last executing test programs: 9m16.670975821s ago: executing program 32 (id=205): prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x80801) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0xa031, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000002040)={0xaa, 0x22c}) ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000100)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000339000/0x1000)=nil, 0x800000}) 8m37.214712792s ago: executing program 33 (id=329): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) openat$vmci(0xffffff9c, &(0x7f0000001180), 0x2, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) syz_open_dev$media(&(0x7f00000012c0), 0x66, 0x180502) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) chdir(&(0x7f0000000140)='./file1\x00') r0 = open(&(0x7f0000000000)='.\x00', 0x800000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file0\x00', 0x1c0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x4, &(0x7f0000000180)=ANY=[@ANYRES32=r0], 0x0, 0x8, 0x0, 0x0, 0x0, 0x50, '\x00', 0x0, @fallback=0x3, r0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r0}, 0x94) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, &(0x7f0000000180)) 7m37.594981524s ago: executing program 34 (id=511): openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4008840) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x7, @rand_addr=' \x01\x00', 0x400}, 0x1c) sendmmsg$inet6(r2, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x4000000000000bd, 0x4004004) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x200000a, 0x5d031, 0xffffffffffffffff, 0x0) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000400)={&(0x7f00000002c0)={0x118, 0x0, 0x1, 0x70bd28, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x4c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x2}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xe7}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x9}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8}, @IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_TUN_TYPE={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}, @IPVS_CMD_ATTR_SERVICE={0x54, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x2c}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x5b}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x4}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e24}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x5}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x88}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'fo\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x30000000}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'rr\x00'}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private2={0xfc, 0x2, '\x00', 0x1}}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}, @IPVS_CMD_ATTR_DAEMON={0x1c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x2}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @rand_addr=0x64010101}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}]}, 0x118}, 0x1, 0x0, 0x0, 0x20000010}, 0x8041) r4 = timerfd_create(0x8, 0x0) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000001080)={0x200000, 0x200000}) socket$inet_mptcp(0x2, 0x1, 0x106) timerfd_settime(r4, 0x3, &(0x7f0000000140), 0x0) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r3, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000199000/0x800000)=nil, 0x800000}) r5 = syz_open_dev$sndmidi(&(0x7f0000000180), 0x2, 0x141101) r6 = dup(r5) write$6lowpan_enable(r6, &(0x7f0000000000)='0', 0xfffffd2c) epoll_create1(0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000200)={0x1b, 0x0, 0x0, 0x81, 0x0, r6, 0x9, '\x00', 0x0, r6, 0x5, 0x0, 0x1}, 0x50) 7m14.73811278s ago: executing program 6 (id=595): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$inet6(r0, 0x0, 0x0, 0x2004c0d0) 7m14.451980963s ago: executing program 6 (id=596): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100009dea7840b418fbff7bdc01020301090212000100000000090401"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f00000008c0)={0x1c, &(0x7f0000000100)=ANY=[@ANYBLOB="00000100000001"], 0x0, 0x0}) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) writev(r1, &(0x7f0000000500)=[{&(0x7f0000000440)="bb0f", 0x2}], 0x1) 7m9.802141849s ago: executing program 35 (id=605): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$inet6(r0, &(0x7f0000000c00)=[{{&(0x7f0000000100)={0xa, 0x4e22, 0x1, @dev={0xfe, 0x80, '\x00', 0x30}, 0x1}, 0x1c, &(0x7f0000000480)=[{&(0x7f0000000140)='d', 0x1}], 0x1}}], 0x1, 0x2004c0d0) 7m9.728592555s ago: executing program 6 (id=607): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000040), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r0, 0x0, 0x0) write$FUSE_INIT(r0, &(0x7f0000000080)={0x50, 0x0, 0x0, {0x7, 0x29, 0x1, 0xffffffff9084adc4, 0x0, 0x0, 0xa0, 0x4, 0x0, 0x0, 0x9, 0xfffffffc}}, 0x50) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x18) syz_fuse_handle_req(r0, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x0, {0x0, 0x1c}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r0, &(0x7f00000063c0)="99529ca7d265e2dba44891e35e7d5dab7921b730436ecd4e999a25bcf86a25f8f029c0dd50373e90b7cf7779b12ecd4423c5b13cfac186975cd723976f3c747612913029d42517c189364bc59d8ebad53ed1b86f8f66c99b1f9b5b40d78cef1f14f81815d53bdca7fef40607358db69eb8c0b1f6b0942ab4b1ee7ca8deb4eddef06381a3d1c52d6147fc5109c7c607591497a6b2477f60cc881d3219c96bffb34aadec3fa97250713cce17cd536721bf9c40a019531ed0bbad139e26a3d4d39b68ab1bf37cb1a4bd197a8789cb1940cd86d9e56713bc36c7cffd07a311f5bc2e91f16d152eb480645e85ec9b3bf09c7fa140dced0afd55d7b99e90a96e7748e2d0dc09672ac199ce529e631efe1783769819c182ca106f6184bcbb387ed246c43562d74c36ac3a7ec2f0e11f70bad0007c03bb9c0d2dacc2148cce4a4aea327c7319016ad146b52bfae0357f9e892e9bec61a13c93551cfa3d4f4bfa7585c93bb0bef01a9114f3dc54179cf9a57fe88f5cff3403e33c9d09e3e9c2e10f1f16894e1b59e3cad47c1f202cf7b756f2851fc96d09459c9a8d34c19e6a3525cd5001aac5181f57286d0e1e88ce5092c7c76b6abdaebf2c499aa47587b48eb12a2b72548c190b0324ebedb81a63333b6edb25550f859c5ccc404a944ff7f61af8800888192fbd4c8e0e417d1d181b4b335a6f52e0a7dae18397e81e3f747cab7be902ed903bdd6a622f178f9b4244718ee1206237257374d2fd1466ab6135ef7ef4a114ae170eafe9cd78cf9ffc36974cbc4b8003072bed78765a0b9f1240f24dec6a9e46db9bb498d40f727c0cbf8f4a6a49539bd0805caf65d80130d7fb60a69dc7ed890874a17530c042cf33a977d331435d68ef33885f638c777ad49564ca77d8b81ddd853a21cd55d95b627310dd633a4f005853a5506cd8f744c367f3cb6998b0fa97de6bb35b166b0c6408c4e0a38ed26235a88520c38ca97ac8a6dc81e6dc6483d383fa09f198997b8eea1c68c9e3320683c9a02dd89ddc34c241e7294ccc88d6b35762892e8746e558bfbc2251949f2ecb763dad5b975eaf36e2864be6a41d3e20514d32f5d4b6350dc7e3cc3a85428ea98efb3b1edc2a2ec1e618452949cc7e2ba1251990168fee342d4f304b7a7af9162bcbe6b09c75d7420d2c547b4e3cee1836df6eddd5dff73a4e308fcd8eaa7a33e6980a6f8ead03257a37d72d3b265d02fa42f57db877654ed513e31c35e1af0bd28511d6b57cfe07b27cbe9767a534b426dfc3dd257d5899444f34cbf4dc74b9eab2e7e3e1e1a8a6ac5e4359d653506b299a5b7c67b92dc462f1216655f952362a3387ad9966b606d98e8d1b544dc27dc6bc78fd18a446736e25c51143db9886b6c09812d5825b5d9e0932f218ff8bea4d9e1c4df9c9d4eb19336d48163a921c4ff1f0beef26b01b7e8c0d23fb59b84e229eaabb791f2cffc9aa4db75162cbfe4c9ae8d76a5b6bc4bff20e3f8f125b9aadb3e728d7f78d61fd55f46b7f59511b876e6563256686e44f25cf38d393a9b762bada272eba8df28e4086c4cd2fe3c9fab97756fb145373e6ca1991bb1ee6589e49c821ff29f047970819f88f724bd077cd3f0ae463d99b3e53078431e3f9bebabc5289a65479359efe3909186aac60a29f561de8c590988c913c9e693ab8106e8287f6565eee6735f7c88cad7124d1c8d9ff347e97912824088ee954de01c6d8a06447f06899607eadbfd078bc3df506252005749378dbd7399c9eca60b81dc0d88dedec31e5cf6e7b6d6d411958df8f9e0bf4443e8d3bdfe49d05f811d17088024d0629fc8ab8e05e309bf55e8e60d342623765f4e8d2dc4a90291cd4354ff9568c8170e6ea56e028bcf2719595253adb8c84050bb9ce4927a1c1f4560da87d109ceda90bbe45a1717763d8025f1ff40f157185ddf17079da272ae10c4f34162caf4b0d31221a57b3059fd449c87554d968a54b2eebd760dc3263c40d9eedf5905d5699d29706ea6e9e81ff2bf92489a06deffe7e978661f37a88450783e23f107c2bfce000dfc91c5fca49e46d9ea978f215a45984699f0d2503b30a741e13be56b7abe3e5663c0825c3cb04ead44ce97719c4ee6f4cdd3c452775ad7163d5c9034583cc2dbc2b0c04917a3e1aa3d0a8bb6fcf94d7922eb1d543c09185827aeb1b72ae7103ef2c014af2ff4b47fca40fb0e66ddf0264476d7a84e9b8dc551d4c407bdbac6757f7a25bd404b45bec1091696203cc438860131ad5f2fd80e3c45629864dd9f7d302b66fb8fb86735c9a6dcf8b135a273dd2ae9473bc905081be9fcb8f91b1ddba1ac692798dac0b9ccffe0319a779f5e10c65f294b22fe475283b023f9cd890e92c5447b1bc1528255c5af383bc1fb6e72cb9a67215a9e25cde63c89baa8c7125c7e8b748b728d07d9cb66778404f54e6a9e3ae1ae82f3d0ce77199f23f94a01b71b805b476fedbebeb52c83a1b857f23ba438c56a6c4c2a5909f721e6e3d240e4a16455e92220d13022ce7ec0b1365ba4e67aa6ecb324f8826579e12cebdfc0d8af63e83b5e5624d5b791f99093f9a27f7baea9fd10111209c0857a04f07408111063ef34026aee27a3d51b40e53883f9094402534bdd21cc49d7f5593e99cb204cd805bee4add0f82cf4b6dc5da14d6b79fbc68c9ccf7fb5fe774f8879e13079b024