last executing test programs: 4.289314411s ago: executing program 0 (id=5): socket$netlink(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/custom0\x00', 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x8081) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GDTEFACILITIES(r2, 0x89ea, &(0x7f00000000c0)) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast2, @in6=@private1, 0x2, 0x0, 0x0, 0x0, 0x2, 0x20}, {0x4000000000, 0x0, 0x1, 0x4, 0x0, 0xfffffffffffffff8, 0x0, 0x1ff}, {0x0, 0x0, 0x10001, 0xfffffffffffffffc}, 0x1, 0x0, 0x1, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x2c}, 0x4d3, 0x32}, 0x0, @in=@remote, 0x0, 0x0, 0x1, 0xb7, 0x3, 0xfffffffe}}, 0xe4) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0)) ioctl$I2C_TENBIT(0xffffffffffffffff, 0x704, 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000780)=ANY=[@ANYBLOB], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x0, 0xfffffffc}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x200}, 0x94) timerfd_gettime(0xffffffffffffffff, &(0x7f0000000040)) r3 = socket$rxrpc(0x21, 0x2, 0x2) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cpu.stat\x00', 0x275a, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000080)={0xffffffffffffffff}, 0x111, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r4, &(0x7f0000000380)={0x3, 0x40, 0xfa00, {{0xa, 0x4e20, 0xb, @empty, 0x3}, {0xa, 0x4e22, 0x2, @remote, 0x80000000}, r5, 0xfffffe4d}}, 0x48) syz_emit_ethernet(0x2a, &(0x7f0000000400)=ANY=[@ANYBLOB="bbbbbbbbbbbb00000000000008060001070006040001000000000000ac1414bbbbbbbbbbbbbbac1414bbf256de7f1871c559fcc4458a7e2c"], 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/consoles\x00', 0x0, 0x0) writev(r3, &(0x7f0000000180)=[{&(0x7f0000000000)="bca142dd3401f96279745ab50ec6", 0xe}, {&(0x7f0000000600)="31709439e388a84d342129acb9e341f06f82f900dcec8f3ee7492b23ffe81bd445ec18fb70011cbacdae8f49d80538c10c59050000000000000076356a963eab3a28c5c9956f70adc5f14a7d2d2eb4664ad8ab5feb63133a225c6b4faae704571613e89630b3a1f3a8a501d7f19a596efadcd2fe57c91e77502407935d32abc08a7149de17522044d4b09cb022ae9ba62c9561deed9c5f14ee828fb0308717319cdd3012860db1c09772c7f5956bf1fb7d893918301d13ee54b2b0c6b78ce399f451e3069c79bf91e21238739041466b7cc4abefe95d968f110500bfde0812095c99735a0c44726f1983108835684c72a22f5bb7c287d8170647e8fa405b875a2419e39657876c4a418d4e00f06b1ee0d8d64aca8e7bb7c8cb767db75357f451d10a9ce2c9fec9855dce43c111146956e85474672aca49d2134967b67fc16258d77e63f86b8e80071a6ddc3f85ff3d970eb9", 0x152}, {0x0}, {0x0}, {&(0x7f0000000800)="95507ac442e3f29751625a536c6bdf1e1f78d77e474968b768f2e253deafc7", 0x1f}, {&(0x7f0000000240)="45591f9060b8982314918f4da7122c78f89b3b68abe986153c15ef5c9409ce55", 0x20}], 0x6) mount(&(0x7f0000000000)=@sr0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='minix\x00', 0x221000d, 0x0) 3.333852622s ago: executing program 0 (id=6): openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) renameat2(0xffffffffffffffff, &(0x7f00000002c0)='./file1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffffff, 0x0, 0x1) socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x101400, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r1 = openat$comedi(0xffffff9c, &(0x7f0000000000)='/dev/comedi4\x00', 0x300, 0x0) ioctl$COMEDI_CHANINFO(r1, 0x80206403, &(0x7f0000071e80)={0x1, 0x0, 0x0, 0x0}) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket(0x2b, 0x80801, 0x1) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(0xffffffffffffffff, 0x3b88, &(0x7f0000000100)={0xc, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f0000000180)={0x28, 0x3, r2, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x5}) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB="000000006632eb3096e8d06100000200000000000000019c95aa79caca22043274254bb13ba76fbffc6906cc4b892af1cf34fb6aafdefd50e19f2f2a1c27e3d11ca32ba6a6d3abaf0d19f4fe4fc385acf09f24b07a9c62c2de3415096f49a921040e60dd64e402f56fdf5e5efae973180f3b05ba3c02964bbb56", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0x10, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000004000000000000000000000098110000b2c3830c287e150d9568d321362e", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09000000000000550901000000000095000000000000001daaf5ff00000000bf91000000000000b7020000020000008500000085000000b7000000000000009500"], &(0x7f0000000080)='GPL\x00', 0x7, 0x0, 0x0, 0x41100, 0xc}, 0x94) sigaltstack(0x0, 0x0) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r4, 0x0, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0185648, &(0x7f0000000080)={0x980000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0x98f910, 0x80008002, '\x00', @p_u16=&(0x7f00000010c0)=0xa5b}}) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000440)=@abs={0x1, 0x0, 0x4e22}, 0x6e) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0x1000000f, 