last executing test programs: 1m5.291976573s ago: executing program 0 (id=13): socket$kcm(0x10, 0x3, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) setresgid(0xee00, 0xee01, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) close(0xffffffffffffffff) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r4, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r4, 0x84, 0x15, &(0x7f00000000c0), 0x1) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) sendto$inet6(r4, &(0x7f0000000080)="b1", 0x1, 0x400c0d4, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0xffffffff}, 0x1c) prlimit64(0x0, 0x3, &(0x7f0000000140)={0x928, 0x200000008b}, 0x0) r5 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) listen(r5, 0x0) 1m2.441024818s ago: executing program 0 (id=15): unlink(0x0) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x0) pwrite64(r3, 0x0, 0x0, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000004"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000040)='sched_switch\x00', r4}, 0x10) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) r5 = socket$inet(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r5, 0x4000000000000, 0x40, &(0x7f0000002700)=@raw={'raw\x00', 0x8, 0x3, 0x2a0, 0x208, 0x8, 0xfa04, 0x0, 0x6c02, 0x208, 0x194, 0x194, 0x208, 0x194, 0x3, 0x0, {[{{@ip={@empty=0x1e00, @broadcast, 0x0, 0x0, 'veth0_to_hsr\x00', 'veth0_virt_wifi\x00', {}, {}, 0x6}, 0x0, 0xa0, 0xc8, 0x0, {0x0, 0x74020000}, [@common=@inet=@tcp={{0x30}, {[], [], 0x0, 0x0, 0x7a}}]}, @common=@inet=@TCPMSS={0x28}}, {{@ip={@multicast1, @rand_addr, 0x0, 0x0, 'batadv_slave_0\x00', 'pimreg\x00'}, 0x0, 0xf8, 0x140, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@connlimit={{0x40}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x300) sched_setaffinity(0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) keyctl$set_reqkey_keyring(0xe, 0x4) request_key(&(0x7f0000000340)='user\x00', &(0x7f0000000380)={'syz', 0x3}, &(0x7f00000003c0)=')\x00', 0x0) 59.996824862s ago: executing program 0 (id=19): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0xff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000400), 0x200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x236, &(0x7f0000000400)={0x0, 0xf691, 0x10100, 0x0, 0x2b5, 0x0, r1}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r2, 0x708, 0x41e3, 0x0, 0x0, 0x0) r5 = open(&(0x7f0000000180)='.\x00', 0x2000, 0x0) flock(r5, 0x2) r6 = open(&(0x7f0000000180)='.\x00', 0x10000, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_open_procfs$namespace(0x0, 0xfffffffffffffffe) flock(r6, 0x1) flock(r6, 0x2) close(r5) r7 = io_uring_setup(0x191a, &(0x7f0000000000)={0x0, 0x761, 0x10, 0x4, 0x11cb}) io_uring_register$IORING_REGISTER_BUFFERS(r7, 0x20, 0x0, 0x0) 58.38366368s ago: executing program 0 (id=21): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000300)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001bc0)='\v', 0x1) r1 = accept4(r0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_TX_TS(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)={0x1c, r3, 0x1, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r4}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x800) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_emit_ethernet(0x2a, &(0x7f00000003c0)={@local, @random="50a245d5cde0", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x100, 0x0, 0x0, 0x2, 0x0, @empty, @broadcast}, @address_reply={0x12, 0x0, 0x0, 0x8}}}}}, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{0x0}, {&(0x7f0000007380)="77ad6ce4603dbbc2126089e03c787d54f5970fb83325deb19c4ff38ee461aed0c5c6bfcba81bf07acc1ffa8397c0093760e1d52b1ac5347e172b2ca8feb4c91d885d640bf757305378c6fa1bdd75b878e7ed479fa21c218c2b083f2fed52d1f8562da20e3648c860574f69dc76394f34a58f3bf58ba818513e0ddc38fb189c9d5f68ceab50ffdf36a266107ba61182b410522a37e7dc1ebe908879eab6abf5d54f0f46124a60853162629819090f1a5f95015d61005074d534e28979ba1b099917f5d74643a644b5e3570405824773db7a9393834c36dbcc4fe7c9a9181fad62f0eeff5785e3eb4dafc5cd4e0633f01a57a9e48b186666dddf4ad657092cd1e9516a2ea50bbe2c878d892ec33737f101ba89f94f39e1198fc87e8b9f31173936ee27ae772ee251419f6b638f7b58c36069950f6ed27c582cb2994c4149a22ad682fb573cbc0854fa4cd9290c8991aac028a7abeff2fd8d0252200ece8f41b2237fbce3135bc351773f5351c298ebac8dca385f8569cacb5963fcab9eea82026b15f1d81f742c47101fa2918eb055f04320b718d744ed8efe479ff76b32374ff096cf02268d34f15a7ad99b84f9370c23fa2917149e992f4a2291c6b237c2c558b294ab16a816a340831ab64e0da042cb67494e53e9dfd0610c38e12e5cb824ac2e860fb4e32aa67861397a6e85fc483ab2d852b6bde895c630667b528de2acd654f18154a74d257ed4d7f4dda0b5fecdc13011aaaec4e68f51215e56e1a7d39210abfeecd68dde604534a26c6131150ea0bd4fa124a351334bb02e6110af294b72ea359981d62e4d5f878501f4816ba339cdeec76c0de83f6fcbdeeb07de5a216e958c0c2caebfa063dc004a470d96a8ba8f7517393975eec732e1362447bb7153890307a15a4597785e7f435ff4b9634deb1cf2e4a8aa5e3c4b4a8f43797378a085c20f2e754007c441bad4e1ebaf36dddd6ea543afc11d63ba0889d6ca3062519c384d5c66fa869a8c6e3dec87f66be8ed8937bfc167e14e5f52b166aa3da13336f59f52c91572c71cb3873fdf6d34ff58bdf79001e93700db2330197bd1974af9eb9c174219f829c8808461a84142d7b15282a41c235a605e51aff9aa4e15c299765450f379cae75526e09d54824e25a32e4a22b15a2e470eddba8b0e9406fc9f14d4850ff001f918ff359401c980f557754effe8b40e9736de8e2ec66bbd0e6772f985999475c89d8e1523f9df15ab67e5c5ee453d881eee7b3261814485cf6906a3f98b7a145a2bc15c8ee7a7250762f8d683f986f730c59fc8e689ca3c5fa428d9fb38a3f7386657d420ed3a9b204c74b40cbc779227d2104a16930e2ff3c0f1c96995270070b47ca1748358fa9bb022a11828c05d83452a59bfeef20b5cc00cfe6306d18683dfed030756ed5d584b0d398ce0c75d11be88e6be8ecf0303017f4b2b825c63109b5f1c68259fcbc1620d8a36478d3c8af07bb8462701f3d683c8fb98485ca67416ac5f4f3b75b65e11ed603321548602c8848398c100b1d435581275c929bc67c17d63b6d34947df4e56d2bd1ad62068746b8d1740d81e7277ab1d9c256689e68b137e432c942ded1f1121be6c29e59627f46fbcf68bf0c0a953bb53cca582bcc05add64778fe4421f0b2a464bbec5c5898cd20bb8331a103dfb7aadb246e67eb5c6944a512d03094d6c94e6e37712c216515fb37b0fa831ac59a063cc5dda6f281d5858ac3bc9be69d82a02de83ee3251eba0e830f5ab849fb8c3fc5dbf39bc03888a4d79513ff678b3f1a60e650ed2ce6e317c7acf8ee21b5b3caecce88c9fcc9369d16ec5ace072a6c2faeca0bf1e192536e79888f168f9b06af130cd27c8f82d673f3c92e9e15fba87bc0029aa05c6c812098cdca9ec54b03f2949931ba2b650c36206f60009912de9135e002a978bf297de886b9440caeb6e15d613ffe9e8f8cc355983b0d0c5f95039bf7fc6e7373a0d29924256c6647462143836103bbd0791c33f44b193eff4766dadfbed919a7be6ecf87d8c8457f4903a374cb7dec5bf21d4d5392871868bfb6261c0dd1c5c44f45ab50f3c6b7c47f12e7b5940b0512c75599390ba0f167247e6a0557cc9eb5a7ed99c310b33c50dd2b57df3de1af4ae7a889056fc0e7c753cbd8354f0fe5bcb6e1418b5b0e41f51ae2a49069d742aa38f1fb716f0db57d068f9255f0f5faf16aafce09db86cd23c0f5721ed10749bba99b93f9224a18b9bc892b18e516cf352ec563248eea9ee5d1d8e8e87ad89f3c9cf69f7ea35f5fa8d3c20f1a6a4da2b9d0f513109fa0188dc596b70c211c6f6a85abd7e542cf74e5421b5a2139def64a03ff4364d593398c092989665f3dd93968a489e48a168b3c4a88368be39d8bf40a053c4f019e7eb016940976963af0ffd31b9363f5cdadb29b1ab1058b52c4952d761acf4aba01ca32720c8eaa66930db8721eee2fd5b7d9d065e5761f067a4c0e86ce583516363d2c6148c23123d24c8bef66981742a3eef541d7443b967a6c7b932bbab66390af623ee036ad2a6c4f016c0421cbffe50b43892a15cc9b3c689560b2e5f479d34f833345600ce377c076e5638a95c2245fc3eeedb101f625f3ca3caaeeb16c35a4e972552ea4a54f57e9f66a7713f675ddf042cf39d597cf825464a3885cd5150373c09087d45706d946e7d16ddea6ca84bd7460b2fe02aeb2d90f2466fbc25a7b9465283cadb961dcce07b871f2eb9ed207d92c2406bbaa5a5a016254735f518f3eef1168461ef2983a2a649c5faab14d415c841c101efa1a6dcb924cb8027c64a3e87be10419d25168730e55cc4719a6cdde6a08fd1dea43d041a6345a961cfdfb13e94679dad6e368428b196164058d93f73107ab5acb80ab5b673f506cb1ece2a8b6a2c227e26c79b8f6ce41cecc5065984afe1872feab94bcccf7e873b4641e2b3ebe20c1adf3ce2e99be96f5e0f7cded48ad3cab991fbe10b8843dc212f17b2bce2b92a1410d9c43420abfa9338960c1b7942e8a6206392b81b58565eb90b094e329011831f8844fd6029602421b831626817ddf48717914f1bcf4abca8b8a3f9331ca47be485e7d0856a1148c0704cf7e0d436cee90a2212c376c91c170bae0c1a6fca5f84740e97015b3c30835513df97bb5e8c8c38d4d4af43c783886e40868a5287f897fc635a0e51c2ce7ce7ffe19a5c00a63e640bbe7e3e8f5c322c05734c936c65742e86a26205ae5d2677631afdcd405ced0f894918ca7e0242c119d7dd7329c4aaeac4ecf5d0d0e2f5cf7a3ae31f586cd1fe2947831884398fed27216e554ab70a72db3aafccd904d94ca03914db49b0dac8a8c76ced4dd230d5906bf79c10ee8250f14a8dfd6d1b11833426009b21d1dbca0c7fdf86e5048a5b840f854ce8ad963623d4d4db57a612f19dabaafb44d80d7693735da8c6951c54ed8862374f59fcf66ec9f978f18fb8e7a77e09537f03b8884f95bc9b2d6b9758959ee12b292c4c8870ca8402de26fc1c37a2a973ecc284cbbf471dceac8d68bf5e1c5ddd2ccc20fbb6ebb19ab06fce5fb44cb56b7c732528eea9caca766a88c23982ab76f31d721edf93deacf87d7db0bfc7b4b84e110a1545abea98fac75014697a9e5ebd69e090b5d30e127593d7588a5b98de62cb6a86a3e8b775f8962c3457384b25bd7d83582e0ea347891ea66dd4c7b14034eef50e8c3f80582ea9e48b8b34a1b189b8e75ff0595e832ea5ac7049a0e5ac48c8f93806654094c88cea3b0f9f52221a489976597863fb72aa0be3e034f00c7bd366e203f3525b179ee8f4a5898db7152414f05f2f5ccc06d511fb28775b2cf0e054de01f70cd69920a66ba4893834678fdd7cbc6f41b62f6502a3730fe0cad1498fdf408c23da619732056a6a33bbf70b4ac8c91f707ef3cd469921c7333ad2b4e4b14bd1bafc5659287258e7695ae761f80cf87313db1337dad4ba1a57e245dc279530a30aa7c90f892bbcd9377f17d38619ad460727c97d1c64f40036fdeb4aa1b4646516d596fd0118de15ad20d6fac7cee1b23a7944757e2c15f2954bccfbe18e17ac4d33a4bb4babe0205b1da5a91d7bb1ef442eb5542147a58802e10e77c770a80924dd857067c64726140f71f3b2bd24fc361076be5b6476f3beaa8eeb46c3bddd90e834029832054f8a3bc48645421cb2c02c60f0ea882eba65d768f0edbdb8cb1ca99f36aba26620146b1b733145288ff47af1aaa4db91a4255905425ae9fb9bf526bbb9c186b2f95cc9776880b3b314677b807389d0b0146577930481de3b26c736130f22332284fe8394ceaa527b444aac8b0f41d0f0623ae85e9fea47a2b40f4147aa9070729b45800e9265985fb4a6e8cec52bc1ce664d23419b9e4561ca14b3b4313c7b8051dd63c90b4557a01600c745645db56594802a94fc22b678ab7cb1e3cc38b8afc16889683f19c122f55945b0216b0a7395d9a92fb0be62279c873ef506688ac244e7bf4aee087d43b61b9a705dc8f121e00576dadc7956a6db722ea7a3f2b39dc1187b28124475d261241906db6f6cf9b68fbe2ab994d1819c0beed5447c76bdcf6cee8f4f4fdd16164f4a4f4ba7f4424ccd5d3414ab37ab6923bd06dbe5b37ae3c73fa19fb9b4625f9768d1c69da2bba306d89cde4a83a706707f1968682f593ecc7b9ca8f4e10d98f3cd0c240b4aab7db0ef64e8adac4a881ae3cc327ae5592896a1783b1ca6b7e46a3fa7494d047f536617ca9e71a624838e078001cb962b0121442f8c646765d1480781facb5e42b48cb017adbd91295b1256216ed6b59cceee688c8c091a298c878fe8bea1f2d206a3ae6590d44a652c9d23553a4d28e3aa14f07cb6c96ba82ec351bc126a5d8bf841d209eca36de35a8bb1977175a706ce01dc71a1aa5b08e055b7a425cf07a5320ce4770aa15b221f94c9d551864f8d54d33567473446c0c5cbc142f68c21ffbfb17b6657bff7e63bf4d4bbb611ee1b575b3e50e6d2d034e179997b62405ba6388e562ae7627691f247cb6a69f8a2f145deca5ee12067356732d17004f196eabe15346b8965acac29429204b8c6726bbfe9cc63952ed53b3f030c8d700d0b8a7f829be4d2251742ad0a26f968d0fffedc1cdd7f4a5224ba8cfe0f7b0ad17bab9179b548b06ba08e2d085c17a32eeee24137207ec10038d573079e65623ec717d7b74c0876d4accf39cdcf3a792e138e1887b240ca2834fe0c156ce881fb1b8f30cd568c1bfc2b35bde17883f88eebae695b0ade4f444483e322d016f427da3b87f995d99358230785913984dcdd7fc80ebb752391ccc3507b6544ea415bf9e566fd03e525a95be24803c1c7ab814f65e67ffc6a6ed402ad02d5643284a832cf21cd361ac93d78aba70f213d6e15dd1dbeb4b7686e5c34d7b50c4da7dad6f25981030883f2b3a10440560815ec7aae6656ada483bb677cc3fc7491deacac09be381c1de00ecdda3e5efc09e8732387ef51be233a9d878776d916dcec960a8ba204b4b8bbcacdf92b2b0b1778e3392bb9770c155e3d91783882fa158123eed96b93309b092b6e4ac1f056d4d0e04898f0ad782f88241d8b903a787419877dae66f42f5150b1704db78d14956db318271cb175fce3f08361fd7ec562734e57d09f3b1973b89be06d9f963a433eedaac4a929f08522e2ae81af8e157af725ceb0866cbc2105f8db32f0ed9fbb7e386a3fa4f9567ab9af91528aa699bfd332080c47a6b989e80edbb85d39b46dd6a72baf01d0fe3fd8c5254559015eb4460c75bb1029a32bc109ca7f546b7ee19f", 0x1000}, {&(0x7f0000008480)}], 0x3) process_vm_writev(0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/170, 0xaa}], 0x1, &(0x7f00000006c0)=[{0x0}, {0x0}], 0x2, 0x0) r6 = getpid() ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000380)={'ip6tnl0\x00', &(0x7f0000001a40)={'syztnl1\x00', 0x0, 0x29, 0x2, 0x0, 0x800, 0x2, @private0, @local, 0x20, 0x80, 0xff, 0x2c75}}) r7 = syz_pidfd_open(r6, 0x0) setns(r7, 0x8020000) mount$bind(0x0, &(0x7f0000000100)='.