last executing test programs: 14.738564358s ago: executing program 3 (id=11): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x1000000) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r1, 0xc000000, &(0x7f0000000000)=[{&(0x7f0000001600)=""/4096, 0x1000}], 0x1, 0x12}) io_uring_enter(0xffffffffffffffff, 0x847ba, 0x0, 0xe, 0x0, 0x0) 12.759642698s ago: executing program 3 (id=14): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(0xffffffffffffffff, 0x84, 0x20, 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_procfs(0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20088004, &(0x7f0000000280)={0xa, 0x4e20, 0x0, @empty, 0x20000007}, 0x1c) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000480)={{}, &(0x7f0000000340), &(0x7f0000000440)}, 0x20) sendmsg(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, 0x0}, 0x40051) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_mptcp(0xa, 0x1, 0x106) timer_create(0x2, 0x0, 0x0) timer_create(0x2, 0x0, &(0x7f0000000080)=0x0) timer_delete(r1) r2 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000100)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r2, &(0x7f00000000c0)='asymmetric\x00', &(0x7f0000000280)=@chain) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x84, 0x25, 0x0, 0x0) 11.085225213s ago: executing program 3 (id=18): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b6db714e4b94bdae214fa68a0557eb3c5ca683a4b6fc89398f2b9000f224891060017c4700de60beac671e8e8fdecb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c5553d2ccb5fc5b51fe6b174ebd9907dcff414ed55b0d18a93ee341ab59016f81860324b800300000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4a801efdf008499d7aca1afac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000040)=ANY=[@ANYRES32, @ANYRES32=r1, @ANYBLOB='&'], 0x10) timer_create(0x2, 0x0, &(0x7f0000000080)=0x0) timer_delete(r2) 10.335578484s ago: executing program 0 (id=19): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$nl_rdma(0x10, 0x3, 0x14) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$inet_sctp(0x2, 0x5, 0x84) socket$inet6_mptcp(0xa, 0x1, 0x106) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x9}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000003e000701feffffff00000000017c0000040042800c00018006000600894f0000200002"], 0x44}, 0x1, 0x0, 0x0, 0x40040c0}, 0xc000) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r4, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x3}, 0x6, @null, @bpq0, 0x0, [@bcast, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @default, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) socket(0x2, 0x80805, 0x0) r5 = syz_init_net_socket$rose(0xb, 0x5, 0x0) connect$rose(r5, &(0x7f0000000040)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x1, @default}, 0x1c) connect$rose(r5, &(0x7f0000000100)=@full={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x0, [@null, @null, @null, @default, @bcast, @default]}, 0x40) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)=ANY=[@ANYRES64=r4], 0x18}, 0x1, 0x0, 0x0, 0x4000040}, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000380)={0x0, 0x0, 0x10}, 0xc) 9.303865008s ago: executing program 1 (id=21): r0 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00'}) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x1, 0x803, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) bind$netlink(r3, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfa, 0x400000}, 0xc) getsockname$packet(r3, 0x0, &(0x7f0000000080)) sendmsg$nl_route(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c00000010000d042abd70000000000000000000", @ANYRES32, @ANYBLOB="01001400000000001c00128009000100626f6e64000000000c0002800500010004"], 0x3c}, 0x1, 0x0, 0x0, 0x40040}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=r6, @ANYBLOB="00000000000000001c00128009000100626f6e64000000000c0002800800070003"], 0x3c}}, 0x0) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x1}, 0x0) 8.922889638s ago: executing program 3 (id=22): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x1000000) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = syz_io_uring_setup(0x497, &(0x7f00000002c0)={0x0, 0x89b8, 0x800, 0x0, 0x207}, &(0x7f0000000040)=0x0, &(0x7f00000000c0)=0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0xc000000, &(0x7f0000000000)=[{&(0x7f0000001600)=""/4096, 0x1000}], 0x1, 0x12}) io_uring_enter(r1, 0x847ba, 0x0, 0xe, 0x0, 0x0) 8.611426904s ago: executing program 0 (id=23): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r1, 0xc018643a, &(0x7f00000000c0)={0x4000001, 0x71, 0x200000009}) r2 = syz_io_uring_setup(0x66e, &(0x7f0000000240)={0x0, 0x0, 0x10100}, &(0x7f0000000380)=0x0, &(0x7f0000000200)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r2, 0x567, 0x0, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000400)={0x0, 0x0, r5, 0x0, 0x0, 0x1f5, 0x0, 0x0, {0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, "b4bc323ef77d1f000071849800000000dfff00"}}) 7.570944408s ago: executing program 1 (id=26): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(0xffffffffffffffff, 0x84, 0x20, 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20088004, &(0x7f0000000280)={0xa, 0x4e20, 0x0, @empty, 0x20000007}, 0x1c) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000480)={{}, &(0x7f0000000340), &(0x7f0000000440)}, 0x20) sendmsg(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, 0x0}, 0x40051) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_mptcp(0xa, 0x1, 0x106) timer_create(0x2, 0x0, 0x0) timer_create(0x2, 0x0, &(0x7f0000000080)=0x0) timer_delete(r1) r2 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000100)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r2, &(0x7f00000000c0)='asymmetric\x00', &(0x7f0000000280)=@chain) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x84, 0x25, 0x0, 0x0) 7.527293581s ago: executing program 0 (id=27): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(0xffffffffffffffff, 0x84, 0x20, 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_procfs(0x0, 0x0) r1 = socket$inet6(0xa, 0x80002, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20088004, &(0x7f0000000280)={0xa, 0x4e20, 0x0, @empty, 0x20000007}, 0x1c) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b6db714e4b94bdae214fa68a0557eb3c5ca683a4b6fc89398f2b9000f224891060017c4700de60beac671e8e8fdecb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c5553d2ccb5fc5b51fe6b174ebd9907dcff414ed55b0d18a93ee341ab59016f81860324b800300000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4a801efdf008499d7aca1afac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000040)=ANY=[@ANYRES32, @ANYRES32=r2, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000480)={{}, &(0x7f0000000340), &(0x7f0000000440)=r1}, 0x20) sendmsg(r1, &(0x7f0000000440)={0x0, 0x0, 0x0}, 0x40051) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_mptcp(0xa, 0x1, 0x106) timer_create(0x2, 0x0, 0x0) timer_create(0x2, 0x0, &(0x7f0000000080)=0x0) timer_delete(r3) r4 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000100)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) r5 = add_key$keyring(0x0, &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, &(0x7f0000000240)='asymmetric\x00', &(0x7f00000001c0)=@keyring={'key_or_keyring:', r4}) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='asymmetric\x00', &(0x7f0000000280)=@chain={'key_or_keyring:', r5}) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x84, 