0x80000006}, 0x0, 0x0) 2.333729775s ago: executing program 0 (id=7): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$unix(0x1, 0x2, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x44, r2, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {@void, @val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x7ff, 0x14}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'syzkaller0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x44}, 0x1, 0x0, 0x0, 0x91}, 0x24044884) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r5, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x8}]}, 0x24}}, 0x0) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000600)={0x0, 0xc, &(0x7f0000000000)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848480000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) 2.16634233s ago: executing program 2 (id=3): openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@tracing={0x0, 0x5}}, 0x20) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/246, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/70, 0x100000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) 2.044358114s ago: executing program 0 (id=8): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x4e23, @local}]}, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f00000001c0)={0x0, 0x1, 0xefe, 0x5, 0x2, 0x3}, 0x14) 2.033072984s ago: executing program 1 (id=2): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x3) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000000)=@gcm_128={{0x303}, "5335572af7aa9ec3", "0bb3bbceae3b6d56e33a5c51cbf284c6", "1363cf10", "5c892ebd183c8c13"}, 0x28) recvmsg(r0, 0x0, 0x20) shutdown(r0, 0x0) 1.975550416s ago: executing program 2 (id=9): r0 = bpf$MAP_CREATE(0x0, 0x0, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x17440000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000500)=@file={0x0, './mnt\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0xf241f1a146326c4, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./bus\x00', 0x0, &(0x7f0000000d40)=ANY=[@ANYBLOB="73686f72746e616d653d77696e39352c73686f72746e616d653d77696e6e742c756e695f786c6174653d302c756e695f786c6174653d312c757466383d312c757466383d312c646973636172642c757466383d302c756e695f786c6174653d302c666c7573682c73686f72746e616d653d6d697865642c73686f72746e616d653d6c6f7765722c646f733178666c6f7070792c73686f72746e616d653d77696e6e742c73686f72746e616d653d6c6f7765722c757466382c0014697a7960fb374b723f64329787434c6c9f891d2e309efaf1d4e529e1ba0f697fedffb095592bc19d5a8f8141ee9bf46262f3a2b1452bf206c0e2ae8a465e6e1be6eeb5d588035a24458d476fc1f9a234cdc4ba352a4185614ce67df4870bff796357ee95fffb99cde9"], 0x1, 0x2bc, &(0x7f00000015c0)="$eJzs3U9rY1UUAPDz0uQ1QxftwpUIvsUs3Fims3VhBqkgdqVk4R/QwZmBoQkDDQRGxTArP4ELF34Pd+4FN34DwYVLdw5SuPLeS5NMkkmmHdMO5ffb9HLuOe/em3fbFMK7+fKN/vG9R4MHT779I9rtLBqd6MTTLPaiEWfSWAAA18LTlOLvC72/NxubmhMAsFkz7/+t56RsL4be3fS0AIAN+viTTz+8c3R0+FFRtCP63w+7WdQ/6/47D+Jh9OJ+3IrdOJ1+FpBS3X7/g6PDaBalvbjZHw27ZWX/i98mqXlU9QexG3vL6w+K2kz9aNis/vPIsoiHnXIit2M3XluoL/sPby+pj24eb7XHiyzH34/d+P2reBS9uFd9pjEd/7s8ivfSD/9881mZXNZno2F3u8qbSluXfW8AAAAAAAAAAAAAAAAAAAAAALi+9ouJvbjZL0P1+TvdrdOqf/+Z/up8nUbVX9dnEXnVmDsfaJTip7PzdW4VRZGyOn9yvs+NZrzejOaVLRwAAAAAAAAAAAAAAAAAAABeIYPHXx/f7fXun/wvjfFD/pPH+i96nc5M5M1Ynbx9rrFia5xeznU+5+DXz/uTSLmIi0x+2CoiVs25tRC5Uc5n/ZX/TSmlLIt4udvUepGx1jR2VueUL/AvP+68fXw3W/cats9u3M+zXXmcDB7P3dPIVg96+kwknWv75Sty8vGOeaHr7LzkL9E7f9aDjSPZmlW0ZiKtcSOet/3a59rPl/c3CAAAAAAAAAAAAAAAAAAAqE0f+l3S+WRlaWNjkwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACASzb9/v9pIxYic41R/FUVL89JKY0mkTxOBle9RgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAK6//wIAAP//qWdtxQ==") timerfd_gettime(0xffffffffffffffff, &(0x7f0000000580)) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x15, 0x17, &(0x7f0000000880)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x4}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x76}}, {{0x6, 0x0, 0x2, 0x9, 0x0, 0x6, 0xe7030000}, {0x4, 0x0, 0x0, 0x6}}, [@printk={@s, {0x5, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x1, 0xa, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {}, {0x14}}], {{0x4, 0x1, 0x5, 0x3}, {0x5, 0x0, 0xb, 0x3, 0x0, 0x2}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.654031867s ago: executing program 0 (id=10): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000003c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x7, 0x2, 0x1}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4040001}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000023c0)=@newtfilter={0x24, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, r7, {0x0, 0xffff}, {}, {0x8, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x2004c800}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000b00)=@newqdisc={0x24, 