last executing test programs: 2.663758167s ago: executing program 1 (id=2): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) socket$nl_generic(0x10, 0x3, 0x10) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r0, &(0x7f0000000440)=[{{&(0x7f0000000500)=@xdp={0x2c, 0xdd86, r2}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x1}], 0x1, 0x0, 0x0, 0x2f00}}], 0x1, 0x20000084) syz_usb_connect(0x3, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="16010107f748be08f41515002b6f0102030109021200010902200b0904c6a9009b7dd103"], &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x5, [{0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x3801}}, {0x4, &(0x7f0000000080)=@lang_id={0x4, 0x3, 0x410}}, {0x4, &(0x7f00000000c0)=@lang_id={0x4, 0x3, 0x807}}, {0x4, &(0x7f0000000040)=@lang_id={0x4, 0x3, 0x423}}, {0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x43f}}]}) 2.631491823s ago: executing program 3 (id=5): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1400000010000100ab5a0000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4024}, 0x4000010) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff274"], 0x84}, 0x1, 0x0, 0x0, 0x48d0}, 0x8c0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000001240)=ANY=[@ANYBLOB="000086dd00002800ff000000000060fc03000f982c00fe8000000000000000000000000000aaff02000000000000000000000000000184"], 0xfce) 2.630956461s ago: executing program 2 (id=3): syz_usb_connect(0x4, 0x9bc, &(0x7f0000000280)={{0x12, 0x1, 0x300, 0xef, 0x1b, 0xd0, 0x20, 0x6cd, 0x10b, 0xbf18, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9aa, 0x3, 0xb, 0xe, 0xc0, 0x0, [{{0x9, 0x4, 0x88, 0x5, 0xc, 0x7a, 0x57, 0x8e, 0xa, [@uac_as={[@format_type_ii_discrete={0x10, 0x24, 0x2, 0x2, 0xfffb, 0x100, 0x7, "49891d96ca0180"}, @format_type_i_discrete={0x10, 0x24, 0x2, 0x1, 0x9, 0x2, 0x3, 0xa, "447947aa86db3fd4"}, @format_type_i_discrete={0xa, 0x24, 0x2, 0x1, 0x8, 0x1, 0x7, 0x9e, '\tQ'}]}], [{{0x9, 0x5, 0x9, 0x10, 0x3ff, 0x3, 0x0, 0x1}}, {{0x9, 0x5, 0x1, 0x0, 0x10, 0x0, 0x7, 0x6, [@generic={0xea, 0x22, "0f16a1fbec2664822539222c915843319257fe1009de4c85a6ea8b2a0a52c3ef80c25e89d4a2bf8e7899663bdd171d8b3c10791b0633228cfff4353dbc26a3288343abe7df6d1e5162da53a0af9b353d3addafa726dab274b88189735edb7e2963b3cb9d27ef0f776d6b6674f44540797c6e6815d2c46929ae2bfaefa4ed8d561a94e5e94a2c739ac21f1b34a5bc822a1c554353f87218ad7075d21ec3067862aee1f71660747b48459efd3df27050532c8e0a540547dadb17dbf44741e7a675aefb1a224a3a231a1630e7f67dd97789f3f022f012afa0de4aee97974bfa6a61e15e38c28e397836"}, @uac_iso={0x7, 0x25, 0x1, 0x81, 0x4, 0x7}]}}, {{0x9, 0x5, 0xc, 0x3, 0x3ff, 0x4, 0x79, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x0, 0x18}, @uac_iso={0x7, 0x25, 0x1, 0x83, 0x3, 0x4}]}}, {{0x9, 0x5, 0x80, 0x2, 0x400, 0x3, 0x1, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0x4, 0x8001}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x6, 0x6}]}}, {{0x9, 0x5, 0x6, 0x3, 0x200, 0x10, 0x4, 0xc}}, {{0x9, 0x5, 0x8, 0x2, 0x3ff, 0x9, 0x40, 0xf7, [@generic={0x1c, 0x5, "02e7830d68f15aafc96629a04f59d7a84d3ee4a88ce414026254"}]}}, {{0x9, 0x5, 0x7, 0x10, 0x8, 0x7, 0x5, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0x6e, 0x8}]}}, {{0x9, 0x5, 0x7, 0x8, 0x20, 0xf8, 0x6, 0x4}}, {{0x9, 0x5, 0x0, 0x0, 0x200, 0x86, 0x5, 0x1d}}, {{0x9, 0x5, 0x0, 0x2, 0x20, 0x3, 0x2, 0x1, [@generic={0x92, 0x30, "6fbb7a51dbbbf81657150f845e552861e22ea07f6d758eb3c7cac6742eeacd92ac3d679c6dbe12f9cebb4de9f88bef99d67ea677ff78bed61823651364df227e866780364bedaf1bbeefc0292ce8233d5ca9ba13e28b58f16347c780b87568ebccf9d77c2c04d850bceacdc777d79f726d1ddd21afecc5a0a245887daa99bc5d5d359bb4bd46c718057c9852213500bf"}]}}, {{0x9, 0x5, 0x9, 0x8, 0x8, 0x9, 0x9, 0x8, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x6, 0x3c}, @uac_iso={0x7, 0x25, 0x1, 0x3, 0xaa, 0x57b5}]}}, {{0x9, 0x5, 0xa, 0x0, 0x10, 0x0, 0xf, 0xc6, [@generic={0x7e, 0x8, "94df64ff1706887cbe40e3aa4248c839d5f9aeffa20da460e8697b2da463b36497e2ba8b9fb304d2628af575c6b6ed1923da7da0b661f5952580316cfd7f7b604922cced8a7338233030c9e15ef790c4d12e9412ffe1b9b7ff1de829bef721c1155c588d95b738efab5ee96b444ab8244f72f781f6b633295bb1762c"}, @uac_iso={0x7, 0x25, 0x1, 0x2, 0x0, 0x1}]}}]}}, {{0x9, 0x4, 0xa5, 0xe, 0xe, 0xff, 0xff, 0xff, 0x3d, [], [{{0x9, 0x5, 0x9, 0xc, 0x10, 0x0, 0x7, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0xd, 0x1}, @generic={0x25, 0x9, "78218219e6af130f7a1be40af0ae04cf16fbedcc03ebe69d999c7b0e2434250b86677f"}]}}, {{0x9, 0x5, 0xb, 0x2, 0x40, 0x6, 0x8, 0x6, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x6b, 0x100}]}}, {{0x9, 0x5, 0x6, 0x0, 0x40, 0xd, 0x0, 0x81, [@generic={0xba, 0x11, "811e76bbf52bf1e4738cec452c7a2fa15db73aacf1d4d3bbc8f3b5e22982ba5c0b93bb16fe81d306a6206b85ba6fc357b85c21ec9c330f112c523a408a2d331dd0961ac370fa2812dc652c2520113de4ddf26aea9280e67bba97d956413296188a53fba48caed4d4edabbb6ca2feb04648b72f1e50ea34796782b46417f3f74cabd39c9166015dd7f9009f9558d83e1b8b768e38c896ccbfe24333347edf4f8263d1554134e9878800250517bb9b1635ed3aab89b355b9b0"}]}}, {{0x9, 0x5, 0x80, 0xe75ce1b4a7b7573b, 0x410, 0x66, 0x3, 0x4, [@generic={0x7, 0xd, "5fb8f794cb"}]}}, {{0x9, 0x5, 0x3, 0x8, 0x400, 0xc8, 0x8, 0xc, [@generic={0xe6, 0x8, "18699ef9ad03d3257953f0eb5c3302ab5f9e9be4ee399c0d90c2a1b48437261b45740ee9ba6134389d89dbf6256d7395ba425296b25320283407d0daf6eb22c94351c886c1ef76895cff321aaf934a60150dbb4b498a11aa4de82bec5522ec4e18a83c256383cf96e94a04480259369ff2a6a19b639ba258c8d979365bce2720a85d49c8fe2af4cb772f88d954963e310db732f6fbde3dfeb91605df63163257905842442648ad065b498aa71d47d0ebd9b3993276653c83f0e3afc12e35e3ae9dc7aeee04c4014086f02b8c43a132410c57f403fc29e7f7dcc118442df44719b6106544"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x20, 0x5, 0x4}}, {{0x9, 0x5, 0xf, 0x8, 0x20, 0x84, 0xb2, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0x83, 0x2, 0xfff7}, @generic={0xe1, 0x21, "9813db83be5c2875a4e7ba0dbeb1b2d4e91548445e94de35a8184fb9ac1f1c45d99d02ca546e107ef7e1d4be3aa6368975b655d0beb8c5b1effc14923ece72accfab031a04638fecf7b7c221bac3273dd130a455a8eb927a1b2377a2c476e159f796936d4712fa2fbcab8bfdcef3fb1c9bb216b62ca6ce8e18a308d1e91caadea305a448c6b525828f823a5814ef619cfb412686836581bdbdb79b90bc9ac8e8ca3b0ff697237d77aaea0b529a2d4b7142f59b1c4f58bb64da48c1bc10a0b4e59892e67cf1f1985c4ab46fb383d12c73465046df0998f48659cb08602c4182"}]}}, {{0x9, 0x5, 0x7, 0x10, 0x3ff, 0x5, 0x8, 0x6f}}, {{0x9, 0x5, 0x7, 0x10, 0x40, 0x81, 0x37, 0x40}}, {{0x9, 0x5, 0x6, 0x10, 0x400, 0x1, 0x5, 0x7}}, {{0x9, 0x5, 0x3, 0x0, 0x3ff, 0x3, 