a8ad24bf123c420d630837a84ba05abf0ae4dc3fc04f25c7f74ff91d0d609c958642a48551e51b5c0074a56a7da10ce153b08cabea636f8489d8e7b655758a41d7f7474c9d76bf4d54d789bfceaffef139854065de6a94b0275a9626aab99ae838364b1a491e55017e4212b6b01f7a41bc9c215ecd17c49a8610db28c699259c58b81a0e84c45fd8e719c05c48501c49e8a6515044d247f58e4cd0bf22fd6ae31f45339d1f801196d426c52269b1aaffaf18e2a03760bb231cb7cefa6d72f1d7eb6a3bbd65d0914221b8fbf531dbd562eb4a1b28983ac7d83d4813b10b34c9525ba644f61a2c4800d4fe96a7bca63da1041ed73cc57fb9d42f9dfc8ca41d80292bbb311c89b0a0fcee1d88a025a7416863342aea00e6f049cb2ddebd17c5c617ff562a8af0c965cbe8341431a30ea239e4a62aa2b19757a3b0de04229a9907f8610c27b26591405845bf8b5b83706ed18d910c4f68777378366ff565617b19168a04560a32ce5ad64aaef9f4377118c4335b24826cdcde78fb4bdb11498553f56d8dfeb3a482c70cc6580c399b92339cbdb3464fcc7b00e9839fd0d2b8b6db90c56b33593a0048bf7983421f29b1285c81a239045b96a9b0cacd70d6d9853206471f06915efc8d3ec4c50fb13601abc73247a656066fd7b329159b3ce9e3302b4c0d6aec58cb0946a8ee8e7f55f1af604f1edb4d887fa6292dc0ce57705c1a25dc62650c127d11a364b397aefc2fcc3a164bdc53165a461b01de9180c1461b309c75af0911b4cc1b8aa05652b62119c87b4b235c573aa15b1516cddf61efd6a7f8c953fbaaee9c0e800e8f519e1494de850ddb976864088fe0cf90bbc54395078ea2501e8baa84d6807e184105bc2a140b663416496886422643bbf764d406af06e7d086678828defda0b648b25666b7b5ea29e927141740d5be0e61bf25d40b8404ffd3c67bb855b11d4faf82b7b8051615c101c3deb0601a0fa9ecd8b4a95082ccbc8222b0982802dd8430e653d6eea2786dc3a91397135faffdc65a5bae048f5c463b1a6648becce961d39d063d28d1ad6dafcea0b0878379adb16cc0d4cea572abeacd9a168a4fe2e338092b5bc93ecf02ac6ccda03e5b23adf511fdf7a79442093233b79c67d3fdd3c36c96a8f67aa79e4743d99cf963ae6161877f73656eb0314d889f4b8649bbce8a759f90eac6c006197b54b2bbac7c9b237f1e3dc099c62a65481960e6ad697fc66316ac084ba99c60f58bf44ff45f3b2006cbc4196a25f124dfaf247e863a855ef6070deb45219a922dcf2be9bd01c340e1ca5ed7c3ddac9f7a677c5d00610991d21e0751ac8044585b39f3fec5b672a11a9bce32196c2003d01ea50b0f0403e16df188ecbbb74f295f01398363ddfecdb63a49347c912c125670205d7b6be999688df85bb7d5ac12b62b4fdc4eadcc2a9a7897028404f697b007603a0ad588c772952d6670ee870771774ad157c0b9cccd4b2192d835606198ea0c65036ae4e406cdc539ff3aa81fa20b7ab58d6f3abdb69cc1f503d593f7025d2035e7f21db76336efc2843a0dc9bd2eb8794718134ee68fc57d4d2bcc18969d08177f442b87433b48540c661940cf9e2462c53efa310c7e47487deab2ae15b1978ef05aa1e14110943f649d82486f710a39854409e74edcaf06b4a92d3580b9cdabf83c6351657698d3d5af7514f382e75d1c912cded577258603fc9ed002e010747cddf7885d34afc9a84d82696c6660cb5ecafb68b564908fc49c4db6a187d037241a26b1141cf20f2e968a53366db0f60b79cd98cf3c897c50b7b9728e6e7100f99e4d5ed2428dbd285516ca6660777a39b4b2617c1be5b0232d60b9c8099f5daedbf190109439c40b46090985200d6c0501313f3fa4d244864575c275faca47aeff32c7b3e3c59392618562a7c2d4b3af85a37a8847f595352024cb63d3a9085c2a502c6a3248f43c5fc828e636cb634b2d393d853ae2dc9605985cf85c060860a90256c7b574c1e01c320687a2bb0b2d51cc2950c485f2ffa5db0ad7aaf753f543de7f86efb775c6bac2989a33757a28836fd27f9347229a0004bd2e546994c69c678fe5717f613f905d945c072004c3a80e0e54215e19ff9972521890d4e705e429f16fc35fe5a15f2e6b75cd719d38f76b087b62e4b5dcdb35f4baa2bab167150bafb6c69e260ca51004bc826d46b77c3f67eaa08497294868e6d91b7b867e4da62052f4f891677256cfbaf19cf32bad99a7da69d8a66537686f89a58d78c7eeaa99cd38009a1a32582bedc5c718e57b19cd405ae659a89909356a07fcef89384d160fa5ae6683cc379642aea4f0c915f72d679bd521399cb16112f2abdede3001400b4a64d2173e153a68631183679b56b8f389ba889784133453a7e892fd3b092f5040870a3cfd6f982990143e7c0882b4ff4c5d049192d36925a25ae4be441aa30dc7e74398b340c45b52c73ed3b0cd640e3cc9fd4be24e7355f386106f65895f1ee850b2a781d1d1d322ca5a3b0fdb78ce1eda048ece94af25437969c99c58c08f1446ca5541e03987a20fd75283e3e116dc4c9222ab7522e4ccf6da14aef49cac9a6a2cd4aba1c54d49e6da4179a66b84e384cd3da53908579b28c11d525ebdc4dc69074cef8a9ecd3aab98f2858769d656b46141c3a4e69a5ed6c0a732c9ec1fce080eaebf537fa5e17236a44ba9c931f555d193e475ffafd20c53ccbab607c1a15fd06742a64691205eb0d00f7f40e4dd8efb279cf09b2522aac0729a631aacb92d5cfa2ce6bb07385b981890b5916755d5cc3a51c8c36bd2987068cc24fcf73840895469bbb9aff1059601f771afedf0a48d5921103920515b27d7e607951982feba197df8c61600feb3622b9eea13a4db4068728cb98cca76cfae197f6258758490bf41673ee29acd91fd296ec863c646e0ca6a0f0e9de146c663ba13d962964d7c32804fd12a14c1ca7212ad48bdfab469c6570dca562220ecbe7b6b163ed4c9361c5c10bed5c92861b8786ada20a99245d282e4454187ec02adfe354e30647cb10661c85168f7958e3ce69ab48c9455214707a63c9b1167f0845a6bfcce2a96cd53eab430f13cd527f1666290719a47c517cfa22fec2e9916af8aa93c78e567993d7fb8ee60fc4b903b8c67a3658302c5e5f35250c30427e4c055b6c54705bc599861f80b7200d361965ff98c88cc698a2615cadeac4bdfd3d613377cea52d2bbcb7e6b78ac31d4b2c33eaf0b2ed40b963e3cb25c7dfea3ebfe7b4aff2aaaaf184dc80ab649a108e2c830ce7eaea58a263392aa9cd13d7f7bd607dc7c804b19dfa41b3e5a5155201a87311e22062c93896e70f3a5c4b03521300b61cc311ebd5beb9838d0ed207c6bfc99e4392508e95804b10b36024f32e1fe1138e9ee7773f797b2bc6be7416f4e9691ef4c2a8d06af6c8b84bd1e6fd1ba3d3183475ef6c139ccf8dcf37671fbb96a2ab5e0e042f7c4728cf30bcc1a0de28a5024276ceaa194b4926e7f6a97b78bac36e47f832d56a96cd266434d37bcf2c2f57877717d91b1854972f832354acc207a2ee8caace7504e0e6197dd7e64a01c4c67bb2de8acc0cccc6c6bff0b0cbfe345542c5a795dfa48cc0990ab5702574d36494bc44c20f5b324f7c984d986cc8cb40cb2550076d96a069b6688d22171beed2dc5b6ff3ede8fff4c4a9de6d3817357a7ca7d24d87300b4545ebbac8cf7f09ec637a4f4d6bd07673709b6c363a75ccef585610c5f15de7851b5ab53e02a757bfc3caeb9a9a8996beffdc0cfd1201b6cd99cb035584e51a6c15a5d2e17d2f8aa6b41e26809392fac6caed1e02a53dcea8a413203608780dab33315a76eba24d540e4c5b9790420834bc8d4e47bc65ae52a54c0ff308427a8d7aff746aa6589d17514e40fee5d0b3533cf4ad2c5f9d96db9f50bd69ed8c92b860e199a35cf268c66ed13516a3b4b024f62d4b2a656067eece95575bdb4907efc488a9821bc3a9c81dd11b2128b7a01aa7a9ce6e73de3b4e9beced70206f91575baddbcbe5722337953c8016a0f4b62120d776c43b7d1a879b692107954f45acdf8967dcaa994aad4922d4fe093e16c2d0090906f5036af99e50bb09b04e9c9b3b5085abf621297ce203010249cede92e9b66b446b86b43eaaae228dfdd3b4408c12b404bb727f7e969e7da04fc59900112bf8d38af0416dc616e75f167aa1352215f07115a6f4eb6bb5fff6f5c2fc9ab906392036b44090e65fdaf017dc53bc94e0807d679d793df18cc44e6c846d414cef1569530f7692daf91eaaf4ae89fe2522f2c9cf33b6ca508ebcd006bc1a61f0c800553aff9dc7d57200b25ecb83e1e0b8cd29520b63aa649d3f71a62570eee56e03223ddf31f0c04fa686b7f6dd054e7a259d9ba335c2c5b2c508897506c0db7f01878dec1411c33f0af61b81dbcf9ff8bdc0c50044963a79f3ee1462150c6bd03a32dbdfef8d72f0b8b3a395ffb0cc85792e7bc867feb5e312cb64e29e193388e9f173c162f4a1320a6f99ea3795fb77d982605959909a1aa11076fcc779ea6b80ec1bf0edfc2569ec04d15a0bdeebccf3c75393dca5e81663532f8ced12d08e4c2ae6e2954d427c7bf053dc4718f56f453bc88d74045bd2f9747aae9b5298a0de927f1d6b1308f4e1483487f083e71ed09298deb52bb10079b13def7453eb432498069edb5ade70c5c54913684d934a3febf78753ac13300a91f467ff3f6e2f00898f015d08f7739047b321b3eaee5ad8aa7adbf7833f014d8c576a491af9fca6843b327ed513821cb3951b2e67a275225d7af6b382e2f955adaacba5d1fdea2223202dee132b91d5cf381b51da94145255f584a70c5e8d11e06a44afa6599bf3ed0cb61703eba254333af53afac60e54cf6397f9f7302249ab644f0b576c713b15007be1f4f9bb213660bca8a70251472b86669d361ef968f542e81ddbe8f4d2e9cabe8d7bf6a31f14a2cc272963553a424c105e7750437ec5bf316e30ce60b4b0c27ccc1eb27e60f6472fef27654da49905ff9c01b28695310ecd8701aedff25a83da4b7c41995f902bdf249769dcb53a3efa894710dd66ba8745ae2253cc6b75a038183a0bee21226d48239320efad6727093e4f94bbc2fdcc216200d903c32bb9f16dd17d5dac423ae0696f3decc576b8f1fdce63d0532370af7d1e2fa2ca5c5d17bd88f5e3abb4792dac8689ca13752f83d753b06b037bf5a80a3748983790352775685b0414c9d74849fd217e388f904278ddb6b0abdda941b61579c796e2bb77a9bc363b18642c401faa502a31011544111b6eedaa369976c814773d83220a75f31026d6ad0b8b4298ea6062234db232bc435e096e84f740e55bb14d46ae04af0500aa5bb218aff6c76aa8a8e3140a1b0d6638538fd7f30fa8d992e53abf8af2fbc16b9e8a668c1aac72cea1a746ee5f7f3392a4ec8f1d19f2f426b6069b1cd347cbc38bceba96ce5da49198083403143c740c04639cd1089abb34fe812d85921c47437604f684bca44a1eaa965c0a6e1c1fd1f70ee932af3455b36184cc15934cdb3f28959d37d8fc10696f8ec1e4b0c3d1b9ff74a01b796d1bb68954a3768c8bcec741b3b69da892f8922142b16b2cabb469a9906b34216243fac80374c10e178c5fd36440f8d7a8588a9c2510d86ffa8cb68ce8c330d2111c94724e522f04573dad43bce252eb505d29ca9379a6b281519d38b7174f3ae8f185544f3003c936a7e6b23ca97a313aac6a061caa45fda73522f3061767bb4e33dbe4bde390eb0f07225a8aef939cb6ab2ada10c02527281abad394cd4ea9f59467a08b72047cdb75d7b2b98e5b4542554a60f953ac7a4b980f42518eec05ff2c044549cab0cf33eef36dfbabcbc0300009d898862d2194cfcdd9a713c30bbe52291105193656ea5eb830873ac956469d31689cc3c69edb5cb9a6e31ce3e6fb50ddd4e52ef9fdeacfc0db21e1e83e0d8d0a64f17cacb4dc208a893e7fd8ffa86cfc554dfba3d9fd281115eccb4b9d909f2fbf3fbb66bedd7b5db3f6d4f076f5d8fb54f8832896f8ef6f624162f1dd589be7a8e87dd5065708a8b0bfb18a5c2299f5605ac8a11c1add55b2018e6099380a70bee3e0727ca6ec58928fe6eb3147b47401e8d822eebade713b58335787669e5e0de5d328a1067df4cd9124665bb02ee8adfd1b3618374ef167df1f0fe79456f78aee3da4c1bf397e4637b0cf41a0f4a2910efd02b17bf5f3c15b0084b36fa7d4e85a53e5be366b428244eeba7499c3e54397227928e2ff6e583