0x29, 0x4ee4e6a52ff56541, 0x4001, 0xfffdfdfc, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0xffff, 0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x400c0}, 0x44840) 1.653872437s ago: executing program 3 (id=4): add_key(&(0x7f0000000100)='big_key\x00', &(0x7f0000000140)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/keys\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000001580)={0x2020}, 0x2020) 72.020128ms ago: executing program 1 (id=11): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000000}, 0x20000884) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001340)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd25, 0x8004, {0x0, 0x0, 0x0, r8, {}, {}, {0xa, 0xb}}, [@filter_kind_options=@f_u32={{0x8}, {0x15, 0x2, [@TCA_U32_DIVISOR={0x8, 0x4, 0x2}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x80}, 0x24040812) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r3, {0xc, 0xc}, {0x0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) 21.17439ms ago: executing program 0 (id=12): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000740)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x5}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x2c, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x81, 0x0, 0xee8, 0x1c, 0x0, 0x8}, {0x7, 0x2, 0x7, 0x1003, 0x5, 0x20000005}, 0x6db6312a, 0x7, 0x1257}}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0x3}, {0xffff, 0xb}, {0x0, 0x5}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4004}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r1, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r7, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214000600002fb96d", 0xe}], 0x1}, 0x0) 0s ago: executing program 3 (id=13): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) syz_emit_ethernet(0x72, &(0x7f0000000300)={@link_local, @local, @val={@void, {0x8100, 0x5, 0x1, 0x4}}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x38, 0x3a, 0xff, @local, @mcast2, {[], @param_prob={0x4, 0x1, 0x0, 0x1, {0x3, 0x6, '|6M', 0x6, 0x2f, 0xff, @mcast2, @private0, [@fragment={0x33, 0x0, 0x1a, 0x0, 0x0, 0x8, 0x66}]}}}}}}}, 0x0) setsockopt(r0, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f00000005c0)={0xa, 0x4e22, 0x8, @empty, 0x9}, 0x1c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() prlimit64(0x0, 0x4, &(0x7f0000000040)={0xfffffffffffffffc, 0xffffffffffffffff}, 0x0) prctl$PR_SET_MM(0x23, 0xa, &(0x7f0000ffc000/0x1000)=nil) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r5 = syz_open_dev$swradio(&(0x7f00000004c0), 0x1, 0x2) ioctl$VIDIOC_ENUM_FREQ_BANDS(r5, 0xc0405665, &(0x7f0000000000)={0x7, 0x4, 0x800, 0x100, 0x6, 0x311ced26, 0x4}) r6 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_ONE_REG(r7, 0x4048aecb, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendto$inet6(r0, &(0x7f0000001580)='t', 0x1, 0x0, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.173' (ED25519) to the list of known hosts. [ 73.315384][ T5763] cgroup: Unknown subsys name 'net' [ 73.453833][ T5763] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 74.850445][ T5763] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 76.266775][ T51] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 76.280456][ T5786] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 76.288237][ T5786] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 76.296472][ T5788] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 76.317986][ T5788] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 76.336432][ T5786] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 76.337224][ T5788] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 76.345036][ T5786] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 76.351250][ T5787] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 76.358574][ T5786] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 76.365720][ T5788] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 76.373450][ T5786] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 76.382380][ T5788] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 76.387635][ T5789] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 76.393622][ T5788] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 76.399744][ T5790] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 76.408407][ T5788] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 76.414763][ T5789] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 76.428657][ T5790] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 76.439310][ T5788] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 76.465850][ T5786] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 76.477543][ T5786] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 76.485415][ T5786] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 76.493562][ T5786] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 76.863877][ T5776] chnl_net:caif_netlink_parms(): no params data found [ 76.925069][ T5775] chnl_net:caif_netlink_parms(): no params data found [ 76.951310][ T5778] chnl_net:caif_netlink_parms(): no params data found [ 77.028993][ T5777] chnl_net:caif_netlink_parms(): no params data found [ 77.097908][ T5776] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.105643][ T5776] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.113384][ T5776] bridge_slave_0: entered allmulticast mode [ 77.120838][ T5776] bridge_slave_0: entered promiscuous mode [ 77.136456][ T5776] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.143747][ T5776] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.151267][ T5776] bridge_slave_1: entered allmulticast mode [ 77.158665][ T5776] bridge_slave_1: entered promiscuous mode [ 77.224261][ T5775] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.231891][ T5775] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.239551][ T5775] bridge_slave_0: entered allmulticast mode [ 77.246250][ T5775] bridge_slave_0: entered promiscuous mode [ 77.270531][ T5778] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.277848][ T5778] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.285261][ T5778] bridge_slave_0: entered allmulticast mode [ 77.292246][ T5778] bridge_slave_0: entered promiscuous mode [ 77.299611][ T5775] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.306739][ T5775] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.314967][ T5775] bridge_slave_1: entered allmulticast mode [ 77.322039][ T5775] bridge_slave_1: entered promiscuous mode [ 77.344863][ T5776] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.354157][ T5778] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.362867][ T5778] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.371788][ T5778] bridge_slave_1: entered allmulticast mode [ 77.378818][ T5778] bridge_slave_1: entered promiscuous mode [ 77.422539][ T5776] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.435929][ T5775] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.447852][ T5778] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.460955][ T5778] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.480865][ T5777] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.488125][ T5777] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.495271][ T5777] bridge_slave_0: entered allmulticast mode [ 77.502470][ T5777] bridge_slave_0: entered promiscuous mode [ 77.521922][ T5775] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.548883][ T5777] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.556155][ T5777] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.563785][ T5777] bridge_slave_1: entered allmulticast mode [ 77.570655][ T5777] bridge_slave_1: entered promiscuous mode [ 77.610685][ T5778] team0: Port device team_slave_0 added [ 77.619650][ T5778] team0: Port device team_slave_1 added [ 77.641378][ T5776] team0: Port device team_slave_0 added [ 77.652748][ T5775] team0: Port device team_slave_0 added [ 77.679649][ T5776] team0: Port device team_slave_1 added [ 77.687557][ T5777] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.698908][ T5775] team0: Port device team_slave_1 added [ 77.713049][ T5778] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.722347][ T5778] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.748667][ T5778] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.776838][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.783979][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.809982][ T5776] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.823661][ T5777] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.852389][ T5778] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.859530][ T5778] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.885565][ T5778] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.906502][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.913605][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.939888][ T5776] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.960928][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.968046][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.994603][ T5775] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.034877][ T5777] team0: Port device team_slave_0 added [ 78.044184][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.051933][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.084942][ T5775] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.124768][ T5778] hsr_slave_0: entered promiscuous mode [ 78.131477][ T5778] hsr_slave_1: entered promiscuous mode [ 