0x5, 0x10}}, {{0x9, 0x5, 0xb, 0x1, 0x10, 0x0, 0x83, 0x7}}, {{0x9, 0x5, 0x0, 0x0, 0x10, 0x9, 0x37, 0xa3, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x4, 0x8}]}}, {{0x9, 0x5, 0x5, 0x10, 0x0, 0x8, 0x4, 0x87, [@generic={0x4f, 0x0, "12625db747d36df9367bd322abca3592b0bf0c5d56287ac9ff188bf7a81c686b2dec7b00d6d08c5d2b32e2239001094ff764416bf515eef42d01ac4660bf13f834354ee2f9dc1be051e5aaceb6"}]}}]}}, {{0x9, 0x4, 0xd1, 0x3, 0xc, 0xff, 0x6, 0x3, 0x8, [@hid_hid={0x9, 0x21, 0x3, 0xe5, 0x1, {0x22, 0x40}}], [{{0x9, 0x5, 0x0, 0x3, 0x200, 0xb, 0x2, 0x2}}, {{0x9, 0x5, 0x4, 0x0, 0x230, 0x7, 0xa5, 0x6}}, {{0x9, 0x5, 0xa, 0xc, 0x20, 0xc7, 0xaa, 0x6, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0xff, 0x80}, @generic={0x2e, 0xe, "a864c9346a764d18e4cfaf20bdfe38a36888ed2e417ca6263ef3b5d8f5b0af7420c753777f86a84b481381f8"}]}}, {{0x9, 0x5, 0x8, 0x10, 0x20, 0xff, 0x8, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0xf, 0xea76}]}}, {{0x9, 0x5, 0x9, 0x0, 0x400, 0xa, 0x3, 0xec, [@generic={0xc6, 0xa, "3e4a3bc76550c39e58c88811f51948b2f237c59e1100816dcb60cc16b654ea6d0624bf138b729f316afd675ffba283ffac631ada9bbf31070337d9a7aca144d8a4feb8409615604113662a88a873c48cb11e7d37f02fff2e1585c07785ad216023e7b50403fd90f79baf1fb511f1009e25776843614d0606065dbb43fc32c776a60090e99450cfe1fcfebc546a9d3b17d3519537c1b53045f8fa78209918db5532fdd7bfcc177deee1d4f6c84f5e054927cb80c7f969839d15a0013c8218638733693305"}]}}, {{0x9, 0x5, 0x8, 0xc, 0x40, 0x4, 0x3, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0x2f, 0x80}, @generic={0xdd, 0x11, "1dc2668e9772498a23d3507d7dc5b540af74f7c459727f8aaa5e2dde7fa9ad33e0ab6d55246a7f0a7576b510cacf431094656dbfcf1f616c38359061b2e5ceb8ea0a5a5f52f480f18b7d76132ab6408d60dacd21c8fe1e78f279d9e8efcfc165c2e1d8efcc9c74bc3385ad23f4f89a83cb691eff6c02ca42e70a91f120445a36a3e5daf7c942998b9af92a3f4e6213315b7a6b93e03c51145b3b825e90a69640939d1f1015c15f1bfd4031e5a2b17aea0b06ac992b741585c8380b4d4c17237fcaa53c17cabacb7c0b6d68faa1f9e3ad268a3da4d279c9ff15c43f"}]}}, {{0x9, 0x5, 0x5, 0x10, 0x10, 0x3, 0x5, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0xe6, 0x3}, @uac_iso={0x7, 0x25, 0x1, 0x82, 0x6, 0x5}]}}, {{0x9, 0x5, 0xc, 0x1, 0x0, 0x82, 0xd, 0x7f}}, {{0x9, 0x5, 0x80, 0x0, 0x20, 0x37, 0xfa, 0xd7, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0xd2, 0x7}]}}, {{0x9, 0x5, 0xb, 0x0, 0x200, 0x4, 0x7f, 0x1, [@generic={0x95, 0x24, "d2a0530f91987ce829bc7d95c4ba2f3eb45729d12e93f84f4bfc6e476b632800982d67d081e17918835830a7fc6ccc3471cb43628e33fe2dca12736f575d3ddfe0ed00e4a563635d50e5a53b3e507e5b691d3c95288622495742fddcbda5a6b0fe0e4c3494bcbd6c2caa4bea7581bd37b6e58287c80a0edd37403e5fbff105392c2784eaac13ad0ca82c995e2ac2dcc3c251b5"}]}}, {{0x9, 0x5, 0x2, 0x10, 0x200, 0xe, 0xbd, 0x8}}, {{0x9, 0x5, 0xf, 0x1, 0x20, 0x6, 0x4, 0x5d}}]}}]}}]}}, &(0x7f0000001480)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x110, 0x0, 0x47, 0xaa, 0x20, 0x4}, 0x24, &(0x7f0000000040)={0x5, 0xf, 0x24, 0x2, [@ss_container_id={0x14, 0x10, 0x4, 0x6, "3c623bde65950d7b65d2b8c5c9f7720b"}, @wireless={0xb, 0x10, 0x1, 0xc, 0x20, 0x5, 0x4, 0x2, 0x38}]}, 0x5, [{0x20, &(0x7f0000000080)=ANY=[@ANYBLOB="2003255a892fd8c10dbecbb300a1188c6cfc2929feed6f05e5a05539a26c"]}, {0xd6, &(0x7f00000000c0)=@string={0xd6, 0x3, "3b2e0c0a51989f5e10bd0ebd10580d5264584ddeb350a6fa4f10131282f04a6489c373d11c9ac6fe9375dc352e678cfd0f9fb5a0f9ea9aab961f8161a503a80f0829f4cee5759f363b68aad6f51ee6aa27142b0192f15151422f5cf97fa4f03d300e436a61c1512f18fdbf362d38261cf555c9fa77bdffaf90057f0b3b8d13c9e63b7c8ee909ac78b977778e5682d8e7da98aab648991dd623d5e247d324ffc629b4de69392a2cc7841d9605032b816704f0615396b4c482165766f317c5e8265d7bd110ec2d941308cf9016589960d7091f72ad"}}, {0x4, &(0x7f0000001380)=@lang_id={0x4, 0x3, 0x480a}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x44b}}, {0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x409}}]}) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 2.356281518s ago: executing program 0 (id=1): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) recvmmsg(r0, &(0x7f0000006880)=[{{0x0, 0x0, 0x0}, 0x80000001}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0x101}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000440)=""/183, 0xb7}, {&(0x7f00000007c0)=""/242, 0xf2}, {&(0x7f0000000000)=""/41, 0x29}, {&(0x7f00000018c0)=""/4104, 0x1008}, {&(0x7f0000000340)=""/75, 0x4b}, {&(0x7f0000000500)=""/224, 0xe0}, {&(0x7f0000000600)=""/244, 0xf4}], 0x7}, 0x80000000}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x200}, {{0x0, 0x0, 0x0}, 0x7}, {{0x0, 0x0, 0x0}, 0xd}], 0x8, 0x4022, 0x0) 2.297867892s ago: executing program 3 (id=6): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x28, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffe}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_XOR={0x4}, @NFTA_BITWISE_MASK={0x8, 0x4, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}]}]}}}]}, @NFTA_RULE_TABLE={0xfffffffffffffe4e, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x108}}, 0x0) (async) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000280), 0x8802, 0x0) write$UHID_CREATE2(r2, 0x0, 0x141) (async) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), 0xffffffffffffffff) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000480)={'wlan0\x00', 0x0}) (async) sendmsg$NL80211_CMD_SET_WIPHY(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="28e02f3f", @ANYRES16=r5, @ANYBLOB="00022bbd7000fedbdf250200000008006100e0ffffff0800610004"], 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x801) sendmsg$NL80211_CMD_SET_COALESCE(r4, &(0x7f0000000200)={0x0, 0xffffffffffffff8c, &(0x7f0000000b00)={&(0x7f0000000040)={0x28, r5, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8, 0x3, r6}, @void}}}, 0x28}}, 0x0) sendmsg$NL80211_CMD_ASSOCIATE(r2, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x38, 0x0, 0x200, 0x70bd28, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r6}, @void}}, [@crypto_settings=[@NL80211_ATTR_CONTROL_PORT={0x4}, @NL80211_ATTR_CIPHER_SUITE_GROUP={0x8, 0x4a, 0xfac05}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_CIPHER_SUITE_GROUP={0x8, 0x4a, 0xfac0c}, @NL80211_ATTR_SOCKET_OWNER={0x4}]]}, 0x38}, 0x1, 0x0, 0x0, 0x4040081}, 0x4000000) (async) syz_genetlink_get_family_id$devlink(&(0x7f0000000300), r2) sendmsg$MPTCP_PM_CMD_REMOVE(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r3, 0x2, 0x70bd25, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010101}]}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xffffffff}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}]}, 