234780][ T6745] usb 2-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 9.00
[  772.252159][ T6745] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  772.302465][ T6745] usb 2-1: Product: syz
[  772.311997][ T6745] usb 2-1: Manufacturer: syz
[  772.337065][ T6745] usb 2-1: SerialNumber: syz
[  772.352630][ T6745] usb 2-1: config 0 descriptor??
[  772.389585][ T6745] ftdi_sio 2-1:0.0: FTDI USB Serial Device converter detected
[  772.404622][ T6745] usb 2-1: Detected FT232H
[  772.438450][ T5974] usb 6-1: new high-speed USB device number 34 using dummy_hcd
[  772.496157][ T5974] usb 6-1: device descriptor read/8, error -71
[  772.556406][T16174] 9pnet_fd: Insufficient options for proto=fd
[  772.575666][ T6745] ftdi_sio ttyUSB0: Unable to read latency timer: -32
[  772.665369][ T5974] usb usb6-port1: unable to enumerate USB device
[  772.849581][T16179] smb3: Unexpected value for 'rdma'
[  773.013630][ T6745] usb 2-1: FTDI USB Serial Device converter now attached to ttyUSB0
[  773.373699][ T6830] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  773.392017][ T6830] bond0 (unregistering): Released all slaves
[  773.442532][T16158] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2853'.
[  773.460534][T16158] tc_dump_action: action bad kind
[  773.527984][T16118] chnl_net:caif_netlink_parms(): no params data found
[  773.606654][ T6830] tipc: Left network mode
[  773.670723][ T6749] usb 2-1: USB disconnect, device number 26
[  773.769985][ T6749] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0
[  773.784060][ T6749] ftdi_sio 2-1:0.0: device disconnected
[  773.805101][ T5848] Bluetooth: hci2: command tx timeout
[  774.115512][T16202] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  774.228941][T16213] smb3: Unexpected value for 'rdma'
[  774.965063][ T5903] usb 6-1: new high-speed USB device number 35 using dummy_hcd
[  775.014809][T16202] tipc: Resetting bearer <eth:syzkaller0>
[  775.125194][ T5903] usb 6-1: Using ep0 maxpacket: 16
[  775.142647][ T5903] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 7
[  775.186806][ T5903] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1
[  775.205000][ T5903] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  775.224608][T16118] bridge0: port 1(bridge_slave_0) entered blocking state
[  775.225372][ T5903] usb 6-1: Product: syz
[  775.232611][T16118] bridge0: port 1(bridge_slave_0) entered disabled state
[  775.272406][ T5903] usb 6-1: Manufacturer: syz
[  775.285319][T16118] bridge_slave_0: entered allmulticast mode
[  775.286604][ T5903] usb 6-1: SerialNumber: syz
[  775.293099][T16118] bridge_slave_0: entered promiscuous mode
[  775.322894][ T5903] usb 6-1: config 0 descriptor??
[  775.473278][T16193] tipc: Disabling bearer <eth:syzkaller0>
[  775.573379][T16118] bridge0: port 2(bridge_slave_1) entered blocking state
[  775.595286][T16118] bridge0: port 2(bridge_slave_1) entered disabled state
[  775.602704][T16118] bridge_slave_1: entered allmulticast mode
[  775.640068][T16118] bridge_slave_1: entered promiscuous mode
[  775.780421][ T6830] hsr_slave_0: left promiscuous mode
[  775.824492][ T6830] hsr_slave_1: left promiscuous mode
[  775.885069][T14734] Bluetooth: hci2: command tx timeout
[  776.051541][ T6830] veth1_macvtap: left promiscuous mode
[  776.065909][ T6830] veth0_macvtap: left promiscuous mode
[  776.083818][ T6830] veth1_vlan: left promiscuous mode
[  776.170715][T16243] netfs: Couldn't get user pages (rc=-14)
[  776.279543][T16247] 9pnet_fd: Insufficient options for proto=fd
[  776.943518][T16254] smb3: Unexpected value for 'rdma'
[  777.727348][ T5848] Bluetooth: hci5: Opcode 0x1003 failed: -110
[  777.973323][ T5848] Bluetooth: hci2: command tx timeout
[  778.701939][ T6830] team0 (unregistering): Port device team_slave_1 removed
[  778.817877][ T6830] team0 (unregistering): Port device team_slave_0 removed
[  779.918554][T16295] netlink: 'syz.0.2874': attribute type 10 has an invalid length.
[  779.919065][T16296] netlink: 'syz.0.2874': attribute type 10 has an invalid length.
[  780.027989][ T6830] lo (unregistering): left allmulticast mode
[  780.062651][T16118] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  780.111620][ T5935] usb 6-1: USB disconnect, device number 35
[  780.121828][T16295] team0: Device lo is loopback device. Loopback devices can't be added as a team port
[  780.135660][T16295] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  780.161616][T16296] team0: Device lo is loopback device. Loopback devices can't be added as a team port
[  780.235795][T16296] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check.
[  780.310758][T16118] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  780.836492][ T6745] usb 3-1: new high-speed USB device number 25 using dummy_hcd
[  781.423996][T16310] 9pnet_fd: Insufficient options for proto=fd
[  781.550864][T16118] team0: Port device team_slave_0 added
[  781.581824][T16118] team0: Port device team_slave_1 added
[  781.655975][ T6745] usb 3-1: Using ep0 maxpacket: 32
[  781.766401][ T6745] usb 3-1: config 0 has an invalid interface number: 192 but max is 0
[  782.052493][ T6745] usb 3-1: config 0 has no interface number 0
[  782.060742][ T6745] usb 3-1: config 0 interface 192 has no altsetting 0
[  782.084208][ T6745] usb 3-1: New USB device found, idVendor=0bfd, idProduct=0022, bcdDevice=f4.c6
[  782.129983][ T6745] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  782.140157][T16323] capability: warning: `syz.0.2880' uses deprecated v2 capabilities in a way that may be insecure
[  782.150494][T16118] batman_adv: batadv0: Adding interface: batadv_slave_0
[  782.168082][ T6745] usb 3-1: Product: syz
[  782.172350][ T6745] usb 3-1: Manufacturer: syz
[  782.175006][T16118] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  782.203888][ T6745] usb 3-1: SerialNumber: syz
[  782.224747][ T6745] usb 3-1: config 0 descriptor??
[  782.255706][T16118] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  782.286992][T16118] batman_adv: batadv0: Adding interface: batadv_slave_1
[  782.311871][T16118] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  782.395394][T16118] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  782.556012][ T6745] kvaser_usb 3-1:0.192: error -EPROTO: Cannot get software info
[  782.627570][ T6745] kvaser_usb 3-1:0.192: probe with driver kvaser_usb failed with error -71
[  782.669147][ T6745] usb 3-1: USB disconnect, device number 25
[  783.503515][T16349] smb3: Unexpected value for 'rdma'
[  783.859491][T16118] hsr_slave_0: entered promiscuous mode
[  783.892757][T16118] hsr_slave_1: entered promiscuous mode
[  783.937620][T16118] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  783.968556][T16118] Cannot create hsr debugfs directory
[  783.975090][T16357] smb3: Unexpected value for 'rdma'
[  784.297418][ T5903] usb 6-1: new high-speed USB device number 36 using dummy_hcd
[  784.565061][ T5903] usb 6-1: Using ep0 maxpacket: 16
[  784.745227][ T5903] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 7
[  785.483563][ T5903] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1
[  785.493696][ T5903] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  785.502064][ T5903] usb 6-1: Product: syz
[  785.506474][ T5903] usb 6-1: Manufacturer: syz
[  785.511095][ T5903] usb 6-1: SerialNumber: syz
[  785.563833][T16371] 9pnet_fd: Insufficient options for proto=fd
[  785.606860][ T5903] usb 6-1: config 0 descriptor??
[  785.865442][ T5903] usb 6-1: USB disconnect, device number 36
[  786.027950][ T6745] usb 3-1: new high-speed USB device number 26 using dummy_hcd
[  786.255329][ T6745] usb 3-1: Using ep0 maxpacket: 32
[  786.326390][ T6745] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40
[  786.371123][ T6745] usb 3-1: New USB device strings: Mfr=0, Product=151, SerialNumber=247
[  786.489344][ T6745] usb 3-1: Product: syz
[  786.505656][ T6745] usb 3-1: SerialNumber: syz
[  786.641658][ T6745] usb 3-1: config 0 descriptor??
[  786.685941][ T6749] usb 1-1: new full-speed USB device number 46 using dummy_hcd
[  786.851195][ T6749] usb 1-1: config index 0 descriptor too short (expected 12336, got 2448)
[  786.874574][ T6749] usb 1-1: config 48 has too many interfaces: 48, using maximum allowed: 32
[  786.895985][ T6745] dvb-usb: found a 'Elgato EyeTV Sat' in warm state.
[  786.925522][ T6749] usb 1-1: config 48 has an invalid descriptor of length 0, skipping remainder of the config
[  786.936678][ T6745] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[  786.956565][ T6749] usb 1-1: config 48 has 0 interfaces, different from the descriptor's value: 48
[  786.978795][ T6745] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat)
[  786.989161][ T6749] usb 1-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8
[  786.999842][ T6745] usb 3-1: media controller created
[  787.019826][ T6749] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  787.089013][ T6745] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[  787.158906][T16118] netdevsim netdevsim4 netdevsim0: renamed from eth0
[  787.171333][ T6745] az6027: usb out operation failed. (-71)
[  787.179975][ T6745] az6027: usb out operation failed. (-71)
[  787.186567][ T6745] stb0899_attach: Driver disabled by Kconfig
[  787.192621][ T6745] az6027: no front-end attached
[  787.192621][ T6745] 
[  787.203134][ T6745] az6027: usb out operation failed. (-71)
[  787.219296][T16118] netdevsim netdevsim4 netdevsim1: renamed from eth1
[  787.234217][ T6745] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat'
[  787.255696][T16384] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  787.272553][ T6745] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input14
[  787.296457][T16384] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  787.322000][ T6745] dvb-usb: schedule remote query interval to 400 msecs.
[  787.346124][ T6749] usb 1-1: string descriptor 0 read error: -71
[  787.523859][T16118] netdevsim netdevsim4 netdevsim2: renamed from eth2
[  787.536445][ T6745] dvb-usb: Elgato EyeTV Sat successfully initialized and connected.