f332d6f7e8cf4d058f379b58a7d03a4bfa454bb4b6d543804b8970e6a9fe8886179eb418a8ce9e509e8433571f7d32378f2e983fa418c8c91760ec9fb20968e7fc23b7c4ac71693b2576ac0f8ce2020ff1e7a7ff24301b48b544fb29a1ca4f2502daded865e488a16dd33ec67b2eee3025cdc5ef90f253c4b5e0a61d51e495b675c5a1d55b4ba3812c5f44cd08487e61d36b0c2dc32d27333a5ee8a0906bfbcd388bd9389d1509912c0471c7b706a5aff880569a3fb11ac5f14d780deb4c1b1afe30fb6b8daf87b27a4ceb869d587a97f2f5af8d819aa47bbf207db68a6ecbbefb1e109ed0bfbbf3b54fba9e79de8fad9c3bcd3e74b8b92ccea3ff5c558c6cd72d78a711fc39df603bd4aa1439dd302258edd2204e52d7f435c6f552b612fbc321bea971195cd4d8bb033e2a779e239164d7eea6d8fd233b0b9b776246564cfcf44b31a83031a2413bf98a398c9f93da243cef9ce73d81bade8ad551fb0ffa75bc874c11d23ac9d7752f22a0f54c3870f3314a83e64332db810da1ebb288e10c4eb9be9ec037317b8f813e68160a887da3f5c0389510a0734b69ef275e19973b169d340610cf2112e9964cc0566b9b690c3feb36c8526491d3a563f0bead2abbcf0665e048aa3f929351b2f89876580633a403250ae3b5244c8c0e996bf888938dfc8920348d88e272e6eadc7c0387ca1dae228bd620ce3975d43b58758d9412d304a227245587065f58c4573ba2557f1d8333ba007709b1239d682f03405b22135757178fb701bbde81d2f8faaa7666c025d8a8bb426dc4b8e61aed79b3b3d3a9b01ee9142772d869677ede166e7a8be8ab84cdd6946b1478ce77ba307213971cfb24c86c344310f279e38d22254bf4caf83c02e715cb0550e615dc9f8dd2400fa749e3527493c15fb454c158e4c0603ae6e962b7890058ec7c10f0618ee274a15bca6ca9fe5bc5f9e7797c0950299912be9c58463c07d667d4bffe8aa590ae43db08512b40f3d265026bef2facdd508984e5f6d2ac7ef573397f14ed2e2ccdcbe5796e60ae64d173814906d1da5a5bfe8a2a4c5d6bb0b3315b878b4877d0c045f6e6cfa0dfc1ea4de7abe26f2b2d8c93299ed1d83f1b7853c756bfa346cd53b008fec169883983fe0f2405777dd85e17b2e4e8b23432c0dc4c386d67b6597184d0b4b95877362304638484cc0951400f66ee8391dd44417c58b3d46a8345a8049fcd70f7b5f4a6f912e2b18760947c74ef2b732b342878d7e7cc99902de87db36469555fbbfe76189f108d6ab31f4727fe4e22d075afaf6cc726ab17a5e1b4ab6c8f29a459da3c4266b5ad8ff55906a190f8b19a3bb92a50df49647c03d5d6106ec07e9300038d059a75b54ac31683ef8e5eee946e1c84d016ee1e7800a92c0a3823b62e0417fe86b191951f65abc0c38c1e0e8f1121a04b62a8a720790560f922804b1b7e7eaa497e1bede6e3d0dcf0312dbf221561958fa1e85a8f99e6fc82f919e78c17d1beda16cfef25fb5d00f7c32df9a51eac76000c988ffdf011564aa0e319764b16a5a7c728a470ff70772fb76c9ada26a0ac073fcbfa12501c2454b19e02d928e3939a40bfff76c002533b3849cdf8016728445131e5f1e292b7d3dc06bb3a3cfff6fabae0b7341694a8938c1d2497cd70b76c337c9a312e96c8f736d7625a535e1906eba53d199221ca60202a65be0f7e530aca10e61fa39c7601d65954e5ed4cab94345c6b89c7f8a0de5c61a7945e1564731b6715331d13263b2961a163382f7c4934d847033860e402f3aadb4f3e6cf47a97a2031401da4d2c8de8c80cdad71b97b4deb2075a02282f958ac6772354e67f097ca693778224b80892490015e7d697fb9107f75cea708178ffec93fb1d44e8493bad1d42c918e661219ea819e0200759037a5a585c0fe074fd407536fe58013f42612c41bfc66e16870d7a9c00ee93a3122b253fecbf5de3837641f4a1376af0f053463413c26c29f9a346318565276856b963da30ba6ab8c4c8ef6cfddc432328586d9d9829895835759bcde0851ae0c838a3927ea63fe5ba793fae94da61cab00fc05f3a265a2da1221bb2b66775ed7ba856b41011652d4984991e56249360ddfc997245ac1547a1c16382d42df383a8d1c852643b24895c422712e79c436fdfffece4ed1c50922d4f25296aaf6b204522086d188bee254f8303b60537ead1195ac5dd301286f0042dd68aa05a70e4beb779aa0b61a316f736b72c9ab7ed860a0908a078f4b8a53f2df0abf993f689de4b02b9138ca5047fb0bfc9ba3b92bff033e36fc9553260b008cef3d147c62d1d3944fd1eaff79bc5a922ec2190907bfda1b51c2c7fb867db1f8e13a37b5e3ae0165e93350b958a239ec1f2b78561cff854b975307b5b5dd23b040602a5a36bd79947ee04c7d0e5e30f9c4c79f7b4e6eada98bfc6c357cdf8939213423f1b21ba26cfc2b2756ea3eb992372db0ab8a7c37d8ae96bf3ed6be873c1891550ef741812032e1ae938326c399ee43a3061602dda006f1b6b620bebb6a5752bee77e8acf9921ebf4d4c8af7eb5e937c65697c0664c594e31a62377a25605051996c474ca322ce8e0e6ef8a7988be", 0x2000, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="d800000000000000f9ffffffffffffff0600000000000000020000000000000003000000000000000200000000000000050000000800000006000000000000000a000000000000000700000000000000ff0000000000000009000000000000000000000000000000ffffff7f570000000300000000800000ff", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="04000000040000000000000000000000000020003705000000200000ab000000090000003a2d285cc980000000c30000f3397dd86d4d928d24d3a461b60245898556c6"], 0x0, 0x0, 0x0}) getdents64(r1, 0x0, 0x0) 7m9.598395776s ago: executing program 1 (id=609): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000180)=@newlink={0x34, 0x10, 0x1, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x1181}, [@IFLA_IFNAME={0x14, 0x3, 'bridge_slave_0\x00'}]}, 0x34}}, 0x0) openat$snapshot(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000180)={0x26, 'rng\x00', 0x0, 0x0, 'stdrng\x00'}, 0x58) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r2}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x3, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000004000"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x25, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) socket$key(0xf, 0x3, 0x2) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x1) sched_setaffinity(0x0, 0xfffffffffffffdc5, &(0x7f00000002c0)=0x800002) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_open_dev$loop(&(0x7f0000000440), 0x81, 0x2a82) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cpuset.effective_cpus\x00', 0x275a, 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0xc00, &(0x7f0000000080)={[{@quota}, {@usrquota_inode_hardlimit={'usrquota_inode_hardlimit', 0x3d, [0x37]}}]}) r6 = syz_open_procfs(0x0, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r6, &(0x7f0000000300)={0x2020}, 0x2020) ioctl$LOOP_CONFIGURE(r4, 0x4c0a, &(0x7f00000005c0)={r5, 0x800, {0x2a00, 0x80010000, 0x0, 0x5, 0x0, 0x0, 0x0, 0x20, 0x1c, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd6447a4b4e00d9683dda1af1ea09de2b7fb0a0100000000000000000300", "2809e8dbe108598927875397bab22d0000b420a9c81f40f05f819e01177d3d458dac00000000000000000000003b00000000000000000200", "90be8b1c5512406c7f00", [0x4, 0x40000000000000]}}) r7 = syz_open_dev$loop(&(0x7f00000001c0), 0x5, 0x88000) ioctl$LOOP_CONFIGURE(r7, 0x4c0a, &(0x7f0000001280)={r4, 0x200, {0x2a12, 0x80010000, 0x0, 0x2, 0x4, 0x0, 0x0, 0x3, 0x1c, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9603dda1af1ea80000000000000000000000deff00000000000000000000000014a2648f00", "2809e8dbe108038948224ad54afac11d875397bdb22d0000b420a1a93c7540f4767f9e01177d3dd40600000061ac00", "90be8b1c55f96400", [0x800]}}) 7m8.571856349s ago: executing program 6 (id=611): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) openat$vmci(0xffffff9c, &(0x7f0000001180), 0x2, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) syz_open_dev$media(&(0x7f00000012c0), 0x66, 0x180502) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r0 = open(&(0x7f0000000000)='.\x00', 0x800000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file0\x00', 0x1c0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x4, &(0x7f0000000180)=ANY=[@ANYRES32=r0], 0x0, 0x8, 0x0, 0x0, 0x0, 0x50, '\x00', 0x0, @fallback=0x3, r0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r0}, 0x94) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, &(0x7f0000000180)) r1 = syz_clone(0x88200200, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r1, 0x0) setpgid(0x0, r1) openat$dir(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0, 0x0) 7m8.398355533s ago: executing program 1 (id=612): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100009c323f08a504033007c8d1b93c010902120011000200000904"], 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0003040000000403"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) 7m8.086544528s ago: executing program 6 (id=613): socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_buf(r0, 0x29, 0x3d, &(0x7f0000000080)=""/146, &(0x7f0000000000)=0x92) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x6, 0x0) syz_pidfd_open(0x0, 0x0) prlimit64(0x0, 0xc, &(0x7f0000000140)={0x40000000000000, 0x88}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, 0x0) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) chdir(&(0x7f0000000080)='./file1\x00') r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) signalfd(0xffffffffffffffff, 0x0, 0x0) setpgid(r2, 0x0) setpgid(0x0, r2) mount$9p_fd(0x0, &(0x7f00000001c0)='./file1\x00', 0x0, 0x10000, &(0x7f0000000480)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX, @ANYBLOB, @ANYRESHEX, @ANYBLOB]) mkdir(0x0, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@generic={&(0x7f0000000440)='./file1\x00', 0x0, 0x8}, 0x18) r3 = socket(0x10, 0x3, 0x0) recvmmsg$unix(r3, &(0x7f00000037c0)=[{{0x0, 0x0, &(0x7f0000003700)=[{0x0}, {&(0x7f00000024c0)=""/225, 0xe1}, {&(0x7f00000025c0)=""/4096, 0x1000}, {&(0x7f00000035c0)=""/139, 0x8b}], 0x4}}], 0x1, 0x2, 0x0) sendmsg$nl_route(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)=@bridge_getvlan={0x20, 0x72, 0x7e3bfe4fa73db39f, 0x0, 0x0, {}, [@BRIDGE_VLANDB_DUMP_FLAGS={0x8, 0x1, 0x1}]}, 0x20}}, 