\x00', 0x0, 0x920421, 0x0) mount_setattr(0xffffffffffffff9c, &(0x7f0000000180)='.\x00', 0x8000, &(0x7f0000001dc0)={0xf}, 0x20) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) recvmsg(r1, &(0x7f0000001c00)={&(0x7f0000000040)=@hci, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000400)=""/248, 0xf8}, {&(0x7f0000000a40)=""/4096, 0x1000}, {&(0x7f0000000540)=""/228, 0xe4}, {&(0x7f0000001c40)=""/238, 0xee}], 0x4}, 0x40003e00) 55.163469082s ago: executing program 4 (id=25): bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001140)={0x11, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_open_dev$vim2m(0x0, 0x7, 0x2) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='net/snmp6\x00') write$rfkill(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) preadv(r4, &(0x7f0000000040)=[{&(0x7f0000000140)=""/4096, 0x1000}], 0x1, 0x8, 0x8d3a) r5 = openat$smackfs_load(0xffffffffffffff9c, &(0x7f0000000080)='/sys/fs/smackfs/load-self2\x00', 0x2, 0x0) write$binfmt_script(r5, &(0x7f00000001c0)={'#! ', './file0', [{0x20, 'BWXr'}]}, 0xfffffd81) bpf$MAP_CREATE(0x0, 0x0, 0x50) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 54.457303911s ago: executing program 0 (id=26): socket(0x10, 0x3, 0x0) r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) setsockopt$sock_timeval(r0, 0x1, 0x42, 0x0, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_RECV_OWN_MSGS(r1, 0x65, 0x4, 0x0, &(0x7f0000000080)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'bond0\x00'}) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) lsm_get_self_attr(0x64, 0xffffffffffffffff, &(0x7f0000000040)=0xfffffffffffffdb1, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000001c40)=ANY=[@ANYBLOB="61128c000000000061134c0000000000bf2000000000000007000000080000002d0301000000000095000000000000007126000000000000bf670000000000005601000000ff07ad67060000020000006a0200000ee60000bf250000000000003d350000000000006507000002000000070700004c0000001f75000000000000bf54000000000000160400000400f9ffad3001000000000084000000000000004500000001f0ffff95000000000000006e8ad524a56601a5585b7351ca1136aef2e9407e5c2501d11900db85604036883647b1fb3f1403b816f511c8c56e56e40b01005505f8a89dae4293b10f3631b25fc9f189084c7fddccff01361d355f6cce8ec2abcdf1bc9040daef2cfa2046e2091e269f4734ffa55eb2d4e8de20b38c8808b365b46bd54c68cd30139a8c3827a7dd6d6e2b5fea3906f8456b0000000000ff07efffffff0047018ae79db613d2aec070f718ab629b4975320dd7a7da532281fd22c7b835005bf52715396669836db6000000005b4f0591ee7c8cd263dd172b28d01c4d8d4fee81e3cdd5daf2cdad3d1a74a2f078aa6402483856a6e494408d0b33047f06aec2cc590df28efc7dbec6857db922195a271af103f03e1155197e067b2ebf4e2dae060959c9639564f000fc3cdd05a1575c91cf5ba8b2db403681ee48f5287123a0d246c0c4c00fe979dbc09ed4db22d7172adc6ae8faa5f9ad188e07000000000000008d88a0b4684559d46cae41db1b914e93f1f8000000000000000000e33de432e488ad0e724c2d14a1e770e116984a5700afb8a1f3d47277ef0e33e7e00ec5f74e10937ba0e321346977b7d1b18013f509675b5b0f352e30dffda780e95c301f4fc7d5a76475ace6b128b02bfd71023daffdf748a6bd356fcba6ec96373d1101000736ac0bbcb5f4836bddfe8bf46308000000ade9e59fcf271bb98bd0b8b5216b858b414c31682f9f3db2e4d8e5898e445fe55ac56c0d642986f8bbc7340bc6393f774318c9fc9b05788de2c6e601b50777e8dff581de1d5ae3d801ead7eba31126e2172fa1eadf5f3bec81004d00000000c8e4692e051c731f9ac766b7fd66278d40f0760f23e8c7d1f47cd8e02504e85e152955ad8acd989c0b2eea71414f533f5685c3904bfe1d0011ffc1ba5398f3d6812467c1a4186edd036f15bf847c50f79e1a0ad3d2b5080ecb0148e2b86177869884ae62420c9f1b534e969fce97ffff070000000000dbbfe0ed7c5853a665c0805752dca0e571d75cac5a5d8e4f6e05055b6dec5a9a5696f053a92d81fd9e5f2b9dbbe24f38e745b5a95d45003d0600e413dc623f3e6b096c8b0ad7438c6631388892c55b0671140afbfb83bba415f729fea4c8a8a86189dceedad84cdd17c46bdd847a1f4b0facd3744f5bbb06abb319204fca4bcd4297fe7b4cee75abf43e14fe861224799c0f12702964fc890a176fdafa2c9387280b5693c000c0304cece48642649375dae0b7979b229f708a97349e96e783af9a23cd3980a2c29d3d62875e5319cd51bdd224878a0b25edf0e83c930633bd9a0c3e28f359608ea326c77a1aa17318f392a0ec6c188916f452533d4327feccfd68ec8278a90252693fb133c4615801077e1d75420017c03990b855fe481a20b4919bb11c6d737b6545ef140a0fc339bb53953662f1454f9852e7c4e17eb8668f076c659f56d6c7f97a96d6cdf45cfe88b30c170000000001000000effbf33bd1becb0de0a080931f137967de563c29d81aacb3d48226a4e4b6670900000000000000fa68bff3693afc44db223f2be09295e4a8da03d23b48bb38b31a14ffcddd92c38f6b6d86a0e5ed47a82bad5d2a6dce4c4d353261260c9d7a6bd9f2c872c4172a3d2ac80dfb718cc159e6423065624f130000000000000000000000000000000000000000002a37163e8d7ef2f3c58d045f0700000094029acbe333aebd10f2118fbfeda3fa5500d52cd5241588d2b68a332edfef6d701c8936a25d68b841f982511392cc0d3a78616f8ce0f2877d099258bf85866d0ee7f803fa50fd41ef62b028d12028a7b497d92f544523290f520b0d"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x43) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, 0x0, 0x0) connect$inet6(r3, &(0x7f0000000200)={0xa, 0xffff, 0x0, @loopback}, 0x1c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x2, &(0x7f0000000300)=ANY=[@ANYBLOB="850000263f68d3a8876837400dd700a40000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_256={{0x304}, "0002002000", "07f217bd74511e465bbbd5de01000000f9044677d4d588363d63af84db44be59", "00f8ff00", "8ce63ecbc640735f"}, 0x38) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x2, &(0x7f0000000340)=@gcm_256={{0x304}, "76f7bc3e4ae1c84c", "af193cff4810ba5ac120d096eb00b40752095b4285514ca312c52e3a08756735", '8\x00', "bc3a20b10f4ad11e"}, 0x38) socket$nl_netfilter(0x10, 0x3, 0xc) getrandom(&(0x7f0000000000)=""/56, 0x38, 0x1) 53.944083026s ago: executing program 4 (id=27): syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x2) socket$nl_route(0x10, 0x3, 0x0) r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VIDIOC_S_CROP(r0, 0x4014563c, &(0x7f0000000080)={0x2, {0x7fffffff, 0x5, 0x2, 0x418}}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r1, &(0x7f0000000240)=ANY=[@ANYBLOB="000086dd0585"], 0xfdef) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) write$FUSE_NOTIFY_INVAL_INODE(r2, &(0x7f00000002c0)={0x28, 0x2, 0x0, {0x6, 0xf, 0x2}}, 0x28) r3 = socket$packet(0x11, 0x2, 0x300) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r4 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(r4, 0x89e1, &(0x7f0000000400)={r3}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000001080)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x400000bce) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x140, 0x0) mount_setattr(0xffffffffffffff9c, &(0x7f0000000180)='.\x00', 0x100, &(0x7f0000001dc0)={0xf, 0x0, 0x100000}, 0xfffffffffffffdee) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) kexec_load(0x0, 0x2, &(0x7f0000000900)=[{0x0, 0x0, 0x200000000}, {0x0, 0x0, 0x0, 0x8000}], 0x0) 50.115437944s ago: executing program 0 (id=32): fsopen(0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000400)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, &(0x7f0000000100)}) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000340)=0x2, 0xa2) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000640), r5) sendmsg$MPTCP_PM_CMD_GET_ADDR(r5, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000ac0)={0x20, r6, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_TOKEN={0x8}, @MPTCP_PM_ATTR_ADDR={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x800}, 0x4) write$binfmt_script(r4, &(0x7f000000e0c0), 0x10010) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, &(0x7f0000000200)=@gcm_256={{0x304}, "00e0f07600", "832b4d2434b35bca8c0b78d2afff6d70d2025c7f53123828322d5af0d5c6c3a5", '`\a-N', "298f0e6df9ae9b3d"}, 0x38) ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000000)=0x4000000000003) sendfile(0xffffffffffffffff, r4, 0x0, 0x100000000010001) 48.251976327s ago: executing program 4 (id=36): getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, &(0x7f0000000580)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, &(0x7f0000000200)={0x3, 0x40, 0xfa02, {{0x6000000, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @remote}, r4, 0xfffffffc}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000000)={0xffffffffffffffff}, 0x2, 0xc}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, &(0x7f0000000280)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0x7ff, @empty, 0x1}, {0xa, 0x4e20, 0x1ff, @dev={0xfe, 0x80, '\x00', 0x2f}, 0x9}, r5, 0xb}}, 0x48) write$RDMA_USER_CM_CMD_DESTROY_ID(r3, &(0x7f0000000380)={0x1, 0x10, 0xfa00, {0x0, r5}}, 0x18) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(0xffffffffffffffff, &(0x7f0000000180)={0x4, 0x8, 0xfa00, {r5, 0x3ff}}, 0x10) r6 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_MSFILTER(r6, 0x29, 0x2d, 0x0, 0x90) socket$inet6_udplite(0xa, 0x2, 0x88) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)={0x158, r8, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}, @WGDEVICE_A_PEERS={0x130, 0x8, 0x0, 0x1, [{0x48, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e24, 0x4, @rand_addr=' \x01\x00', 0x1}}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @a_g}]}, {0x84, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x4e20, @local}}, @WGPEER_A_ALLOWEDIPS={0x48, 0x9, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @rand_addr=0x64010102}, {0x5}}]}, {0x28, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @remote}, {0x5, 0x3, 0x2}}]}]}, @WGPEER_A_PUBLIC_KEY={0x24}]}, {0x30, 0x0, 0x0, 0x1, [@WGPEER_A_PROTOCOL_VERSION={0x8}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @neg}]}, {0x30, 0x0, 0x0, 0x1, [@WGPEER_A_FLAGS={0x8, 0x3, 0x5}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}]}]}]}, 0x158}, 0x1, 0x0, 0x0, 0x4004840}, 0x40000) 41.774280078s ago: executing program 4 (id=41): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r2, 0x6, 0x22, &(0x7f0000000000)=0x1, 0x4) r3 = socket(0x15, 0x5, 0x0) recvfrom$ax25(r3, 0x0, 0x0, 0x105, &(0x7f0000001c00)={{0x3, @default}, [@default, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}, 0x48) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e24, @broadcast}, 0x10) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r4, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x0, 0x0, 0xffffffff}, 0x1c) syz_emit_ethernet(0x82, &(0x7f0000000000)={@local, @empty, @val, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, "5f1060", 0x44, 0x2f, 0x0, @private0, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x1, 0x8100}, {0x0, 0x0, 0x0, 0x0, 0x100}, {}, {0x8, 0x88be, 0x86ddffff}, {0x8, 0x22eb, 0x0, {{}, 0x2, {0x0, 0x4}}}}}}}}}, 0x0) sendmmsg(r2, &(0x7f00000007c0)=[{{&(0x7f0000000380)=@in={0x2, 0x4e24, @local}, 0x80, &(0x7f0000000140)=[{&(0x7f00000004c0)='&', 0x1}], 0x1}}], 0x1, 0x2c000011) sendto(r2, 0x0, 0x0, 0x8000, 0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x3, 0x8, 0x2, 0xb}, 0x0, &(0x7f0000000280)={0x3ff, 0x0, 0x0, 0x400d, 0x0, 0x9, 0x466}, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 35.820064055s ago: executing program 4 (id=48): socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002000)=""/102400, 0x19000) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, 0x0) timer_settime(0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) r2 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x1) fchdir(r3) r4 = openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='.