0x38}, 0x1, 0x0, 0x0, 0x30004041}, 0x4004800) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a6c000000060a0104000000000000000002000000400004803c0001800a0001006d617463680000002c00028014000300f4f03b0200000000030007116b61979e0c000100636c75737465720008000240000000000900010073797a30000000000900020073797a32"], 0x94}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 2.208639957s ago: executing program 0 (id=7): r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0xc0001, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000040), 0x10000, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r2, 0x0) ioctl$I2C_RETRIES(r2, 0x701, 0xcc) ioctl$VFAT_IOCTL_READDIR_BOTH(r1, 0x82307201, &(0x7f00000002c0)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) ioctl$SNAPSHOT_ATOMIC_RESTORE(r0, 0x3304) syz_usb_connect(0x3, 0x10d, &(0x7f0000000ac0)=ANY=[], 0x0) 2.207640933s ago: executing program 3 (id=8): r0 = memfd_create(&(0x7f00000009c0)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdbU\xb1\xe1br\xb6\x008\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\x90i\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\xc7\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14O\xf8\xb5C\x1f\xb6b8b\x06A2@D\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\x05\x00\x00\x00\x00\x00\x00\x00\'\x93\xef\x1d\xa0H\xd9\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00\x88\xd1\x1eQB\x18\xc1-\xc4\x8fK\xf8\xfa\xb6\xf8\v;\xaa\x8fW\xcc\n\x17\x7f\x98\xb7\xcdqV\xd4\xf0)\xfa\x0fG\xc8\xbf\xfd\xe8>K\f\xcd+\xb0\x99Q\xba/\xa8\xb9`k\b\xd1\xcc\xfc\xeaA\"\v=\x83fC\x90%\xa1d\x91\xf8:\x16<\xad\xc2\x18\xdf\x01\xe2\x96\xfcj\xe9\xa4\x065m\x03\x05Np\xda\"\xf1\xb6\xbcP\x8fP\x8d\x89%\xf2\x12T\xd0\xc3\x15W\x9c\x87\x1b\x8c\xc9\xd9\xc6\xad\x96-d\xa2wFB\xcaB\xa5\x15\xf8,\x04\x1c*\xd98\x8bG\x90\x81`\x03\xe0\xde\x9c\x9a\x0f\x1b\x8f\xd2%*&$Wc\xb3\xa6\xc4TK1}2\xb3\xab\xf4\xb7\xb7\x85\apa\xaf\x1c\x10i\xb9\x9f\x06\xff4%\"7f \x0e\xf5Bk\r\xac\"\x13tNx\xc0$\x85\x9f', 0x3) ftruncate(r0, 0xffff) fcntl$addseals(r0, 0x409, 0x7) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)='-', 0x1}], 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000040)="d8000000100081044e81f782db44b904021d006a11000000e8fe55a1180015000600d12603600e1209000a0044000000a80016000a000173000c8a34891c722a9e0e987ac2c8e47510", 0x49}], 0x100001b3}, 0x844) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="0439000020"], 0x33fe0) ioctl$FS_IOC_GET_ENCRYPTION_NONCE(r0, 0x8010661b, &(0x7f0000000180)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpu.stat\x00', 0x275a, 0x0) write$cgroup_devices(r1, &(0x7f0000000000)=ANY=[], 0x9) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='attr/fscreate\x00') read$msr(r2, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f00000000c0)="c4c2cbf7f366baf80cb82a218089ef66bafc0c66b8b10066efc4417e2cea66ba420066edc4c15dd2ef0fc7b94b000000c74424002074edd4c7442402c3000000c7442406000000000f011424b8010000000f01c1c44225461242857000", 0x5d}], 0x1, 0x4, &(0x7f0000000180), 0x0) 2.043119065s ago: executing program 3 (id=9): syz_usb_connect(0x0, 0x3c1, &(0x7f00000004c0)=ANY=[@ANYBLOB="12010000f9bbb410e3050205eab0010203010902af0301000000000904ee"], 0x0) syz_usb_connect$hid(0x1, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0xcf, 0x56a, 0x30, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x4, 0x80, 0x0, [{{0x9, 0x4, 0x0, 0x10, 0x2, 0x3, 0x1, 0x1, 0x40, {0x9, 0x21, 0x47dd, 0x6, 0x1, {0x22, 0x326}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x0, 0x40, 0x1}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0x5, 0x8, 0xb}}]}}}]}}]}}, &(0x7f0000000180)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x300, 0xa, 0x6, 0x8, 0xff, 0x7f}, 0x19, &(0x7f0000000080)={0x5, 0xf, 0x19, 0x1, [@ss_container_id={0x14, 0x10, 0x4, 0x1, "baf73517f0f733adde5e6a51b612729f"}]}, 0x2, [{0x4, &(0x7f00000000c0)=@lang_id={0x4, 0x3, 0x4c0a}}, {0x5b, &(0x7f0000000100)=@string={0x5b, 0x3, "81b2b7d7d7c97d9cfb715e29645e1ae106750f1c24c1d8d6720f30e6423269492fa272906b0c73db9835d8aee56da6cbdf143c750ca538731b6fefc08526cad9b18035a4008edf8891fbb401de96a8a75d935883446cac3e57"}}]}) 1.922300808s ago: executing program 2 (id=10): r0 = socket(0x10, 0x803, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x800) mkdir(&(0x7f0000000400)='./file1\x00', 0xc) mount$overlay(0x0, &(0x7f0000000040)='./file1\x00', &(0x7f0000000340), 0x0, &(0x7f0000000080)={[{@workdir}]}) sendmsg$IPSET_CMD_LIST(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)=ANY=[], 0x14}}, 0x8018) accept4(r2, 0x0, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r3, &(0x7f0000006d00)=[{{&(0x7f0000000000)={0xa, 0xa0ec, 0xfffffe01, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xc2}, 0x1c, &(0x7f00000021c0)=[{&(0x7f0000001080)="4aa1", 0x2}], 0x1}}], 0x1, 0x8000) shutdown(r3, 0x1) getsockopt$bt_hci(r3, 0x84, 0x1f, &(0x7f0000000080)=""/4057, &(0x7f0000001180)=0xfd9) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), r0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x5d) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) 1.840218646s ago: executing program 2 (id=11): syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) socket(0x22, 0x6, 0xffffffff) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r1, &(0x7f00000001c0)='\\', 0x1) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) read$eventfd(r0, &(0x7f0000000340), 0x8) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000000000040ef174760000000000001090224000100000000a956437c58e1e50f3223465d79492e360904000001030002000921000000012205000905810300e6230000"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000040)={0x2c, &(0x7f0000000000)={0x0, 0x23, 0x1f, {0x1f, 0xa, "a7ea3163fd3bc518194b120c1e73d54cfc4ad2841ef4f6a3027c59ccb7"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000000680)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.491733321s ago: executing program 0 (id=12): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1e7d, 0x30d4, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000001000/0x4000)=nil) r1 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) preadv(r1, &(0x7f0000000180)=[{&(0x7f0000000100)=""/57, 0x39}, {&(0x7f0000000140)=""/9, 0x9}], 0x2, 0xfffffff8, 0xfffffffb) prctl$PR_SET_MM(0x23, 0x9, &(0x7f0000004000/0x3000)=nil) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x90, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x64, 