0x0) mount$afs(0x0, &(0x7f0000000200)='./file1\x00', 0x0, 0x88, 0x0) r4 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) ioctl$AUTOFS_IOC_READY(r4, 0x9360, 0x800000000000001) name_to_handle_at(r1, &(0x7f0000000180)='./file1\x00', &(0x7f0000000240)=@isofs={0x14, 0x1, {0x5, 0x5, 0x7, 0x10000, 0x0, 0x6}}, &(0x7f0000000280), 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) timer_create(0x0, 0x0, &(0x7f0000000300)) mprotect(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2) 7m7.383835425s ago: executing program 6 (id=615): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x8000002000000, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$NL80211_CMD_RELOAD_REGDB(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)={0x14, r4, 0x101, 0x70bd2c, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000) socket$inet_udplite(0x2, 0x2, 0x88) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) io_setup(0x2e, &(0x7f0000000100)=0x0) io_submit(r6, 0x1, &(0x7f00000001c0)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r5, &(0x7f0000000140)='^', 0x1}]) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) syz_init_net_socket$bt_sco(0x9, 0x5, 0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a31000000000800054000000002"], 0x84}, 0x1, 0x0, 0x0, 0x40008d0}, 0x40) r7 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r7, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000340)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x5a}, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "f900f5", 0x18, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 7m7.005838375s ago: executing program 36 (id=615): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x8000002000000, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$NL80211_CMD_RELOAD_REGDB(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)={0x14, r4, 0x101, 0x70bd2c, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000) socket$inet_udplite(0x2, 0x2, 0x88) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) io_setup(0x2e, &(0x7f0000000100)=0x0) io_submit(r6, 0x1, &(0x7f00000001c0)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r5, &(0x7f0000000140)='^', 0x1}]) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) syz_init_net_socket$bt_sco(0x9, 0x5, 0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a31000000000800054000000002"], 0x84}, 0x1, 0x0, 0x0, 0x40008d0}, 0x40) r7 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r7, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000340)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x5a}, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "f900f5", 0x18, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 7m5.320122182s ago: executing program 1 (id=617): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x4, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket$tipc(0x1e, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x4000040) openat$fb0(0xffffffffffffff9c, &(0x7f0000001540), 0x2000, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, &(0x7f0000000200)=@gcm_128={{0x304, 0x39}, "f3ffff0d00ffffff", "37a0f9ffff4b00000200007d00", "40c28f00", "de3f106b925ded4d"}, 0x28) r1 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r1, 0x8923, &(0x7f0000000000)={'bridge_slave_0\x00', 0x1}) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2041, 0x0) ioctl$TCSETAF(r2, 0x5408, &(0x7f0000000080)={0x49de, 0x0, 0xfffc, 0xbfff, 0x19, "ec28a144f13d7607"}) write$binfmt_aout(r2, 0x0, 0xff2e) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x10, "0062ba5d8200"}) r3 = syz_open_pts(r2, 0x20800) dup3(r3, r2, 0x0) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000100)=0x44) 7m3.340158972s ago: executing program 1 (id=620): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) openat$vmci(0xffffff9c, &(0x7f0000001180), 0x2, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) syz_open_dev$media(&(0x7f00000012c0), 0x66, 0x180502) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r0 = open(&(0x7f0000000000)='.\x00', 0x800000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file0\x00', 0x1c0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x4, &(0x7f0000000180)=ANY=[@ANYRES32=r0], 0x0, 0x8, 0x0, 0x0, 0x0, 0x50, '\x00', 0x0, @fallback=0x3, r0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r0}, 0x94) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, &(0x7f0000000180)) r1 = syz_clone(0x88200200, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r1, 0x0) setpgid(0x0, r1) openat$dir(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0, 0x0) 7m2.886866098s ago: executing program 1 (id=621): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/stat\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x4) 7m2.399817188s ago: executing program 1 (id=622): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) openat$snapshot(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000180)={0x26, 'rng\x00', 0x0, 0x0, 'stdrng\x00'}, 0x58) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000002340)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x44, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r3}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x3, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000004000"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x25, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) socket$key(0xf, 0x3, 0x2) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x1) sched_setaffinity(0x0, 0xfffffffffffffdc5, &(0x7f00000002c0)=0x800002) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_open_dev$loop(&(0x7f0000000440), 0x81, 0x2a82) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cpuset.effective_cpus\x00', 0x275a, 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0xc00, &(0x7f0000000080)={[{@quota}, {@usrquota_inode_hardlimit={'usrquota_inode_hardlimit', 0x3d, [0x37]}}]}) r7 = syz_open_procfs(0x0, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r7, &(0x7f0000000300)={0x2020}, 0x2020) ioctl$LOOP_CONFIGURE(r5, 0x4c0a, &(0x7f00000005c0)={r6, 0x800, {0x2a00, 0x80010000, 0x0, 0x5, 0x0, 0x0, 0x0, 0x20, 0x1c, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd6447a4b4e00d9683dda1af1ea09de2b7fb0a0100000000000000000300", "2809e8dbe108598927875397bab22d0000b420a9c81f40f05f819e01177d3d458dac00000000000000000000003b00000000000000000200", "90be8b1c5512406c7f00", [0x4, 0x40000000000000]}}) r8 = syz_open_dev$loop(&(0x7f00000001c0), 0x5, 0x88000) ioctl$LOOP_CONFIGURE(r8, 0x4c0a, &(0x7f0000001280)={r5, 0x200, {0x2a12, 0x80010000, 0x0, 0x2, 0x4, 0x0, 0x0, 0x3, 0x1c, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9603dda1af1ea80000000000000000000000deff00000000000000000000000014a2648f00", "2809e8dbe108038948224ad54afac11d875397bdb22d0000b420a1a93c7540f4767f9e01177d3dd40600000061ac00", "90be8b1c55f96400", [0x800]}}) 7m1.861296801s ago: executing program 37 (id=622): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) openat$snapshot(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000180)={0x26, 'rng\x00', 0x0, 0x0, 'stdrng\x00'}, 0x58) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000002340)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x44, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='percpu_alloc_percpu\x00', r3}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x3, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000004000"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x25, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) socket$key(0xf, 0x3, 0x2) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x1) sched_setaffinity(0x0, 0xfffffffffffffdc5, &(0x7f00000002c0)=0x800002) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_open_dev$loop(&(0x7f0000000440), 0x81, 0x2a82) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cpuset.effective_cpus\x00', 0x275a, 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0xc00, &(0x7f0000000080)={[{@quota}, {@usrquota_inode_hardlimit={'usrquota_inode_hardlimit', 0x3d, [0x37]}}]}) r7 = syz_open_procfs(0x0, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r7, &(0x7f0000000300)={0x2020}, 0x2020) ioctl$LOOP_CONFIGURE(r5, 0x4c0a, &(0x7f00000005c0)={r6, 0x800, {0x2a00, 0x80010000, 0x0, 0x5, 0x0, 0x0, 0x0, 0x20, 0x1c, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd6447a4b4e00d9683dda1af1ea09de2b7fb0a0100000000000000000300", "2809e8dbe108598927875397bab22d0000b420a9c81f40f05f819e01177d3d458dac00000000000000000000003b00000000000000000200", "90be8b1c5512406c7f00", [0x4, 0x40000000000000]}}) r8 = syz_open_dev$loop(&(0x7f00000001c0), 0x5, 0x88000) ioctl$LOOP_CONFIGURE(r8, 0x4c0a, &(0x7f0000001280)={r5, 0x200, {0x2a12, 0x80010000, 0x0, 0x2, 0x4, 0x0, 0x0, 0x3, 0x1c, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd64c6a4b4e00d9603dda1af1ea80000000000000000000000deff00000000000000000000000014a2648f00", "2809e8dbe108038948224ad54afac11d875397bdb22d0000b420a1a93c7540f4767f9e01177d3dd40600000061ac00", "90be8b1c55f96400", [0x800]}}) 