[  787.549352][ T6749] usb 1-1: USB disconnect, device number 46
[  787.566892][ T6745] usb 3-1: USB disconnect, device number 26
[  787.800774][T16118] netdevsim netdevsim4 netdevsim3: renamed from eth3
[  787.886583][T16410] netlink: 52 bytes leftover after parsing attributes in process `syz.5.2896'.
[  788.803532][ T6745] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected.
[  788.925175][ T5903] usb 6-1: new high-speed USB device number 37 using dummy_hcd
[  789.091769][ T5903] usb 6-1: device descriptor read/64, error -71
[  789.345552][T16426] ntfs3(nullb0): Primary boot signature is not NTFS.
[  789.353612][T16426] ntfs3(nullb0): try to read out of volume at offset 0x3e7ffffe00
[  790.052284][ T5903] usb 6-1: new high-speed USB device number 38 using dummy_hcd
[  790.081281][T16434] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2900'.
[  790.092884][T16436] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2900'.
[  790.108998][T16118] 8021q: adding VLAN 0 to HW filter on device bond0
[  790.199569][T16118] 8021q: adding VLAN 0 to HW filter on device team0
[  790.235441][ T5903] usb 6-1: device descriptor read/64, error -71
[  790.302237][   T60] bridge0: port 1(bridge_slave_0) entered blocking state
[  790.309493][   T60] bridge0: port 1(bridge_slave_0) entered forwarding state
[  790.742915][ T5903] usb usb6-port1: attempt power cycle
[  790.776241][   T60] bridge0: port 2(bridge_slave_1) entered blocking state
[  790.783445][   T60] bridge0: port 2(bridge_slave_1) entered forwarding state
[  790.897450][T16442] 9pnet_fd: Insufficient options for proto=fd
[  792.192559][T16118] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  793.461904][ T6745] usb 2-1: new high-speed USB device number 27 using dummy_hcd
[  793.615326][ T5903] usb 1-1: new high-speed USB device number 47 using dummy_hcd
[  794.305055][ T6745] usb 2-1: Using ep0 maxpacket: 8
[  794.731848][T16118] 8021q: adding VLAN 0 to HW filter on device batadv0
[  794.749666][ T6745] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 7
[  794.805142][ T5903] usb 1-1: Using ep0 maxpacket: 16
[  794.856736][ T6745] usb 2-1: New USB device found, idVendor=082d, idProduct=0100, bcdDevice=70.4b
[  794.866243][ T5903] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  794.866278][ T5903] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0
[  794.866300][ T5903] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0
[  794.866334][ T5903] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 576
[  794.866358][ T5903] usb 1-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 22
[  794.872243][ T5903] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  794.880330][ T6745] usb 2-1: New USB device strings: Mfr=44, Product=2, SerialNumber=3
[  794.940635][ T5903] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1
[  794.945293][ T6745] usb 2-1: Product: syz
[  794.975153][ T6745] usb 2-1: Manufacturer: syz
[  794.980146][ T6745] usb 2-1: SerialNumber: syz
[  794.986579][ T5903] usb 1-1: SerialNumber: syz
[  795.009203][T16457] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22
[  795.046480][ T5903] cdc_acm 1-1:1.0: Control and data interfaces are not separated!
[  795.098220][ T5903] cdc_acm 1-1:1.0: probe with driver cdc_acm failed with error -12
[  795.175772][T16476] netlink: 'syz.5.2907': attribute type 1 has an invalid length.
[  795.705406][ T6745] usb 2-1: Handspring Visor / Palm OS: port 0, is for Generic use
[  795.713381][ T6745] usb 2-1: Handspring Visor / Palm OS: port 0, is for Generic use
[  795.777870][ T5903] usb 1-1: USB disconnect, device number 47
[  795.925753][ T6745] usb 2-1: Handspring Visor / Palm OS: Number of ports: 2
[  796.227718][ T6745] usb 2-1: palm_os_3_probe - error -71 getting bytes available request
[  796.253758][ T6745] visor 2-1:1.0: Handspring Visor / Palm OS converter detected
[  796.305886][ T6745] usb 2-1: Handspring Visor / Palm OS converter now attached to ttyUSB0
[  796.356548][ T6745] usb 2-1: Handspring Visor / Palm OS converter now attached to ttyUSB1
[  796.410457][ T6745] usb 2-1: USB disconnect, device number 27
[  796.456862][ T6745] visor ttyUSB0: Handspring Visor / Palm OS converter now disconnected from ttyUSB0
[  796.515802][ T6745] visor ttyUSB1: Handspring Visor / Palm OS converter now disconnected from ttyUSB1
[  796.553258][ T6745] visor 2-1:1.0: device disconnected
[  796.634743][T16118] veth0_vlan: entered promiscuous mode
[  796.729096][T16118] veth1_vlan: entered promiscuous mode
[  796.800507][T16502] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2911'.
[  797.368307][T16498] 9pnet_fd: Insufficient options for proto=fd
[  797.499621][T16118] veth0_macvtap: entered promiscuous mode
[  797.625543][ T6745] usb 2-1: new high-speed USB device number 28 using dummy_hcd
[  797.664429][T16118] veth1_macvtap: entered promiscuous mode
[  797.763877][T16118] batman_adv: batadv0: Interface activated: batadv_slave_0
[  797.782881][T16118] batman_adv: batadv0: Interface activated: batadv_slave_1
[  797.795121][ T6745] usb 2-1: device descriptor read/64, error -71
[  797.814022][T16118] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  797.830089][T16118] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  797.849327][T16118] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  798.732952][T16118] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  798.865533][ T6745] usb 2-1: new high-speed USB device number 29 using dummy_hcd
[  799.095061][ T6745] usb 2-1: device descriptor read/64, error -71
[  799.706999][ T6745] usb usb2-port1: attempt power cycle
[  799.797857][ T6813] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  799.818833][ T6813] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  800.201763][T16530] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.2919'.
[  800.543619][T16523] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2916'.
[  800.566888][ T6822] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  800.575327][T16523] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2916'.
[  800.584491][T16523] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2916'.
[  800.593931][T16523] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2916'.
[  800.641354][ T6822] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  800.767307][T16535] netlink: 'syz.0.2922': attribute type 4 has an invalid length.
[  801.312323][T16535] netlink: 16186 bytes leftover after parsing attributes in process `syz.0.2922'.
[  801.323105][T16535] netlink: 16186 bytes leftover after parsing attributes in process `syz.0.2922'.
[  801.542555][T16542] syz.4.2842: attempt to access beyond end of device
[  801.542555][T16542] nbd4: rw=6144, sector=128, nr_sectors = 8 limit=0
[  801.557329][T16542] gfs2: error -5 reading superblock
[  802.665113][T16546] 9pnet_fd: Insufficient options for proto=fd
[  804.473210][T16565] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2928'.
[  805.305955][ T6744] usb 1-1: new high-speed USB device number 48 using dummy_hcd
[  805.821769][ T6744] usb 1-1: device descriptor read/64, error -71
[  806.360988][ T6744] usb 1-1: new high-speed USB device number 49 using dummy_hcd
[  806.506801][ T6744] usb 1-1: device descriptor read/64, error -71
[  806.692307][ T6744] usb usb1-port1: attempt power cycle
[  808.292335][T15008] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  808.366046][T14734] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[  808.383378][T14734] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[  808.384150][T16589] FAULT_INJECTION: forcing a failure.
[  808.384150][T16589] name failslab, interval 1, probability 0, space 0, times 0
[  808.417109][T14734] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[  808.425117][T14734] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[  808.434004][T14734] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[  808.515210][T16589] CPU: 1 UID: 0 PID: 16589 Comm: syz.0.2934 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) 
[  808.515239][T16589] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  808.515251][T16589] Call Trace:
[  808.515261][T16589]  <TASK>
[  808.515272][T16589]  dump_stack_lvl+0x189/0x250
[  808.515300][T16589]  ? __pfx____ratelimit+0x10/0x10
[  808.515321][T16589]  ? __pfx_dump_stack_lvl+0x10/0x10
[  808.515344][T16589]  ? __pfx__printk+0x10/0x10
[  808.515375][T16589]  ? __pfx___might_resched+0x10/0x10
[  808.515401][T16589]  ? fs_reclaim_acquire+0x7d/0x100
[  808.515429][T16589]  should_fail_ex+0x414/0x560
[  808.515451][T16589]  should_failslab+0xa8/0x100
[  808.515470][T16589]  kmem_cache_alloc_noprof+0x73/0x3c0
[  808.515483][T16589]  ? skb_clone+0x212/0x3a0
[  808.515500][T16589]  skb_clone+0x212/0x3a0
[  808.515512][T16589]  ? nfnetlink_rcv+0x486/0x2520
[  808.515532][T16589]  nfnetlink_rcv+0x4b4/0x2520
[  808.515550][T16589]  ? unwind_get_return_address+0x4d/0x90
[  808.515570][T16589]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[  808.515604][T16589]  ? stack_trace_save+0x9c/0xe0
[  808.515628][T16589]  ? stack_depot_save_flags+0x40/0x900
[  808.515652][T16589]  ? __pfx_nfnetlink_rcv+0x10/0x10
[  808.515682][T16589]  ? __lock_acquire+0xab9/0xd20
[  808.515720][T16589]  ? __lock_acquire+0xab9/0xd20
[  808.515742][T16589]  ? netlink_deliver_tap+0x2e/0x1b0
[  808.515767][T16589]  ? netlink_deliver_tap+0x2e/0x1b0
[  808.515787][T16589]  ? netlink_deliver_tap+0x2e/0x1b0
[  808.515820][T16589]  netlink_unicast+0x75c/0x8e0
[  808.515851][T16589]  netlink_sendmsg+0x805/0xb30
[  808.515887][T16589]  ? __pfx_netlink_sendmsg+0x10/0x10
[  808.515919][T16589]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  808.515933][T16589]  ? __pfx_netlink_sendmsg+0x10/0x10
[  808.515953][T16589]  __sock_sendmsg+0x21c/0x270
[  808.515973][T16589]  ____sys_sendmsg+0x505/0x830
[  808.516003][T16589]  ? __pfx_____sys_sendmsg+0x10/0x10
[  808.516038][T16589]  ? import_iovec+0x74/0xa0
[  808.516066][T16589]  ___sys_sendmsg+0x21f/0x2a0
[  808.516098][T16589]  ? __pfx____sys_sendmsg+0x10/0x10
[  808.516183][T16589]  ? __fget_files+0x2a/0x420
[  808.516204][T16589]  ? __fget_files+0x3a0/0x420
[  808.516237][T16589]  __x64_sys_sendmsg+0x19b/0x260
[  808.516270][T16589]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  808.516308][T16589]  ? __pfx_ksys_write+0x10/0x10
[  808.516325][T16589]  ? rcu_is_watching+0x15/0xb0
[  808.516351][T16589]  ? do_syscall_64+0xbe/0x3b0
[  808.516377][T16589]  do_syscall_64+0xfa/0x3b0
[  808.516397][T16589]  ? lockdep_hardirqs_on+0x9c/0x150
[  808.516418][T16589]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  808.516437][T16589]  ? clear_bhb_loop+0x60/0xb0
[  808.516461][T16589]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  808.516480][T16589] RIP: 0033:0x7efcfdd8ebe9
[  808.516498][T16589] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  808.516516][T16589] RSP: 002b:00007efcfeb0f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  808.516536][T16589] RAX: ffffffffffffffda RBX: 00007efcfdfb5fa0 RCX: 00007efcfdd8ebe9
[  808.516551][T16589] RDX: 0000000000040000 RSI: 0000200000000d00 RDI: 0000000000000003
[  808.516563][T16589] RBP: 00007efcfeb0f090 R08: 0000000000000000 R09: 0000000000000000
[  808.516576][T16589] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  808.516587][T16589] R13: 00007efcfdfb6038 R14: 00007efcfdfb5fa0 R15: 00007ffcaec851f8
[  808.516619][T16589]  </TASK>
[  808.547232][T16585] lo speed is unknown, defaulting to 1000
[  808.691450][ T1302] ieee802154 phy0 wpan0: encryption failed: -22
[  808.980290][T15008] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  809.049495][T16592] netlink: 'syz.0.2935': attribute type 5 has an invalid length.