0x4, 0x0, 0x1, [{0x50, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x40, 0x2, 0x0, 0x1, [@NFTA_TARGET_INFO={0x2c, 0x3, "7339f2f10455afb9fdd672bad09dfb78c7699c74e891a0c700"/40}, @NFTA_TARGET_REV={0x8}, @NFTA_TARGET_NAME={0x8, 0x1, 'LED\x00'}]}}}, {0x10, 0x1, 0x0, 0x1, @inner={{0xa}, @void}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) syz_usb_control_io$hid(r0, &(0x7f0000000080)={0x24, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x22, 0x7, {[@main=@item_4={0x3, 0x0, 0x0, "051000"}, @local=@item_012={0x1, 0x2, 0x5, "d3"}]}}, 0x0}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000340)={0x40, 0x18, 0xd, "0666bc5ba10cd4cc610666e761"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.132200989s ago: executing program 1 (id=13): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYRES8=r0], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x20044000) recvmmsg(r0, &(0x7f0000006880)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0xfffffffffffffec5, 0x0}, 0x101}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000440)=""/183, 0xb7}, {&(0x7f00000007c0)=""/242, 0xf2}, {&(0x7f0000000000)=""/37, 0x25}, {&(0x7f00000018c0)=""/4104, 0x1008}, {&(0x7f0000000340)=""/75, 0x4b}, {&(0x7f0000000500)=""/224, 0xe0}, {&(0x7f0000000600)=""/244, 0xf4}], 0x7}, 0x80000000}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x200200}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0x7}, {{0x0, 0x0, 0x0}, 0xd}], 0x9, 0x4022, 0x0) 686.653791ms ago: executing program 3 (id=14): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched_retired(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=@newtaction={0xffffffffffffffbd, 0x32, 0x1, 0x70bd29, 0x25dfdbfe, {}, [{0x0, 0x1, [@m_ipt={0x0, 0x7, 0x0, 0x0, {{}, {0x0, 0x2, 0x0, 0x1, [@TCA_IPT_HOOK={0x0, 0x2, 0x6}, @TCA_IPT_TARG={0x0, 0x6, {0x0, 'mangle\x00', 0x0, 0x8, "76697caed096c25fb0852564145afb50788dea9f3b2ebae3fe6274ec9bcda1d19fae1b9d4829a34e46d6f5b8dd6bc6247ac51b393e6d5609ae5fcf37477bcba2553f08b378043effb85debacd81205a7d2c0478d2ad12e95862668d3e9dfa817479ca3a7c90a3010c97b8bde5933e04ca9877b0b41bfae6d8735908cbbb83daac2c74c02a8e951187725c2dac53575b4d40c7c2ea3bc32d72626029956fccc8fe9a60840ac0fd96f38f3b1e8dae3598326f4124808aaa9408d73e50e3d7c9a64a43be470201edea815fd65cd9044fedffc89597e569de930f73bb91fa44a781098632ce0b67a43ce212e"}}, @TCA_IPT_TABLE={0x0, 0x1, 'nat\x00'}, @TCA_IPT_TARG={0x0, 0x6, {0x401, 'security\x00', 0x7, 0x0, "b8656a9a06b227d216b1eef7cc79b3b94b6bfde73703aca57146c45b40fdaf3987897bf95ba88a3daa6d023cc9d15fdc3bb675a0f31bbf2a9708f9ce761d2b05be2dc7033676889d67e907bff4253adcebcef44687da3d3337647d704d162f0450986038a4da40aaf1ee3cf7c6826ed9cae4d52a52279fa3ea94331ee629788b100f5dcd5ee33e3cf3a3"}}, @TCA_IPT_INDEX={0x0, 0x3, 0x3}, @TCA_IPT_HOOK={0x0, 0x2, 0x3}]}, {0x0, 0x6, "f419ea84623e7e10b044e29dd502b17ef56db5668d540efa83c56c81c2b5ad768a9b52a6ad617f83bfc73da820c439d5a656ef3a6c94399b3b81a25fb5c523301dcd44d6576d84de1e23631f87505fd6213628800bbe7e717379d35cbd8e5c222a4e9bac81ccfd6589"}, {0x0, 0x7, {0x0, 0x1}}, {0x0, 0x8, {0x2, 0x1}}}}]}]}, 0x14}, 0x1, 0x0, 0x0, 0x8080}, 0x9080) r1 = socket(0x11, 0x3, 0x3a) ioctl$VIDIOC_G_SLICED_VBI_CAP(0xffffffffffffffff, 0xc0745645, &(0x7f0000000000)={0x3, [0x7b, 0x240, 0x4, 0xffe, 0x0, 0x0, 0xfe01, 0x8, 0x8, 0x3, 0x4371, 0x80, 0x1000, 0x7, 0xfffc, 0x2, 0x7905, 0xff, 0x3, 0x25, 0x2, 0xccf9, 0x8000, 0x3, 0x1900, 0x7, 0x9, 0x9c9, 0x80, 0x2, 0x0, 0x4, 0x8, 0x0, 0x5, 0x4, 0x8, 0xd, 0x80, 0x8, 0x9, 0x10, 0x9, 0x1a, 0x7, 0x8, 0x7, 0x2], 0x6}) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000000c0)={'veth1_vlan\x00', &(0x7f0000000100)=@ethtool_sfeatures={0x3b, 0x2, [{0xffffffff, 0x4}, {0x3, 0xb36a}]}}) 584.280117ms ago: executing program 3 (id=15): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYRESDEC], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, &(0x7f0000000480)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) (async) mremap(&(0x7f0000000000/0x9000)=nil, 0x600000, 0x600000, 0x3, &(0x7f0000a00000/0x600000)=nil) (async) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000001200)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) 258.614543ms ago: executing program 1 (id=16): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) recvmmsg(r0, &(0x7f0000006880)=[{{0x0, 0x0, 0x0}, 0x80000001}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0x101}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000440)=""/183, 0xb7}, {&(0x7f00000007c0)=""/242, 0xf2}, {&(0x7f0000000000)=""/41, 0x29}, {&(0x7f00000018c0)=""/4104, 0x1008}, {&(0x7f0000000340)=""/75, 0x4b}, {&(0x7f0000000500)=""/224, 0x11d}, {&(0x7f0000000600)=""/244, 0xed}], 0x7}, 0x80000000}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x200}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0x7}, {{0x0, 0x0, 0x0}, 0xd}], 0x9, 0x4022, 0x0) (fail_nth: 24) 210.228535ms ago: executing program 1 (id=17): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) (async) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000100)='cgroup.threads\x00', 0x2, 0x0) (async) r0 = socket$inet_tcp(0x2, 0x1, 0x0) (async) r1 = socket$inet(0xa, 0x801, 0x84) connect$inet(r1, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) (async) listen(r1, 0x8) (async) r2 = socket$inet(0xa, 0x801, 0x84) listen(r2, 0xfffffffd) (async) r3 = socket$inet(0xa, 0x801, 0x84) listen(r3, 0x8) (async) r4 = socket$inet(0xa, 0x801, 0x84) listen(r4, 0x8) (async) r5 = socket$inet6(0xa, 0x1, 0x8010000000000084) listen(r5, 0x208) (async) r6 = socket$netlink(0x10, 0x3, 0x4) writev(r6, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x40b}], 0x1) (async) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) (async) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f00000001c0)=0x2, 0xfffffc8d) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f0000000280)="1de8", 0x2, 0x200400c5, 0x0, 0x0) (async) setsockopt$inet_tcp_int(r0, 0x6, 0x18, &(0x7f00000002c0)=0x3, 0x4) r7 = socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) write$tun(0xffffffffffffffff, &(0x7f0000000280)=ANY=[@ANYBLOB="0a0000cbffffffffffffaaaac2aaaabb86dd6d000000000000000000ff02000000000000000000000002000800194e200008907800"/66], 0x42) (async) sendmsg$ETHTOOL_MSG_PAUSE_SET(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="310401080000030000001600000018000180140002006e657464657673696d3000000000000005000300010000000500040001000000050002"], 0x44}}, 