0x25, 0x0, 0x0) 7.506396463s ago: executing program 3 (id=28): socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) r3 = syz_usbip_server_init(0x4) syz_usb_connect(0x1, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="120100001ddf8208c00712152230000000010902"], 0x0) write$usbip_server(r3, &(0x7f0000000040)=ANY=[@ANYBLOB="000000030000000100000000000000010000000800000fff000000000f0000340000000300000001000000000000000000000002000000050000000200005961000000017fffffff000000070000000800000006000000000000"], 0x60) syz_emit_ethernet(0xfdef, &(0x7f0000000000)={@broadcast, @dev, @void, {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x1, @local, @empty, @empty, @local}}}}, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'netdevsim0\x00'}) sendmsg$ETHTOOL_MSG_PAUSE_SET(r4, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x80) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x0, 0x0, &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x2d) r6 = socket$netlink(0x10, 0x3, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r6, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) 5.93447606s ago: executing program 2 (id=29): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000280)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0x7ff, @empty, 0x1}, {0xa, 0x4e20, 0x17f, @dev={0xfe, 0x80, '\x00', 0xb}, 0x9}, 0xffffffffffffffff, 0xb}}, 0x48) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f00000000c0)="98a591c65382f702b9eb", 0xa}, {&(0x7f00000006c0)="da467702f9520108dcebc5560e4f93142974b51221138c2cdf5b4d577cb800c423ace69c1eba8d0c505baa2ad7ddff4bc6e17bd735b3576550a4b33160cad82f3df56db53fbf5fbad6125c8b7932af43ba88cd499a6c421696d57ff38d5231dc712a114aaeae7681c19a1975b5ae7a925a7b878d482b1375a1b59f2b669bcf1f5a39f4241eef5d48ba4a16fb354031b55dd5bad3ff8d69fe0a9e54a633953fea9e23fdf840a0b9270d", 0xa9}, {&(0x7f0000000300)="f111f39463acbac94f37eaaa931da78c8c414a4edadbcac605b6a5089e71e9b125f3a628ad2cbfd97cb9ad0e", 0x2c}], 0x3, 0x0, 0x0, 0x4000}, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[], 0x3c}}, 0x44000) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="a80000"], 0xa8}, 0x1, 0x0, 0x0, 0x4000}, 0x10) r2 = syz_open_dev$media(&(0x7f0000000380), 0x0, 0x0) r3 = syz_open_dev$media(&(0x7f0000001a80), 0x3, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc0287c02, &(0x7f00000002c0)={0x80000000, 0x0, &(0x7f0000002c40)=[{{0x80000000, 0x0}}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc0287c02, &(0x7f0000000400)={r5, &(0x7f00000007c0)=[{0x80000000}], &(0x7f0000000500)=[{{}, {0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r3, 0xc0287c02, &(0x7f0000000280)={r7, 0x0, &(0x7f0000000080)=[{{0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r2, 0xc0347c03, &(0x7f000000a300)={{r6, r9, 0x0, [0x1, 0x2]}, {r8, r4, 0x0, [0xc1b, 0x8]}, 0x1, [0x1007e, 0x9]}) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a28000000000a030000000000000000000100000908000240000000050900010073797a300000000028000000000a"], 0x78}, 0x1, 0x0, 0x0, 0x890}, 0x0) r10 = socket$alg(0x26, 0x5, 0x0) bind$alg(r10, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(des3_ede)\x00'}, 0x58) 5.927420901s ago: executing program 1 (id=30): syz_usb_connect(0x3, 0x2d, 0x0, 0x0) r0 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00'}) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb01001800000000000000340000003400000002000000000000000000000d030000000000000000"], 0x0, 0x4e}, 0x28) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000008000000010001000900000001"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={0x0, r4}, 0x18) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x23, 0x0, 0x6, 0x2, &(0x7f0000000640), 0x8, 0x0, 0x0, {0x1}}) r6 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r6, 0x5393, &(0x7f0000000000)) recvmmsg(r5, &(0x7f0000002ec0)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000300)=""/130, 0x82}, {&(0x7f00000004c0)=""/178, 0xb2}, {&(0x7f0000000580)=""/172, 0xac}], 0x3, &(0x7f0000000780)=""/244, 0xf4}, 0x4}, {{&(0x7f0000000640)=@xdp, 0x80, &(0x7f0000000fc0)=[{&(0x7f0000000880)=""/72, 0x48}, {&(0x7f0000000900)=""/160, 0xa0}, {&(0x7f0000001140)=""/4096, 0x1000}, {&(0x7f00000001c0)=""/34, 0x22}, {&(0x7f00000009c0)=""/201, 0xc9}, {&(0x7f0000000b40)=""/210, 0xd2}, {&(0x7f0000000c40)=""/155, 0x9b}, {&(0x7f0000000d40)=""/232, 0xe8}, {&(0x7f0000000e40)=""/199, 0xc7}, {&(0x7f0000000f40)=""/87, 0x57}], 0xa}, 0x3}, {{&(0x7f0000001080)=@rc, 0x80, &(0x7f0000002800)=[{&(0x7f0000002140)=""/222, 0xde}, {&(0x7f0000000280)=""/37, 0x25}, {&(0x7f0000002240)=""/136, 0x88}, {&(0x7f0000002300)=""/206, 0xce}, {&(0x7f0000002400)=""/126, 0x7e}, {&(0x7f0000002480)=""/95, 0x5f}, {&(0x7f0000002500)=""/158, 0x9e}, {&(0x7f00000025c0)=""/174, 0xae}, {&(0x7f0000002680)=""/65, 0x41}, {&(0x7f0000002700)=""/203, 0xcb}], 0xa}, 0xff}, {{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f00000003c0)=""/10, 0xa}, {&(0x7f00000028c0)=""/111, 0x6f}], 0x2, &(0x7f0000002940)=""/106, 0x6a}, 0x4}, {{&(0x7f00000029c0)=@un=@abs, 0x80, &(0x7f0000002d80)=[{&(0x7f0000002a40)=""/157, 0x9d}, {&(0x7f0000002b00)=""/87, 0x57}, {&(0x7f0000002b80)=""/226, 0xe2}, {&(0x7f00000006c0)=""/24, 0x18}, {&(0x7f0000002c80)=""/125, 0x7d}, {&(0x7f0000002d00)=""/110, 0x6e}], 0x6, &(0x7f0000002e00)=""/187, 0xbb}, 0x5}], 0x5, 0x120, &(0x7f0000003040)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000001100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="380000002000010329bd7000100000000200000403000007020000001400110069616376746170300000000000000000080006002503"], 0x38}, 0x1, 0x0, 0x0, 0x240480c4}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="3800000010003704feffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="8b040400000000001800128008000100736974000c00028008000300ff"], 0x38}, 0x1, 0x0, 0x0, 0x4c050}, 0x20000000) 4.497659576s ago: executing program 2 (id=31): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$nl_rdma(0x10, 0x3, 0x14) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$inet_sctp(0x2, 0x5, 0x84) socket$inet6_mptcp(0xa, 0x1, 0x106) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x9}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000003e000701feffffff00000000017c0000040042800c00018006000600894f0000200002"], 0x44}, 0x1, 0x0, 0x0, 0x40040c0}, 0xc000) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r4, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x3}, 0x6, @null, @bpq0, 0x0, [@bcast, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @default, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) socket(0x2, 0x80805, 0x0) r5 = syz_init_net_socket$rose(0xb, 0x5, 0x0) connect$rose(r5, &(0x7f0000000040)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x1, @default}, 0x1c) connect$rose(r5, &(0x7f0000000100)=@full={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x0, [@null, @null, @null, @default, @bcast, @default]}, 0x40) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)=ANY=[@ANYRES64=r4], 0x18}, 0x1, 0x0, 0x0, 0x4000040}, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000380)={0x0, 0x0, 0x10}, 0xc) 3.187958712s ago: executing program 3 (id=32): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b6db714e4b94bdae214fa68a0557eb3c5ca683a4b6fc89398f2b9000f224891060017c4700de60beac671e8e8fdecb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c5553d2ccb5fc5b51fe6b174ebd9907dcff414ed55b0d18a93ee341ab59016f81860324b800300000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4a801efdf008499d7aca1afac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000040)=ANY=[@ANYRES32, @ANYRES32=r1, @ANYBLOB='&'], 0x10) timer_create(0x2, 0x0, &(0x7f0000000080)=0x0) timer_delete(r2) 3.187181732s ago: executing program 0 (id=33): openat$vmci(0xffffff9c, &(0x7f0000001180), 0x2, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) syz_open_dev$media(&(0x7f00000012c0), 0x66, 0x180502) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x2b38094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r0 = open(&(0x7f0000000000)='.