6m11.403030892s ago: executing program 8 (id=739): r0 = syz_open_dev$vbi(&(0x7f0000000040), 0x1, 0x2) socketpair$unix(0x1, 0x2, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, 0x0, 0x0, 0x4d, 0x0, 0x0) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000080)={0x5, 0x2}) 6m10.728948437s ago: executing program 8 (id=741): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect$hid(0x6, 0x36, 0x0, 0x0) syz_emit_ethernet(0x66, &(0x7f0000000080)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @random="a0725ce9403b", @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cb8000", 0x30, 0x3a, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @mcast2, {[], @time_exceed={0x4, 0x0, 0x0, 0x60, '\x00', {0x0, 0x6, "fd9063", 0x2, 0x3a, 0x0, @empty, @mcast2}}}}}}}, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043e"], 0xf8) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x50) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e21, 0x0, @empty}, 0x1c) connect$unix(0xffffffffffffffff, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$key(0xf, 0x3, 0x2) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWSET={0x30, 0x12, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0xa}]}], {0x14}}, 0x58}}, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000300)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x318, 0x1, 0x24}, 0x9c) 6m6.317575663s ago: executing program 8 (id=750): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[], 0x50}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000009006000000000000000000000a44000000090a050600000000000000000100000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000001405000d40460000001400"], 0x6c}}, 0x0) sendmsg$NFT_MSG_GETSET(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000005c0)={0x14, 0xa, 0xa, 0x101}, 0x14}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x1400200bce) r1 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) r2 = socket$l2tp(0x2, 0x2, 0x73) sendmmsg(r2, 0x0, 0x0, 0x4000000) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x6) socket$netlink(0x10, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) close(r4) socket(0x10, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @random="0bb97820edd4"}) close(r3) 6m0.644002193s ago: executing program 8 (id=763): socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_buf(r0, 0x29, 0x3d, &(0x7f0000000080)=""/146, &(0x7f0000000000)=0x92) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x6, 0x0) syz_pidfd_open(0x0, 0x0) prlimit64(0x0, 0xc, &(0x7f0000000140)={0x40000000000000, 0x88}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) chdir(&(0x7f0000000080)='./file1\x00') r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) signalfd(0xffffffffffffffff, 0x0, 0x0) setpgid(r2, 0x0) setpgid(0x0, r2) mount$9p_fd(0x0, &(0x7f00000001c0)='./file1\x00', 0x0, 0x10000, &(0x7f0000000480)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX, @ANYBLOB, @ANYRESHEX, @ANYBLOB]) mkdir(0x0, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@generic={&(0x7f0000000440)='./file1\x00', 0x0, 0x8}, 0x18) r3 = socket(0x10, 0x3, 0x0) recvmmsg$unix(r3, &(0x7f00000037c0)=[{{0x0, 0x0, &(0x7f0000003700)=[{0x0}, {&(0x7f00000024c0)=""/225, 0xe1}, {&(0x7f00000025c0)=""/4096, 0x1000}, {&(0x7f00000035c0)=""/139, 0x8b}], 0x4}}], 0x1, 0x2, 0x0) sendmsg$nl_route(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)=@bridge_getvlan={0x20, 0x72, 0x7e3bfe4fa73db39f, 0x0, 0x0, {}, [@BRIDGE_VLANDB_DUMP_FLAGS={0x8, 0x1, 0x1}]}, 0x20}}, 0x0) mount$afs(0x0, &(0x7f0000000200)='./file1\x00', 0x0, 0x88, 0x0) r4 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) ioctl$AUTOFS_IOC_READY(r4, 0x9360, 0x800000000000001) name_to_handle_at(r1, &(0x7f0000000180)='./file1\x00', &(0x7f0000000240)=@isofs={0x14, 0x1, {0x5, 0x5, 0x7, 0x10000, 0x0, 0x6}}, &(0x7f0000000280), 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) timer_create(0x0, 0x0, &(0x7f0000000300)) mprotect(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2) 6m0.170003871s ago: executing program 8 (id=767): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000f40), r0) sendmsg$IPVS_CMD_NEW_SERVICE(r0, &(0x7f0000001100)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000000300)={0x18, r1, 0x1, 0x70bd67, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x20004084}, 0x20008800) 6m0.002685014s ago: executing program 8 (id=769): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, &(0x7f0000001680)=ANY=[@ANYBLOB="1800000000030000000000000000000095"], &(0x7f0000001700)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='mmap_lock_acquire_returned\x00', r0}, 0x10) move_pages(0x0, 0x20000000000000fe, &(0x7f0000000080)=[&(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil], 0x0, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0) mlockall(0x7) 5m43.168339676s ago: executing program 38 (id=769): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, &(0x7f0000001680)=ANY=[@ANYBLOB="1800000000030000000000000000000095"], &(0x7f0000001700)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='mmap_lock_acquire_returned\x00', r0}, 0x10) move_pages(0x0, 0x20000000000000fe, &(0x7f0000000080)=[&(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil], 0x0, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0) mlockall(0x7) 5m6.346227174s ago: executing program 9 (id=928): r0 = syz_usb_connect(0x0, 0x24, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0003040000000403"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) 5m5.435955368s ago: executing program 9 (id=929): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='highspeed\x00', 0xa) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, 0x0) sendto$inet(r0, &(0x7f0000000580)="17", 0x1d4c, 0x10048095, 0x0, 0x0) 5m4.41608127s ago: executing program 9 (id=934): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x4, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, 0x0, 0x0) socket$tipc(0x1e, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x4000040) openat$fb0(0xffffffffffffff9c, &(0x7f0000001540), 0x2000, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, &(0x7f0000000200)=@gcm_128={{0x304, 0x39}, "f3ffff0d00ffffff", "37a0f9ffff4b00000200007d00", "40c28f00", "de3f106b925ded4d"}, 0x28) r1 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r1, 0x8923, &(0x7f0000000000)={'bridge_slave_0\x00', 0x1}) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2041, 0x0) ioctl$TCSETAF(r2, 0x5408, &(0x7f0000000080)={0x49de, 0x0, 0xfffc, 0xbfff, 0x19, "ec28a144f13d7607"}) write$binfmt_aout(r2, 0x0, 0xff2e) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x10, "0062ba5d8200"}) r3 = syz_open_pts(r2, 0x20800) dup3(r3, r2, 0x0) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000100)=0x44) 5m3.841733356s ago: executing program 0 (id=935): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_usb_connect$hid(0x6, 0x36, 0x0, 0x0) syz_emit_ethernet(0x66, &(0x7f0000000080)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @random="a0725ce9403b", @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cb8000", 0x30, 0x3a, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @mcast2, {[], @time_exceed={0x4, 0x0, 0x0, 0x60, '\x00', {0x0, 0x6, "fd9063", 0x2, 0x3a, 0x0, @empty, @mcast2}}}}}}}, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043e"], 0xf8) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(r1, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x50) r2 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e21, 0x0, @empty}, 0x1c) connect$unix(0xffffffffffffffff, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$key(0xf, 0x3, 0x2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWSET={0x30, 0x12, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0xa}]}], {0x14}}, 0x58}}, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000300)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x318, 0x1, 0x24}, 0x9c) 5m1.2046595s ago: executing program 9 (id=936): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) openat$vmci(0xffffff9c, 0x0, 0x2, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) syz_open_dev$media(&(0x7f00000012c0), 0x66, 0x180502) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r0 = open(&(0x7f0000000000)='.