[  809.133522][T15008] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  809.177768][T16599] smb3: Unexpected value for 'rdma'
[  809.267383][T16597] 9pnet_fd: Insufficient options for proto=fd
[  809.345333][T15008] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  810.277905][T16613] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2941'.
[  810.527711][T14734] Bluetooth: hci3: command tx timeout
[  811.163255][ T6745] usb 1-1: new high-speed USB device number 51 using dummy_hcd
[  811.198646][T16620] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2942'.
[  812.305380][ T6745] usb 1-1: device descriptor read/64, error -71
[  812.559035][ T6745] usb 1-1: new high-speed USB device number 52 using dummy_hcd
[  812.586801][T15008] bridge_slave_1: left allmulticast mode
[  812.593948][T15008] bridge_slave_1: left promiscuous mode
[  812.605276][T14734] Bluetooth: hci3: command tx timeout
[  812.671099][T16631] netlink: 'syz.4.2945': attribute type 9 has an invalid length.
[  812.684162][T15008] bridge0: port 2(bridge_slave_1) entered disabled state
[  812.716115][ T6745] usb 1-1: device descriptor read/64, error -71
[  812.791364][T15008] bridge_slave_0: left allmulticast mode
[  812.807937][T15008] bridge_slave_0: left promiscuous mode
[  812.814194][T15008] bridge0: port 1(bridge_slave_0) entered disabled state
[  812.826802][ T6745] usb usb1-port1: attempt power cycle
[  812.871408][T16638] netlink: 'syz.0.2948': attribute type 10 has an invalid length.
[  812.899918][T16638] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2948'.
[  813.990479][T15008] bond5 (unregistering): (slave gretap1): Releasing active interface
[  814.268606][T15008] geneve0 (unregistering): left promiscuous mode
[  814.305825][T15008] team0: Port device geneve0 removed
[  814.546844][T15008] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  814.561063][T15008] bond_slave_0: left promiscuous mode
[  814.570286][T15008] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  814.582676][T15008] bond_slave_1: left promiscuous mode
[  814.592518][T15008] bond0 (unregistering): (slave team0): Releasing backup interface
[  814.603821][T15008] team0: left promiscuous mode
[  814.609365][T15008] team_slave_0: left promiscuous mode
[  814.615627][T15008] team_slave_1: left promiscuous mode
[  814.623037][T15008] bond0 (unregistering): (slave batadv0): Releasing backup interface
[  814.635666][T15008] batadv0: left promiscuous mode
[  814.648803][T15008] bond0 (unregistering): Released all slaves
[  814.688945][T14734] Bluetooth: hci3: command tx timeout
[  814.794868][T15008] bond1 (unregistering): (slave bond2): Releasing backup interface
[  814.803858][T15008] bond2 (unregistering): left promiscuous mode
[  814.810823][T15008] bond2 (unregistering): left allmulticast mode
[  814.818322][T15008] bond1 (unregistering): Released all slaves
[  814.958338][T15008] bond2 (unregistering): Released all slaves
[  815.090663][T15008] bond3 (unregistering): (slave bond4): Releasing backup interface
[  815.100132][T15008] bond3 (unregistering): Released all slaves
[  815.233883][T15008] bond4 (unregistering): Released all slaves
[  815.252514][T15008] bond5 (unregistering): Released all slaves
[  815.307780][T16638] geneve0: entered promiscuous mode
[  815.319800][T16638] team0: Port device geneve0 added
[  815.403550][T16585] chnl_net:caif_netlink_parms(): no params data found
[  816.043697][T16585] bridge0: port 1(bridge_slave_0) entered blocking state
[  816.061629][T16663] 9pnet_fd: Insufficient options for proto=fd
[  816.088842][T16585] bridge0: port 1(bridge_slave_0) entered disabled state
[  816.112719][T16585] bridge_slave_0: entered allmulticast mode
[  816.138636][T16585] bridge_slave_0: entered promiscuous mode
[  816.287105][T16585] bridge0: port 2(bridge_slave_1) entered blocking state
[  816.327852][T16585] bridge0: port 2(bridge_slave_1) entered disabled state
[  816.384331][T16585] bridge_slave_1: entered allmulticast mode
[  816.398004][T16585] bridge_slave_1: entered promiscuous mode
[  816.796782][T14734] Bluetooth: hci3: command tx timeout
[  816.808313][T16585] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  816.949622][T16585] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  817.178816][T16585] team0: Port device team_slave_0 added
[  817.267142][T16585] team0: Port device team_slave_1 added
[  817.947573][T16585] batman_adv: batadv0: Adding interface: batadv_slave_0
[  817.965643][T16585] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  818.179416][T16585] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  818.251551][T15008] tipc: Left network mode
[  818.330234][T15008] IPVS: stopping master sync thread 12293 ...
[  818.360690][T16585] batman_adv: batadv0: Adding interface: batadv_slave_1
[  818.435052][T16585] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  818.529789][T16585] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  819.029086][T16711] netlink: 52 bytes leftover after parsing attributes in process `syz.5.2957'.
[  819.855468][ T6732] usb 6-1: new high-speed USB device number 40 using dummy_hcd
[  820.065336][ T6732] usb 6-1: device descriptor read/64, error -71
[  820.307470][T16725] IPVS: set_ctl: invalid protocol: 94 0.0.0.0:3
[  820.335335][ T6732] usb 6-1: new high-speed USB device number 41 using dummy_hcd
[  820.535051][ T6732] usb 6-1: device descriptor read/64, error -71
[  820.705520][ T6732] usb usb6-port1: attempt power cycle
[  821.091916][T16729] 9pnet_fd: Insufficient options for proto=fd
[  821.135253][ T6732] usb 6-1: new high-speed USB device number 42 using dummy_hcd
[  821.173268][T16585] hsr_slave_0: entered promiscuous mode
[  821.223973][ T6732] usb 6-1: device descriptor read/8, error -71
[  821.277488][T16585] hsr_slave_1: entered promiscuous mode
[  821.289145][T16585] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  821.315491][T16585] Cannot create hsr debugfs directory
[  821.748763][T15008] hsr_slave_0: left promiscuous mode
[  821.995890][T15008] hsr_slave_1: left promiscuous mode
[  822.019691][T15008] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  822.215031][T15008] batman_adv: batadv0: Removing interface: batadv_slave_0
[  822.388353][T15008] veth1_macvtap: left promiscuous mode
[  822.395466][T15008] veth0_macvtap: left promiscuous mode
[  822.425495][T16750] IPVS: set_ctl: invalid protocol: 1 224.0.0.2:0
[  822.434238][T15008] veth1_vlan: left promiscuous mode
[  822.442105][T15008] veth0_vlan: left promiscuous mode
[  824.608144][T16778] /dev/nullb0: Can't open blockdev
[  825.577828][T14734] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0
[  825.603310][T14734] Bluetooth: hci4: Injecting HCI hardware error event
[  825.707597][T14734] Bluetooth: hci4: hardware error 0x00
[  825.887694][T16786] 9pnet_fd: Insufficient options for proto=fd
[  826.726297][T15008] team0 (unregistering): Port device team_slave_1 removed
[  826.906705][T15008] team0 (unregistering): Port device team_slave_0 removed
[  827.510966][ T6732] lo speed is unknown, defaulting to 1000
[  827.512268][T16771] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -12
[  827.526397][T16771] platform regulatory.0: Direct firmware load for regulatory.db failed with error -12
[  827.536023][T16771] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db
[  827.730507][ T6732] infiniband syz1: ib_query_port failed (-19)
[  827.925080][T14734] Bluetooth: hci4: Opcode 0x0c03 failed: -110
[  828.067575][T16800] netlink: 52 bytes leftover after parsing attributes in process `syz.5.2974'.