\x00', 0x0, 0x0) getdents64(r4, &(0x7f0000000040)=""/53, 0x2457a0be381e3a04) getdents(r4, 0x0, 0x58) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RWRITE(r5, &(0x7f0000000040)={0xb, 0x77, 0x810}, 0x11000) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2f, &(0x7f0000000340)={0x0, {{0xa, 0x0, 0x3, @mcast1}}, {{0xa, 0xffff, 0x0, @mcast1, 0x10}}}, 0x108) r6 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_AUTOCLOSE(r6, 0x84, 0x4, 0x0, 0x0) 34.353965823s ago: executing program 4 (id=52): syz_open_dev$video4linux(&(0x7f0000000240), 0x6000000, 0x10401) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) getsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x2, 0x0, &(0x7f0000000080)) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) syz_open_dev$usbmon(&(0x7f0000000180), 0x5c, 0x3a540) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000340), 0x1c9243, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$phonet_pipe(0x23, 0x5, 0x2) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x3) dup(r1) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r2, 0x30, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) syz_open_procfs(0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x47}, 0x0, &(0x7f00000002c0)={0x3ff, 0x7, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000080)=0xf) ioctl$TCFLSH(r3, 0x400455c8, 0x4) syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) 18.614300909s ago: executing program 32 (id=52): syz_open_dev$video4linux(&(0x7f0000000240), 0x6000000, 0x10401) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) getsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x2, 0x0, &(0x7f0000000080)) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) syz_open_dev$usbmon(&(0x7f0000000180), 0x5c, 0x3a540) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000340), 0x1c9243, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$phonet_pipe(0x23, 0x5, 0x2) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x3) dup(r1) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r2, 0x30, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) syz_open_procfs(0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x47}, 0x0, &(0x7f00000002c0)={0x3ff, 0x7, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000080)=0xf) ioctl$TCFLSH(r3, 0x400455c8, 0x4) syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) 14.053603085s ago: executing program 3 (id=70): r0 = socket(0x2, 0x2, 0x1) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) ioctl$SNDCTL_DSP_SETFMT(0xffffffffffffffff, 0xc0045005, &(0x7f0000000040)=0xfffffffd) writev(0xffffffffffffffff, &(0x7f0000001500)=[{&(0x7f00000013c0)="f0", 0x1}], 0x1) r2 = socket$inet6(0xa, 0x1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x2c, 0x0, &(0x7f0000000180)) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) rmdir(&(0x7f00000001c0)='./file1\x00') recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) keyctl$clear(0x3, 0xfffffffffffffffd) bind$unix(r0, &(0x7f0000000000)=@abs, 0x6e) r6 = openat$fb0(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$FBIOBLANK(r6, 0x4611, 0x4) 13.86317593s ago: executing program 1 (id=71): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x1}) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, 0x0, 0x0, 0x4000014, &(0x7f000005ffe4)={0xa, 0x4e23, 0xfffffffb, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, 0x1c) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) r2 = getpid() bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x11, 0x3, 0x0, &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000002540)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0xfffffffffffffc33, &(0x7f0000000280)=0x2) madvise(&(0x7f0000bc0000/0x400000)=nil, 0x400000, 0x9) recvmmsg(r1, &(0x7f0000000ac0)=[{{0x0, 0x0, 0x0}, 0x3}], 0x1, 0x120, 0x0) r5 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0) r6 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(r5, r6, 0x0, 0x106f) keyctl$dh_compute(0x17, &(0x7f0000000680), 0x0, 0x0, &(0x7f0000000840)={&(0x7f00000007c0)={'cbcmac-aes-neon\x00'}}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETSNDBUF(r0, 0x400454d4, &(0x7f0000000380)=0x2) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000100)={'pim6reg1\x00', @broadcast}) 12.365369619s ago: executing program 3 (id=72): r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = syz_io_uring_setup(0x49a, &(0x7f0000000400)={0x0, 0x79af, 0x3180, 0x8000, 0x40024e}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) r5 = eventfd2(0xff, 0x80001) io_uring_register$IORING_REGISTER_EVENTFD(r2, 0x4, &(0x7f0000000300)=r5, 0x1) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_MSG_RING={0x28, 0x40, 0x0, r2, 0x0, 0x0, 0x0, 0x2}) io_uring_enter(r2, 0x627, 0x4c1, 0x43, 0x0, 0x0) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x42031, 0xffffffffffffffff, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0)) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r6, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) sendmmsg$inet(r6, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000340)="b9cd14c222ee3c0cb001829a8681ed391da1a71d8d", 0x15}], 0x1}}], 0x1, 0x20008000) setsockopt$inet_tcp_TLS_TX(r6, 0x6, 0x1, &(0x7f0000000080)=@ccm_128={{0x303}, "f1a0f9fff9e440b4", "881aae83544dfa6412f91b9057e3f415", "9dca43b6", "9ecb592c6ee49fbd"}, 0x28) socket$kcm(0x10, 0x2, 0x0) msgrcv(0x0, 0x0, 0x0, 0x5, 0x4c00) 10.091409264s ago: executing program 3 (id=74): socket$inet6(0xa, 0x80002, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_audit(0x10, 0x3, 0x9) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000040)=0x1, 0x4) socket$nl_route(0x10, 0x3, 0x0) socket$kcm(0x10, 0x2, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket(0x40000000015, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0x56a, 0xd8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x673119c074b3a761, 0x6, [{{0x9, 0x4, 0x0, 0x1, 0x2, 0x3, 0x1, 0x3, 0xfa, {0x9, 0x21, 0x2, 0x4, 0x1, {0x22, 0x6c2}}, {{{0x9, 0x5, 0x81, 0x3, 0x600, 0x0, 0xaa, 0x6}}}}}]}}]}}, 0x0) openat$vimc0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) r2 = socket$packet(0x11, 0x3, 0x300) getsockopt(r1, 0x8f4, 0x0, &(0x7f00000001c0)=""/210, &(0x7f00000000c0)=0xd2) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000080)=0xfff, 0x4) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r3, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r2, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x0, r4}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x36}], 0x1}}], 0x1, 0x0) r5 = syz_io_uring_setup(0x10d2, &(0x7f0000000340)={0x0, 0x6bf6, 0x100, 0x5, 0x12}, &(0x7f00000000c0)=0x0, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r5, 0x9, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) 9.852304602s ago: executing program 1 (id=75): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r0 = accept$nfc_llcp(0xffffffffffffffff, 0x0, 0x0) shutdown(r0, 0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_buf(r2, 0x6, 0xd, 0x0, &(0x7f0000000b00)) r3 = getpid() ioprio_get$pid(0x3, r3) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00'}) r4 = socket$inet6(0xa, 0x3, 0x1) connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) r5 = add_key$keyring(&(0x7f00000000c0), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) add_key(&(0x7f0000000080)='pkcs7_test\x00', 0x0, &(0x7f0000000200)="3081", 0x2, r5) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x972, &(0x7f0000006680)) preadv(0xffffffffffffffff, 0x0, 0x0, 0x6, 0xfffffff9) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)={0x1c, 0x1, 0x4, 0x3, 0x0, 0x0, {0x5, 0x0, 0x3}, [@NFULA_CFG_CMD={0x5, 0x1, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004000}, 0x800) 9.626560767s ago: executing program 2 (id=76): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000300)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000100)={@dev, 0x0, 0x2}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000033c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=""/28, 0x1c}, 0x2}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000fc0)=""/171, 0xab}, 0x5}, {{&(0x7f0000001080)=@in6={0xa, 0x0, 0x0, @private2}, 0x80, &(0x7f0000002340)=[{0x0}, {&(0x7f0000002180)=""/72, 0x48}, {0x0}, {0x0}], 0x4}, 0x528a}], 0x3, 0x1, &(0x7f0000003500)={0x0, 0x3938700}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) clock_gettime(0x0, 0x0) pselect6(0x40, &(0x7f0000000080)={0x1000000000000000, 0x7, 0x7, 0x3, 0x7, 0xffff, 0x9, 0xc}, &(0x7f0000003540)={0x2, 0x6, 0x8000000000000000, 0x1, 0x4, 0x2, 0x401, 0x6}, 0x0, &(0x7f0000003600), &(0x7f0000003680)={0x0}) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000040)={0x84, @dev={0xac, 0x14, 0x14, 0x2d}, 0x4e20, 0x3, 'wrr\x00', 0x1, 0x2, 0x6f}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, 0x0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r2, 0x800448d7, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa014101, 0x4e21, 0x3, 'nq\x00', 0x4, 0x3, 0x10075}, {@rand_addr=0x64010102, 0x4e1f, 0x0, 0x4, 0x13d5f, 0x7}}, 0x44) ioctl$FS_IOC_GETFSLABEL(r1, 0x400452c8, &(0x7f0000000100)) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/fscaps', 0x0, 0x106) setuid(0xee00) fchmod(r3, 0x80) 8.207674868s ago: executing program 2 (id=77): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) getrlimit(0x9, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000300)=[@increfs], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000001a40)=""/102392, 0x18ff8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x3, 0x3, 0x2, 0x1, 0xc8}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r3, 0x400448ca, 0x0) bind$bt_hci(r3, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000001ac0), 0x6) ioctl$sock_bt_hci(r4, 0x400448dc, 0x0) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0x5ba8, 0xfffffffffffffffd) keyctl$read(0xb, 0x0, &(0x7f0000000240)=""/112, 0x349b7f55) 7.19389286s ago: executing program 2 (id=78): r0 = syz_open_dev$swradio(&(0x7f0000000040), 0x1, 0x2) ioctl$VIDIOC_G_FREQUENCY(r0, 0xc02c5638, &(0x7f0000000080)={0xc, 0x5, 0x401}) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) chdir(0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x2) r2 = socket$inet6_udp(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000004c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x458, 0x0, 0x2b8, 0xb0000010, 0x2, 0x5c8f0200, 0x388, 0x3a8, 0x3a8, 0x388, 0x3a8, 0x3, 0x0, {[{{@ipv6={@private1, @local, [], [], 'vlan1\x00', 'veth0_to_team\x00'}, 0x0, 0x248, 0x290, 0x700, {}, [@common=@inet=@hashlimit3={{0x158}, {'geneve1\x00', {0xf1, 0x0, 0x33, 0x0, 0x10000000, 0x1, 0x7fffffff}}}, @common=@unspec=@limit={{0x48}, {0x0, 0x3}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x206, 'syz1\x00'}}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@CONNSECMARK={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4b8) eventfd(0x8) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r6, 0x4601, &(0x7f0000000240)={0x400, 0x30, 0xf0, 0x0, 0x0, 0x1f, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x40, 0x0, 0x7, 0x0, 0x5, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x16, 0x0, 0x0, 0x5}) 6.795586725s ago: executing program 1 (id=79): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r2 = open(&(0x7f0000000580)='./file1\x00', 0x80242, 0x1df2a23c5997fa5f) write$FUSE_CREATE_OPEN(r2, &(0x7f0000000180)={0xa0, 0xffffffffffffffda, 0x0, {{0x4, 0x3, 0x5, 0x6, 0x3, 0x1, {0x1, 0x180, 0x20ff, 0x5, 0x89, 0xd615, 0x9, 0x7fffffff, 0xfffffffe, 0x8000, 0x0, 0x0, 0x0, 0x3ff, 0x1}}, {0x0, 0x13}}}, 0xa0) sendfile(r2, r2, &(0x7f0000000080), 0x7f03) sendmsg$nl_route_sched(r0, 0x0, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x0) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, 0x0) recvmmsg(r4, &(0x7f0000003b80), 0x0, 0x40000002, 0x0) setsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, &(0x7f00000003c0)=0x1, 0x4) sendmsg$can_raw(r4, 0x0, 0x0) 6.0254658s ago: executing program 3 (id=80): bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xa, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x63, 0x11, 0x8}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x23}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x70) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socket$alg(0x26, 0x5, 0x0) socket$packet(0x11, 0x3, 0x300) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket(0x22, 0x2, 0x3) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet6_sctp(0xa, 0x5, 0x84) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket$xdp(0x2c, 0x3, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$inet6_sctp(0xa, 0x1, 0x84) socket$netlink(0x10, 0x3, 0x15) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x15) socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000280)=ANY=[@ANYRES32, @ANYRES32, @ANYRES64=r1, @ANYRES64=0x0, @ANYRESOCT=r0], 0x20) 3.761022712s ago: executing program 2 (id=81): r0 = syz_io_uring_setup(0x3b, &(0x7f00000001c0)={0x0, 0x0, 