\x00', 0x800000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file0\x00', 0x1c0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x4, &(0x7f0000000180)=ANY=[@ANYRES32=r0], 0x0, 0x8, 0x0, 0x0, 0x0, 0x50, '\x00', 0x0, @fallback=0x3, r0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r0}, 0x94) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, &(0x7f0000000180)) r1 = syz_clone(0x88200200, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r1, 0x0) setpgid(0x0, r1) openat$dir(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0, 0x0) 5m0.816338781s ago: executing program 9 (id=939): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x44) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000002280)=@newlink={0x20, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x4, 0x0, 0xa300}}, 0x20}, 0x1, 0x0, 0x0, 0x24008000}, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_serviced\x00', 0x26e1, 0x0) r4 = syz_open_dev$vim2m(0x0, 0x4, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r4, 0xc0405602, 0x0) close(r3) socket$igmp(0x2, 0x3, 0x2) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x21c0, 0x103) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x200000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r5 = getpid() sched_setscheduler(r5, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYRES32, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\x00\b\x00\x00\x00'], 0x48) sendmsg$NFT_MSG_GETRULE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40004}, 0x20002004) ioctl$SIOCSIFHWADDR(r3, 0x8b18, &(0x7f0000000000)={'wlan1\x00', @random="010000000700"}) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x1000, 0x2}) 5m0.567560631s ago: executing program 9 (id=940): r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r0, 0x890b, 0x0) 4m59.923706603s ago: executing program 39 (id=940): r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_rose_SIOCADDRT(r0, 0x890b, 0x0) 4m59.830281751s ago: executing program 0 (id=942): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/mdstat\x00', 0x0, 0x0) read$hiddev(r3, &(0x7f00000000c0)=""/4092, 0xffc) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000001080)=@file={0x0, './file0\x00'}, 0x6e) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000000)='source', &(0x7f0000000180)='4:.:\x00\x8e\xf7\xd4\t\xe1\xae\x19\xe5\xf7c\x84\x9c\x06\x00\x00\x00\x11\x01\xf2 \xec\xbe#\'S\xc4\xbd\xb5\x1e\x98MM\x06\x1a\x7f5U\x18\x90\x99\xb2\xfa\')Z\x9ew\xae\xe8\xdd\b\t\xf0\xc4\xbfj\xb6\x88/)~\x93E\x1d4\xa7\xcb\xeb\x0f\xd4(\xb6>\x87\xc3\t\xb0\x80\xf7\xe6\x8b?\xa4\xb3\b\x00\x81\xbe\xea\x1f\xfe\xed\x9d\x1a\x8aQ\xafQ\x06\x0fJ\xc0\xc0=}\x7f\xaeB\xb1\xed\xa4\xf3c#\xbe\b\x1f\xa4L[\xfa\x01Uu\xe0\x8b\x94E\xda\xd9j\x93\xc8~\xd9\x82\x8f\xcam\x17\xa2\xed\xf3\xc3_h\xfc6\t\x96@\xaf\xe6\xd0!)\xc3\xcfe\xe1g\xe7\xe5F\xbdC\xd9$\x9b@\xaf\xc2j1p\xa9\xb2d\x92\x8fo\xcbg\x9fZ\xd7\xef\xb2z\xf5\x0fq\x7f\b\xc2\xa7\x90\xc5\xf5Y\xbc\xf1s\x93X\xb6\xeb\x86&\xa7\x14%B', 0x0) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x6, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x5, 0x0, 0xb, 0x9, 0x0, 0x2, 0x2}, {0x3, 0x2, 0x3, 0xa, 0x9, 0xfe00}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x4}, {0x3, 0x0, 0x6, 0xa, 0x9, 0xfe04, 0xe1}, {0x7, 0x1, 0xb, 0x7, 0x8}, {0x7, 0x0, 0x0, 0x8}, {0x7, 0x1, 0xb, 0x4, 0xa, 0x20}, {}, {}, {0x18, 0x2, 0x2, 0x0, r2}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 4m59.012115637s ago: executing program 0 (id=944): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x4, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket$tipc(0x1e, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x4000040) openat$fb0(0xffffffffffffff9c, &(0x7f0000001540), 0x2000, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, &(0x7f0000000200)=@gcm_128={{0x304, 0x39}, "f3ffff0d00ffffff", "37a0f9ffff4b00000200007d00", "40c28f00", "de3f106b925ded4d"}, 0x28) r1 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r1, 0x8923, &(0x7f0000000000)={'bridge_slave_0\x00', 0x1}) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x2041, 0x0) ioctl$TCSETAF(r2, 0x5408, &(0x7f0000000080)={0x49de, 0x0, 0xfffc, 0xbfff, 0x19, "ec28a144f13d7607"}) write$binfmt_aout(r2, 0x0, 0xff2e) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x10, "0062ba5d8200"}) r3 = syz_open_pts(r2, 0x20800) dup3(r3, r2, 0x0) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000100)=0x44) 4m58.193216013s ago: executing program 0 (id=947): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) openat$vmci(0xffffff9c, 0x0, 0x2, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) syz_open_dev$media(&(0x7f00000012c0), 0x66, 0x180502) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r0 = open(&(0x7f0000000000)='.\x00', 0x800000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file0\x00', 0x1c0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x4, &(0x7f0000000180)=ANY=[@ANYRES32=r0], 0x0, 0x8, 0x0, 0x0, 0x0, 0x50, '\x00', 0x0, @fallback=0x3, r0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r0}, 0x94) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, &(0x7f0000000180)) r1 = syz_clone(0x88200200, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r1, 0x0) setpgid(0x0, r1) openat$dir(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0, 0x0) 4m58.175165864s ago: executing program 5 (id=948): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000020000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, 0x0}], 0x1, 0x56, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000009, 0x204031, 0xffffffffffffffff, 0xec776000) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x2710, 0x0, 0x10000, 0x1000, &(0x7f0000009000/0x1000)=nil}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 4m57.810771704s ago: executing program 0 (id=949): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_usb_connect$hid(0x6, 0x36, 0x0, 0x0) syz_emit_ethernet(0x66, &(0x7f0000000080)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @random="a0725ce9403b", @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cb8000", 0x30, 0x3a, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @mcast2, {[], @time_exceed={0x4, 0x0, 0x0, 0x60, '\x00', {0x0, 0x6, "fd9063", 0x2, 0x3a, 0x0, @empty, @mcast2}}}}}}}, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043e"], 0xf8) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(r1, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x50) r2 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e21, 0x0, @empty}, 0x1c) connect$unix(0xffffffffffffffff, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$key(0xf, 0x3, 0x2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWSET={0x30, 0x12, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0xa}]}], {0x14}}, 0x58}}, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000300)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x318, 0x1, 0x24}, 0x9c) 4m57.3640926s ago: executing program 5 (id=950): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x4206, r0) tkill(r0, 0x12) ptrace(0x4208, r0) tkill(r0, 0x12) syz_open_procfs(0xffffffffffffffff, &(0x7f00000042c0)='fdinfo/3\x00') r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) writev(r1, &(0x7f0000001740)=[{&(0x7f0000000040)="db00137a954e8fa665954ab3f52e4245", 0x10}, {&(0x7f0000000240)="ac47dd0bf078a3b27f9965bb69224411a824f1d2d99beb6596a5f57f8328c1195ca58224571643c7b4900c387eab4ce54c8beab0f43550b23be7de8e0aa16227902bc0bd81343560cf89d09ea8ad73460b7157b71a96ad84b0db092cb97a748717999359bc2227db960a35975db177329b33ec86c0df3be26818c851cae1dad1b415fdd01468fb0f9bfb911a30a371ae5233eed4db521b9fed081bf4df7838e87bb52df9a25bfa509b7e853f9ab31ddf7f2fb96507d30d7d7535b34c3c03ccf17c89ad9414715359709c86f1788a824bd651157076d8", 0xd6}, {&(0x7f0000000340)}], 0x3) syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) syz_open_dev$ttys(0xc, 0x2, 0x1) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000090f00080000000000000000850000000e00000085"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000500)='sys_exit\x00', r2}, 0x10) rt_sigpending(0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000540), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x42031, 0xffffffffffffffff, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x21, 0x2, 0x2) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) 4m57.36392892s ago: executing program 0 (id=951): syz_emit_vhci(&(0x7f0000000340)=ANY=[@ANYBLOB], 0x8) 4m56.685815365s ago: executing program 40 (id=951): syz_emit_vhci(&(0x7f0000000340)=ANY=[@ANYBLOB], 0x8) 4m55.786271458s ago: executing program 5 (id=953): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/mdstat\x00', 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000000)='source', &(0x7f0000000180)='4:.:\x00\x8e\xf7\xd4\t\xe1\xae\x19\xe5\xf7c\x84\x9c\x06\x00\x00\x00\x11\x01\xf2 \xec\xbe#\'S\xc4\xbd\xb5\x1e\x98MM\x06\x1a\x7f5U\x18\x90\x99\xb2\xfa\')Z\x9ew\xae\xe8\xdd\b\t\xf0\xc4\xbfj\xb6\x88/)~\x93E\x1d4\xa7\xcb\xeb\x0f\xd4(\xb6>\x87\xc3\t\xb0\x80\xf7\xe6\x8b?\xa4\xb3\b\x00\x81\xbe\xea\x1f\xfe\xed\x9d\x1a\x8aQ\xafQ\x06\x0fJ\xc0\xc0=}\x7f\xaeB\xb1\xed\xa4\xf3c#\xbe\b\x1f\xa4L[\xfa\x01Uu\xe0\x8b\x94E\xda\xd9j\x93\xc8~\xd9\x82\x8f\xcam\x17\xa2\xed\xf3\xc3_h\xfc6\t\x96@\xaf\xe6\xd0!)