78.139850][ T5777] team0: Port device team_slave_1 added [ 78.166003][ T5776] hsr_slave_0: entered promiscuous mode [ 78.172642][ T5776] hsr_slave_1: entered promiscuous mode [ 78.179435][ T5776] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 78.187502][ T5776] Cannot create hsr debugfs directory [ 78.203720][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.211080][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.237957][ T5777] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.283450][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.290649][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.316879][ T5777] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.341955][ T5775] hsr_slave_0: entered promiscuous mode [ 78.348299][ T5775] hsr_slave_1: entered promiscuous mode [ 78.354755][ T5775] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 78.362577][ T5775] Cannot create hsr debugfs directory [ 78.439216][ T5777] hsr_slave_0: entered promiscuous mode [ 78.445565][ T5777] hsr_slave_1: entered promiscuous mode [ 78.452121][ T5777] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 78.458002][ T5784] Bluetooth: hci0: command tx timeout [ 78.460269][ T5777] Cannot create hsr debugfs directory [ 78.547078][ T5784] Bluetooth: hci3: command tx timeout [ 78.547226][ T51] Bluetooth: hci2: command tx timeout [ 78.552754][ T5784] Bluetooth: hci1: command tx timeout [ 78.794728][ T5776] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 78.810367][ T5776] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 78.819951][ T5776] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 78.837568][ T5776] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 78.872799][ T5775] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 78.890991][ T5775] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 78.902684][ T5775] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 78.912224][ T5775] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 79.001817][ T5778] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 79.030395][ T5778] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 79.061561][ T5778] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 79.072956][ T5778] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 79.134801][ T5777] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 79.161915][ T5777] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 79.171656][ T5777] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 79.183840][ T5777] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 79.210016][ T5775] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.276237][ T5775] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.299478][ T5776] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.321043][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.328396][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.365587][ T5776] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.376418][ T1077] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.383605][ T1077] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.406908][ T1077] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.414087][ T1077] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.449142][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.456254][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.495153][ T5777] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.566106][ T5778] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.594240][ T5777] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.629455][ T5778] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.637911][ T4222] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.645041][ T4222] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.679085][ T4222] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.686252][ T4222] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.708465][ T4222] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.715641][ T4222] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.784473][ T4222] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.791684][ T4222] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.850424][ T5775] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.015658][ T5775] veth0_vlan: entered promiscuous mode [ 80.061043][ T5775] veth1_vlan: entered promiscuous mode [ 80.134117][ T5776] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.174725][ T5775] veth0_macvtap: entered promiscuous mode [ 80.209436][ T5775] veth1_macvtap: entered promiscuous mode [ 80.293080][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.306014][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.325645][ T5775] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.334988][ T5775] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.344045][ T5775] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.353867][ T5775] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.368986][ T5777] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.394987][ T5776] veth0_vlan: entered promiscuous mode [ 80.423809][ T5778] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.441579][ T5776] veth1_vlan: entered promiscuous mode [ 80.537511][ T51] Bluetooth: hci0: command tx timeout [ 80.569289][ T4222] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.584331][ T5777] veth0_vlan: entered promiscuous mode [ 80.588184][ T4222] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.613016][ T5776] veth0_macvtap: entered promiscuous mode [ 80.619044][ T51] Bluetooth: hci1: command tx timeout [ 80.627663][ T51] Bluetooth: hci2: command tx timeout [ 80.628166][ T5784] Bluetooth: hci3: command tx timeout [ 80.668720][ T5776] veth1_macvtap: entered promiscuous mode [ 80.686119][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.703449][ T5777] veth1_vlan: entered promiscuous mode [ 80.712448][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.721083][ T5778] veth0_vlan: entered promiscuous mode [ 80.740116][ T5778] veth1_vlan: entered promiscuous mode [ 80.799697][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 80.818926][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.832685][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.856301][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 80.868692][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.880751][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.896109][ T5777] veth0_macvtap: entered promiscuous mode [ 80.950237][ T5778] veth0_macvtap: entered promiscuous mode [ 80.963170][ T5777] veth1_macvtap: entered promiscuous mode [ 80.974276][ T5836] netlink: 'syz.0.1': attribute type 1 has an invalid length. [ 80.984287][ T5778] veth1_macvtap: entered promiscuous mode [ 80.994868][ T5776] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.003940][ T5776] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.013123][ T5776] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.022195][ T5776] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.034135][ T5836] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1'. [ 81.048996][ T5836] gre0: entered promiscuous mode [ 81.053978][ T5836] gre0: entered allmulticast mode [ 81.130201][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.141797][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.151794][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.163556][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.187976][ T5778] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.206765][ T5836] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1'. [ 81.233715][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.257847][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.269057][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.279691][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.289691][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.300274][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.321087][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.347889][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.364490][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.379977][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.394992][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.412778][ T5778] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.436289][ T5778] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.445678][ T5778] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.455343][ T5778] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.465390][ T5778] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.662929][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.706418][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.740641][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.773749][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.788935][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.813162][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.846311][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 82.056880][ T5777] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.084695][ T5777] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.106891][ T5777] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.135573][ T5777] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.292145][ T4222] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.300553][ T4222] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.627073][ T5784] Bluetooth: hci0: command tx