0x10100}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r1, r2, &(0x7f0000000380)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r4, 0x0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, &(0x7f00000018c0)=ANY=[@ANYBLOB=' '], 0x20}, 0x0, 0xe3d08660d3cd4684}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) prlimit64(0x0, 0x6, &(0x7f0000000140), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00000095"], 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='9p_protocol_dump\x00', r5}, 0x18) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f0000000500)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r6, @ANYBLOB=',wfdno=', @ANYRESHEX=r7, @ANYBLOB="2c7876ba884df75029059e826b9e3e912936107a1f9e4b7bbbc7da6bb936db00524b95a7dc72f6680e3db7aa03c3321534190374d1229d38d35efdd76f5c0608899f3a0a8d76b6f59a8682e2f936d26d39c3c173300925cbb17425b27537ad31a55faf1dfb14d8adf29483d125389c7185b5c862738573be4b84fc55f0738dcd9a503127d1b1689d65715bab61f6be3f56"]) setuid(0xee01) r8 = socket(0x1e, 0x4, 0x0) recvmmsg$unix(r8, &(0x7f0000003100)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000480)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) r9 = socket$pppl2tp(0x18, 0x1, 0x1) r10 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r9, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r10, {0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2}}, 0x2e) r11 = inotify_init1(0x800) r12 = fcntl$dupfd(r9, 0x406, r11) setsockopt$inet_mtu(r12, 0x111, 0xa, &(0x7f0000000000), 0x4) io_uring_enter(r0, 0x92, 0x0, 0x0, 0x0, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r3, 0x10f, 0x81, &(0x7f0000000400)=0xd60, 0x4) getsockopt$TIPC_DEST_DROPPABLE(r4, 0x10f, 0x81, &(0x7f0000001500), &(0x7f0000001540)=0x4) syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f0000000180)) 3.26332504s ago: executing program 1 (id=82): r0 = fsopen(&(0x7f0000000000)='pipefs\x00', 0x0) sendto(0xffffffffffffffff, &(0x7f0000000740), 0x0, 0x0, 0x0, 0x0) socket(0x2, 0x80805, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) getrlimit(0xa, &(0x7f0000000080)) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) listen(r3, 0x7) accept4$x25(r3, 0x0, 0x0, 0x80800) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r6, 0xc008ae88, &(0x7f0000000100)=ANY=[@ANYBLOB="010000000000084000000040"]) close_range(r0, 0xffffffffffffffff, 0x0) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000001c0), 0x120000) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r7, 0xc058534f, &(0x7f0000000500)={{0xf}, 0x1, 0x0, 0xd3, {0x9, 0x81}, 0x1e, 0x6}) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, &(0x7f0000000180)='ceph\x00', &(0x7f00000000c0)=@chain) add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0x0) 3.153762753s ago: executing program 3 (id=83): syz_usb_connect(0x0, 0x24, 0x0, 0x0) ioctl$DRM_IOCTL_SET_VERSION(0xffffffffffffffff, 0xc0106407, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000400)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeef, 0x8031, 0xffffffffffffffff, 0x55779000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) close(0xffffffffffffffff) socket$inet6_mptcp(0xa, 0x1, 0x106) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x16, 0x16, &(0x7f0000000240)=ANY=[@ANYBLOB], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_LINK_CREATE(0xa, &(0x7f0000000340)={r5, 0xffffffffffffffff, 0x24, 0x7, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x8, 0x0, 0x1}}, 0x40) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@newtaction={0x74, 0x30, 0xb, 0x0, 0x0, {}, [{0x60, 0x1, [@m_skbmod={0x5c, 0x1, 0x0, 0x0, {{0xb}, {0x32, 0x2, 0x0, 0x1, [@TCA_SKBMOD_PARMS={0x24, 0x2, {{0x0, 0x0, 0x21000000}}}, @TCA_SKBMOD_ETYPE={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, 0x0, 0x0) prctl$PR_SET_IO_FLUSHER(0x39, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x2, &(0x7f0000000040)=0x7, 0x4) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8b0f, &(0x7f0000000000)={'wlan0\x00'}) 1.956444166s ago: executing program 2 (id=84): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYRES8=r0, @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000000), 0x6ffffffffffffffe, 0x0) read$msr(r2, &(0x7f000001b000)=""/102400, 0x19000) rseq(&(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x1, 0x1, 0x3, 0x2}, 0x1}, 0x20, 0x0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000240)='./binderfs2/custom0\x00', 0x0, 0x0) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/diskstats\x00', 0x0, 0x0) sendfile(r4, r5, 0x0, 0x106f) r6 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=@ipv6_newnexthop={0x3c, 0x68, 0x1, 0x0, 0x0, {0x2}, [@NHA_ENCAP={0xc, 0x8, 0x0, 0x1, @LWTUNNEL_IP6_TC={0x5}}, @NHA_ID={0x8, 0x6, 0xf2}, @NHA_OIF={0x8, 0x5, r7}, @NHA_ENCAP_TYPE={0x6, 0x7, 0x2}]}, 0x3c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, 0x0) timer_create(0x3, 0x0, 0x0) socket(0x1, 0x6, 0x7ff) timer_settime(0x0, 0x1, 0x0, 0x0) timer_delete(0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f0000000040)='io_uring_cqe_overflow\x00', r1, 0x0, 0x4000000000000004}, 0x18) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) 1.878085233s ago: executing program 1 (id=85): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000007c0), r0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000800)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000840)={0x3c, r1, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xe6}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x710ce59bde3da92}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40}, 0x4010044) r3 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, &(0x7f00000015c0)={0xfff7, 0x8000, 0x7}, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4040, 0x9, @empty, 0x6}, 0x1c) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_GET_COALESCE(r9, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000400)={0x0, 0x14}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtfilter={0x2c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x74, 0x0, {0xfff2}, {}, {0xa, 0x1}}, [@TCA_RATE={0x6, 0x5, {0x39, 0x1}}]}, 0x2c}, 0x1, 0xf0ffffffffffff, 0x0, 0x4004140}, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18010000", @ANYRES16=r7, @ANYBLOB="010027bd7000fcdbdf2501000000140001800800030003000000080004", @ANYRES32, @ANYBLOB="04000300ac00028054000180080001000300000008000100060000000800010000000000080001000700000008000100080000000800010007000000080001000200000008000100020000000800010002000000080001000800000024000180080001000300000008000100020000000800010000000000080001000000000014000180080001000200000008000100030000001c000180080001000000000008000100140000000800010001000000040003003800028034000180080001000500000008000100050000000800010006000000080001000800000008000100080000000800010002000000040003"], 0x118}, 0x1, 0x0, 0x0, 0x804}, 0x4050) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)=@newqdisc={0x14c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r12, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_choke={{0xa}, {0x11c, 0x2, [@TCA_CHOKE_PARMS={0x14}, @TCA_CHOKE_STAB={0x104, 0x2, "13119f34dae3c090b3da2c64426a1d777a61e2fad4599fb11a71e149072d265bbcf090bd7bbe0e5d2de66213d88d7e773024ba3482c95f5dc6359186172ae22ed9616876e0ec13f573a7c2f0d185109a8457e43c5390e59a84747ee7b311ecc2f8bac84497d72789b0fa4ab2e321de479655bda89963ae5f37684f73a07ca9d223dfe04aae9e1ff7f8441133075f4355c81d80a33e4907edd482cafffa6cf27913b8cf68da47ea06d0d17b9770d10d6978345f4fb5f2b61619e5e3b4b4090c77e69d028f41ab371e8c6bef4485fe557e260ff37e8f6a854d0b686963dcfea9a71953940f9d6ec1de1d4e2221adfd549d529a594013b2dcde2d070f6ba92fcbb7"}]}}]}, 0x14c}}, 0x0) sendmsg$ETHTOOL_MSG_PAUSE_GET(r5, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x18, r7, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@HEADER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000}, 0x24000080) sendmsg$inet6(0xffffffffffffffff, 0x0, 0x80) 915.27471ms ago: executing program 2 (id=86): mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = memfd_secret(0x0) prlimit64(0x0, 0xe, &(0x7f0000000340)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0xfffffdca, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, 0x0, &(0x7f0000000a00)=0x5a) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) mknodat(0xffffffffffffffff, &(0x7f0000000280)='./file1/file0\x00', 0xc000, 0x0) openat$cgroup_ro(r0, &(0x7f00000002c0)='memory.events.local\x00', 0x0, 0x0) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x2, 0x2, 0x81, 0x200, 0x1, 0x1}, 0x1c) recvmsg$unix(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000980)}, 0x20) sendmmsg(r2, &(0x7f00000030c0)=[{{0x0, 0x0, &(0x7f0000000400)=[{0x0}], 0x1}}], 0x1, 0x24000000) r3 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x1, 0x81, 0x1ff, 0x801, 0x1}, 0x1c) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000000)={0x6, 'vcan0\x00', {0x8}, 0x7ff}) memfd_create(&(0x7f0000000380)='\x00\x00\x00\x00\x00\x00z\x9b\xb6\xe8t;\xfc\x02\x00\x00\x009\xa0\x8b\x14d\xa3\xa1\xa8!\xe8\xd1\xa0\x8a\xce0\x1c\xb7\xf1\xccm\xcf\xd4\xdb\x89\xe5\x8f\xe2\xb6\xd6\x9cF\xbd\xff\x14\x05\x00\x00\x00\x00\x00\x00\x00\xf3\xdc\x91\'\x06\\8\r\xfc\xeeG\xbe\x90C\x1c)5\x98\xa3\xfa\a\xf9\x98\xbb}\xeb\x86P=\xe51\x9d,\xb9\xea#\xff[\xd1\xc3\x9a\xa3\x1b\xf9\xe9\x1d \xce1\xc9\x9f\xb0\x14\xc2\xeb\xf9\xceE\xad\xa4\x92\f\xef\x87g\xb6\xabW\xb5\rP\xf62\xb7\xc8\xaajn\xd7\n\r\x802\xd7\x1b$\x95tO*\xe7\xae\xb8\xb8m\xbf\r\xd5\xbf*\xfd\xc7\x85\x1b\x8b\xe5\x97j`c\xe0\x88?\xda\x8a#t>r\xae\xe8\xc9)~d7\xe9\x03\xee\xb39\xe9\x98K\xb4\xc9v]\b]\xd3\x83\xad\x15\xe2\xc6\x9f1]\xec\x11\x81q\x8a\xd8M\xd7\a\x9a\x10\x88\x02`\"YJN\vyB\x88\xe8\xaf\x8fk\xb6\xd7\xaaEI\\,%+ Qv\xb1X)\xb5\xd3$\xad_\xfb\\U0\x8bR\xdb\x17\xbd[*Ui\xdfE\x9a\x19\xe9\x87I\xd5\xbb\xa8\rU\xe6=\xde.\xc2\xc2e\xb7\xcf\xb1\xddZ\xd0\tO\xff\xae_\xcf\x8b\xd3\xc4\xc9\xb05\xb9\xee\xb2 )iq\x8a\v>:C\xe6*\f\xf1\x1a\x85\xf44\xe5*\x1e\a6\xde\x84\xe6\xb2\xf1\xd5G\xff\x18\xc6A\xc0]\x04\x0ey2E~\x11\fO\xceKRQ\\\xd5\x81\xe9\x04*L\x9e\xd0za\x89f\x12)\xce@\x93\xbc\x98\xb4Jr\xd2\x01\xb4\xe3\xdb\xf6\xf5W\xd8L\xbb\x97\x03', 0x4) r4 = fsopen(&(0x7f0000000240)='binder\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) 430.301644ms ago: executing program 1 (id=87): bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0xe, 0x4, 0x4, 0x3, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) setsockopt$bt_rfcomm_RFCOMM_LM(r0, 0x12, 0x3, 0x0, 0x0) r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_G_FMT(r1, 0xc0285629, &(0x7f0000000080)={0x3, @win={{0x2}, 0x9, 0x0, &(0x7f0000000040), 0x0, 0x0}}) dup3(r1, 0xffffffffffffffff, 0x80000) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/snmp6\x00') r3 = openat$rfkill(0xffffffffffffff9c, 0x0, 0x801, 0x0) write$rfkill(r3, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={0x0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x1, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000002000)=""/102400, 0x19000) ustat(0x0, 0x0) gettid() timer_create(0x0, 0x0, &(0x7f0000000040)) bind$inet6(0xffffffffffffffff, 0x0, 0x0) preadv(r2, &(0x7f0000000040)=[{&(0x7f0000000140)=""/4096, 0x1000}], 0x1, 0x8, 0x8d3a) r5 = openat$smackfs_load(0xffffffffffffff9c, &(0x7f0000000080)='/sys/fs/smackfs/load-self2\x00', 0x2, 0x0) write$binfmt_script(r5, &(0x7f00000001c0)={'#! ', './file0', [{0x20, 'BWXr'}]}, 0xfffffd81) 0s ago: executing program 3 (id=88): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="180100001c0000000000000000", @ANYRESDEC=0x0], &(0x7f0000000480)='GPL\x00', 0x40, 0x0, 0x0, 0x0, 0x18, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0xfffffffffffffe97) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x8400, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) sendmsg$NL802154_CMD_GET_SEC_LEVEL(0xffffffffffffffff, 0x0, 0x40810) syz_init_net_socket$llc(0x1a, 0x4, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000580), 0xa, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$radio(0x0, 0x3, 0x2) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) syz_emit_vhci(&(0x7f0000000540)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x2, 0x1, 0x4}}, 0x9) ioctl$FS_IOC_SETFLAGS(r2, 