[  829.165662][ T5974] usb 6-1: new high-speed USB device number 44 using dummy_hcd
[  829.305333][ T5974] usb 6-1: device descriptor read/64, error -71
[  829.625138][ T5974] usb 6-1: new high-speed USB device number 45 using dummy_hcd
[  829.765198][ T5974] usb 6-1: device descriptor read/64, error -71
[  829.877118][ T5974] usb usb6-port1: attempt power cycle
[  830.255509][ T5974] usb 6-1: new high-speed USB device number 46 using dummy_hcd
[  830.336902][ T5974] usb 6-1: device descriptor read/8, error -71
[  830.645618][ T5974] usb 6-1: new high-speed USB device number 47 using dummy_hcd
[  830.727148][ T5974] usb 6-1: device descriptor read/8, error -71
[  830.866472][T16585] netdevsim netdevsim2 netdevsim0: renamed from eth0
[  830.881866][ T5974] usb usb6-port1: unable to enumerate USB device
[  830.970557][T16823] 
: renamed from bond_slave_0 (while UP)
[  831.034042][T16585] netdevsim netdevsim2 netdevsim1: renamed from eth1
[  831.148432][T16585] netdevsim netdevsim2 netdevsim2: renamed from eth2
[  831.465676][T16585] netdevsim netdevsim2 netdevsim3: renamed from eth3
[  831.641228][T16830] IPVS: Error connecting to the multicast addr
[  831.667642][T16832] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2980'.
[  832.293381][T16852] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2983'.
[  832.317378][T16585] 8021q: adding VLAN 0 to HW filter on device bond0
[  832.324272][T16852] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2983'.
[  832.368760][T16852] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2983'.
[  832.440642][T16585] 8021q: adding VLAN 0 to HW filter on device team0
[  832.546652][ T6828] bridge0: port 1(bridge_slave_0) entered blocking state
[  832.553849][ T6828] bridge0: port 1(bridge_slave_0) entered forwarding state
[  832.643927][ T6828] bridge0: port 2(bridge_slave_1) entered blocking state
[  832.651188][ T6828] bridge0: port 2(bridge_slave_1) entered forwarding state
[  832.820396][T16859] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2984'.
[  833.785597][T16869] ALSA: mixer_oss: invalid index 40000
[  835.211924][T16895] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2990'.
[  836.096634][ T5974] usb 2-1: new high-speed USB device number 31 using dummy_hcd
[  836.265114][ T5974] usb 2-1: device descriptor read/64, error -71
[  836.516028][T16904] program syz.4.2993 is using a deprecated SCSI ioctl, please convert it to SG_IO
[  836.843423][ T5974] usb 2-1: new high-speed USB device number 32 using dummy_hcd
[  836.869744][T16585] 8021q: adding VLAN 0 to HW filter on device batadv0
[  837.032788][T16585] veth0_vlan: entered promiscuous mode
[  837.055292][ T5974] usb 2-1: device descriptor read/64, error -71
[  837.113462][T16585] veth1_vlan: entered promiscuous mode
[  837.165862][ T5974] usb usb2-port1: attempt power cycle
[  837.192789][T16908] netlink: 'syz.4.2994': attribute type 10 has an invalid length.
[  837.209760][T16585] veth0_macvtap: entered promiscuous mode
[  837.610752][T16917] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2994'.
[  837.642052][ T5974] usb 2-1: new high-speed USB device number 33 using dummy_hcd
[  837.645981][T16908] team0: Port device dummy0 added
[  837.684597][T16917] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  837.728595][T16917] batman_adv: batadv0: Removing interface: batadv_slave_0
[  838.145819][T16917] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  838.153654][T16917] batman_adv: batadv0: Removing interface: batadv_slave_1
[  838.314997][ T5974] usb 2-1: device not accepting address 33, error -71
[  838.370899][T16585] veth1_macvtap: entered promiscuous mode
[  839.243756][T16585] batman_adv: batadv0: Interface activated: batadv_slave_0
[  839.301296][T16585] batman_adv: batadv0: Interface activated: batadv_slave_1
[  839.350051][T16585] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  839.383012][T16585] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  839.412953][T16585] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  839.435536][T16585] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  840.513922][ T6822] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  840.538885][ T6822] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  840.641741][ T6822] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  840.672857][ T6822] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  840.697311][T16954] netlink: 'syz.4.3005': attribute type 1 has an invalid length.
[  840.925082][ T5935] usb 1-1: new high-speed USB device number 54 using dummy_hcd
[  841.190067][ T5935] usb 1-1: Invalid ep0 maxpacket: 9
[  841.316047][T16973] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3006'.
[  841.394461][ T5935] usb 1-1: new high-speed USB device number 55 using dummy_hcd
[  841.920875][T16976] netlink: 48 bytes leftover after parsing attributes in process `syz.5.3007'.
[  842.155198][ T5935] usb 1-1: Invalid ep0 maxpacket: 9
[  842.181753][ T5935] usb usb1-port1: attempt power cycle
[  842.195638][ T6732] usb 3-1: new high-speed USB device number 27 using dummy_hcd
[  842.241842][T16987] FAULT_INJECTION: forcing a failure.
[  842.241842][T16987] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  842.255686][T16987] CPU: 1 UID: 0 PID: 16987 Comm: syz.4.3009 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) 
[  842.255711][T16987] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  842.255724][T16987] Call Trace:
[  842.255731][T16987]  <TASK>
[  842.255740][T16987]  dump_stack_lvl+0x189/0x250
[  842.255768][T16987]  ? __pfx____ratelimit+0x10/0x10
[  842.255786][T16987]  ? __pfx_dump_stack_lvl+0x10/0x10
[  842.255806][T16987]  ? __pfx__printk+0x10/0x10
[  842.255831][T16987]  ? __might_fault+0xb0/0x130
[  842.255863][T16987]  should_fail_ex+0x414/0x560
[  842.255888][T16987]  _copy_from_user+0x2d/0xb0
[  842.255922][T16987]  core_sys_select+0x604/0xa20
[  842.255956][T16987]  ? __pfx_core_sys_select+0x10/0x10
[  842.256001][T16987]  ? __pfx_set_user_sigmask+0x10/0x10
[  842.256035][T16987]  __se_sys_pselect6+0x27a/0x300
[  842.256062][T16987]  ? __pfx___se_sys_pselect6+0x10/0x10
[  842.256082][T16987]  ? __pfx_ksys_write+0x10/0x10
[  842.256106][T16987]  ? __x64_sys_pselect6+0x21/0xf0
[  842.256130][T16987]  do_syscall_64+0xfa/0x3b0
[  842.256149][T16987]  ? lockdep_hardirqs_on+0x9c/0x150
[  842.256169][T16987]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  842.256188][T16987]  ? clear_bhb_loop+0x60/0xb0
[  842.256211][T16987]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  842.256229][T16987] RIP: 0033:0x7f1bc0b8ebe9
[  842.256247][T16987] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  842.256264][T16987] RSP: 002b:00007f1bc19e4038 EFLAGS: 00000246 ORIG_RAX: 000000000000010e
[  842.256285][T16987] RAX: ffffffffffffffda RBX: 00007f1bc0db6090 RCX: 00007f1bc0b8ebe9
[  842.256300][T16987] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000040
[  842.256313][T16987] RBP: 00007f1bc19e4090 R08: 0000000000000000 R09: 0000000000000000
[  842.256325][T16987] R10: 00002000000002c0 R11: 0000000000000246 R12: 0000000000000001
[  842.256338][T16987] R13: 00007f1bc0db6128 R14: 00007f1bc0db6090 R15: 00007ffd80424498
[  842.256370][T16987]  </TASK>
[  842.535021][ T6732] usb 3-1: device descriptor read/64, error -71
[  842.745026][ T5935] usb 1-1: new high-speed USB device number 56 using dummy_hcd
[  842.766543][ T5935] usb 1-1: Invalid ep0 maxpacket: 9
[  842.775087][ T6732] usb 3-1: new high-speed USB device number 28 using dummy_hcd
[  842.907378][ T5935] usb 1-1: new high-speed USB device number 57 using dummy_hcd
[  842.915801][ T6732] usb 3-1: device descriptor read/64, error -71
[  842.993918][ T5935] usb 1-1: Invalid ep0 maxpacket: 9
[  842.999732][ T5935] usb usb1-port1: unable to enumerate USB device
[  843.046416][ T6732] usb usb3-port1: attempt power cycle
[  843.405371][ T6732] usb 3-1: new high-speed USB device number 29 using dummy_hcd
[  843.466151][ T6732] usb 3-1: device descriptor read/8, error -71
[  843.540082][T17012] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  843.563316][T17012] netlink: 16186 bytes leftover after parsing attributes in process `syz.4.3013'.
[  843.573494][T17012] netlink: 16186 bytes leftover after parsing attributes in process `syz.4.3013'.
[  843.746411][ T6732] usb 3-1: new high-speed USB device number 30 using dummy_hcd
[  843.786265][ T6732] usb 3-1: device descriptor read/8, error -71
[  843.917318][ T6732] usb usb3-port1: unable to enumerate USB device
[  844.520270][T17032] netlink: 'syz.2.3017': attribute type 4 has an invalid length.
[  844.558243][T17032] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3017'.
[  844.770103][T15008] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  844.830704][T15008] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  855.411559][   T15] sched: DL replenish lagged too much
[  855.497178][T15008] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  857.795041][T15008] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  858.799522][ T5848] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  858.837719][ T5848] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  858.875808][ T5848] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  858.945813][ T5848] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  859.093212][ T5848] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  859.340146][T15008] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  859.499576][T15008] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  859.772042][T15008] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
[  861.165552][ T5848] Bluetooth: hci1: command tx timeout
[  861.265045][T15008] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  862.933775][T17086] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3027'.
[  863.304944][ T5848] Bluetooth: hci1: command tx timeout
[  863.607108][ T5935] usb 2-1: new high-speed USB device number 35 using dummy_hcd
[  865.325400][ T5848] Bluetooth: hci1: command tx timeout
[  865.955392][ T5935] usb 2-1: device descriptor read/64, error -71
[  867.405014][ T5848] Bluetooth: hci1: command tx timeout
[  869.026453][T17097] netlink: 'syz.5.3029': attribute type 10 has an invalid length.