\x00', 0x800000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file0\x00', 0x1c0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x4, &(0x7f0000000180)=ANY=[@ANYRES32=r0], 0x0, 0x8, 0x28, 0x0, 0x0, 0x50, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r0}, 0x94) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, &(0x7f0000000180)) 2.363439109s ago: executing program 2 (id=34): r0 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00'}) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x1, 0x803, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) bind$netlink(r3, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfa, 0x400000}, 0xc) getsockname$packet(r3, 0x0, &(0x7f0000000080)) sendmsg$nl_route(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c00000010000d042abd70000000000000000000", @ANYRES32, @ANYBLOB="01001400000000001c00128009000100626f6e64000000000c0002800500010004"], 0x3c}, 0x1, 0x0, 0x0, 0x40040}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=r6, @ANYBLOB="00000000000000001c00128009000100626f6e64000000000c0002800800070003"], 0x3c}}, 0x0) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x1}, 0x0) 2.270489467s ago: executing program 0 (id=35): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x5) sched_setaffinity(0x0, 0xff43, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000007c0), 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) gettid() timer_create(0x0, 0x0, &(0x7f0000bbdffc)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCMGET(r2, 0x541e, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x0) write$cgroup_int(r3, &(0x7f00000000c0)=0x1c3, 0x12) pipe(0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) gettid() timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r4 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000380)={'vxcan0\x00', 0x0}) bind$can_j1939(r4, &(0x7f0000000100)={0x1d, r5, 0x0, {0x0, 0x0, 0x4}}, 0x18) connect$can_j1939(r4, &(0x7f0000000080)={0x1d, r5, 0x0, {0x0, 0xf0}, 0x1}, 0x18) sendmsg$can_j1939(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={0x0}}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 2.23385975s ago: executing program 1 (id=36): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x1000000) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = syz_io_uring_setup(0x497, &(0x7f00000002c0)={0x0, 0x89b8, 0x800, 0x0, 0x207}, &(0x7f0000000040)=0x0, &(0x7f00000000c0)=0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0xc000000, &(0x7f0000000000)=[{&(0x7f0000001600)=""/4096, 0x1000}], 0x1, 0x12}) io_uring_enter(r1, 0x847ba, 0x0, 0xe, 0x0, 0x0) 1.527437167s ago: executing program 2 (id=37): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r1, 0xc018643a, &(0x7f00000000c0)={0x4000001, 0x71, 0x200000009}) r2 = syz_io_uring_setup(0x66e, &(0x7f0000000240)={0x0, 0x0, 0x10100}, &(0x7f0000000380)=0x0, &(0x7f0000000200)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r2, 0x567, 0x0, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000400)={0x0, 0x0, r5, 0x0, 0x0, 0x1f5, 0x0, 0x0, {0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, "b4bc323ef77d1f000071849800000000dfff00"}}) 710.129663ms ago: executing program 0 (id=38): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$nl_rdma(0x10, 0x3, 0x14) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$inet_sctp(0x2, 0x5, 0x84) socket$inet6_mptcp(0xa, 0x1, 0x106) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x9}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000003e000701feffffff00000000017c0000040042800c00018006000600894f0000200002"], 0x44}, 0x1, 0x0, 0x0, 0x40040c0}, 0xc000) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000000)={'#! ', './file0', [{0x20, 'axA\x9b^\xfb^$\r\'uij\r\xd9\xef\xd2Et^Q\v\x9fOFL\x95`Z\xae\xc3a\xfe%\x94\x1a\xebt\xc6\x06\x8fD,\xf7\xae#\x80\x80\xdf\xa3\xcaO\xc6\x8a\x91\x90\xadR\aW\xe1\xf3n\xca\xa3\x8f\xd6F\x03\x0e\x9b\xe5yb\xfc\xa19wUs\x83\xf1{&\n\x1d\x8e\x82y\x1a.B\x0e\xea\x17\xc7\xe7H\xa9\xd4\x8e\xe7 gD\x89*\xb5c\xc5\x8a\xe6R\xe5YGq\xf5\xb6\x95\xbc\x112\x9bno\xc8\x06\xb6\b\xcc\x03{Sn\x94G\x01\xb4\xffJQ8t\x99vY\xaaf\xc7,\x9f\xbb\x15G\x1cr\x19\xef\xab\n\xa8\xbc\xbd\xa2E\x16\x1cm\xbd=\x98\x7fU\xcbg\x15%\x95\xb11\x017\x83*\x14\xcbt\xc2\xcb\x04\x1e~?\xb9j\x18\x96\x84EA\xeaB\a\x83\xba\xdco<\x00'/256}]}, 0x10c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) r3 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r3, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x3}, 0x6, @null, @bpq0, 0x0, [@bcast, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @default, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) socket(0x2, 0x80805, 0x0) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) connect$rose(r4, &(0x7f0000000040)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x1, @default}, 0x1c) connect$rose(r4, &(0x7f0000000100)=@full={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x0, [@null, @null, @null, @default, @bcast, @default]}, 0x40) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)=ANY=[@ANYRES64=r3], 0x18}, 0x1, 0x0, 0x0, 0x4000040}, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000380)={0x0, 0x0, 0x10}, 0xc) 604.133852ms ago: executing program 1 (id=39): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000280)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0x7ff, @empty, 0x1}, {0xa, 0x4e20, 0x17f, @dev={0xfe, 0x80, '\x00', 0xb}, 0x9}, 0xffffffffffffffff, 0xb}}, 0x48) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f00000000c0)="98a591c65382f702b9eb", 0xa}, {&(0x7f00000006c0)="da467702f9520108dcebc5560e4f93142974b51221138c2cdf5b4d577cb800c423ace69c1eba8d0c505baa2ad7ddff4bc6e17bd735b3576550a4b33160cad82f3df56db53fbf5fbad6125c8b7932af43ba88cd499a6c421696d57ff38d5231dc712a114aaeae7681c19a1975b5ae7a925a7b878d482b1375a1b59f2b669bcf1f5a39f4241eef5d48ba4a16fb354031b55dd5bad3ff8d69fe0a9e54a633953fea9e23fdf840a0b9270d", 0xa9}, {&(0x7f0000000300)="f111f39463acbac94f37eaaa931da78c8c414a4edadbcac605b6a5089e71e9b125f3a628ad2cbfd97cb9ad0e", 0x2c}], 0x3, 0x0, 0x0, 0x4000}, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[], 0x3c}}, 0x44000) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="a80000"], 0xa8}, 0x1, 0x0, 0x0, 0x4000}, 0x10) r1 = syz_open_dev$media(&(0x7f0000000380), 0x0, 0x0) r2 = syz_open_dev$media(&(0x7f0000001a80), 0x3, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc0287c02, &(0x7f00000002c0)={0x80000000, 0x0, &(0x7f0000002c40)=[{{0x80000000, 0x0}}, {{0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc0287c02, &(0x7f0000000400)={r4, &(0x7f00000007c0)=[{0x80000000}], &(0x7f0000000500)=[{{}, {0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc0287c02, &(0x7f0000000280)={r6, 