0x40046f41, &(0x7f0000000440)=0x1f) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), r0) sendmsg$TIPC_NL_BEARER_SET(r1, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000002c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002bbd7000fcd5df25050000003c0003800800020083030000080002000400000008000200590d0000080002000800000008000200ff07000008000200000000000800020007000000"], 0x50}, 0x1, 0x0, 0x0, 0x20000000}, 0x20004040) getsockname$packet(r1, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000440)=0xfe3b) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=@newqdisc={0x78, 0x24, 0xf0b, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xa, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x48, 0x2, [@TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x6}, @TCA_CAKE_MPU={0x8, 0xe, 0xf3}, @TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x2}, @TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x2}, @TCA_CAKE_OVERHEAD={0x8, 0x6, 0xa1}, @TCA_CAKE_ACK_FILTER={0x8, 0x10, 0x2}, @TCA_CAKE_FLOW_MODE={0x8}, @TCA_CAKE_ACK_FILTER={0x8}]}}]}, 0x78}, 0x1, 0x0, 0x0, 0x4040001}, 0x4000004) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.109' (ED25519) to the list of known hosts. [ 87.694043][ T5812] cgroup: Unknown subsys name 'net' [ 87.806958][ T5812] cgroup: Unknown subsys name 'cpuset' [ 87.816369][ T5812] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 89.560771][ T5812] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 93.886083][ T5832] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 93.894043][ T5832] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 93.901961][ T5832] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 93.910960][ T5832] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 93.918718][ T5839] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 93.931808][ T5834] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 93.941178][ T5834] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 93.948635][ T5839] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 93.955963][ T5839] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 93.964373][ T5834] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 93.971453][ T5842] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 93.973728][ T5834] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 93.979581][ T5842] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 93.986454][ T5834] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 94.001509][ T5839] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 94.002528][ T5842] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 94.009913][ T5839] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 94.016816][ T5842] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 94.023185][ T5834] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 94.030651][ T5842] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 94.039684][ T5833] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 94.052737][ T5834] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 94.063198][ T5827] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 94.071002][ T5834] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 94.078862][ T5827] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 94.754433][ T5830] chnl_net:caif_netlink_parms(): no params data found [ 94.906491][ T5826] chnl_net:caif_netlink_parms(): no params data found [ 94.988090][ T5840] chnl_net:caif_netlink_parms(): no params data found [ 95.059900][ T5822] chnl_net:caif_netlink_parms(): no params data found [ 95.106113][ T5823] chnl_net:caif_netlink_parms(): no params data found [ 95.177318][ T5830] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.184712][ T5830] bridge0: port 1(bridge_slave_0) entered disabled state [ 95.192992][ T5830] bridge_slave_0: entered allmulticast mode [ 95.200613][ T5830] bridge_slave_0: entered promiscuous mode [ 95.279496][ T5830] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.286937][ T5830] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.294953][ T5830] bridge_slave_1: entered allmulticast mode [ 95.303654][ T5830] bridge_slave_1: entered promiscuous mode [ 95.378794][ T5826] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.386334][ T5826] bridge0: port 1(bridge_slave_0) entered disabled state [ 95.393948][ T5826] bridge_slave_0: entered allmulticast mode [ 95.401911][ T5826] bridge_slave_0: entered promiscuous mode [ 95.411037][ T5826] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.418547][ T5826] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.425931][ T5826] bridge_slave_1: entered allmulticast mode [ 95.434524][ T5826] bridge_slave_1: entered promiscuous mode [ 95.558573][ T5830] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 95.572462][ T5830] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 95.583577][ T5840] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.590831][ T5840] bridge0: port 1(bridge_slave_0) entered disabled state [ 95.598676][ T5840] bridge_slave_0: entered allmulticast mode [ 95.607036][ T5840] bridge_slave_0: entered promiscuous mode [ 95.628805][ T5822] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.637085][ T5822] bridge0: port 1(bridge_slave_0) entered disabled state [ 95.644589][ T5822] bridge_slave_0: entered allmulticast mode [ 95.653538][ T5822] bridge_slave_0: entered promiscuous mode [ 95.663015][ T5823] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.670266][ T5823] bridge0: port 1(bridge_slave_0) entered disabled state [ 95.678070][ T5823] bridge_slave_0: entered allmulticast mode [ 95.686158][ T5823] bridge_slave_0: entered promiscuous mode [ 95.695162][ T5823] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.702400][ T5823] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.709621][ T5823] bridge_slave_1: entered allmulticast mode [ 95.717065][ T5823] bridge_slave_1: entered promiscuous mode [ 95.738264][ T5840] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.745815][ T5840] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.753519][ T5840] bridge_slave_1: entered allmulticast mode [ 95.760939][ T5840] bridge_slave_1: entered promiscuous mode [ 95.774800][ T5826] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 95.784744][ T5822] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.791919][ T5822] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.799407][ T5822] bridge_slave_1: entered allmulticast mode [ 95.807978][ T5822] bridge_slave_1: entered promiscuous mode [ 95.847751][ T5830] team0: Port device team_slave_0 added [ 95.887932][ T5826] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 95.929071][ T5830] team0: Port device team_slave_1 added [ 95.938268][ T5840] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 95.977491][ T5823] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 95.990541][ T5822] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 96.017256][ T5840] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 96.061338][ T5823] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 96.088764][ T5822] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 96.104149][ T5838] Bluetooth: hci1: command tx timeout [ 96.104154][ T5146] Bluetooth: hci3: command tx timeout [ 96.104479][ T5838] Bluetooth: hci2: command tx timeout [ 96.110840][ T5827] Bluetooth: hci0: command tx timeout [ 96.136090][ T5830] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 96.143180][ T5830] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 96.170040][ T5830] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 96.183265][ T5827] Bluetooth: hci4: command tx timeout [ 96.203142][ T5826] team0: Port device team_slave_0 added [ 96.259203][ T5830] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 96.269942][ T5830] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 96.296599][ T5830] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 96.312299][ T5840] team0: Port device team_slave_0 added [ 96.320544][ T5826] team0: Port device team_slave_1 added [ 96.329586][ T5823] team0: Port device team_slave_0 added [ 96.339211][ T5822] team0: Port device team_slave_0 added [ 96.354538][ T5822] team0: Port device team_slave_1 added [ 96.378561][ T5840] team0: Port device team_slave_1 added [ 96.430768][ T5823] team0: Port device team_slave_1 added [ 96.467865][ T5823] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 96.475269][ T5823] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 96.501692][ T5823] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 96.541576][ T5826] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 96.548676][ T5826] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 96.575122][ T5826] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 96.600471][ T5823] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 96.608001][ T5823] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 96.634081][ T5823] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 96.652903][ T5822] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 96.660008][ T5822] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 96.686524][ T5822] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 96.698509][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 96.705894][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 96.732563][ T5840] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 96.744614][ T5826] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 96.751605][ T5826] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 96.777944][ T5826] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 96.818258][ T5830] hsr_slave_0: entered promiscuous mode [ 96.825556][ T5830] hsr_slave_1: entered promiscuous mode [ 96.835097][ T5822] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 96.842079][ T5822] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 96.868584][ T5822] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 96.880937][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 96.888105][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 96.914100][ T5840] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 97.022446][ T5823] hsr_slave_0: entered promiscuous mode [ 97.029687][ T5823] hsr_slave_1: entered promiscuous mode [ 97.036836][ T5823] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 97.045021][ T5823] Cannot create hsr debugfs directory [ 97.076146][ T5826] hsr_slave_0: entered promiscuous mode [ 97.082843][ T5826] hsr_slave_1: entered promiscuous mode [ 97.089150][ T5826] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 97.096800][ T5826] Cannot create hsr debugfs directory [ 97.189978][ T5822] hsr_slave_0: entered promiscuous mode [ 97.198347][ T5822] hsr_slave_1: entered promiscuous mode [ 97.205903][ T5822] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 97.213643][ T5822] Cannot create hsr debugfs directory [ 97.226489][ T9] cfg80211: failed to load regulatory.db [ 97.240639][ T5840] hsr_slave_0: entered promiscuous mode [ 97.247327][ T5840] hsr_slave_1: entered promiscuous mode [ 97.254334][ T5840] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 97.261926][ T5840] Cannot create hsr debugfs directory [ 97.840548][ T5830] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 97.857253][ T5830] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 97.869808][ T5830] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 97.891008][ T5830] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 97.950428][ T5823] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 97.967515][ T5823] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 97.987012][ T5823] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 97.998861][ T5823] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 98.095625][ T5840] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 98.121133][ T5840] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 98.144495][ T5840] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 98.182637][ T5827] Bluetooth: hci2: command tx timeout [ 98.182687][ T5834] Bluetooth: hci0: command tx timeout [ 98.188105][ T5827] Bluetooth: hci3: command tx timeout [ 