[  869.144222][T17097] 8021q: adding VLAN 0 to HW filter on device team0
[  869.171709][T17097] bond0: (slave team0): Enslaving as an active interface with an up link
[  869.987440][T15008] bridge_slave_1: left allmulticast mode
[  870.124952][T15008] bridge_slave_1: left promiscuous mode
[  870.145521][ T1302] ieee802154 phy0 wpan0: encryption failed: -22
[  870.179984][T15008] bridge0: port 2(bridge_slave_1) entered disabled state
[  870.413473][T15008] bridge_slave_0: left allmulticast mode
[  870.495206][T15008] bridge_slave_0: left promiscuous mode
[  870.501035][T15008] bridge0: port 1(bridge_slave_0) entered disabled state
[  873.757921][T15008] geneve0 (unregistering): left promiscuous mode
[  873.783846][T15008] team0: Port device geneve0 removed
[  874.310480][T15008] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  874.329267][T15008] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  874.358070][T15008] bond0 (unregistering): Released all slaves
[  874.389067][T17207] @: renamed from vlan0 (while UP)
[  874.461519][T17055] chnl_net:caif_netlink_parms(): no params data found
[  885.283588][T17215] syzkaller0: entered promiscuous mode
[  885.289359][T17215] syzkaller0: entered allmulticast mode
[  887.871092][T17273] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3040'.
[  888.072204][T14734] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[  888.093236][T14734] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[  888.105947][T14734] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[  888.114759][T14734] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[  888.125616][T14734] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[  888.165086][ T6732] usb 2-1: new high-speed USB device number 37 using dummy_hcd
[  888.318029][ T6732] usb 2-1: device descriptor read/64, error -71
[  888.349378][ T5848] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[  888.371552][ T5848] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[  888.381174][ T5848] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[  888.402822][ T5848] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[  888.415526][ T5848] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[  888.595001][ T6732] usb 2-1: new high-speed USB device number 38 using dummy_hcd
[  888.736573][ T6732] usb 2-1: device descriptor read/64, error -71
[  888.861633][ T6732] usb usb2-port1: attempt power cycle
[  889.208308][T14734] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[  889.228032][T14734] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[  889.238233][T14734] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[  889.246943][T14734] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[  889.257290][T14734] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[  889.283664][ T6732] usb 2-1: new high-speed USB device number 39 using dummy_hcd
[  889.326547][ T6732] usb 2-1: device descriptor read/8, error -71
[  889.608006][ T6732] usb 2-1: new high-speed USB device number 40 using dummy_hcd
[  889.643273][ T6732] usb 2-1: device descriptor read/8, error -71
[  889.781698][ T6732] usb usb2-port1: unable to enumerate USB device
[  890.217269][ T5848] Bluetooth: hci5: command tx timeout
[  890.529399][ T5848] Bluetooth: hci6: command tx timeout
[  891.325496][T14734] Bluetooth: hci7: command tx timeout
[  892.289894][T14734] Bluetooth: hci5: command tx timeout
[  892.608053][T14734] Bluetooth: hci6: command tx timeout
[  892.690546][T14734] Bluetooth: hci2: command 0x0406 tx timeout
[  893.405337][ T5848] Bluetooth: hci7: command tx timeout
[  894.370948][ T5848] Bluetooth: hci5: command tx timeout
[  894.685072][ T5848] Bluetooth: hci6: command tx timeout
[  895.195141][ T5935] usb 2-1: new high-speed USB device number 41 using dummy_hcd
[  895.356472][ T5935] usb 2-1: Using ep0 maxpacket: 32
[  895.363820][ T5935] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  895.382888][ T5935] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  895.399401][ T5935] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40
[  895.414828][ T5935] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  895.462598][ T5935] usb 2-1: config 0 descriptor??
[  895.476264][ T5935] hub 2-1:0.0: USB hub found
[  895.485324][ T5848] Bluetooth: hci7: command tx timeout
[  895.684469][ T5935] hub 2-1:0.0: config failed, hub doesn't have any ports! (err -19)
[  896.451809][ T5848] Bluetooth: hci5: command tx timeout
[  896.765672][ T5848] Bluetooth: hci6: command tx timeout
[  897.571544][ T5848] Bluetooth: hci7: command tx timeout
[  898.285816][T17305] veth0: entered promiscuous mode
[  914.795424][ T5935] usbhid 2-1:0.0: can't add hid device: -71
[  914.801603][ T5935] usbhid 2-1:0.0: probe with driver usbhid failed with error -71
[  915.476594][ T5935] usb 2-1: USB disconnect, device number 41
[  921.013917][T17305] veth0: left promiscuous mode
[  921.371257][T15008] : left promiscuous mode
[  922.161992][T14734] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  922.199769][T14734] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  922.231864][T14734] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  922.319708][T14734] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  922.373696][T14734] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  922.501064][T14210] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  922.511545][T14210] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  922.527945][T14210] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  922.601585][T14210] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  922.609873][T14210] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  922.848890][T15008] tipc: Left network mode
[  924.261244][T15008] team0: left promiscuous mode
[  924.305065][T15008] team_slave_0: left promiscuous mode
[  924.326455][T15008] team_slave_1: left promiscuous mode
[  924.354750][T15008] batadv_slave_1: left promiscuous mode
[  924.482442][T15008] hsr_slave_0: left promiscuous mode
[  924.498929][T15008] hsr_slave_1: left promiscuous mode
[  924.511398][T15008] batman_adv: batadv0: Removing interface: batadv_slave_0
[  924.527637][ T5848] Bluetooth: hci0: command tx timeout
[  924.569667][T15008] batman_adv: batadv0: Removing interface: batadv_slave_1
[  924.686178][ T5848] Bluetooth: hci1: command tx timeout
[  925.521183][T15008] team0 (unregistering): Port device team_slave_1 removed
[  925.619987][T15008] team0 (unregistering): Port device team_slave_0 removed
[  926.609085][ T5848] Bluetooth: hci0: command tx timeout
[  926.767426][ T5848] Bluetooth: hci1: command tx timeout
[  927.943532][T17271] chnl_net:caif_netlink_parms(): no params data found
[  928.053346][T15008] IPVS: stop unused estimator thread 0...
[  928.685480][ T5848] Bluetooth: hci0: command tx timeout
[  928.795193][T17379] chnl_net:caif_netlink_parms(): no params data found
[  928.837311][T17289] chnl_net:caif_netlink_parms(): no params data found
[  928.848407][ T5848] Bluetooth: hci1: command tx timeout
[  929.304066][T17283] chnl_net:caif_netlink_parms(): no params data found
[  929.710017][T15008] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  929.729807][T17271] bridge0: port 1(bridge_slave_0) entered blocking state
[  929.739095][T17271] bridge0: port 1(bridge_slave_0) entered disabled state
[  929.746889][T17271] bridge_slave_0: entered allmulticast mode
[  929.754021][T17271] bridge_slave_0: entered promiscuous mode
[  929.808180][T17271] bridge0: port 2(bridge_slave_1) entered blocking state
[  929.823201][T17271] bridge0: port 2(bridge_slave_1) entered disabled state
[  929.831696][T17271] bridge_slave_1: entered allmulticast mode
[  929.843198][T17271] bridge_slave_1: entered promiscuous mode
[  930.008046][T15008] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  930.064209][T17289] bridge0: port 1(bridge_slave_0) entered blocking state
[  930.072516][T17289] bridge0: port 1(bridge_slave_0) entered disabled state
[  930.080312][T17289] bridge_slave_0: entered allmulticast mode
[  930.088946][T17289] bridge_slave_0: entered promiscuous mode
[  930.100933][T17271] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  930.117157][T17271] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  930.204857][T17364] chnl_net:caif_netlink_parms(): no params data found
[  930.258378][T15008] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  930.271468][T17289] bridge0: port 2(bridge_slave_1) entered blocking state
[  930.282191][T17289] bridge0: port 2(bridge_slave_1) entered disabled state
[  930.289917][T17289] bridge_slave_1: entered allmulticast mode
[  930.298175][T17289] bridge_slave_1: entered promiscuous mode
[  930.346232][T17379] bridge0: port 1(bridge_slave_0) entered blocking state
[  930.354164][T17379] bridge0: port 1(bridge_slave_0) entered disabled state
[  930.361518][T17379] bridge_slave_0: entered allmulticast mode
[  930.374578][T17379] bridge_slave_0: entered promiscuous mode
[  930.383303][T17283] bridge0: port 1(bridge_slave_0) entered blocking state
[  930.391397][T17283] bridge0: port 1(bridge_slave_0) entered disabled state
[  930.398897][T17283] bridge_slave_0: entered allmulticast mode
[  930.407022][T17283] bridge_slave_0: entered promiscuous mode
[  930.424860][T17283] bridge0: port 2(bridge_slave_1) entered blocking state
[  930.432865][T17283] bridge0: port 2(bridge_slave_1) entered disabled state
[  930.440624][T17283] bridge_slave_1: entered allmulticast mode
[  930.449327][T17283] bridge_slave_1: entered promiscuous mode
[  930.475527][T15008] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  930.552180][T17271] team0: Port device team_slave_0 added
[  930.561212][T17379] bridge0: port 2(bridge_slave_1) entered blocking state
[  930.569752][T17379] bridge0: port 2(bridge_slave_1) entered disabled state
[  930.577167][T17379] bridge_slave_1: entered allmulticast mode
[  930.584252][T17379] bridge_slave_1: entered promiscuous mode
[  930.650519][T17283] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  930.669723][T17289] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  930.684513][T17271] team0: Port device team_slave_1 added