0x8000) (async) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x1) ioctl$KVM_GET_MSRS_cpu(r11, 0xc008ae88, &(0x7f0000000200)={0x1, 0x0, [{0x29f, 0x0, 0x7fffffff}]}) 116.281051ms ago: executing program 1 (id=18): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1400000010000100ab5a0000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4024}, 0x4000010) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x48d0}, 0x8c0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000001240)=ANY=[@ANYBLOB="000086dd84002800ff000000000060fc03000f982c00fe8000000000000000000000000000aaff02000000000000000000000000000184"], 0xfce) 0s ago: executing program 1 (id=19): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$TCFLSH(r1, 0x400455c8, 0x2) (async) ioctl$TIOCSETD(r1, 0x5412, &(0x7f00000003c0)=0xffffffc0) (async, rerun: 32) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff097b00000800395032303030"], 0x15) (async, rerun: 32) r2 = syz_open_dev$ndb(&(0x7f0000000040), 0x0, 0x0) ioctl$NBD_SET_SOCK(r2, 0x1265, 0xffffffffffffffff) (async) r3 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000080)='.\x00\x00\x00>\x00', 0x6}], 0x1, 0x0, 0x0, 0x39c}, 0x0) (async, rerun: 32) write$cgroup_subtree(r3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000069"], 0xfe33) (rerun: 32) flock(r1, 0x8) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.159' (ED25519) to the list of known hosts. syzkaller login: [ 83.606761][ T5851] cgroup: Unknown subsys name 'net' [ 83.724236][ T5851] cgroup: Unknown subsys name 'cpuset' [ 83.733782][ T5851] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 85.424642][ T5851] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 88.015246][ T5865] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 88.034430][ T5876] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 88.043405][ T5876] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 88.051792][ T5876] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 88.060016][ T5876] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 88.068216][ T5876] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 88.086758][ T5869] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 88.090224][ T5876] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 88.096291][ T5869] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 88.109839][ T5869] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 88.118649][ T5869] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 88.143581][ T5877] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 88.152210][ T5877] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 88.160690][ T5877] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 88.168482][ T5877] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 88.179230][ T5877] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 88.179334][ T5879] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 88.200388][ T5874] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 88.215672][ T5877] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 88.223289][ T5877] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 88.807851][ T5864] chnl_net:caif_netlink_parms(): no params data found [ 88.870689][ T5867] chnl_net:caif_netlink_parms(): no params data found [ 88.886761][ T5861] chnl_net:caif_netlink_parms(): no params data found [ 89.020818][ T5866] chnl_net:caif_netlink_parms(): no params data found [ 89.100990][ T5864] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.108171][ T5864] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.116065][ T5864] bridge_slave_0: entered allmulticast mode [ 89.123752][ T5864] bridge_slave_0: entered promiscuous mode [ 89.169396][ T5864] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.176639][ T5864] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.184140][ T5864] bridge_slave_1: entered allmulticast mode [ 89.191419][ T5864] bridge_slave_1: entered promiscuous mode [ 89.211598][ T5867] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.218848][ T5867] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.226150][ T5867] bridge_slave_0: entered allmulticast mode [ 89.233581][ T5867] bridge_slave_0: entered promiscuous mode [ 89.290445][ T5864] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.299860][ T5867] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.307014][ T5867] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.315273][ T5867] bridge_slave_1: entered allmulticast mode [ 89.323382][ T5867] bridge_slave_1: entered promiscuous mode [ 89.331349][ T5861] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.339083][ T5861] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.346972][ T5861] bridge_slave_0: entered allmulticast mode [ 89.354593][ T5861] bridge_slave_0: entered promiscuous mode [ 89.370210][ T5864] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 89.404600][ T5861] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.412339][ T5861] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.419527][ T5861] bridge_slave_1: entered allmulticast mode [ 89.427515][ T5861] bridge_slave_1: entered promiscuous mode [ 89.467751][ T5867] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.540758][ T5867] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 89.553163][ T5861] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.562740][ T5866] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.570305][ T5866] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.577517][ T5866] bridge_slave_0: entered allmulticast mode [ 89.585334][ T5866] bridge_slave_0: entered promiscuous mode [ 89.594884][ T5864] team0: Port device team_slave_0 added [ 89.620202][ T5861] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 89.629947][ T5866] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.637088][ T5866] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.644824][ T5866] bridge_slave_1: entered allmulticast mode [ 89.652128][ T5866] bridge_slave_1: entered promiscuous mode [ 89.661674][ T5864] team0: Port device team_slave_1 added [ 89.735643][ T5867] team0: Port device team_slave_0 added [ 89.771014][ T5866] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.782287][ T5867] team0: Port device team_slave_1 added [ 89.790565][ T5866] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 89.801567][ T5861] team0: Port device team_slave_0 added [ 89.822028][ T5864] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.829101][ T5864] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 89.856008][ T5864] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.881228][ T5861] team0: Port device team_slave_1 added [ 89.902493][ T5864] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.909489][ T5864] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 89.936267][ T5864] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.974878][ T5866] team0: Port device team_slave_0 added [ 89.991700][ T5867] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.998896][ T5867] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.025092][ T5867] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.068843][ T5866] team0: Port device team_slave_1 added [ 90.075614][ T5867] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.083078][ T5867] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.109735][ T5867] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.121443][ T5861] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.128429][ T5861] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.155151][ T5861] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.197707][ T5861] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.204972][ T5861] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.231061][ T5861] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.247664][ T5864] hsr_slave_0: entered promiscuous mode [ 90.251295][ T5184] Bluetooth: hci3: command tx timeout [ 90.255112][ T5864] hsr_slave_1: entered promiscuous mode [ 90.258998][ T5184] Bluetooth: hci2: command tx timeout [ 90.270151][ T5877] Bluetooth: hci1: command tx timeout [ 90.284325][ T5866] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.291382][ T5866] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.317443][ T5866] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.330232][ T5184] Bluetooth: hci0: command tx timeout [ 90.331439][ T5866] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.343444][ T5866] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 90.369464][ T5866] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.447984][ T5867] hsr_slave_0: entered promiscuous mode [ 90.454542][ T5867] hsr_slave_1: entered promiscuous mode [ 90.461536][ T5867] debugfs: 'hsr0' already exists in 'hsr' [ 90.467401][ T5867] Cannot create hsr debugfs directory [ 90.534069][ T5861] hsr_slave_0: entered promiscuous mode [ 90.540635][ T5861] hsr_slave_1: entered promiscuous mode [ 90.546799][ T5861] debugfs: 'hsr0' already exists in 'hsr' [ 90.553314][ T5861] Cannot create hsr debugfs directory [ 90.635326][ T5866] hsr_slave_0: entered promiscuous mode [ 90.642009][ T5866] hsr_slave_1: entered promiscuous mode [ 90.648228][ T5866] debugfs: 'hsr0' already exists in 'hsr' [ 90.654203][ T5866] Cannot create hsr debugfs directory [ 91.053527][ T5864] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 91.084413][ T5864] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 91.103471][ T5864] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 91.114087][ T5864] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 91.162453][ T5867] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 91.173249][ T5867] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 91.185979][ T5867] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 91.213391][ T5867] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 91.283753][ T5866] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 91.296966][ T5866] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 91.324225][ T5866] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 91.335978][ T5866] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 91.444492][ T5861] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 91.466640][ T5861] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 91.487542][ T5861] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 91.508143][ T5861] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 91.542081][ T5864] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.589274][ T5864] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.614798][ T66] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.622190][ T66] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.645017][ T5867] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.666097][ T66] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.673344][ T66] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.726562][ T5867] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.743279][ T5866] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.773168][ T50] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.780360][ T50] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.792247][ T50] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.799513][ T50] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.857789][ T10] cfg80211: failed to load regulatory.db [ 91.868607][ T5866] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.902639][ T1096] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.909855][ T1096] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.946624][ T1096] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.953915][ T1096] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.997469][ T5861] 8021q: adding VLAN 0 to HW filter on device bond0 [ 92.119130][ T5861] 8021q: adding VLAN 0 to HW filter on device team0 [ 92.156622][ T66] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.163857][ T66] bridge0: port 1(bridge_slave_0) entered forwarding state [ 92.225290][ T66] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.232538][ T66] bridge0: port 2(bridge_slave_1) entered forwarding state [ 92.327649][ T5864] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.330455][ T5184] Bluetooth: hci2: command tx timeout [ 92.338191][ T52] Bluetooth: hci3: command tx timeout [ 92.346329][ T5877] Bluetooth: hci1: command tx timeout [ 92.409913][ T5877] Bluetooth: hci0: command tx timeout [ 92.511525][ T5867] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.542643][ T5864] veth0_vlan: entered promiscuous mode [ 92.577155][ T5866] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.604093][ T5864] veth1_vlan: entered promiscuous mode [ 92.699130][ T5867] veth0_vlan: entered promiscuous mode [ 92.724318][ T5864] veth0_macvtap: entered promiscuous mode [ 92.735620][ T5867] veth1_vlan: entered promiscuous mode [ 92.749728][ T5864] veth1_macvtap: entered promiscuous mode [ 92.772132][ T5861] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.781065][ T5866] veth0_vlan: entered promiscuous mode [ 92.804706][ T5866] veth1_vlan: entered promiscuous mode [ 92.845574][ T5864] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.867165][ T5864] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.905627][ T5867] veth0_macvtap: entered promiscuous mode [ 92.918053][ T66] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.933623][ T5866] veth0_macvtap: entered promiscuous mode [ 92.948019][ T5867] veth1_macvtap: entered promiscuous mode [ 92.957014][ T5866] veth1_macvtap: entered promiscuous mode [ 92.964710][ T66] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.973750][ T66] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.984135][ T66] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.002587][ T5861] veth0_vlan: entered promiscuous mode [ 93.037571][ T5867] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.055922][ T5866] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.071808][ T5861] veth1_vlan: entered promiscuous mode [ 93.085057][ T5866] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.104080][ T5867] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.143830][ T50] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.153797][ T1096] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.163836][ T1096] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.196481][ T1096] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.205470][ T1096] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.223654][ T1096] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.225732][ T50] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.234664][ T1096] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.257453][ T50] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.283254][ T1096] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.328813][ T1043] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.339564][ T1043] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.350548][ T5861] veth0_macvtap: entered promiscuous mode [ 93.387227][ T5861] veth1_macvtap: entered promiscuous mode [ 93.478829][ T1096] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.488075][ T1096] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.500499][ T5864] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 93.504480][ T5861] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.525907][ T66] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.536970][ T66] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.600971][ T5861] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.643648][ T5955] syz.3.4 uses obsolete (PF_INET,SOCK_PACKET) [ 93.667201][ T1043] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.673460][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.684895][ T1043] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.686215][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.717297][ T66] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.739102][ T1043] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.749144][ T1043] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.775589][ T1043] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.949135][ T50] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.985437][ T50] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.088955][ T1043] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.099497][ T1043] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.270613][ T5870] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 94.283862][ T5966] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6'. [ 94.353571][ T5970] random: crng reseeded on system resumption [ 94.410833][ T5877] Bluetooth: hci2: command tx timeout [ 94.416410][ T52] Bluetooth: hci1: command tx timeout [ 94.416424][ T5184] Bluetooth: hci3: command tx timeout [ 94.454566][ T5870] usb 2-1: Using ep0 maxpacket: 8 [ 94.473010][ T5870] usb 2-1: unable to get BOS descriptor or descriptor too short [ 94.488590][ T5870] usb 2-1: config 9 has an invalid interface number: 198 but max is 0 [ 94.498851][ T5870] usb 2-1: config 9 has no interface number 0 [ 94.504147][ T5184] Bluetooth: hci0: command tx timeout [ 94.509207][ T5870] usb 2-1: config 9 interface 198 has no altsetting 0 [ 94.520851][ T5870] usb 2-1: New USB device found, idVendor=15f4, idProduct=0015, bcdDevice=6f.2b [ 94.530707][ T5870] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 94.538838][ T5870] usb 2-1: Product: ࠇ [ 94.545202][ T5870] usb 2-1: Manufacturer: А [ 94.551488][ T5870] usb 2-1: SerialNumber: У [ 94.641709][ T5976] overlay: Bad value for 'workdir' [ 94.730773][ T5917] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 94.743617][ T30] audit: type=1326 audit(1758226805.543:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5977 comm="syz.2.11" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f6b7798eba9 code=0x0 [ 94.778640][ T5870] dvb-usb: found a 'Hanftek UMT-010 DVB-T USB2.0' in warm state. [ 94.787710][ T5870] dvb-usb: bulk message failed: -22 (3/0) [ 94.815041][ T5870] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 94.826184][ T5870] dvbdev: DVB: registering new adapter (Hanftek UMT-010 DVB-T USB2.0) [ 94.836132][ T5870] usb 2-1: media controller created [ 94.860911][ T5870] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 94.891719][ T5917] usb 4-1: Using ep0 maxpacket: 16 [ 94.907615][ T5917] usb 4-1: config 0 has an invalid interface number: 238 but max is 0 [ 94.919942][ T5870] DVB: Unable to find symbol mt352_attach() [ 94.920595][ T5917] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 94.926039][ T5870] dvb-usb: no frontend was attached by 'Hanftek UMT-010 DVB-T USB2.0' [ 94.937311][ T5917] usb 4-1: config 0 has no interface number 0 [ 94.940493][ T5917] usb 4-1: New USB device found, idVendor=05e3, idProduct=0502, bcdDevice=b0.ea [ 94.968030][ T5917] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 94.977304][ T5870] dvb-usb: bulk message failed: -22 (3/0) [ 94.981335][ T5917] usb 4-1: Product: syz [ 94.990646][ T5917] usb 4-1: Manufacturer: syz [ 94.999402][ T5917] usb 4-1: SerialNumber: syz [ 95.000341][ T5870] dvb-usb: Hanftek UMT-010 DVB-T USB2.0 successfully initialized and connected. [ 