98.193567][ T5838] Bluetooth: hci1: command tx timeout [ 98.194474][ T5840] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 98.240124][ T5830] 8021q: adding VLAN 0 to HW filter on device bond0 [ 98.262639][ T5827] Bluetooth: hci4: command tx timeout [ 98.299613][ T5830] 8021q: adding VLAN 0 to HW filter on device team0 [ 98.345499][ T5826] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 98.356467][ T5826] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 98.370641][ T5826] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 98.382282][ T5826] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 98.396297][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.403739][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.446845][ T63] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.454138][ T63] bridge0: port 2(bridge_slave_1) entered forwarding state [ 98.577036][ T5822] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 98.599353][ T5823] 8021q: adding VLAN 0 to HW filter on device bond0 [ 98.615152][ T5822] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 98.628898][ T5822] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 98.640251][ T5822] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 98.669828][ T5823] 8021q: adding VLAN 0 to HW filter on device team0 [ 98.695080][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.702228][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.738854][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.746027][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 98.814715][ T5840] 8021q: adding VLAN 0 to HW filter on device bond0 [ 98.929287][ T5840] 8021q: adding VLAN 0 to HW filter on device team0 [ 98.964337][ T5826] 8021q: adding VLAN 0 to HW filter on device bond0 [ 99.021667][ T3541] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.028989][ T3541] bridge0: port 1(bridge_slave_0) entered forwarding state [ 99.077547][ T5822] 8021q: adding VLAN 0 to HW filter on device bond0 [ 99.109581][ T63] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.116853][ T63] bridge0: port 2(bridge_slave_1) entered forwarding state [ 99.207385][ T5826] 8021q: adding VLAN 0 to HW filter on device team0 [ 99.274995][ T63] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.282194][ T63] bridge0: port 1(bridge_slave_0) entered forwarding state [ 99.313806][ T5822] 8021q: adding VLAN 0 to HW filter on device team0 [ 99.340116][ T63] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.347341][ T63] bridge0: port 2(bridge_slave_1) entered forwarding state [ 99.371272][ T5840] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 99.399433][ T3541] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.406677][ T3541] bridge0: port 1(bridge_slave_0) entered forwarding state [ 99.434453][ T5830] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 99.450179][ T3541] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.457443][ T3541] bridge0: port 2(bridge_slave_1) entered forwarding state [ 99.616435][ T5823] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 99.753673][ T5830] veth0_vlan: entered promiscuous mode [ 99.787406][ T5830] veth1_vlan: entered promiscuous mode [ 99.906977][ T5840] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 99.946707][ T5830] veth0_macvtap: entered promiscuous mode [ 100.007030][ T5830] veth1_macvtap: entered promiscuous mode [ 100.117740][ T5830] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 100.155725][ T5830] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 100.178073][ T5840] veth0_vlan: entered promiscuous mode [ 100.217815][ T5840] veth1_vlan: entered promiscuous mode [ 100.242179][ T5830] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.252203][ T5830] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.265099][ T5146] Bluetooth: hci0: command tx timeout [ 100.265871][ T5834] Bluetooth: hci1: command tx timeout [ 100.270548][ T5146] Bluetooth: hci2: command tx timeout [ 100.280419][ T5830] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.281931][ T5827] Bluetooth: hci3: command tx timeout [ 100.296395][ T5830] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.346345][ T5827] Bluetooth: hci4: command tx timeout [ 100.436590][ T5840] veth0_macvtap: entered promiscuous mode [ 100.449976][ T5826] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.479425][ T5840] veth1_macvtap: entered promiscuous mode [ 100.491636][ T5822] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.510798][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.534077][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.567961][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 100.615551][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 100.655342][ T5840] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.665277][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.671432][ T5840] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.681921][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.681988][ T5840] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.698373][ T5840] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.747151][ T5822] veth0_vlan: entered promiscuous mode [ 100.777580][ T5823] veth0_vlan: entered promiscuous mode [ 100.815257][ T5822] veth1_vlan: entered promiscuous mode [ 100.866847][ T5830] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 100.885811][ T5823] veth1_vlan: entered promiscuous mode [ 100.900922][ T5826] veth0_vlan: entered promiscuous mode [ 100.929033][ T5826] veth1_vlan: entered promiscuous mode [ 101.032691][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.040563][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.055764][ T5823] veth0_macvtap: entered promiscuous mode [ 101.078773][ T5823] veth1_macvtap: entered promiscuous mode [ 101.110319][ T5822] veth0_macvtap: entered promiscuous mode [ 101.147569][ T5822] veth1_macvtap: entered promiscuous mode [ 101.161707][ T5826] veth0_macvtap: entered promiscuous mode [ 101.174721][ T5823] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 101.207770][ T5826] veth1_macvtap: entered promiscuous mode [ 101.222007][ T5823] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 101.240801][ T5822] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 101.276441][ T5823] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.286554][ T5823] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.296408][ T5823] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.306208][ T5823] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.327595][ T5826] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 101.412681][ T5822] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 101.432923][ T5826] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 101.503506][ T5916] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 101.975513][ T3444] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.984857][ T3444] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.005488][ T5822] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.017289][ T5822] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.028605][ T5822] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.037674][ T5822] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.077806][ T5826] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.102127][ T5826] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.118892][ T5826] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.128080][ T5826] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.330274][ T3541] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.362737][ T5827] Bluetooth: hci3: command tx timeout [ 102.368287][ T5827] Bluetooth: hci2: command tx timeout [ 102.378563][ T5827] Bluetooth: hci1: command tx timeout [ 102.384297][ T5827] Bluetooth: hci0: command tx timeout [ 102.397026][ T3541] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.424678][ T5827] Bluetooth: hci4: command tx timeout [ 103.305492][ T3541] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.322671][ T3541] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.607315][ T5926] ======================================================= [ 103.607315][ T5926] WARNING: The mand mount option has been deprecated and [ 103.607315][ T5926] and is ignored by this kernel. Remove the mand [ 103.607315][ T5926] option from the mount to silence this warning. [ 103.607315][ T5926] ======================================================= [ 103.710096][ T5926] syz.3.4: attempt to access beyond end of device [ 103.710096][ T5926] loop3: rw=0, sector=64, nr_sectors = 1 limit=0 [ 103.714750][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.733117][ T5926] syz.3.4: attempt to access beyond end of device [ 103.733117][ T5926] loop3: rw=0, sector=256, nr_sectors = 1 limit=0 [ 103.748025][ T5926] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=256, location=256 [ 103.749557][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.772717][ T5926] syz.3.4: attempt to access beyond end of device [ 103.772717][ T5926] loop3: rw=0, sector=512, nr_sectors = 1 limit=0 [ 103.788810][ T5926] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=512, location=512 [ 103.799297][ T5926] UDF-fs: warning (device loop3): udf_load_vrs: No anchor found [ 103.807225][ T5926] UDF-fs: Scanning with blocksize 512 failed [ 103.822146][ T5926] syz.3.4: attempt to access beyond end of device [ 103.822146][ T5926] loop3: rw=0, sector=64, nr_sectors = 2 limit=0 [ 103.841323][ T5926] syz.3.4: attempt to access beyond end of device [ 103.841323][ T5926] loop3: rw=0, sector=512, nr_sectors = 2 limit=0 [ 103.856439][ T5926] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=256, location=256 [ 103.869252][ T5926] syz.3.4: attempt to access beyond end of device [ 103.869252][ T5926] loop3: rw=0, sector=1024, nr_sectors = 2 limit=0 [ 103.882467][ T5926] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=512, location=512 [ 103.892094][ T5926] UDF-fs: warning (device loop3): udf_load_vrs: No anchor found [ 103.900138][ T5926] UDF-fs: Scanning with blocksize 1024 failed [ 103.911479][ T5926] syz.3.4: attempt to access beyond end of device [ 103.911479][ T5926] loop3: rw=0, sector=64, nr_sectors = 4 limit=0 [ 103.925933][ T5926] syz.3.4: attempt to access beyond end of device [ 103.925933][ T5926] loop3: rw=0, sector=1024, nr_sectors = 4 limit=0 [ 103.932742][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 103.939765][ T5926] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=256, location=256 [ 103.958313][ T5926] syz.3.4: attempt to access beyond end of device [ 103.958313][ T5926] loop3: rw=0, sector=2048, nr_sectors = 4 limit=0 [ 103.972181][ T5926] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=512, location=512 [ 103.981993][ T5926] UDF-fs: warning (device loop3): udf_load_vrs: No anchor found [ 103.990020][ T5926] UDF-fs: Scanning with blocksize 2048 failed [ 104.001046][ T5926] syz.3.4: attempt to access beyond end of device [ 104.001046][ T5926] loop3: rw=0, sector=64, nr_sectors = 8 limit=0 [ 104.016158][ T5926] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=256, location=256 [ 104.029681][ T5926] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=512, location=512 [ 104.040729][ T5926] UDF-fs: warning (device loop3): udf_load_vrs: No anchor found [ 104.050731][ T5926] UDF-fs: Scanning with blocksize 4096 failed [ 104.057426][ T5926] UDF-fs: warning (device loop3): udf_fill_super: No partition found (1) [ 104.673384][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 104.681648][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 104.742831][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 104.833258][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 104.841540][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 104.854240][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 105.342838][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 105.351207][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 105.359858][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 