[  930.762728][T17283] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  930.771945][ T5848] Bluetooth: hci0: command tx timeout
[  930.800198][T17289] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  930.870305][T17271] batman_adv: batadv0: Adding interface: batadv_slave_0
[  930.895178][T17271] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  930.922757][T17271] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  930.933410][ T5848] Bluetooth: hci1: command tx timeout
[  930.948370][T17379] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  931.116684][T17289] team0: Port device team_slave_0 added
[  931.123716][T17271] batman_adv: batadv0: Adding interface: batadv_slave_1
[  931.139273][T17271] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  931.174102][T17271] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  931.211441][T17379] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  931.244810][T17283] team0: Port device team_slave_0 added
[  931.274465][T17289] team0: Port device team_slave_1 added
[  931.391346][T17283] team0: Port device team_slave_1 added
[  931.452266][T17379] team0: Port device team_slave_0 added
[  931.521223][T17271] hsr_slave_0: entered promiscuous mode
[  931.530155][T17271] hsr_slave_1: entered promiscuous mode
[  931.543025][T17271] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  931.552427][T17271] Cannot create hsr debugfs directory
[  931.569707][ T1302] ieee802154 phy0 wpan0: encryption failed: -22
[  931.671323][T17289] batman_adv: batadv0: Adding interface: batadv_slave_0
[  931.681091][T17289] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  931.707357][T17289] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  931.720565][T17379] team0: Port device team_slave_1 added
[  931.759823][T17364] bridge0: port 1(bridge_slave_0) entered blocking state
[  931.769001][T17364] bridge0: port 1(bridge_slave_0) entered disabled state
[  931.778467][T17364] bridge_slave_0: entered allmulticast mode
[  931.788195][T17364] bridge_slave_0: entered promiscuous mode
[  931.798606][T17364] bridge0: port 2(bridge_slave_1) entered blocking state
[  931.806307][T17364] bridge0: port 2(bridge_slave_1) entered disabled state
[  931.813495][T17364] bridge_slave_1: entered allmulticast mode
[  931.821923][T17364] bridge_slave_1: entered promiscuous mode
[  931.849035][T17283] batman_adv: batadv0: Adding interface: batadv_slave_0
[  931.856516][T17283] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  931.883368][T17283] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  931.900251][T17289] batman_adv: batadv0: Adding interface: batadv_slave_1
[  931.907705][T17289] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  931.934191][T17289] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  932.040158][T17283] batman_adv: batadv0: Adding interface: batadv_slave_1
[  932.048954][T17283] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  932.075558][T17283] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  932.117386][T17379] batman_adv: batadv0: Adding interface: batadv_slave_0
[  932.125769][T17379] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  932.160382][T17379] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  932.173414][T17379] batman_adv: batadv0: Adding interface: batadv_slave_1
[  932.180503][T17379] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  932.208735][T17379] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  932.251820][T17364] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  932.329172][T17364] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  932.389546][T17364] team0: Port device team_slave_0 added
[  932.530440][T17364] team0: Port device team_slave_1 added
[  932.567279][T15008] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  932.602696][T17379] hsr_slave_0: entered promiscuous mode
[  932.609231][T17379] hsr_slave_1: entered promiscuous mode
[  932.618119][T17379] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  932.625794][T17379] Cannot create hsr debugfs directory
[  932.664230][T17289] hsr_slave_0: entered promiscuous mode
[  932.671035][T17289] hsr_slave_1: entered promiscuous mode
[  932.680787][T17289] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  932.688552][T17289] Cannot create hsr debugfs directory
[  932.736819][T17364] batman_adv: batadv0: Adding interface: batadv_slave_0
[  932.743801][T17364] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  932.769946][T17364] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  932.817798][T15008] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  932.837789][T17283] hsr_slave_0: entered promiscuous mode
[  932.844152][T17283] hsr_slave_1: entered promiscuous mode
[  932.852856][T17283] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  932.860504][T17283] Cannot create hsr debugfs directory
[  932.891815][T17364] batman_adv: batadv0: Adding interface: batadv_slave_1
[  932.899314][T17364] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  932.931089][T17364] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  933.022419][T15008] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  933.274042][T15008] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  933.393264][T17364] hsr_slave_0: entered promiscuous mode
[  933.406484][T17364] hsr_slave_1: entered promiscuous mode
[  933.412707][T17364] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  933.421614][T17364] Cannot create hsr debugfs directory
[  934.131391][T17271] netdevsim netdevsim6 netdevsim0: renamed from eth0
[  934.166400][T17271] netdevsim netdevsim6 netdevsim1: renamed from eth1
[  934.244836][T17271] netdevsim netdevsim6 netdevsim2: renamed from eth2
[  934.329545][T17271] netdevsim netdevsim6 netdevsim3: renamed from eth3
[  934.399145][T15008] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  934.504395][T15008] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  934.562767][T17379] netdevsim netdevsim9 netdevsim0: renamed from eth0
[  934.583167][T17379] netdevsim netdevsim9 netdevsim1: renamed from eth1
[  934.619935][T15008] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  934.643301][T17379] netdevsim netdevsim9 netdevsim2: renamed from eth2
[  934.660913][T17379] netdevsim netdevsim9 netdevsim3: renamed from eth3
[  934.703106][T15008] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  934.904351][T17289] netdevsim netdevsim7 netdevsim0: renamed from eth0
[  934.935905][T17289] netdevsim netdevsim7 netdevsim1: renamed from eth1
[  935.000804][T17289] netdevsim netdevsim7 netdevsim2: renamed from eth2
[  935.190367][T17289] netdevsim netdevsim7 netdevsim3: renamed from eth3
[  935.511216][T15008] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  935.684534][T17271] 8021q: adding VLAN 0 to HW filter on device bond0
[  935.724442][T15008] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  935.874775][T15008] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  935.904236][T17271] 8021q: adding VLAN 0 to HW filter on device team0
[  935.959455][T15008] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  935.999338][T13499] bridge0: port 1(bridge_slave_0) entered blocking state
[  936.006579][T13499] bridge0: port 1(bridge_slave_0) entered forwarding state
[  936.026762][T13499] bridge0: port 2(bridge_slave_1) entered blocking state
[  936.034034][T13499] bridge0: port 2(bridge_slave_1) entered forwarding state
[  936.113963][T17379] 8021q: adding VLAN 0 to HW filter on device bond0
[  936.313899][T17379] 8021q: adding VLAN 0 to HW filter on device team0
[  936.330294][T17364] netdevsim netdevsim0 netdevsim0: renamed from eth0
[  936.343804][T17364] netdevsim netdevsim0 netdevsim1: renamed from eth1
[  936.488544][T17364] netdevsim netdevsim0 netdevsim2: renamed from eth2
[  936.514275][T17364] netdevsim netdevsim0 netdevsim3: renamed from eth3
[  936.557453][T13499] bridge0: port 1(bridge_slave_0) entered blocking state
[  936.564710][T13499] bridge0: port 1(bridge_slave_0) entered forwarding state
[  936.664812][T17289] 8021q: adding VLAN 0 to HW filter on device bond0
[  936.743621][T13499] bridge0: port 2(bridge_slave_1) entered blocking state
[  936.750921][T13499] bridge0: port 2(bridge_slave_1) entered forwarding state
[  936.782916][T15008] bridge_slave_1: left allmulticast mode
[  936.794428][T15008] bridge_slave_1: left promiscuous mode
[  936.809154][T15008] bridge0: port 2(bridge_slave_1) entered disabled state
[  936.831390][T15008] bridge_slave_0: left allmulticast mode
[  936.839682][T15008] bridge_slave_0: left promiscuous mode
[  936.851105][T15008] bridge0: port 1(bridge_slave_0) entered disabled state
[  936.873158][T15008] bridge_slave_1: left allmulticast mode
[  936.884193][T15008] bridge_slave_1: left promiscuous mode
[  936.898494][T15008] bridge0: port 2(bridge_slave_1) entered disabled state
[  936.914791][T15008] bridge_slave_0: left allmulticast mode
[  936.923715][T15008] bridge_slave_0: left promiscuous mode
[  936.931336][T15008] bridge0: port 1(bridge_slave_0) entered disabled state
[  936.943793][T15008] bridge_slave_1: left allmulticast mode
[  936.951118][T15008] bridge_slave_1: left promiscuous mode
[  936.958667][T15008] bridge0: port 2(bridge_slave_1) entered disabled state
[  936.968960][T15008] bridge_slave_0: left allmulticast mode
[  936.974738][T15008] bridge_slave_0: left promiscuous mode
[  936.981623][T15008] bridge0: port 1(bridge_slave_0) entered disabled state
[  937.002852][T15008] bridge_slave_1: left allmulticast mode
[  937.021951][T15008] bridge_slave_1: left promiscuous mode
[  937.028960][T15008] bridge0: port 2(bridge_slave_1) entered disabled state
[  937.046029][T15008] bridge_slave_0: left allmulticast mode
[  937.051734][T15008] bridge_slave_0: left promiscuous mode
[  937.064723][T15008] bridge0: port 1(bridge_slave_0) entered disabled state
[  937.350198][T15008] bond0 (unregistering): Released all slaves
[  937.724591][T15008] bond0 (unregistering): (slave 
3
0
): Releasing backup interface
[  937.736097][T15008] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  937.746076][T15008] bond0 (unregistering): Released all slaves