95.017748][ T5917] usb 4-1: config 0 descriptor?? [ 95.036474][ T5870] usb 2-1: USB disconnect, device number 2 [ 95.040004][ T9] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 95.069768][ T5917] gl620a 4-1:0.238: probe with driver gl620a failed with error -22 [ 95.146478][ T5870] dvb-usb: Hanftek UMT-010 DVB-T USB2.0 successfully deinitialized and disconnected. [ 95.242790][ T9] usb 3-1: config 0 has an invalid descriptor of length 169, skipping remainder of the config [ 95.246606][ T5974] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 95.254952][ T9] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 95.266660][ T5974] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 95.278521][ T9] usb 3-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 95.288158][ T916] usb 4-1: USB disconnect, device number 2 [ 95.296970][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.311992][ T9] usb 3-1: config 0 descriptor?? [ 95.359937][ T24] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 95.532741][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 95.543912][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 95.555009][ T24] usb 1-1: New USB device found, idVendor=1e7d, idProduct=30d4, bcdDevice= 0.00 [ 95.564389][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.576741][ T24] usb 1-1: config 0 descriptor?? [ 95.998099][ T24] arvo 0003:1E7D:30D4.0001: unknown main item tag 0x0 [ 96.011376][ T24] arvo 0003:1E7D:30D4.0001: hidraw0: USB HID v0.00 Device [HID 1e7d:30d4] on usb-dummy_hcd.0-1/input0 [ 96.170681][ T916] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 96.319805][ T916] usb 4-1: device descriptor read/64, error -71 [ 96.401500][ T981] usb 1-1: USB disconnect, device number 2 [ 96.490274][ T5184] Bluetooth: hci2: command tx timeout [ 96.493798][ T5877] Bluetooth: hci3: command tx timeout [ 96.495736][ T52] Bluetooth: hci1: command tx timeout [ 96.556981][ T6007] Oops: general protection fault, probably for non-canonical address 0xdffffc000000005f: 0000 [#1] SMP KASAN PTI [ 96.569376][ T6007] KASAN: null-ptr-deref in range [0x00000000000002f8-0x00000000000002ff] [ 96.569865][ T52] Bluetooth: hci0: command tx timeout [ 96.577805][ T6007] CPU: 1 UID: 0 PID: 6007 Comm: syz.1.19 Not tainted syzkaller #0 PREEMPT(full) [ 96.577830][ T6007] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 96.602380][ T6007] RIP: 0010:h5_recv+0x146/0x910 [ 96.607274][ T6007] Code: 18 48 c1 ea 03 48 89 54 24 28 48 89 d8 48 c1 e8 03 48 89 44 24 50 44 89 64 24 14 48 b8 00 00 00 00 00 fc ff df 48 8b 4c 24 30 <80> 3c 01 00 74 08 4c 89 ef e8 1c 86 aa f9 4d 8b 65 00 31 ff 4c 89 [ 96.626897][ T6007] RSP: 0018:ffffc9000a7dfc20 EFLAGS: 00010202 [ 96.632990][ T6007] RAX: dffffc0000000000 RBX: 00000000000002e8 RCX: 000000000000005f [ 96.641004][ T6007] RDX: 000000000000005e RSI: 0000000000000001 RDI: 0000000000000000 [ 96.649026][ T6007] RBP: ffffc9000a7dfd40 R08: ffff88802842d81f R09: 1ffff11005085b03 [ 96.657064][ T6007] R10: dffffc0000000000 R11: ffffffff887a2780 R12: 0000000000000001 [ 96.665063][ T6007] R13: 00000000000002f8 R14: ffff88802842d810 R15: ffffc9000a7dfde0 [ 96.673056][ T6007] FS: 00007fadd88df6c0(0000) GS:ffff88812589c000(0000) knlGS:0000000000000000 [ 96.682005][ T6007] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 96.688604][ T6007] CR2: 00007fadd88def98 CR3: 000000007e25e000 CR4: 00000000003526f0 [ 96.696699][ T6007] Call Trace: [ 96.700027][ T6007] [ 96.702972][ T6007] ? __pfx_h5_recv+0x10/0x10 [ 96.707566][ T6007] ? rcu_read_lock_any_held+0xb3/0x120 [ 96.713038][ T6007] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 96.718946][ T6007] ? tty_audit_push+0x7c/0x250 [ 96.723734][ T6007] hci_uart_tty_receive+0x194/0x220 [ 96.728956][ T6007] ? __pfx_hci_uart_tty_receive+0x10/0x10 [ 96.734712][ T6007] tiocsti+0x23c/0x2c0 [ 96.739285][ T6007] ? __pfx_tiocsti+0x10/0x10 [ 96.743903][ T6007] ? __fget_files+0x3a0/0x420 [ 96.748592][ T6007] ? __fget_files+0x2a/0x420 [ 96.753190][ T6007] tty_ioctl+0x626/0xde0 [ 96.757449][ T6007] ? __pfx_tty_ioctl+0x10/0x10 [ 96.762224][ T6007] __se_sys_ioctl+0xfc/0x170 [ 96.766837][ T6007] do_syscall_64+0xfa/0xfa0 [ 96.771370][ T6007] ? lockdep_hardirqs_on+0x9c/0x150 [ 96.776688][ T6007] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.782857][ T6007] ? clear_bhb_loop+0x60/0xb0 [ 96.787546][ T6007] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.793457][ T6007] RIP: 0033:0x7fadd798eba9 [ 96.797900][ T6007] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 96.817554][ T6007] RSP: 002b:00007fadd88df038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 96.826000][ T6007] RAX: ffffffffffffffda RBX: 00007fadd7bd6090 RCX: 00007fadd798eba9 [ 96.834006][ T6007] RDX: 00002000000003c0 RSI: 0000000000005412 RDI: 0000000000000004 [ 96.841998][ T6007] RBP: 00007fadd7a11e19 R08: 0000000000000000 R09: 0000000000000000 [ 96.849986][ T6007] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 96.857974][ T6007] R13: 00007fadd7bd6128 R14: 00007fadd7bd6090 R15: 00007ffe76d8ea28 [ 96.866058][ T6007] [ 96.869088][ T6007] Modules linked in: [ 96.874808][ T6007] ---[ end trace 0000000000000000 ]--- [ 96.881397][ T6007] RIP: 0010:h5_recv+0x146/0x910 [ 96.882346][ T916] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 96.886482][ T6007] Code: 18 48 c1 ea 03 48 89 54 24 28 48 89 d8 48 c1 e8 03 48 89 44 24 50 44 89 64 24 14 48 b8 00 00 00 00 00 fc ff df 48 8b 4c 24 30 <80> 3c 01 00 74 08 4c 89 ef e8 1c 86 aa f9 4d 8b 65 00 31 ff 4c 89 [ 96.916039][ T6007] RSP: 0018:ffffc9000a7dfc20 EFLAGS: 00010202 [ 96.922747][ T6007] RAX: dffffc0000000000 RBX: 00000000000002e8 RCX: 000000000000005f [ 96.932062][ T6007] RDX: 000000000000005e RSI: 0000000000000001 RDI: 0000000000000000 [ 96.940399][ T6007] RBP: ffffc9000a7dfd40 R08: ffff88802842d81f R09: 1ffff11005085b03 [ 96.948724][ T6007] R10: dffffc0000000000 R11: ffffffff887a2780 R12: 0000000000000001 [ 96.957148][ T6007] R13: 00000000000002f8 R14: ffff88802842d810 R15: ffffc9000a7dfde0 [ 96.965573][ T6007] FS: 00007fadd88df6c0(0000) GS:ffff88812579c000(0000) knlGS:0000000000000000 [ 96.976235][ T6007] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 96.983058][ T6007] CR2: 00005555561d55c8 CR3: 000000007e25e000 CR4: 00000000003526f0 [ 96.991942][ T6007] Kernel panic - not syncing: Fatal exception [ 96.998377][ T6007] Kernel Offset: disabled [ 97.002710][ T6007] Rebooting in 86400 seconds..