timeout [ 82.697314][ T5784] Bluetooth: hci3: command tx timeout [ 82.703034][ T5784] Bluetooth: hci2: command tx timeout [ 82.767404][ T51] Bluetooth: hci1: command tx timeout [ 82.839273][ T4222] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.890613][ T4222] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.236312][ T4855] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.249229][ T4855] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.272753][ T4222] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.296780][ T4222] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.355302][ T1077] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.371767][ T1077] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.387135][ T5853] netlink: 'syz.0.7': attribute type 10 has an invalid length. [ 83.445673][ T5853] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 83.550619][ T4222] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.583979][ T4222] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.001192][ T5870] syz.2.9[5870]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 84.040622][ T5870] loop2: detected capacity change from 0 to 256 [ 84.199606][ T5870] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 84.697220][ T5786] Bluetooth: hci0: command tx timeout [ 84.787319][ T51] Bluetooth: hci3: command tx timeout [ 84.792846][ T5784] Bluetooth: hci1: command tx timeout [ 84.798563][ T5786] Bluetooth: hci2: command tx timeout [ 85.386942][ C1] sched: RT throttling activated [ 85.901715][ T5883] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 85.932816][ T5882] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11'. [ 86.003661][ T5884] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 86.034884][ T5884] [ 86.037757][ T5884] ============================= [ 86.043249][ T5884] WARNING: suspicious RCU usage [ 86.048342][ T5884] syzkaller #0 Not tainted [ 86.052774][ T5884] ----------------------------- [ 86.057828][ T5884] net/mac80211/iface.c:378 suspicious rcu_dereference_protected() usage! [ 86.066264][ T5884] [ 86.066264][ T5884] other info that might help us debug this: [ 86.066264][ T5884] [ 86.076667][ T5884] [ 86.076667][ T5884] rcu_scheduler_active = 2, debug_locks = 1 [ 86.085039][ T5884] 1 lock held by syz.0.12/5884: [ 86.089953][ T5884] #0: ffffffff8e3c6988 (rtnl_mutex){+.+.}-{3:3}, at: dev_ioctl+0x7a4/0x1140 [ 86.099691][ T5884] [ 86.099691][ T5884] stack backtrace: [ 86.105632][ T5884] CPU: 1 PID: 5884 Comm: syz.0.12 Not tainted syzkaller #0 [ 86.112864][ T5884] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 86.122984][ T5884] Call Trace: [ 86.126283][ T5884] [ 86.129246][ T5884] dump_stack_lvl+0x18c/0x250 [ 86.133924][ T5884] ? show_regs_print_info+0x20/0x20 [ 86.139122][ T5884] ? load_image+0x420/0x420 [ 86.143710][ T5884] lockdep_rcu_suspicious+0x1e1/0x300 [ 86.149082][ T5884] ieee80211_check_concurrent_iface+0x475/0x950 [ 86.155332][ T5884] ieee80211_open+0xc1/0x200 [ 86.159932][ T5884] __dev_open+0x2cb/0x430 [ 86.164275][ T5884] ? dev_open+0x190/0x190 [ 86.168633][ T5884] __dev_change_flags+0x211/0x6a0 [ 86.173679][ T5884] ? dev_get_flags+0x1c0/0x1c0 [ 86.178442][ T5884] ? mutex_lock_nested+0x20/0x20 [ 86.183386][ T5884] dev_change_flags+0x88/0x1a0 [ 86.188155][ T5884] dev_ioctl+0x7b4/0x1140 [ 86.192504][ T5884] sock_do_ioctl+0x239/0x310 [ 86.197112][ T5884] ? sock_show_fdinfo+0xb0/0xb0 [ 86.201985][ T5884] sock_ioctl+0x5ba/0x7e0 [ 86.206324][ T5884] ? sock_poll+0x3e0/0x3e0 [ 86.210776][ T5884] ? bpf_lsm_file_ioctl+0x9/0x10 [ 86.215733][ T5884] ? security_file_ioctl+0x80/0xa0 [ 86.220852][ T5884] ? sock_poll+0x3e0/0x3e0 [ 86.225293][ T5884] __se_sys_ioctl+0xfd/0x170 [ 86.229891][ T5884] do_syscall_64+0x55/0xb0 [ 86.234330][ T5884] ? clear_bhb_loop+0x40/0x90 [ 86.239011][ T5884] ? clear_bhb_loop+0x40/0x90 [ 86.243777][ T5884] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 86.249770][ T5884] RIP: 0033:0x7fe264f9ce59 [ 86.254209][ T5884] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 86.273845][ T5884] RSP: 002b:00007fe265e9c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 86.282286][ T5884] RAX: ffffffffffffffda RBX: 00007fe265215fa0 RCX: 00007fe264f9ce59 [ 86.290272][ T5884] RDX: 0000200000002280 RSI: 0000000000008914 RDI: 0000000000000006 [ 86.298252][ T5884] RBP: 00007fe265032d6f R08: 0000000000000000 R09: 0000000000000000 [ 86.306226][ T5884] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 86.314297][ T5884] R13: 00007fe265216038 R14: 00007fe265215fa0 R15: 00007ffdde63e488 [ 86.322313][ T5884] [ 86.382419][ T5884] mac80211_hwsim hwsim3 syzkaller0: entered promiscuous mode [ 86.391335][ T5884] mac80211_hwsim hwsim3 syzkaller0: entered allmulticast mode [ 87.029470][ T23] cfg80211: failed to load regulatory.db