[  938.119516][T15008] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  938.133875][T15008] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  938.144424][T15008] bond0 (unregistering): Released all slaves
[  938.512921][T15008] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  938.523895][T15008] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  938.534421][T15008] bond0 (unregistering): Released all slaves
[  938.890956][T15008] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  938.902622][T15008] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  938.913213][T15008] bond0 (unregistering): (slave team0): Releasing backup interface
[  938.923000][T15008] bond0 (unregistering): Released all slaves
[  938.938887][T15008] bond1 (unregistering): Released all slaves
[  939.223937][T17283] netdevsim netdevsim8 netdevsim0: renamed from eth0
[  939.292941][T17289] 8021q: adding VLAN 0 to HW filter on device team0
[  939.302554][T15008] tipc: Left network mode
[  939.321338][T17283] netdevsim netdevsim8 netdevsim1: renamed from eth1
[  939.361694][T17283] netdevsim netdevsim8 netdevsim2: renamed from eth2
[  939.381755][T17283] netdevsim netdevsim8 netdevsim3: renamed from eth3
[  939.400182][ T6816] bridge0: port 1(bridge_slave_0) entered blocking state
[  939.407387][ T6816] bridge0: port 1(bridge_slave_0) entered forwarding state
[  939.486152][ T6828] bridge0: port 2(bridge_slave_1) entered blocking state
[  939.493323][ T6828] bridge0: port 2(bridge_slave_1) entered forwarding state
[  939.505950][T17271] 8021q: adding VLAN 0 to HW filter on device batadv0
[  940.262556][T17364] 8021q: adding VLAN 0 to HW filter on device bond0
[  940.401972][T17364] 8021q: adding VLAN 0 to HW filter on device team0
[  940.468588][T17283] 8021q: adding VLAN 0 to HW filter on device bond0
[  940.523003][T17271] veth0_vlan: entered promiscuous mode
[  940.567959][T17379] 8021q: adding VLAN 0 to HW filter on device batadv0
[  940.589531][ T6828] bridge0: port 1(bridge_slave_0) entered blocking state
[  940.596863][ T6828] bridge0: port 1(bridge_slave_0) entered forwarding state
[  940.777883][T17271] veth1_vlan: entered promiscuous mode
[  940.865488][ T6822] bridge0: port 2(bridge_slave_1) entered blocking state
[  940.872683][ T6822] bridge0: port 2(bridge_slave_1) entered forwarding state
[  940.902894][T17283] 8021q: adding VLAN 0 to HW filter on device team0
[  940.932142][ T6828] bridge0: port 1(bridge_slave_0) entered blocking state
[  940.939360][ T6828] bridge0: port 1(bridge_slave_0) entered forwarding state
[  941.053934][   T49] bridge0: port 2(bridge_slave_1) entered blocking state
[  941.061192][   T49] bridge0: port 2(bridge_slave_1) entered forwarding state
[  941.180974][T17271] veth0_macvtap: entered promiscuous mode
[  941.265918][T17289] 8021q: adding VLAN 0 to HW filter on device batadv0
[  941.339720][T17271] veth1_macvtap: entered promiscuous mode
[  941.463868][T17271] batman_adv: batadv0: Interface activated: batadv_slave_0
[  941.504591][T15008] hsr_slave_0: left promiscuous mode
[  941.513819][T15008] hsr_slave_1: left promiscuous mode
[  941.528469][T15008] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  941.542619][T15008] batman_adv: batadv0: Removing interface: batadv_slave_0
[  941.553505][T15008] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  941.573934][T15008] batman_adv: batadv0: Removing interface: batadv_slave_1
[  941.599580][T15008] hsr_slave_0: left promiscuous mode
[  941.606094][T15008] hsr_slave_1: left promiscuous mode
[  941.611894][T15008] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  941.619637][T15008] batman_adv: batadv0: Removing interface: batadv_slave_0
[  941.627541][T15008] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  941.635163][T15008] batman_adv: batadv0: Removing interface: batadv_slave_1
[  941.649264][T15008] hsr_slave_0: left promiscuous mode
[  941.655587][T15008] hsr_slave_1: left promiscuous mode
[  941.664540][T15008] hsr_slave_0: left promiscuous mode
[  941.671172][T15008] hsr_slave_1: left promiscuous mode
[  941.678043][T15008] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  941.686728][T15008] batman_adv: batadv0: Removing interface: batadv_slave_0
[  941.694526][T15008] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  941.702214][T15008] batman_adv: batadv0: Removing interface: batadv_slave_1
[  941.720448][T15008] 
[  941.722825][T15008] ======================================================
[  941.729825][T15008] WARNING: possible circular locking dependency detected
[  941.736843][T15008] 6.16.0-syzkaller #0 Not tainted
[  941.741854][T15008] ------------------------------------------------------
[  941.748930][T15008] kworker/u8:2/15008 is trying to acquire lock:
[  941.755162][T15008] ffff88807e3bce00 (team->team_lock_key#8){+.+.}-{4:4}, at: team_device_event+0x182/0xa20
[  941.765084][T15008] 
[  941.765084][T15008] but task is already holding lock:
[  941.772501][T15008] ffff888076b56d30 (&dev_instance_lock_key#3){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0x5a1/0x2320
[  941.784110][T15008] 
[  941.784110][T15008] which lock already depends on the new lock.
[  941.784110][T15008] 
[  941.794514][T15008] 
[  941.794514][T15008] the existing dependency chain (in reverse order) is:
[  941.803531][T15008] 
[  941.803531][T15008] -> #1 (&dev_instance_lock_key#3){+.+.}-{4:4}:
[  941.811951][T15008]        lock_acquire+0x120/0x360
[  941.816978][T15008]        __mutex_lock+0x182/0xe80
[  941.821990][T15008]        dev_set_mtu+0x10e/0x260
[  941.826931][T15008]        team_add_slave+0x8b8/0x2840
[  941.832236][T15008]        do_set_master+0x530/0x6d0
[  941.837373][T15008]        do_setlink+0xcf0/0x41c0
[  941.842312][T15008]        rtnl_newlink+0x160b/0x1c70
[  941.847510][T15008]        rtnetlink_rcv_msg+0x7cc/0xb70
[  941.852965][T15008]        netlink_rcv_skb+0x205/0x470
[  941.858251][T15008]        netlink_unicast+0x75c/0x8e0
[  941.863531][T15008]        netlink_sendmsg+0x805/0xb30
[  941.868815][T15008]        __sock_sendmsg+0x21c/0x270
[  941.874010][T15008]        ____sys_sendmsg+0x505/0x830
[  941.879304][T15008]        ___sys_sendmsg+0x21f/0x2a0
[  941.884508][T15008]        __x64_sys_sendmsg+0x19b/0x260
[  941.889971][T15008]        do_syscall_64+0xfa/0x3b0
[  941.894991][T15008]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  941.901402][T15008] 
[  941.901402][T15008] -> #0 (team->team_lock_key#8){+.+.}-{4:4}:
[  941.909615][T15008]        validate_chain+0xb9b/0x2140
[  941.914898][T15008]        __lock_acquire+0xab9/0xd20
[  941.920090][T15008]        lock_acquire+0x120/0x360
[  941.925127][T15008]        __mutex_lock+0x182/0xe80
[  941.930155][T15008]        team_device_event+0x182/0xa20
[  941.935614][T15008]        notifier_call_chain+0x1b3/0x3e0
[  941.941243][T15008]        dev_close_many+0x29c/0x410
[  941.946438][T15008]        unregister_netdevice_many_notify+0x619/0x2320
[  941.953280][T15008]        default_device_exit_batch+0x819/0x890
[  941.959434][T15008]        ops_undo_list+0x522/0x990
[  941.964549][T15008]        cleanup_net+0x4c5/0x800
[  941.969484][T15008]        process_scheduled_works+0xade/0x17b0
[  941.975545][T15008]        worker_thread+0x8a0/0xda0
[  941.980661][T15008]        kthread+0x70e/0x8a0
[  941.985335][T15008]        ret_from_fork+0x3fc/0x770
[  941.990438][T15008]        ret_from_fork_asm+0x1a/0x30
[  941.995719][T15008] 
[  941.995719][T15008] other info that might help us debug this:
[  941.995719][T15008] 
[  942.005936][T15008]  Possible unsafe locking scenario:
[  942.005936][T15008] 
[  942.013413][T15008]        CPU0                    CPU1
[  942.018772][T15008]        ----                    ----
[  942.024128][T15008]   lock(&dev_instance_lock_key#3);
[  942.029336][T15008]                                lock(team->team_lock_key#8);
[  942.036798][T15008]                                lock(&dev_instance_lock_key#3);
[  942.044532][T15008]   lock(team->team_lock_key#8);
[  942.049476][T15008] 
[  942.049476][T15008]  *** DEADLOCK ***
[  942.049476][T15008] 
[  942.057615][T15008] 9 locks held by kworker/u8:2/15008:
[  942.062978][T15008]  #0: ffff88801b2fb948 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0
[  942.073867][T15008]  #1: ffffc9000c797bc0 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0
[  942.084407][T15008]  #2: ffffffff8f4fd310 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf7/0x800
[  942.093729][T15008]  #3: ffffffff8f509f08 (rtnl_mutex){+.+.}-{4:4}, at: default_device_exit_batch+0xdc/0x890
[  942.103748][T15008]  #4: ffff888078a64d30 (&dev_instance_lock_key#3){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0x5a1/0x2320
[  942.115769][T15008]  #5: ffff88805a392d30 (&dev_instance_lock_key#3){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0x5a1/0x2320
[  942.127792][T15008]  #6: ffff88807da38d30 (&dev_instance_lock_key#3){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0x5a1/0x2320
[  942.139813][T15008]  #7: ffff88807c15ad30 (&dev_instance_lock_key#3){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0x5a1/0x2320
[  942.151834][T15008]  #8: ffff888076b56d30 (&dev_instance_lock_key#3){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0x5a1/0x2320
[  942.163863][T15008] 
[  942.163863][T15008] stack backtrace:
[  942.169745][T15008] CPU: 1 UID: 0 PID: 15008 Comm: kworker/u8:2 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) 
[  942.169765][T15008] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  942.169777][T15008] Workqueue: netns cleanup_net
[  942.169803][T15008] Call Trace:
[  942.169812][T15008]  <TASK>
[  942.169820][T15008]  dump_stack_lvl+0x189/0x250
[  942.169841][T15008]  ? __pfx_dump_stack_lvl+0x10/0x10
[  942.169859][T15008]  ? __pfx__printk+0x10/0x10
[  942.169880][T15008]  ? print_lock_name+0xde/0x100
[  942.169901][T15008]  print_circular_bug+0x2ee/0x310
[  942.169923][T15008]  check_noncircular+0x134/0x160
[  942.169944][T15008]  validate_chain+0xb9b/0x2140
[  942.169965][T15008]  ? __lock_acquire+0xab9/0xd20
[  942.169985][T15008]  __lock_acquire+0xab9/0xd20