0x0, &(0x7f0000000080)=[{{0x80000000, 0x0}}]}) ioctl$MEDIA_IOC_SETUP_LINK(r1, 0xc0347c03, &(0x7f000000a300)={{r5, r8, 0x0, [0x1, 0x2]}, {r7, r3, 0x0, [0xc1b, 0x8]}, 0x1, [0x1007e, 0x9]}) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a28000000000a030000000000000000000100000908000240000000050900010073797a300000000028000000000a"], 0x78}, 0x1, 0x0, 0x0, 0x890}, 0x0) r9 = socket$alg(0x26, 0x5, 0x0) bind$alg(r9, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(des3_ede)\x00'}, 0x58) 465.932372ms ago: executing program 2 (id=40): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000007c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000b80)=ANY=[@ANYBLOB], 0x0, 0xfc5f}, 0x28) 456.068963ms ago: executing program 1 (id=41): socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) r3 = syz_usbip_server_init(0x4) syz_usb_connect(0x1, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="120100001ddf8208c00712152230000000010902"], 0x0) write$usbip_server(r3, &(0x7f0000000040)=ANY=[@ANYBLOB="000000030000000100000000000000010000000800000fff000000000f0000340000000300000001000000000000000000000002000000050000000200005961000000017fffffff000000070000000800000006000000000000"], 0x60) syz_emit_ethernet(0xfdef, &(0x7f0000000000)={@broadcast, @dev, @void, {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x1, @local, @empty, @empty, @local}}}}, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'netdevsim0\x00'}) sendmsg$ETHTOOL_MSG_PAUSE_SET(r4, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x80) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x0, 0x0, &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x2d) r6 = socket$netlink(0x10, 0x3, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r6, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) 0s ago: executing program 2 (id=42): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$nl_rdma(0x10, 0x3, 0x14) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$inet_sctp(0x2, 0x5, 0x84) socket$inet6_mptcp(0xa, 0x1, 0x106) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x9}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000003e000701feffffff00000000017c0000040042800c00018006000600894f0000200002"], 0x44}, 0x1, 0x0, 0x0, 0x40040c0}, 0xc000) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r4, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x3}, 0x6, @null, @bpq0, 0x0, [@bcast, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @default, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) socket(0x2, 0x80805, 0x0) r5 = syz_init_net_socket$rose(0xb, 0x5, 0x0) connect$rose(r5, &(0x7f0000000040)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x1, @default}, 0x1c) connect$rose(r5, &(0x7f0000000100)=@full={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x0, [@null, @null, @null, @default, @bcast, @default]}, 0x40) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000001c0)=ANY=[@ANYRES64=r4], 0x18}, 0x1, 0x0, 0x0, 0x4000040}, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000380)={0x0, 0x0, 0x10}, 0xc) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.202' (ED25519) to the list of known hosts. [ 67.634143][ T5770] cgroup: Unknown subsys name 'net' [ 67.794041][ T5770] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 69.104418][ T5770] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 71.113703][ T5783] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 71.129354][ T5783] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 71.148287][ T5783] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 71.158608][ T5783] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 71.162426][ T5785] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 71.178646][ T5783] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 71.187078][ T5792] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 71.188172][ T5783] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 71.204867][ T5783] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 71.206165][ T5792] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 71.213678][ T5795] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 71.222989][ T5792] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 71.235756][ T5783] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 71.241536][ T5795] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 71.245518][ T5792] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 71.251479][ T5795] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 71.258493][ T5792] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 71.265084][ T5795] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 71.272356][ T5792] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 71.279070][ T5795] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 71.292491][ T5795] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 71.308144][ T5788] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 71.316053][ T5788] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 71.324276][ T5788] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 71.363804][ T1288] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.374303][ T1288] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.813247][ T5779] chnl_net:caif_netlink_parms(): no params data found [ 71.840242][ T5789] chnl_net:caif_netlink_parms(): no params data found [ 71.942307][ T5781] chnl_net:caif_netlink_parms(): no params data found [ 71.962575][ T5780] chnl_net:caif_netlink_parms(): no params data found [ 71.998684][ T5779] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.006170][ T5779] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.014247][ T5779] bridge_slave_0: entered allmulticast mode [ 72.022061][ T5779] bridge_slave_0: entered promiscuous mode [ 72.085034][ T5779] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.092367][ T5779] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.100090][ T5779] bridge_slave_1: entered allmulticast mode [ 72.106713][ T5779] bridge_slave_1: entered promiscuous mode [ 72.124214][ T5789] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.131470][ T5789] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.139106][ T5789] bridge_slave_0: entered allmulticast mode [ 72.145724][ T5789] bridge_slave_0: entered promiscuous mode [ 72.171985][ T5789] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.179268][ T5789] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.186396][ T5789] bridge_slave_1: entered allmulticast mode [ 72.193828][ T5789] bridge_slave_1: entered promiscuous mode [ 72.263634][ T5779] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.280004][ T5789] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.290157][ T5780] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.297432][ T5780] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.305495][ T5780] bridge_slave_0: entered allmulticast mode [ 72.312946][ T5780] bridge_slave_0: entered promiscuous mode [ 72.321946][ T5779] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.355887][ T5789] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.374929][ T5780] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.382300][ T5780] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.390161][ T5780] bridge_slave_1: entered allmulticast mode [ 72.396740][ T5780] bridge_slave_1: entered promiscuous mode [ 72.450635][ T5779] team0: Port device team_slave_0 added [ 72.456740][ T5781] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.464598][ T5781] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.472048][ T5781] bridge_slave_0: entered allmulticast mode [ 72.480191][ T5781] bridge_slave_0: entered promiscuous mode [ 72.489734][ T5789] team0: Port device team_slave_0 added [ 72.496423][ T5781] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.503884][ T5781] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.511388][ T5781] bridge_slave_1: entered allmulticast mode [ 72.518473][ T5781] bridge_slave_1: entered promiscuous mode [ 72.534365][ T5779] team0: Port device team_slave_1 added [ 72.553127][ T5789] team0: Port device team_slave_1 added [ 72.570125][ T5780] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.616092][ T5780] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.636697][ T5779] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 72.644041][ T5779] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.671312][ T5779] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 72.698283][ T5781] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.723587][ T5780] team0: Port device team_slave_0 added [ 72.730681][ T5779] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 72.737672][ T5779] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.764352][ T5779] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 72.775855][ T5789] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 72.782952][ T5789] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.808948][ T5789] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 72.822757][ T5789] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 72.829821][ T5789] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.856174][ T5789] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 72.870759][ T5781] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.887279][ T5780] team0: Port device team_slave_1 added [ 72.984380][ T5779] hsr_slave_0: entered promiscuous mode [ 72.992606][ T5779] hsr_slave_1: entered promiscuous mode [ 73.016218][ T5781] team0: Port device team_slave_0 added [ 73.023502][ T5780] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 73.030894][ T5780] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.056935][ T5780] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 73.070527][ T5780] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 73.077500][ T5780] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.103497][ T5780] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 73.136425][ T5781] team0: Port device team_slave_1 added [ 73.163915][ T5789] hsr_slave_0: entered promiscuous mode [ 73.170698][ T5789] hsr_slave_1: entered promiscuous mode [ 73.176952][ T5789] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 73.185006][ T5789] Cannot create hsr debugfs directory [ 73.216224][ T5781] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 73.223366][ T5781] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.249510][ T5781] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 73.278763][ T5791] Bluetooth: hci0: command tx timeout [ 73.296309][ T5781] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 73.303614][ T5781] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 73.330600][ T5781] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 73.362795][ T50] Bluetooth: hci2: command tx timeout [ 73.366000][ T5791] Bluetooth: hci1: command tx timeout [ 73.368877][ T5788] Bluetooth: hci3: command tx timeout [ 73.431167][ T5780] hsr_slave_0: entered promiscuous mode [ 73.438268][ T5780] hsr_slave_1: entered promiscuous mode [ 73.444344][ T5780] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 73.452412][ T5780] Cannot create hsr debugfs directory [ 73.479520][ T5781] hsr_slave_0: entered promiscuous mode [ 73.486090][ T5781] hsr_slave_1: entered promiscuous mode [ 73.492960][ T5781] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 73.500719][ T5781] Cannot create hsr debugfs directory [ 73.810200][ T5779] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 73.823594][ T5779] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 73.834678][ T5779] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 73.845872][ T5779] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 73.911786][ T5789] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 73.933133][ T5789] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 73.947574][ T5789] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 73.963668][ T5789] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 74.045390][ T5780] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 74.063951][ T5780] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 74.073776][ T5780] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 74.083711][ T5780] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 74.165464][ T5781] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 74.185047][ T5781] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 74.194628][ T5781] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 74.207553][ T5781] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 74.250849][ T5779] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.327596][ T5779] 8021q: adding VLAN 0 to HW filter on device team0 [ 74.363943][ T989] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.371332][ T989] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.403925][ T989] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.411470][ T989] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.439300][ T5789] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.479459][ T5789] 8021q: adding VLAN 0 to HW filter on device team0 [ 74.497663][ T5780] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.526550][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.533734][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.559645][ T58] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.566764][ T58] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.601067][ T5780] 8021q: adding VLAN 0 to HW filter on device team0 [ 74.661668][ T3429] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.668894][ T3429] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.699869][ T5781] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.730234][ T4528] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.737396][ T4528] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.793487][ T5781] 8021q: adding VLAN 0 to HW filter on device team0 [ 74.866992][ T58] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.875241][ T58] bridge0: port 1(bridge_slave_0) entered forwarding state [ 74.886765][ T58] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.894001][ T58] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.187023][ T5789] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.219862][ T5779] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.312613][ T5789] veth0_vlan: entered promiscuous mode [ 75.347477][ T5789] veth1_vlan: entered promiscuous mode [ 75.361771][ T5788] Bluetooth: hci0: command tx timeout [ 75.439313][ T5788] Bluetooth: hci2: command tx timeout [ 75.444813][ T5788] Bluetooth: hci1: command tx timeout [ 75.448789][ T50] Bluetooth: hci3: command tx timeout [ 75.456082][ T5779] veth0_vlan: entered promiscuous mode [ 75.490926][ T5780] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.503558][ T5789] veth0_macvtap: entered promiscuous mode [ 75.522082][ T5789] veth1_macvtap: entered promiscuous mode [ 75.560252][ T5779] veth1_vlan: entered promiscuous mode [ 75.580405][ T5789] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.617760][ T5789] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.632535][ T5789] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.643146][ T5789] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.654365][ T5789] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.663232][ T5789] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.706533][ T5781] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.748838][ T5779] veth0_macvtap: entered promiscuous mode [ 75.759560][ T5780] veth0_vlan: entered promiscuous mode [ 75.781751][ T5779] veth1_macvtap: entered promiscuous mode [ 75.836049][ T5780] veth1_vlan: entered promiscuous mode [ 75.866668][ T989] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.872200][ T5779] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 75.886728][ T5779] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.892498][ T989] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.899500][ T5779] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.962949][ T5779] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 75.974195][ T5779] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.992158][ T5779] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 76.003587][ T5779] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.013168][ T5779] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.022803][ T5779] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.032193][ T5779] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.050761][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.057520][ T5781] veth0_vlan: entered promiscuous mode [ 76.082199][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.087622][ T5780] veth0_macvtap: entered promiscuous mode [ 76.126718][ T5780] veth1_macvtap: entered promiscuous mode [ 76.141817][ T5781] veth1_vlan: entered promiscuous mode [ 76.214435][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 76.227326][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 76.237374][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 76.250147][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 76.262817][ T5780] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 76.273959][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 76.285192][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 76.295405][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 76.306003][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 76.316795][ T5780] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 76.349319][ T989] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.361723][ T989] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.374589][ T5780] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.389480][ T5780] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.403986][ T5780] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.413075][ T5780] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.460989][ T5781] veth0_macvtap: entered promiscuous mode [ 76.497767][ T5872] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 76.535863][ T5781] veth1_macvtap: entered promiscuous mode [ 76.564749][ T4528] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.597279][ T4528] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.678778][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 76.710752][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 76.726924][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 76.740639][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 76.751756][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 76.763532][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 76.775958][ T5781] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 77.013704][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 77.026239][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.037681][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 77.048933][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.058831][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 77.070400][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 77.097277][ T5781] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 77.155525][ T5878] mmap: syz.0.5 (5878) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 77.222742][ T5781] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.257893][ T5781] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.266673][ T5781] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.298582][ T5781] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.427106][ T989] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.438149][ T5791] Bluetooth: hci0: command tx timeout [ 77.519005][ T5791] Bluetooth: hci3: command tx timeout [ 77.519196][ T50] Bluetooth: hci1: command tx timeout [ 77.525034][ T5791] Bluetooth: hci2: command tx timeout [ 77.614206][ T989] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.749165][ T5883] bpq0: entered allmulticast mode [ 78.133126][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 78.377710][ T3429] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.408245][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 78.760448][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 78.832692][ T3429] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.247775][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.278117][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.518725][ T5791] Bluetooth: hci0: command tx timeout [ 79.598115][ T5791] Bluetooth: hci2: command tx timeout [ 79.598498][ T5788] Bluetooth: hci1: command tx timeout [ 79.603644][ T5791] Bluetooth: hci3: command tx timeout [ 80.078190][ T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!! [ 80.086558][ T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!! [ 80.095199][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 80.180635][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 80.318522][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 80.387947][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 80.398201][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 80.773639][ T5904] block device autoloading is deprecated and will be removed. [ 80.887647][ T5907] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6) [ 80.894855][ T5907] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 80.903611][ T5907] vhci_hcd vhci_hcd.0: Device attached [ 80.969798][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.072648][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.109550][ T5172] vhci_hcd: vhci_device speed not set [ 81.187928][ T785] usb 1-1: new low-speed USB device number 2 using dummy_hcd [ 81.268886][ T5172] usb 33-1: new full-speed USB device number 2 using vhci_hcd [ 81.395977][ T785] usb 1-1: config 0 has no interfaces? [ 81.445199][ T785] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 81.545352][ T785] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 81.591151][ T5918] Zero length message leads to an empty skb [ 81.664640][ T23] cfg80211: failed to load regulatory.db [ 81.704527][ T2101] bond0: (slave bond_slave_0): interface is now down [ 81.792154][ T785] usb 1-1: config 0 descriptor?? [ 81.813286][ T2101] bond0: (slave bond_slave_1): interface is now down [ 81.981226][ T12] bond0: (slave bond_slave_0): interface is now down [ 82.090004][ T12] bond0: (slave bond_slave_1): interface is now down [ 82.110753][ T5909] vhci_hcd: unknown pdu 2 [ 83.019112][ T2101] bond0: (slave bond_slave_0): interface is now down [ 83.025894][ T2101] bond0: (slave bond_slave_1): interface is now down [ 83.042326][ T4528] vhci_hcd: stop threads [ 83.068074][ T5172] vhci_hcd: vhci_device speed not set [ 83.089074][ T4528] vhci_hcd: release socket [ 83.129766][ T43] bond0: (slave bond_slave_0): interface is now down [ 83.146960][ T4528] vhci_hcd: disconnect device [ 83.148202][ T5172] usb 33-1: device descriptor read/64, error -71 [ 83.172935][ T43] bond0: (slave bond_slave_1): interface is now down [ 83.220478][ T42] bond0: (slave bond_slave_0): interface is now down [ 83.227240][ T42] bond0: (slave bond_slave_1): interface is now down [ 83.333016][ T12] bond0: (slave bond_slave_0): interface is now down [ 84.078154][ T12] bond0: (slave bond_slave_1): interface is now down [ 84.131469][ T785] usb 1-1: USB disconnect, device number 2 [ 84.198053][ T5172] vhci_hcd: vhci_device speed not set [ 84.200857][ T4528] bond0: (slave bond_slave_0): interface is now down [ 84.349061][ T4528] bond0: (slave bond_slave_1): interface is now down [ 84.408671][ T2101] bond0: (slave bond_slave_0): interface is now down [ 84.607894][ T2101] bond0: (slave bond_slave_1): interface is now down [ 84.780567][ T2101] bond0: now running without any active interface! [ 86.694237][ T5944] bpq0: entered promiscuous mode [ 86.880941][ T5944] bpq0: left allmulticast mode [ 88.537557][ T5967] bpq0: left promiscuous mode [ 88.542504][ T5967] bpq0: entered allmulticast mode [ 90.007028][ T5972] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6) [ 90.013601][ T5972] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 90.021514][ T5972] vhci_hcd vhci_hcd.0: Device attached [ 90.247935][ T23] usb 4-1: new low-speed USB device number 2 using dummy_hcd [ 90.766420][ T785] vhci_hcd: vhci_device speed not set [ 90.939328][ T785] usb 39-1: new full-speed USB device number 2 using vhci_hcd [ 91.073574][ T23] usb 4-1: config 0 has no interfaces? [ 91.091603][ T23] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 91.148290][ T23] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 91.222351][ T23] usb 4-1: config 0 descriptor?? [ 91.472664][ T5973] vhci_hcd: unknown pdu 2 [ 91.567945][ T3429] vhci_hcd: stop threads [ 91.573427][ T3429] vhci_hcd: release socket [ 91.579282][ T3429] vhci_hcd: disconnect device [ 92.792195][ T23] usb 4-1: USB disconnect, device number 2 [ 92.828358][ T785] vhci_hcd: vhci_device speed not set [ 92.883254][ T5987] bpq0: entered promiscuous mode [ 92.888646][ T5987] bpq0: left allmulticast mode [ 93.623159][ T989] bond0: (slave bond_slave_0): interface is now down [ 93.650816][ T989] bond0: (slave bond_slave_1): interface is now down [ 93.672940][ T989] bond0: now running without any active interface! [ 95.340203][ T6002] bpq0: left promiscuous mode [ 95.344933][ T6002] bpq0: entered allmulticast mode [ 95.802259][ T6012] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 95.808839][ T6012] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 95.816337][ T6012] vhci_hcd vhci_hcd.0: Device attached [ 96.038711][ T5828] vhci_hcd: vhci_device speed not set [ 96.118048][ T8] usb 2-1: new low-speed USB device number 2 using dummy_hcd [ 96.136693][ T6018] bpq0: entered promiscuous mode [ 96.141920][ T6018] bpq0: left allmulticast mode [ 96.170412][ T6002] ================================================================== [ 96.178599][ T6002] BUG: KASAN: slab-use-after-free in rose_transmit_link+0x5ba/0x740 [ 96.187032][ T6002] Read of size 1 at addr ffff888020b23832 by task syz.0.38/6002 [ 96.194652][ T6002] [ 96.197058][ T6002] CPU: 1 PID: 6002 Comm: syz.0.38 Not tainted 6.6.101-syzkaller #0 [ 96.204935][ T6002] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 96.214985][ T6002] Call Trace: [ 96.218264][ T6002] [ 96.221229][ T6002] dump_stack_lvl+0x16c/0x230 [ 96.225895][ T6002] ? __lock_acquire+0x7c80/0x7c80 [ 96.230907][ T6002] ? show_regs_print_info+0x20/0x20 [ 96.236097][ T6002] ? load_image+0x3b0/0x3b0 [ 96.240593][ T6002] ? _raw_spin_lock_irqsave+0xb4/0xf0 [ 96.245948][ T6002] ? __virt_addr_valid+0x18c/0x540 [ 96.251036][ T6002] ? __virt_addr_valid+0x469/0x540 [ 96.256137][ T6002] print_report+0xac/0x220 [ 96.260620][ T6002] ? rose_transmit_link+0x5ba/0x740 [ 96.265796][ T6002] kasan_report+0x117/0x150 [ 96.270282][ T6002] ? kmem_cache_alloc_node+0x17f/0x330 [ 96.275722][ T6002] ? rose_transmit_link+0x5ba/0x740 [ 96.280988][ T6002] rose_transmit_link+0x5ba/0x740 [ 96.286006][ T6002] ? skb_put+0x11b/0x210 [ 96.290232][ T6002] rose_write_internal+0x11d1/0x1ab0 [ 96.295521][ T6002] ? rose_validate_nr+0x120/0x120 [ 96.300526][ T6002] ? __timer_delete+0x6b/0x290 [ 96.305304][ T6002] ? skb_queue_purge_reason+0x6c/0x1c0 [ 96.310744][ T6002] rose_release+0x24e/0x510 [ 96.315230][ T6002] sock_close+0xbd/0x230 [ 96.319469][ T6002] ? sock_mmap+0xa0/0xa0 [ 96.323694][ T6002] __fput+0x234/0x970 [ 96.327662][ T6002] task_work_run+0x1ce/0x250 [ 96.332251][ T6002] ? task_work_cancel+0x240/0x240 [ 96.337256][ T6002] get_signal+0x1235/0x1400 [ 96.341741][ T6002] ? task_work_add+0x3a3/0x440 [ 96.346483][ T6002] ? __ia32_sys_pidfd_getfd+0x90/0x90 [ 96.351853][ T6002] ? wake_bit_function+0x200/0x200 [ 96.356963][ T6002] ? __might_fault+0xaa/0x120 [ 96.361633][ T6002] arch_do_signal_or_restart+0x96/0x780 [ 96.367210][ T6002] ? __sys_connect+0x240/0x420 [ 96.371983][ T6002] ? get_sigframe_size+0x20/0x20 [ 96.376928][ T6002] ? exit_to_user_mode_loop+0x3b/0x110 [ 96.382468][ T6002] exit_to_user_mode_loop+0x70/0x110 [ 96.387737][ T6002] exit_to_user_mode_prepare+0xb1/0x140 [ 96.393316][ T6002] syscall_exit_to_user_mode+0x1a/0x50 [ 96.398774][ T6002] do_syscall_64+0x61/0xb0 [ 96.403177][ T6002] ? clear_bhb_loop+0x40/0x90 [ 96.407840][ T6002] ? clear_bhb_loop+0x40/0x90 [ 96.412505][ T6002] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 96.418396][ T6002] RIP: 0033:0x7f4d4558ebe9 [ 96.422816][ T6002] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 96.442428][ T6002] RSP: 002b:00007f4d46455038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 96.450847][ T6002] RAX: fffffffffffffe00 RBX: 00007f4d457b5fa0 RCX: 00007f4d4558ebe9 [ 96.458807][ T6002] RDX: 0000000000000040 RSI: 0000200000000100 RDI: 0000000000000010 [ 96.466774][ T6002] RBP: 00007f4d45611e19 R08: 0000000000000000 R09: 0000000000000000 [ 96.474740][ T6002] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 96.482716][ T6002] R13: 00007f4d457b6038 R14: 00007f4d457b5fa0 R15: 00007fffeb57b6a8 [ 96.490763][ T6002] [ 96.493812][ T6002] [ 96.496113][ T6002] Allocated by task 6002: [ 96.500415][ T6002] kasan_set_track+0x4e/0x70 [ 96.505074][ T6002] __kasan_kmalloc+0x8f/0xa0 [ 96.509641][ T6002] rose_add_node+0x23a/0xdd0 [ 96.514213][ T6002] rose_rt_ioctl+0xa42/0xfb0 [ 96.518780][ T6002] rose_ioctl+0x3cf/0x8b0 [ 96.523086][ T6002] sock_do_ioctl+0xd7/0x2f0 [ 96.527568][ T6002] sock_ioctl+0x623/0x7a0 [ 96.531982][ T6002] __se_sys_ioctl+0xfd/0x170 [ 96.536550][ T6002] do_syscall_64+0x55/0xb0 [ 96.540969][ T6002] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 96.546842][ T6002] [ 96.549145][ T6002] Freed by task 6018: [ 96.553098][ T6002] kasan_set_track+0x4e/0x70 [ 96.557663][ T6002] kasan_save_free_info+0x2e/0x50 [ 96.562666][ T6002] ____kasan_slab_free+0x126/0x1e0 [ 96.567756][ T6002] slab_free_freelist_hook+0x130/0x1b0 [ 96.573200][ T6002] __kmem_cache_free+0xba/0x1f0 [ 96.578047][ T6002] rose_rt_device_down+0x43d/0x490 [ 96.583133][ T6002] rose_device_event+0x604/0x690 [ 96.588046][ T6002] notifier_call_chain+0x197/0x390 [ 96.593135][ T6002] __dev_notify_flags+0x18e/0x2e0 [ 96.598137][ T6002] dev_change_flags+0xe8/0x1a0 [ 96.602897][ T6002] dev_ifsioc+0x6a7/0xe20 [ 96.607288][ T6002] dev_ioctl+0x7e2/0x1170 [ 96.611590][ T6002] sock_do_ioctl+0x226/0x2f0 [ 96.616158][ T6002] sock_ioctl+0x623/0x7a0 [ 96.620467][ T6002] __se_sys_ioctl+0xfd/0x170 [ 96.625032][ T6002] do_syscall_64+0x55/0xb0 [ 96.629532][ T6002] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 96.635420][ T6002] [ 96.637720][ T6002] The buggy address belongs to the object at ffff888020b23800 [ 96.637720][ T6002] which belongs to the cache kmalloc-512 of size 512 [ 96.651751][ T6002] The buggy address is located 50 bytes inside of [ 96.651751][ T6002] freed 512-byte region [ffff888020b23800, ffff888020b23a00) [ 96.665447][ T6002] [ 96.667787][ T6002] The buggy address belongs to the physical page: [ 96.674207][ T6002] page:ffffea000082c800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20b20 [ 96.684337][ T6002] head:ffffea000082c800 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 96.693263][ T6002] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 96.701217][ T6002] page_type: 0xffffffff() [ 96.705525][ T6002] raw: 00fff00000000840 ffff888017841c80 dead000000000100 dead000000000122 [ 96.714100][ T6002] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 96.722658][ T6002] page dumped because: kasan: bad access detected [ 96.729062][ T6002] page_owner tracks the page as allocated [ 96.734751][ T6002] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 6113593401, free_ts 0 [ 96.754344][ T6002] post_alloc_hook+0x1cd/0x210 [ 96.759108][ T6002] get_page_from_freelist+0x195c/0x19f0 [ 96.764646][ T6002] __alloc_pages+0x1e3/0x460 [ 96.769223][ T6002] alloc_page_interleave+0x24/0x1e0 [ 96.774419][ T6002] alloc_slab_page+0x5d/0x170 [ 96.779077][ T6002] new_slab+0x87/0x2e0 [ 96.783124][ T6002] ___slab_alloc+0xc6d/0x12f0 [ 96.787778][ T6002] __kmem_cache_alloc_node+0x1a2/0x260 [ 96.793219][ T6002] __kmalloc_node+0xa4/0x230 [ 96.797784][ T6002] __irq_domain_create+0xbc/0x680 [ 96.802795][ T6002] irq_domain_create_hierarchy+0x61/0x220 [ 96.808504][ T6002] __msi_create_irq_domain+0x33d/0x430 [ 96.813953][ T6002] msi_create_device_irq_domain+0x4d2/0x6a0 [ 96.819825][ T6002] __pci_enable_msix_range+0x544/0x6f0 [ 96.825263][ T6002] pci_alloc_irq_vectors_affinity+0x110/0x2c0 [ 96.831394][ T6002] vp_find_vqs_msix+0x467/0x1000 [ 96.836322][ T6002] page_owner free stack trace missing [ 96.841672][ T6002] [ 96.843973][ T6002] Memory state around the buggy address: [ 96.849578][ T6002] ffff888020b23700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 96.857615][ T6002] ffff888020b23780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 96.865737][ T6002] >ffff888020b23800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 96.873773][ T6002] ^ [ 96.879378][ T6002] ffff888020b23880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 96.887415][ T6002] ffff888020b23900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 96.895455][ T6002] ================================================================== [ 96.903564][ C1] vkms_vblank_simulate: vblank timer overrun [ 96.911163][ T6002] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 96.918366][ T6002] CPU: 1 PID: 6002 Comm: syz.0.38 Not tainted 6.6.101-syzkaller #0 [ 96.926245][ T6002] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 96.936281][ T6002] Call Trace: [ 96.939554][ T6002] [ 96.942468][ T6002] dump_stack_lvl+0x16c/0x230 [ 96.947147][ T6002] ? show_regs_print_info+0x20/0x20 [ 96.952321][ T6002] ? load_image+0x3b0/0x3b0 [ 96.956807][ T6002] panic+0x2c0/0x710 [ 96.960695][ T6002] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 96.966829][ T6002] ? bpf_jit_dump+0xd0/0xd0 [ 96.971401][ T6002] ? _raw_spin_unlock_irqrestore+0xa9/0x110 [ 96.977292][ T6002] ? _raw_spin_unlock_irqrestore+0xae/0x110 [ 96.983208][ T6002] ? _raw_spin_unlock+0x40/0x40 [ 96.988056][ T6002] ? rose_transmit_link+0x5ba/0x740 [ 96.993238][ T6002] check_panic_on_warn+0x84/0xa0 [ 96.998167][ T6002] ? rose_transmit_link+0x5ba/0x740 [ 97.003340][ T6002] end_report+0x6f/0x140 [ 97.007559][ T6002] kasan_report+0x128/0x150 [ 97.012052][ T6002] ? kmem_cache_alloc_node+0x17f/0x330 [ 97.017489][ T6002] ? rose_transmit_link+0x5ba/0x740 [ 97.022665][ T6002] rose_transmit_link+0x5ba/0x740 [ 97.027663][ T6002] ? skb_put+0x11b/0x210 [ 97.031898][ T6002] rose_write_internal+0x11d1/0x1ab0 [ 97.037168][ T6002] ? rose_validate_nr+0x120/0x120 [ 97.042169][ T6002] ? __timer_delete+0x6b/0x290 [ 97.046912][ T6002] ? skb_queue_purge_reason+0x6c/0x1c0 [ 97.052464][ T6002] rose_release+0x24e/0x510 [ 97.056971][ T6002] sock_close+0xbd/0x230 [ 97.061233][ T6002] ? sock_mmap+0xa0/0xa0 [ 97.065458][ T6002] __fput+0x234/0x970 [ 97.069538][ T6002] task_work_run+0x1ce/0x250 [ 97.074110][ T6002] ? task_work_cancel+0x240/0x240 [ 97.079206][ T6002] get_signal+0x1235/0x1400 [ 97.083702][ T6002] ? task_work_add+0x3a3/0x440 [ 97.088446][ T6002] ? __ia32_sys_pidfd_getfd+0x90/0x90 [ 97.093808][ T6002] ? wake_bit_function+0x200/0x200 [ 97.098898][ T6002] ? __might_fault+0xaa/0x120 [ 97.103574][ T6002] arch_do_signal_or_restart+0x96/0x780 [ 97.109107][ T6002] ? __sys_connect+0x240/0x420 [ 97.113852][ T6002] ? get_sigframe_size+0x20/0x20 [ 97.118799][ T6002] ? exit_to_user_mode_loop+0x3b/0x110 [ 97.124248][ T6002] exit_to_user_mode_loop+0x70/0x110 [ 97.129520][ T6002] exit_to_user_mode_prepare+0xb1/0x140 [ 97.135058][ T6002] syscall_exit_to_user_mode+0x1a/0x50 [ 97.140497][ T6002] do_syscall_64+0x61/0xb0 [ 97.144895][ T6002] ? clear_bhb_loop+0x40/0x90 [ 97.149636][ T6002] ? clear_bhb_loop+0x40/0x90 [ 97.154296][ T6002] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 97.160185][ T6002] RIP: 0033:0x7f4d4558ebe9 [ 97.164613][ T6002] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 97.184216][ T6002] RSP: 002b:00007f4d46455038 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 97.192608][ T6002] RAX: fffffffffffffe00 RBX: 00007f4d457b5fa0 RCX: 00007f4d4558ebe9 [ 97.200659][ T6002] RDX: 0000000000000040 RSI: 0000200000000100 RDI: 0000000000000010 [ 97.208627][ T6002] RBP: 00007f4d45611e19 R08: 0000000000000000 R09: 0000000000000000 [ 97.216577][ T6002] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 97.224614][ T6002] R13: 00007f4d457b6038 R14: 00007f4d457b5fa0 R15: 00007fffeb57b6a8 [ 97.232583][ T6002] [ 97.235854][ T6002] Kernel Offset: disabled [ 97.240159][ T6002] Rebooting in 86400 seconds..