\xc3\xcfe\xe1g\xe7\xe5F\xbdC\xd9$\x9b@\xaf\xc2j1p\xa9\xb2d\x92\x8fo\xcbg\x9fZ\xd7\xef\xb2z\xf5\x0fq\x7f\b\xc2\xa7\x90\xc5\xf5Y\xbc\xf1s\x93X\xb6\xeb\x86&\xa7\x14%B', 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x6, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x5, 0x0, 0xb, 0x9, 0x0, 0x2, 0x2}, {0x3, 0x2, 0x3, 0xa, 0x9, 0xfe00}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x4}, {0x3, 0x0, 0x6, 0xa, 0x9, 0xfe04, 0xe1}, {0x7, 0x1, 0xb, 0x7, 0x8}, {0x7, 0x0, 0x0, 0x8}, {0x7, 0x1, 0xb, 0x4, 0xa, 0x20}, {}, {}, {0x18, 0x2}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 4m53.402961861s ago: executing program 5 (id=956): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) openat$vmci(0xffffff9c, 0x0, 0x2, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) syz_open_dev$media(&(0x7f00000012c0), 0x66, 0x180502) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') r0 = open(&(0x7f0000000000)='.\x00', 0x800000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file0\x00', 0x1c0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x4, &(0x7f0000000180)=ANY=[@ANYRES32=r0], 0x0, 0x8, 0x0, 0x0, 0x0, 0x50, '\x00', 0x0, @fallback=0x3, r0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r0}, 0x94) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, &(0x7f0000000180)) r1 = syz_clone(0x88200200, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r1, 0x0) setpgid(0x0, r1) openat$dir(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0, 0x0) 4m53.146966181s ago: executing program 5 (id=957): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY_LEVEL(r0, 0x0, 0x2, &(0x7f00000001c0)=0x2, 0x4) 4m51.981319066s ago: executing program 5 (id=960): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0xfffffffffffffffe) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r2 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_DQEVENT(r2, 0x80885659, 0x0) 4m51.373849765s ago: executing program 41 (id=960): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0xfffffffffffffffe) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r2 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_DQEVENT(r2, 0x80885659, 0x0) 1.824090333s ago: executing program 7 (id=2678): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a54000000060a0b04000000000000000002000000200004801c0001800b00010072656a6563740000ca00028005000200080000000900010073797a30000000000900020073797a3200"], 0x7c}}, 0x0) 1.671140575s ago: executing program 7 (id=2679): socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_buf(r0, 0x29, 0x3d, &(0x7f0000000080)=""/146, &(0x7f0000000000)=0x92) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x6, 0x0) syz_pidfd_open(0x0, 0x0) prlimit64(0x0, 0xc, &(0x7f0000000140)={0x40000000000000, 0x88}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) chdir(&(0x7f0000000080)='./file1\x00') r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) signalfd(0xffffffffffffffff, 0x0, 0x0) setpgid(r2, 0x0) setpgid(0x0, r2) mount$9p_fd(0x0, &(0x7f00000001c0)='./file1\x00', 0x0, 0x10000, &(0x7f0000000480)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX, @ANYBLOB, @ANYRESHEX, @ANYBLOB]) mkdir(0x0, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@generic={&(0x7f0000000440)='./file1\x00', 0x0, 0x8}, 0x18) r3 = socket(0x10, 0x3, 0x0) recvmmsg$unix(r3, &(0x7f00000037c0)=[{{0x0, 0x0, &(0x7f0000003700)=[{0x0}, {&(0x7f00000024c0)=""/225, 0xe1}, {&(0x7f00000025c0)=""/4096, 0x1000}, {&(0x7f00000035c0)=""/139, 0x8b}], 0x4}}], 0x1, 0x2, 0x0) sendmsg$nl_route(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)=@bridge_getvlan={0x20, 0x72, 0x7e3bfe4fa73db39f, 0x0, 0x0, {}, [@BRIDGE_VLANDB_DUMP_FLAGS={0x8, 0x1, 0x1}]}, 0x20}}, 0x0) mount$afs(0x0, &(0x7f0000000200)='./file1\x00', 0x0, 0x88, 0x0) r4 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) ioctl$AUTOFS_IOC_READY(r4, 0x9360, 0x800000000000001) name_to_handle_at(r1, &(0x7f0000000180)='./file1\x00', &(0x7f0000000240)=@isofs={0x14, 0x1, {0x5, 0x5, 0x7, 0x10000, 0x0, 0x6}}, &(0x7f0000000280), 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) timer_create(0x0, 0x0, 0x0) mprotect(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2) 1.562792354s ago: executing program 3 (id=2681): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f00000001c0)={@mcast2={0xff, 0x5}, @ipv4={'\x00', '\xff\xff', @broadcast}, @mcast2, 0x0, 0x0, 0x0, 0x100, 0x0, 0x2140110}) 1.409255486s ago: executing program 2 (id=2683): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'macsec0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[@ANYBLOB="9c0000001000010012000000ffdbdf2500000000", @ANYRES32=r1, @ANYBLOB="00000000810000007c0019"], 0x9c}, 0x1, 0x0, 0x0, 0x44840}, 0xc000) 1.408368656s ago: executing program 3 (id=2685): r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) setsockopt$sock_int(r0, 0x1, 0x8, 0x0, 0x0) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000200)="0000000000aa303e97380e90231bdbdaf6a4bd866226b7cdb7c26858c4e4fd703be2f51ed6ddc4a47116ec2db75c7042a22491af0ffea4174a9de3350c0a498396b28c7d1784d04aa38922721cb7816094cb82950fd012efd26d", 0x5a}, {&(0x7f0000000900)="0f198d5aa5caa1c55b84b414797cbdd4e8c576a921a070fc828060506683fd1106a961ac55b5b8ea3342ca7de5559ca2c14e05e42aed8ba14b2c78cb540f71a817d80fbf1945a046ebda494a8048a106a4d49d7f214735ada53397db3b203885ce39ee48d69465935eade21ce36e61826c52c82f038341d9bab5687c740ed3c18897094e7e1391eb84a4052e03c0c7c39ae86d454938f65e284620b99481c33d9f5e5b7a6c0d7548723f55b213c76be37f40c850c38e265758ebd8238257a146d6eced16fd658a784c928fea7a841db1a7fd6520442dae5fc0d3a3d3a5f16fcf6fe4f062ecdad7d0f3c6cd339339533c0ef28ad1e2729907094c3de93c1b1b00ad6df89507000000fb7565d3a8e9eaea020ed173c2179fb03e0944460989240a689c7fe795d310be4e7a6b778a903280dbf426b39c3603c49049980767e31edb997f59785184cbd7b9070400000073c745f71db0906cb51780f908fa61634af8ac85d9f04f3dff0a948e81cd3229a59aaeb00995358155343e3239588a0383e4df109d5ca24276d0d83a27d0e9bf681c1bbea12a6f3c20ad50f63430333bb327eb6ae32fe8809065bce26d2dc2fbb2b48d404637d61fd86852e0e1b6ccc6f75b1107aaa5f60ef45f94e953b3f213c3cb4ca4c716565078c666f84e1a99bb4cb5c7190648132f6ff1f6cb79b93f20752753c938da6241607a742361d995188b23cb4b8269e98e822585695962620673433748e476f7cc3e37db88639c525ff3a502c82c283b00aecfe7734ab369e1ed7c75e27a5a333641817baa3ea37844e20e6266c5095abf9d47ca5f8ad93f1a4d8795daec222ada00d65cf91425fae7939ceaa8d94ec1ab5082e1d251c27b3132119b350e81771f3733be232ffb90c03a818bf458aac3314007c3e35d5e4bed6b897608b01e7e26a54433e5f5c74a2ee3c2fc50067be05a677f122b7dba7010830b879a41b579d44158fb89ea05761d2d369853bea84dfb8081ed7b891dcb3bb3361534fdc5252e4964aed936ad2838e7af14fc65c7c1c6d44c6256f2462ae83cfd6a6b2651da607fe79d345e5080098e9e6e7482cc5c267e00d8d09dcde70b60fe6220fe9530547201664db91cf1885ecc2f106b66cd99131523c99f6102ddd7403791b3a7ac59b256cc4c938fe01740ae4f19b5204ca305b1666b0c2a7e5015d6d530995843adfbac3954306d4cd82257d4d2c3283d45dbae43548fed9879328f114f7c8238ac955391b24614d91be1701ae07c170a9c299fcf3d0ac4cea07e88fbf66b697883af17a06ac3f9954eb2fbd20f101802cd023fc48c5d464c16059cc9dce8558c5322ac7612db0e2725427628c2c41a21f0d2f3962e32f710bf9e216ff1694e8d88c8a81328744b36d9ef9f08c0ea3ccd4f8729e2f00a048162834a95", 0x3f1}, {&(0x7f00000003c0)="128b9306006d4810e5ac5040ad9201847839fc378469d5765b9cc241840896c1498194a7197b45d74a8532b82037b02c9e6045c361eb", 0x36}], 0x3}, 0x0) setsockopt$RDS_CONG_MONITOR(r0, 0x114, 0x6, &(0x7f0000000680)=0x1, 0x4) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[], 0x30}}, 0x40) recvmmsg(r0, &(0x7f00000040c0)=[{{0x0, 0x0, 0x0}, 0x6}, {{0x0, 0x0, 0x0}, 0x6}], 0x2, 0x100, 0x0) 1.298594745s ago: executing program 2 (id=2687): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0xc7}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000b80)=@gcm_128={{0x303}, "cfc86a00", "4617a9f6040839230fb7fead776dd8dc", "c6db0872", "a44a883fca4400"}, 0x28) socket(0x400000000010, 0x3, 0x0) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) socket$kcm(0x2, 0x200000000000001, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB, @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000120000002400000008000000850000000500000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x10) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0x8000000000, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x3, 0x0, 0x0, 0x7fffffff, 0xfffffffffffffffc}, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000a00)=[{{0x0, 0x0, 0x0}, 0x1000}], 0x4000000000000c4, 0x10160, 0x0) 1.297792185s ago: executing program 3 (id=2688): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xf, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000800b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r1}, 0x10) bpf$MAP_CREATE(0x700000000000000, &(0x7f0000000a40)=ANY=[@ANYBLOB="1d000000a1000000020000000000000001020000", @ANYRES32, @ANYBLOB="00000000000000008fac00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0100000005000000fcffffff00"], 