[  942.170002][T15008]  ? team_device_event+0x182/0xa20
[  942.170017][T15008]  lock_acquire+0x120/0x360
[  942.170031][T15008]  ? team_device_event+0x182/0xa20
[  942.170054][T15008]  ? _raw_spin_unlock_irqrestore+0x85/0x110
[  942.170082][T15008]  __mutex_lock+0x182/0xe80
[  942.170099][T15008]  ? team_device_event+0x182/0xa20
[  942.170117][T15008]  ? __try_to_del_timer_sync+0x34a/0x3a0
[  942.170138][T15008]  ? team_device_event+0x182/0xa20
[  942.170154][T15008]  ? __pfx___mutex_lock+0x10/0x10
[  942.170171][T15008]  ? __timer_delete_sync+0x218/0x2d0
[  942.170199][T15008]  team_device_event+0x182/0xa20
[  942.170216][T15008]  notifier_call_chain+0x1b3/0x3e0
[  942.170237][T15008]  dev_close_many+0x29c/0x410
[  942.170258][T15008]  ? __lock_acquire+0xab9/0xd20
[  942.170273][T15008]  ? __pfx_dev_close_many+0x10/0x10
[  942.170297][T15008]  unregister_netdevice_many_notify+0x619/0x2320
[  942.170318][T15008]  ? __local_bh_enable_ip+0x12d/0x1c0
[  942.170336][T15008]  ? __local_bh_enable_ip+0x12d/0x1c0
[  942.170353][T15008]  ? __pfx_unregister_netdevice_many_notify+0x10/0x10
[  942.170376][T15008]  ? unregister_netdevice_queue+0x1b3/0x380
[  942.170396][T15008]  ? batadv_meshif_destroy_netlink+0x1dd/0x270
[  942.170420][T15008]  default_device_exit_batch+0x819/0x890
[  942.170445][T15008]  ? __pfx___might_resched+0x10/0x10
[  942.170463][T15008]  ? __pfx_default_device_exit_batch+0x10/0x10
[  942.170486][T15008]  ? __pfx_rdma_dev_exit_net+0x10/0x10
[  942.170506][T15008]  ? net_generic+0x1e/0x240
[  942.170525][T15008]  ? __pfx_default_device_exit_batch+0x10/0x10
[  942.170547][T15008]  ops_undo_list+0x522/0x990
[  942.170572][T15008]  ? __pfx_ops_undo_list+0x10/0x10
[  942.170597][T15008]  cleanup_net+0x4c5/0x800
[  942.170620][T15008]  ? __pfx_cleanup_net+0x10/0x10
[  942.170643][T15008]  ? _raw_spin_unlock_irq+0x23/0x50
[  942.170657][T15008]  ? process_scheduled_works+0x9ef/0x17b0
[  942.170674][T15008]  ? process_scheduled_works+0x9ef/0x17b0
[  942.170692][T15008]  process_scheduled_works+0xade/0x17b0
[  942.170719][T15008]  ? __pfx_process_scheduled_works+0x10/0x10
[  942.170742][T15008]  worker_thread+0x8a0/0xda0
[  942.170761][T15008]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  942.170789][T15008]  ? __kthread_parkme+0x7b/0x200
[  942.170810][T15008]  kthread+0x70e/0x8a0
[  942.170832][T15008]  ? __pfx_worker_thread+0x10/0x10
[  942.170849][T15008]  ? __pfx_kthread+0x10/0x10
[  942.170870][T15008]  ? _raw_spin_unlock_irq+0x23/0x50
[  942.170884][T15008]  ? lockdep_hardirqs_on+0x9c/0x150
[  942.170900][T15008]  ? __pfx_kthread+0x10/0x10
[  942.170920][T15008]  ret_from_fork+0x3fc/0x770
[  942.170936][T15008]  ? __pfx_ret_from_fork+0x10/0x10
[  942.170954][T15008]  ? __switch_to_asm+0x39/0x70
[  942.170972][T15008]  ? __switch_to_asm+0x33/0x70
[  942.170991][T15008]  ? __pfx_kthread+0x10/0x10
[  942.171012][T15008]  ret_from_fork_asm+0x1a/0x30
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[  942.171037][T15008]  </TASK>
[  942.549885][T15008] veth1_macvtap: left promiscuous mode
[  942.557908][T15008] veth0_macvtap: left promiscuous mode
[  942.563521][T15008] veth1_vlan: left promiscuous mode
[  942.569209][T15008] veth0_vlan: left promiscuous mode
[  942.594354][T15008] veth1_macvtap: left promiscuous mode
[  942.600841][T15008] veth0_macvtap: left promiscuous mode
[  942.606976][T15008] veth1_vlan: left promiscuous mode
[  942.612305][T15008] veth0_vlan: left promiscuous mode
[  942.618940][T15008] veth1_macvtap: left promiscuous mode
[  942.624477][T15008] veth0_macvtap: left promiscuous mode
[  942.630973][T15008] veth1_vlan: left promiscuous mode
[  942.638101][T15008] veth0_vlan: left promiscuous mode
[  942.644127][T15008] veth1_macvtap: left promiscuous mode
[  942.651499][T15008] veth0_macvtap: left promiscuous mode
[  942.657058][T15008] veth1_vlan: left promiscuous mode
[  942.662286][T15008] veth0_vlan: left promiscuous mode
[  942.936931][T15008] team0 (unregistering): Port device team_slave_1 removed
[  942.971695][T15008] team0 (unregistering): Port device team_slave_0 removed
[  943.210048][T15008] team0 (unregistering): Port device team_slave_1 removed
[  943.236340][T15008] team0 (unregistering): Port device team_slave_0 removed
[  943.476716][T15008] team0 (unregistering): Port device team_slave_1 removed
[  943.491877][T15008] team0 (unregistering): Port device team_slave_0 removed
[  943.630030][T15008] team0 (unregistering): Port device dummy0 removed
[  943.772098][T15008] team0 (unregistering): Port device team_slave_1 removed
[  943.787851][T15008] team0 (unregistering): Port device team_slave_0 removed
[  946.825066][T15008] bridge_slave_1: left allmulticast mode
[  946.831754][T15008] bridge_slave_1: left promiscuous mode
[  946.838642][T15008] bridge0: port 2(bridge_slave_1) entered disabled state
[  946.850394][T15008] bridge_slave_0: left allmulticast mode
[  946.857133][T15008] bridge_slave_0: left promiscuous mode
[  946.862897][T15008] bridge0: port 1(bridge_slave_0) entered disabled state
[  946.872973][T15008] bridge_slave_1: left allmulticast mode
[  946.878821][T15008] bridge_slave_1: left promiscuous mode
[  946.884462][T15008] bridge0: port 2(bridge_slave_1) entered disabled state
[  946.894636][T15008] bridge_slave_0: left allmulticast mode
[  946.900484][T15008] bridge_slave_0: left promiscuous mode
[  946.908627][T15008] bridge0: port 1(bridge_slave_0) entered disabled state
[  946.917740][T15008] bridge_slave_1: left allmulticast mode
[  946.923402][T15008] bridge_slave_1: left promiscuous mode
[  946.930839][T15008] bridge0: port 2(bridge_slave_1) entered disabled state
[  946.939212][T15008] bridge_slave_0: left allmulticast mode
[  946.945181][T15008] bridge_slave_0: left promiscuous mode
[  946.950890][T15008] bridge0: port 1(bridge_slave_0) entered disabled state
[  946.959865][T15008] bridge_slave_1: left allmulticast mode
[  946.965950][T15008] bridge_slave_1: left promiscuous mode
[  946.971606][T15008] bridge0: port 2(bridge_slave_1) entered disabled state
[  946.980424][T15008] bridge_slave_0: left allmulticast mode
[  946.986304][T15008] bridge_slave_0: left promiscuous mode
[  946.991972][T15008] bridge0: port 1(bridge_slave_0) entered disabled state
[  947.001014][T15008] bridge_slave_1: left allmulticast mode
[  947.006841][T15008] bridge_slave_1: left promiscuous mode
[  947.012485][T15008] bridge0: port 2(bridge_slave_1) entered disabled state
[  947.021347][T15008] bridge_slave_0: left allmulticast mode
[  947.027246][T15008] bridge_slave_0: left promiscuous mode
[  947.032878][T15008] bridge0: port 1(bridge_slave_0) entered disabled state
[  947.152426][T15008] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  947.163115][T15008] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  947.172863][T15008] bond0 (unregistering): Released all slaves
[  947.243218][T15008] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  947.253384][T15008] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  947.263079][T15008] bond0 (unregistering): Released all slaves
[  947.335072][T15008] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  947.344710][T15008] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  947.355205][T15008] bond0 (unregistering): Released all slaves
[  947.445660][T15008] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  947.456421][T15008] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  947.467515][T15008] bond0 (unregistering): Released all slaves
[  947.529915][T15008] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  947.540494][T15008] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  947.550072][T15008] bond0 (unregistering): Released all slaves
[  947.691088][T15008] hsr_slave_0: left promiscuous mode
[  947.699460][T15008] hsr_slave_1: left promiscuous mode
[  947.705674][T15008] batman_adv: batadv0: Removing interface: batadv_slave_0
[  947.713716][T15008] batman_adv: batadv0: Removing interface: batadv_slave_1
[  947.727729][T15008] hsr_slave_0: left promiscuous mode
[  947.737255][T15008] hsr_slave_1: left promiscuous mode
[  947.742894][T15008] batman_adv: batadv0: Removing interface: batadv_slave_0
[  947.767347][T15008] batman_adv: batadv0: Removing interface: batadv_slave_1
[  947.779961][T15008] hsr_slave_0: left promiscuous mode
[  947.787978][T15008] hsr_slave_1: left promiscuous mode
[  947.795470][T15008] batman_adv: batadv0: Removing interface: batadv_slave_0
[  947.803269][T15008] batman_adv: batadv0: Removing interface: batadv_slave_1
[  947.822194][T15008] hsr_slave_0: left promiscuous mode
[  947.828428][T15008] hsr_slave_1: left promiscuous mode
[  947.834276][T15008] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  947.848920][T15008] batman_adv: batadv0: Removing interface: batadv_slave_0
[  947.861863][T15008] batman_adv: batadv0: Removing interface: batadv_slave_1
[  947.872756][T15008] hsr_slave_0: left promiscuous mode
[  947.880367][T15008] hsr_slave_1: left promiscuous mode
[  947.888742][T15008] batman_adv: batadv0: Removing interface: batadv_slave_0
[  947.898212][T15008] batman_adv: batadv0: Removing interface: batadv_slave_1
[  947.925616][T15008] veth1_macvtap: left promiscuous mode
[  947.931245][T15008] veth0_macvtap: left promiscuous mode
[  947.946606][T15008] veth1_vlan: left promiscuous mode
[  947.951965][T15008] veth0_vlan: left promiscuous mode
[  948.292597][T15008] team0 (unregistering): Port device team_slave_1 removed
[  948.334247][T15008] team0 (unregistering): Port device team_slave_0 removed
[  948.507307][T15008] team0 (unregistering): Port device team_slave_1 removed
[  948.518778][T15008] team0 (unregistering): Port device team_slave_0 removed
[  948.706763][T15008] team0 (unregistering): Port device team_slave_1 removed
[  948.734519][T15008] team0 (unregistering): Port device team_slave_0 removed
[  948.923474][T15008] team0 (unregistering): Port device team_slave_1 removed
[  948.950358][T15008] team0 (unregistering): Port device team_slave_0 removed
[  949.134179][T15008] team0 (unregistering): Port device team_slave_1 removed
[  949.159541][T15008] team0 (unregistering): Port device team_slave_0 removed