105.797793][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.991688][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.837620][ T3541] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.865223][ T3541] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.151527][ T3444] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.282704][ T3444] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.696948][ T5884] libceph: connect (1)[c::]:6789 error -101 [ 107.703604][ T5884] libceph: mon0 (1)[c::]:6789 connect error [ 108.103875][ T5824] libceph: connect (1)[c::]:6789 error -101 [ 108.110117][ T5824] libceph: mon0 (1)[c::]:6789 connect error [ 108.237549][ T5939] ceph: No mds server is up or the cluster is laggy [ 110.229794][ T5965] process 'syz.3.12' launched './file0' with NULL argv: empty string added [ 110.283777][ T5965] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 110.911966][ T5963] PKCS8: Unsupported PKCS#8 version [ 113.942966][ T5983] xt_CT: You must specify a L4 protocol and not use inversions on it [ 115.478910][ T6000] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 116.886816][ T30] audit: type=1326 audit(1748963912.953:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6004 comm="syz.4.20" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5e3d58e969 code=0x7ffc0000 [ 117.335202][ T30] audit: type=1326 audit(1748963912.953:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6004 comm="syz.4.20" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7f5e3d58e969 code=0x7ffc0000 [ 117.358949][ T30] audit: type=1326 audit(1748963912.953:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6004 comm="syz.4.20" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5e3d58e969 code=0x7ffc0000 [ 117.380828][ T30] audit: type=1326 audit(1748963912.963:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6004 comm="syz.4.20" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7f5e3d58e969 code=0x7ffc0000 [ 117.402526][ T30] audit: type=1326 audit(1748963912.963:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6004 comm="syz.4.20" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5e3d58e969 code=0x7ffc0000 [ 117.472820][ T30] audit: type=1326 audit(1748963912.963:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6004 comm="syz.4.20" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f5e3d58e969 code=0x7ffc0000 [ 117.617052][ T30] audit: type=1326 audit(1748963912.973:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6004 comm="syz.4.20" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5e3d58e969 code=0x7ffc0000 [ 118.390178][ T30] audit: type=1326 audit(1748963912.973:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6004 comm="syz.4.20" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f5e3d58e969 code=0x7ffc0000 [ 118.614255][ T30] audit: type=1326 audit(1748963912.973:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6004 comm="syz.4.20" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5e3d58e969 code=0x7ffc0000 [ 119.673485][ T30] audit: type=1326 audit(1748963912.983:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6004 comm="syz.4.20" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5e3d58e969 code=0x7ffc0000 [ 124.086161][ T6041] tty tty3: ldisc open failed (-12), clearing slot 2 [ 126.395988][ T63] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 126.493692][ T63] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 126.631424][ T63] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 127.679924][ T6070] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 129.703425][ T63] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 130.370174][ T6086] block device autoloading is deprecated and will be removed. [ 130.381570][ T6086] bio_check_eod: 2 callbacks suppressed [ 130.381618][ T6086] syz.2.37: attempt to access beyond end of device [ 130.381618][ T6086] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 132.985889][ T63] bridge_slave_1: left allmulticast mode [ 132.991813][ T63] bridge_slave_1: left promiscuous mode [ 133.073348][ T63] bridge0: port 2(bridge_slave_1) entered disabled state [ 133.094607][ T5834] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 133.103732][ T5834] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 133.113773][ T5834] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 133.128535][ T5834] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 133.137458][ T5834] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 133.315073][ T63] bridge_slave_0: left allmulticast mode [ 133.383859][ T6103] netlink: 'syz.1.39': attribute type 10 has an invalid length. [ 133.397552][ T63] bridge_slave_0: left promiscuous mode [ 133.481766][ T63] bridge0: port 1(bridge_slave_0) entered disabled state [ 133.691509][ T6106] fuse: Bad value for 'fd' [ 135.920475][ T5827] Bluetooth: hci2: command tx timeout [ 137.960736][ T5827] Bluetooth: hci2: command tx timeout [ 138.169528][ T6129] Illegal XDP return value 4294967294 on prog (id 12) dev N/A, expect packet loss! [ 138.234638][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 138.408653][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 138.839176][ T63] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 138.854919][ T63] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 138.865881][ T63] bond0 (unregistering): Released all slaves [ 138.890071][ T6103] bridge0: port 2(bridge_slave_1) entered disabled state [ 138.898839][ T6103] bridge0: port 1(bridge_slave_0) entered disabled state [ 138.945995][ T6103] bridge0: port 2(bridge_slave_1) entered blocking state [ 138.953376][ T6103] bridge0: port 2(bridge_slave_1) entered forwarding state [ 138.962030][ T6103] bridge0: port 1(bridge_slave_0) entered blocking state [ 138.969386][ T6103] bridge0: port 1(bridge_slave_0) entered forwarding state [ 139.027290][ T6103] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 140.059472][ T5827] Bluetooth: hci2: command tx timeout [ 144.314995][ T5827] Bluetooth: hci2: command tx timeout [ 144.602132][ T3444] Bluetooth: hci5: Frame reassembly failed (-84) [ 144.683538][ T980] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 145.389999][ T980] usb 5-1: Using ep0 maxpacket: 8 [ 145.511105][ T980] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 145.673349][ T980] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 145.956788][ T980] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 145.982872][ T980] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 146.108436][ T980] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 146.265912][ T980] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 146.298773][ T980] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 146.513096][ T63] hsr_slave_0: left promiscuous mode [ 146.533031][ T63] hsr_slave_1: left promiscuous mode [ 146.539560][ T63] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 146.562977][ T63] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 146.623202][ T63] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 146.630719][ T63] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 146.670780][ T5827] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 146.692652][ T5834] Bluetooth: hci5: command 0x1003 tx timeout [ 146.903228][ T63] veth1_macvtap: left promiscuous mode [ 146.909212][ T63] veth0_macvtap: left promiscuous mode [ 146.915623][ T63] veth1_vlan: left promiscuous mode [ 146.921217][ T63] veth0_vlan: left promiscuous mode [ 146.994107][ T6187] netlink: 64 bytes leftover after parsing attributes in process `syz.2.56'. [ 147.929614][ T5146] Bluetooth: hci4: unexpected event 0x06 length: 233 > 3 [ 150.799283][ T6207] netlink: 'syz.3.60': attribute type 16 has an invalid length. [ 150.814644][ T6207] netlink: 64138 bytes leftover after parsing attributes in process `syz.3.60'. [ 151.384243][ T980] usb 5-1: can't set config #16, error -110 [ 151.977608][ T63] team0 (unregistering): Port device team_slave_1 removed [ 152.625791][ T63] team0 (unregistering): Port device team_slave_0 removed [ 155.271815][ T6187] lo speed is unknown, defaulting to 1000 [ 155.297442][ T9] usb 5-1: USB disconnect, device number 2 [ 155.943513][ T6187] lo speed is unknown, defaulting to 1000 [ 155.953913][ T6187] lo speed is unknown, defaulting to 1000 [ 155.967150][ T6187] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 155.986167][ T6187] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 156.158870][ T6187] lo speed is unknown, defaulting to 1000 [ 156.168099][ T6187] lo speed is unknown, defaulting to 1000 [ 156.176080][ T6187] lo speed is unknown, defaulting to 1000 [ 156.302201][ T6187] lo speed is unknown, defaulting to 1000 [ 156.310407][ T6187] lo speed is unknown, defaulting to 1000 [ 156.403458][ T6222] binder: 6221:6222 ioctl 4018620d 0 returned -22 [ 156.461726][ T6222] binder: 6221:6222 ioctl c0306201 0 returned -14 [ 159.839195][ T6093] chnl_net:caif_netlink_parms(): no params data found [ 160.039892][ T5827] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 160.594003][ T5827] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 160.606415][ T5827] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 160.616805][ T5827] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 160.627050][ T5827] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 162.853198][ T5146] Bluetooth: hci5: command tx timeout [ 163.839685][ T6271] could not allocate digest TFM handle cbcmac-aes-neon [ 164.912915][ T6248] lo speed is unknown, defaulting to 1000 [ 164.917871][ T5146] Bluetooth: hci5: command tx timeout [ 165.282650][ T6093] bridge0: port 1(bridge_slave_0) entered blocking state [ 165.332958][ T5884] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 165.402866][ T6093] bridge0: port 1(bridge_slave_0) entered disabled state [ 165.522829][ T6093] bridge_slave_0: entered allmulticast mode [ 165.693294][ T6093] bridge_slave_0: entered promiscuous mode [ 165.892971][ T5884] usb 4-1: config 1 interface 0 altsetting 1 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 165.897785][ T6093] bridge0: port 2(bridge_slave_1) entered blocking state [ 166.324923][ T6093] bridge0: port 2(bridge_slave_1) entered disabled state [ 166.333936][ T5884] usb 4-1: config 1 interface 0 altsetting 1 endpoint 0x81 has invalid maxpacket 1536, setting to 64 [ 166.399402][ T5884] usb 4-1: config 1 interface 0 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 166.402636][ T6093] bridge_slave_1: entered allmulticast mode [ 166.447295][ T6093] bridge_slave_1: entered promiscuous mode [ 166.449337][ T5884] usb 4-1: config 1 interface 0 has no altsetting 0 [ 166.503071][ T5884] usb 4-1: New USB device found, idVendor=056a, idProduct=00d8, bcdDevice= 0.40 [ 166.540564][ T5884] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 166.580592][ T5884] usb 4-1: Product: syz [ 166.604122][ T5884] usb 4-1: Manufacturer: syz [ 166.608820][ T5884] usb 4-1: SerialNumber: syz [ 166.641436][ T6287] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 166.694305][ T6301] binder: 6300:6301 ioctl 4018620d 0 returned -22 [ 166.704503][ T6301] binder: 6300:6301 ioctl c0306201 0 returned -14 [ 166.785486][ T6093] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 166.985617][ T5146] Bluetooth: hci5: command tx timeout [ 167.401304][ T6093] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 167.503166][ T5884] usbhid 4-1:1.0: can't add hid device: -71 [ 167.509334][ T5884] usbhid 4-1:1.0: probe with driver usbhid failed with error -71 [ 167.580260][ T5884] usb 4-1: USB disconnect, device number 2 [ 167.735390][ T6093] team0: Port device team_slave_0 added [ 167.766227][ T6093] team0: Port device team_slave_1 added [ 168.072662][ T6310] xt_hashlimit: max too large, truncated to 1048576 [ 168.085141][ T6310] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 169.009401][ T6317] Zero length message leads to an empty skb [ 169.062571][ T5827] Bluetooth: hci5: command tx timeout [ 170.899294][ T6093] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 170.909712][ T6093] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 170.957757][ T6093] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 171.533112][ T6093] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 171.573922][ T6093] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 171.599877][ C1] vkms_vblank_simulate: vblank timer overrun [ 171.606245][ T6093] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 172.731306][ T63] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 172.787940][ T6335] netlink: 2 bytes leftover after parsing attributes in process `syz.3.83'. [ 172.797755][ T6336] warning: `syz.3.83' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 173.765352][ T63] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 173.911256][ T6093] hsr_slave_0: entered promiscuous mode [ 173.936196][ T5827] block nbd0: Receive control failed (result -32) [ 173.945862][ T6093] hsr_slave_1: entered promiscuous mode [ 173.964859][ T6093] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 173.972569][ T6093] Cannot create hsr debugfs directory [ 174.060763][ T63] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.446642][ T6353] ================================================================== [ 175.454771][ T6353] BUG: KASAN: slab-use-after-free in binder_add_device+0x5f/0xa0 [ 175.462538][ T6353] Write of size 8 at addr ffff88805728a408 by task syz.2.86/6353 [ 175.470263][ T6353] [ 175.472621][ T6353] CPU: 1 UID: 0 PID: 6353 Comm: syz.2.86 Not tainted 6.15.0-syzkaller-11173-g546b1c9e93c2 #0 PREEMPT(full) [ 175.472643][ T6353] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 175.472658][ T6353] Call Trace: [ 175.472669][ T6353] [ 175.472678][ T6353] dump_stack_lvl+0x189/0x250 [ 175.472707][ T6353] ? __virt_addr_valid+0x1c8/0x5c0 [ 175.472724][ T6353] ? rcu_is_watching+0x15/0xb0 [ 175.472750][ T6353] ? __kasan_check_byte+0x12/0x40 [ 175.472777][ T6353] ? __pfx_dump_stack_lvl+0x10/0x10 [ 175.472801][ T6353] ? rcu_is_watching+0x15/0xb0 [ 175.472826][ T6353] ? lock_release+0x4b/0x3e0 [ 175.472851][ T6353] ? __virt_addr_valid+0x1c8/0x5c0 [ 175.472867][ T6353] ? __virt_addr_valid+0x4a5/0x5c0 [ 175.472883][ T6353] print_report+0xd2/0x2b0 [ 175.472904][ T6353] ? binder_add_device+0x5f/0xa0 [ 175.472925][ T6353] kasan_report+0x118/0x150 [ 175.472948][ T6353] ? binder_add_device+0x5f/0xa0 [ 175.472972][ T6353] binder_add_device+0x5f/0xa0 [ 175.472993][ T6353] binderfs_binder_device_create+0x9e7/0xc40 [ 175.473038][ T6353] ? __pfx_binderfs_binder_device_create+0x10/0x10 [ 175.473061][ T6353] ? do_raw_spin_unlock+0x122/0x240 [ 175.473081][ T6353] binderfs_fill_super+0xa0e/0xe90 [ 175.473104][ T6353] ? __pfx_binderfs_fill_super+0x10/0x10 [ 175.473135][ T6353] ? sget_fc+0x962/0xa40 [ 175.473153][ T6353] ? __pfx_set_anon_super_fc+0x10/0x10 [ 175.473171][ T6353] ? __pfx_binderfs_fill_super+0x10/0x10 [ 175.473191][ T6353] get_tree_nodev+0xb8/0x150 [ 175.473211][ T6353] vfs_get_tree+0x92/0x2b0 [ 175.473232][ T6353] vfs_cmd_create+0xa2/0x200 [ 175.473250][ T6353] __se_sys_fsconfig+0x78e/0x8d0 [ 175.473268][ T6353] ? __pfx___se_sys_fsconfig+0x10/0x10 [ 175.473289][ T6353] ? do_syscall_64+0xbe/0x3b0 [ 175.473314][ T6353] ? __x64_sys_fsconfig+0x20/0xc0 [ 175.473330][ T6353] do_syscall_64+0xfa/0x3b0 [ 175.473355][ T6353] ? lockdep_hardirqs_on+0x9c/0x150 [ 175.473379][ T6353] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 175.473395][ T6353] ? clear_bhb_loop+0x60/0xb0 [ 175.473413][ T6353] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 175.473430][ T6353] RIP: 0033:0x7f6b4098e969 [ 175.473450][ T6353] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 175.473464][ T6353] RSP: 002b:00007f6b417e3038 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 175.473482][ T6353] RAX: ffffffffffffffda RBX: 00007f6b40bb5fa0 RCX: 00007f6b4098e969 [ 175.473499][ T6353] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000009 [ 175.473509][ T6353] RBP: 00007f6b40a10ab1 R08: 0000000000000000 R09: 0000000000000000 [ 175.473519][ T6353] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 175.473529][ T6353] R13: 0000000000000000 R14: 00007f6b40bb5fa0 R15: 00007fff2cef94e8 [ 175.473547][ T6353] [ 175.473552][ T6353] [ 175.751988][ T6353] Allocated by task 5823: [ 175.756324][ T6353] kasan_save_track+0x3e/0x80 [ 175.761022][ T6353] __kasan_kmalloc+0x93/0xb0 [ 175.765645][ T6353] __kmalloc_cache_noprof+0x230/0x3d0 [ 175.771036][ T6353] binderfs_binder_device_create+0x1eb/0xc40 [ 175.777031][ T6353] binderfs_fill_super+0xa0e/0xe90 [ 175.782166][ T6353] get_tree_nodev+0xb8/0x150 [ 175.786768][ T6353] vfs_get_tree+0x92/0x2b0 [ 175.791322][ T6353] do_new_mount+0x24a/0xa40 [ 175.795853][ T6353] __se_sys_mount+0x317/0x410 [ 175.800635][ T6353] do_syscall_64+0xfa/0x3b0 [ 175.805165][ T6353] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 175.811074][ T6353] [ 175.813408][ T6353] Freed by task 5883: [ 175.817417][ T6353] kasan_save_track+0x3e/0x80 [ 175.822173][ T6353] kasan_save_free_info+0x46/0x50 [ 175.827206][ T6353] __kasan_slab_free+0x62/0x70 [ 175.832071][ T6353] kfree+0x18e/0x440 [ 175.835979][ T6353] binder_proc_dec_tmpref+0x228/0x4f0 [ 175.841368][ T6353] binder_deferred_func+0x13a5/0x1520 [ 175.846748][ T6353] process_scheduled_works+0xae1/0x17b0 [ 175.852347][ T6353] worker_thread+0x8a0/0xda0 [ 175.857037][ T6353] kthread+0x711/0x8a0 [ 175.861116][ T6353] ret_from_fork+0x3f9/0x770 [ 175.865747][ T6353] ret_from_fork_asm+0x1a/0x30 [ 175.870533][ T6353] [ 175.872869][ T6353] The buggy address belongs to the object at ffff88805728a400 [ 175.872869][ T6353] which belongs to the cache kmalloc-512 of size 512 [ 175.886947][ T6353] The buggy address is located 8 bytes inside of [ 175.886947][ T6353] freed 512-byte region [ffff88805728a400, ffff88805728a600) [ 175.900597][ T6353] [ 175.902941][ T6353] The buggy address belongs to the physical page: [ 175.909384][ T6353] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888057288800 pfn:0x57288 [ 175.919480][ T6353] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 175.928008][ T6353] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) [ 175.936567][ T6353] page_type: f5(slab) [ 175.940561][ T6353] raw: 00fff00000000240 ffff88801a441c80 ffffea00015ddf10 ffffea0000c79e10 [ 175.949164][ T6353] raw: ffff888057288800 000000000010000d 00000000f5000000 0000000000000000 [ 175.957768][ T6353] head: 00fff00000000240 ffff88801a441c80 ffffea00015ddf10 ffffea0000c79e10 [ 175.966902][ T6353] head: ffff888057288800 000000000010000d 00000000f5000000 0000000000000000 [ 175.975596][ T6353] head: 00fff00000000002 ffffea00015ca201 00000000ffffffff 00000000ffffffff [ 175.984284][ T6353] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 175.992962][ T6353] page dumped because: kasan: bad access detected [ 175.999397][ T6353] page_owner tracks the page as allocated [ 176.005126][ T6353] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5826, tgid 5826 (syz-executor), ts 107773051518, free_ts 30581217772 [ 176.026603][ T6353] post_alloc_hook+0x240/0x2a0 [ 176.031411][ T6353] get_page_from_freelist+0x21d5/0x22b0 [ 176.036979][ T6353] __alloc_frozen_pages_noprof+0x181/0x370 [ 176.042803][ T6353] alloc_pages_mpol+0x232/0x4a0 [ 176.047674][ T6353] allocate_slab+0x8a/0x3b0 [ 176.052183][ T6353] ___slab_alloc+0xbfc/0x1480 [ 176.056883][ T6353] __kmalloc_cache_noprof+0x296/0x3d0 [ 176.062373][ T6353] cpuacct_css_alloc+0x55/0x130 [ 176.067242][ T6353] cgroup_apply_control_enable+0x3d4/0xa80 [ 176.073153][ T6353] cgroup_mkdir+0xc40/0xe60 [ 176.077676][ T6353] kernfs_iop_mkdir+0x20e/0x350 [ 176.082543][ T6353] vfs_mkdir+0x306/0x510 [ 176.086799][ T6353] do_mkdirat+0x247/0x590 [ 176.091141][ T6353] __x64_sys_mkdirat+0x87/0xa0 [ 176.096022][ T6353] do_syscall_64+0xfa/0x3b0 [ 176.100559][ T6353] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 176.106648][ T6353] page last free pid 1 tgid 1 stack trace: [ 176.112470][ T6353] __free_frozen_pages+0xc65/0xe60 [ 176.117609][ T6353] free_contig_range+0x1bd/0x4a0 [ 176.122562][ T6353] destroy_args+0x7e/0x5d0 [ 176.126997][ T6353] debug_vm_pgtable+0x412/0x450 [ 176.131970][ T6353] do_one_initcall+0x233/0x820 [ 176.136750][ T6353] do_initcall_level+0x137/0x1f0 [ 176.141707][ T6353] do_initcalls+0x69/0xd0 [ 176.146053][ T6353] kernel_init_freeable+0x3d9/0x570 [ 176.151351][ T6353] kernel_init+0x1d/0x1d0 [ 176.155701][ T6353] ret_from_fork+0x3f9/0x770 [ 176.160419][ T6353] ret_from_fork_asm+0x1a/0x30 [ 176.165193][ T6353] [ 176.167524][ T6353] Memory state around the buggy address: [ 176.173157][ T6353] ffff88805728a300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 176.181231][ T6353] ffff88805728a380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 176.189301][ T6353] >ffff88805728a400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 176.197395][ T6353] ^ [ 176.201832][ T6353] ffff88805728a480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 176.209908][ T6353] ffff88805728a500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 176.217981][ T6353] ================================================================== [ 176.228072][ T6353] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 176.235339][ T6353] CPU: 1 UID: 0 PID: 6353 Comm: syz.2.86 Not tainted 6.15.0-syzkaller-11173-g546b1c9e93c2 #0 PREEMPT(full) [ 176.246812][ T6353] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 176.256892][ T6353] Call Trace: [ 176.260193][ T6353] [ 176.263134][ T6353] dump_stack_lvl+0x99/0x250 [ 176.267743][ T6353] ? __asan_memcpy+0x40/0x70 [ 176.272357][ T6353] ? __pfx_dump_stack_lvl+0x10/0x10 [ 176.277586][ T6353] ? __pfx__printk+0x10/0x10 [ 176.282281][ T6353] panic+0x2db/0x790 [ 176.286224][ T6353] ? __pfx_panic+0x10/0x10 [ 176.290661][ T6353] ? _raw_spin_unlock_irqrestore+0xa8/0x110 [ 176.296664][ T6353] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 176.302580][ T6353] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 176.308938][ T6353] ? print_memory_metadata+0x314/0x400 [ 176.314434][ T6353] ? binder_add_device+0x5f/0xa0 [ 176.319401][ T6353] check_panic_on_warn+0x89/0xb0 [ 176.324360][ T6353] ? binder_add_device+0x5f/0xa0 [ 176.329328][ T6353] end_report+0x78/0x160 [ 176.333611][ T6353] kasan_report+0x129/0x150 [ 176.338135][ T6353] ? binder_add_device+0x5f/0xa0 [ 176.343094][ T6353] binder_add_device+0x5f/0xa0 [ 176.347878][ T6353] binderfs_binder_device_create+0x9e7/0xc40 [ 176.353878][ T6353] ? __pfx_binderfs_binder_device_create+0x10/0x10 [ 176.360402][ T6353] ? do_raw_spin_unlock+0x122/0x240 [ 176.365618][ T6353] binderfs_fill_super+0xa0e/0xe90 [ 176.370750][ T6353] ? __pfx_binderfs_fill_super+0x10/0x10 [ 176.376411][ T6353] ? sget_fc+0x962/0xa40 [ 176.380668][ T6353] ? __pfx_set_anon_super_fc+0x10/0x10 [ 176.386140][ T6353] ? __pfx_binderfs_fill_super+0x10/0x10 [ 176.391874][ T6353] get_tree_nodev+0xb8/0x150 [ 176.396488][ T6353] vfs_get_tree+0x92/0x2b0 [ 176.400947][ T6353] vfs_cmd_create+0xa2/0x200 [ 176.405598][ T6353] __se_sys_fsconfig+0x78e/0x8d0 [ 176.410560][ T6353] ? __pfx___se_sys_fsconfig+0x10/0x10 [ 176.416045][ T6353] ? do_syscall_64+0xbe/0x3b0 [ 176.420755][ T6353] ? __x64_sys_fsconfig+0x20/0xc0 [ 176.425797][ T6353] do_syscall_64+0xfa/0x3b0 [ 176.430322][ T6353] ? lockdep_hardirqs_on+0x9c/0x150 [ 176.435560][ T6353] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 176.441660][ T6353] ? clear_bhb_loop+0x60/0xb0 [ 176.446364][ T6353] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 176.452277][ T6353] RIP: 0033:0x7f6b4098e969 [ 176.456743][ T6353] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 176.476370][ T6353] RSP: 002b:00007f6b417e3038 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 176.484803][ T6353] RAX: ffffffffffffffda RBX: 00007f6b40bb5fa0 RCX: 00007f6b4098e969 [ 176.492795][ T6353] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000009 [ 176.500870][ T6353] RBP: 00007f6b40a10ab1 R08: 0000000000000000 R09: 0000000000000000 [ 176.508855][ T6353] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 176.516837][ T6353] R13: 0000000000000000 R14: 00007f6b40bb5fa0 R15: 00007fff2cef94e8 [ 176.524831][ T6353] [ 176.528268][ T6353] Kernel Offset: disabled [ 176.532617][ T6353] Rebooting in 86400 seconds..