0x50) vmsplice(0xffffffffffffffff, &(0x7f0000002440)=[{&(0x7f00000002c0)="62af263ea3c1befb3bd81deb2fc1cacaa4d2f3c7d8ed578a43f7c4bb44173641f1fd8524ba1d6678d41a89626989170aadb2c8de3262863630637e1f80b2b4b51ee58b9299e10879e5e7cf131a96d45102b25ddcd1a9c1396236f8a9e1be48f3df174a31122fc89187100d16d31e65e68a314119e411a442d36d25fa1a910a16926bbe70937af1a2daffcd5c3a62c21741d80998ec5bdc21609f993fe686eab92a3d9509e824ba65d8ca5a278c2daaa30bae078462870b37ea7868c8f4793a95dfe47a9c60ea83231e51dda3ae07e726e228a4b101565798f3c4d0633da550910f4615720e9ca37e6f3e77bb52ae52a1312724d2f1a641035db3e81b35e55ca077ae17a98a375b6c3f56395c052113c3f125304a41a735b325b05243c1b8a0b8e47ad70f831e640e4d68e32614faef764f07940dbd655c7c45a7a22630e1c3d77bd86fd2c51621f5196efd4844bc327210f9d34141daa5acc425005e38ccdbeba7eafd392b4f3eb9f297aa6dbc28320b48b3f878d9e45916396519eb2f5c4084d210892cc8bd34489e4e12d78c16e5abcf841243e65dddfd7cbe36ec49b51d4ad368a01bba176ecdd8d147bedd7464a07dc59ad833ab8d26639de4131d324c8c1c1401a6758e660e0c7f0c9bd612f5f3589acba3b06198c30d6beb86a76c18cffff86ea6ebc282411a12ea8959b84672e17f10146575abcf6064ff36821f10c23c2e555b4c8d0af9f368e7db70ba47218a5947a1ecd42e08e6dc08ec3f3d51c522caed9d102a44f6d8f5944fa3307b7234f27483b285ef16925815cd9c05fbeee24b369c18fd05d3e7f034e99462de5f6b45c54f137b4b86e88ae17906071194223638760200d6e185e111301f039780bd9ab2d62682da82b0b752ef85f36a2308ced8b395405d2d30c3c883754767ed379aefbb8e4ff465ac1c6e938a41cb04915a16ab25eed7c2e54cd151821e0620fc314472c57b51d003d07a287d256744b8c8f6ac08fb3c143670b3b8318218d6be5e2ee5b71ad03a7c327a272de129875f170b5f1ea10473c3dac826e96a845aa809905b02c8e3e2e1b451d00f437271af7689f93920db839aba8c8c632cc31c7043b3b7e358c4f5725b31db55aa4f260504f6a78c6ff74d59c480b6f4276433eec67beef368c238bba859d2f4f4c28ab94a65821f55045e540914677befa72c15071d28435a016387cf0c69cef003550d83ef4f866ee78add21e6e69a19ca03ba5381791e38b4fb91d725d3e8c0bc7cfa95aa35f48a9127eb93dd67e9746ab92b9cdc9519f2bca2d5d2eaf864381ee2c6a76db4d1b0440dd3aa65b34fbcb3dbfd649c5886cb9b9be8e6aa0a1e5e09ad0afa6a70c203344468ae3e3750af30aff7b140d0906112767a4f5ce3147206ebe7478af7a3ec636f898f09063d138cf90b715bf1bcfb9f8132f9c612db07b458c249244a737095bbb428722e4473e4ef36494ebca4c6463e217ecea9beb0b9df3172e928464a67d0747ef707ee4a9ea8c1d0a8a608243305b8454a28230cf7632b5d6d67b176aadd4aa532b28a3b66a30aca5fcaf7cb2564c3543f97878cb1e35b6a636ab54e54f4cb6eab7c2315128dae5525db24b576ce67e50e2624ecdfedcda8f092a4622e8df12626c9036432f06f6e195dbbe3a1248000607a6ce5624d046239f5931ec6a4930abc7e5a42988a288bf781301c372d98b4236bba6151d51235db9e585cac207dfa16ca0eb6dfc748bdd091f39c86e5fbba9dc32abad2387ecf64d611ed8f433a42d2d12a7c603e86d70219469751108bf822934709171d54211d80e094be85cd034a4930e227b18907bceac6c441988c2e51f053abb79cb82df556b8e1db7dafd436002cd787773e5f58a1421784e402eea625e818d2fdbfcc2fc6480d98f6df816c3392a867a06cbcb8702f95588b919b7641f6fcac161994c399ebd24fbf1e4fe0a3c44aa921270e2246c37a43c64ffd4a0127733c1791a5fcb14b1c02d092e79b024e881fcdb44996e3fa669bea354bf81bbdc6efec3bd4f139b2bf42f52d9568dc6914117854228a7d5094814e739f738a6f5d97a60e17db7def18a7144f7e9bbe8585650b2993aff9d60d583ef8a2cdff8aca32d95df2f3c41c85c37178d82187379474fed55b657dc8ce8f6416243a370a495f26e5f48bd4", 0x604}], 0x1, 0x9) socket$nl_generic(0x10, 0x3, 0x10) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.time_recursive\x00', 0x275a, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x13, 0xb, &(0x7f0000000180)=ANY=[], 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x94) ioctl$sock_SIOCBRADDBR(r3, 0x89a0, &(0x7f00000002c0)='ip6_vti0\x00') r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2}, 0x2000400c) bpf$TOKEN_CREATE(0x24, &(0x7f0000000340), 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x1, 0x6a, 0x0, 0x0, 0xf7ffff7e, 0x0, 0x0, 0x0, 0xe}, 0x94) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r6 = accept4(r5, 0x0, 0x0, 0x800) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x9}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000050) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r8, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r9, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 1.139984188s ago: executing program 2 (id=2689): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)=@delchain={0x144, 0x65, 0x8, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xe, 0x2}, {0xb, 0xe}, {0x6, 0xc5b377f61037765b}}, [@filter_kind_options=@f_flow={{0x9}, {0x10c, 0x2, [@TCA_FLOW_ADDEND={0x8}, @TCA_FLOW_XOR={0x8, 0x7, 0x1ff}, @TCA_FLOW_XOR={0x8, 0x7, 0xfffffff9}, @TCA_FLOW_DIVISOR={0x8, 0x8, 0x7fff}, @TCA_FLOW_ACT={0xd4, 0x9, 0x0, 0x1, [@m_ct={0xa4, 0x1b, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_MARK={0x8, 0x5, 0x8}, @TCA_CT_ZONE={0x6, 0x4, 0xfffb}, @TCA_CT_NAT_IPV4_MIN={0x8, 0x9, @dev={0xac, 0x14, 0x14, 0x30}}]}, {0x61, 0x6, "effbbfbb9975b98b391b34602a99202c04f8aff0f475c3649e7f9024793790e685860edfb7d78570905ca6acc9165a1fb42c399f209c0f00a8f4866f081cd17e904ddc3210cc30ec49b70f2b1fb3ead1fe143d5356ac58b602d03fa75b"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x3}}}}, @m_nat={0x2c, 0x2, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x1}}}}]}, @TCA_FLOW_MODE={0x8}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1b0ee}, @TCA_FLOW_POLICE={0x4}]}}, @TCA_RATE={0x6, 0x5, {0xff, 0x2}}]}, 0x144}, 0x1, 0x0, 0x0, 0x80}, 0x20000080) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f, 0xa1}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) 1.135547708s ago: executing program 3 (id=2690): socket$kcm(0x11, 0x2, 0x0) r0 = syz_init_net_socket$ax25(0x3, 0x3, 0xc4) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000006340)) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000240)=0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0xc0241, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x89f0, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000100)=@ethtool_ringparam={0x7, 0x0, 0x20000000, 0x8, 0x6, 0x900, 0x401}}) socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x86, &(0x7f0000000000)=ANY=[], 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18010000120000000000000000000000850000006d000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000280)='contention_end\x00', r3}, 0x10) r4 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) r5 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)={0x34, r4, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'bond0\x00'}]}, 0x34}}, 0xc800) sendmsg$SMC_PNETID_DEL(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000440)={0x20, r4, 0xe27, 0x70bd28, 0x0, {0x4, 0x7, 0x2}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x20}, 0x1, 0x40030000000000}, 0x0) 1.050965385s ago: executing program 2 (id=2692): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) unshare(0x6020400) connect$inet6(r0, 0x0, 0x0) 927.993785ms ago: executing program 2 (id=2693): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x44}, 0x1, 0x0, 0x0, 0x40040c0}, 0xc000) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c2", 0x17) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000), 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40000844) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) 860.687281ms ago: executing program 2 (id=2695): unshare(0x20000400) r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, 0x0, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f00000038c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da97e22f4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3ab60fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ad0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bff3b89c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c2ed01faa7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945ecefa26b8471d42645288d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f93c0984b5c2d4523497dad64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4e064c98e494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6fba3bd4c440e6e2172e3fcc01b8babb757b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa165099c5ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd2310801570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88cf573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb414c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50261a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e48701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867857ed13a4fa4ae033a09673866cd77f4bcdaaa05207166b19a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d93e1fe9c0b4a4a268921738938aa9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9ea81232fbef665f6212f875b2a000000000000000000000000000000000000000000000000000000a0cc2b89ce1525748ce167cbabb881f060599a6a59f645edca1d5c24b2f6b8c997a8f3e1b7679984a566d98d4d31198ee4c5ea7be0d99cf89bba4a6fd0bec12e7792bec3c5038e13b1982f80cdecd07f8908a983a7c9fb81c2ba7f7e87c991f30e50d1b3bbe4cf2a2f5d4571b6568ada51bc121c9139d2a8e0638c84066b1759081802"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x2e) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000540)='rcu_utilization\x00', r1}, 0x10) close(r0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x5, 0x5, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000004830000000000000fa40000007010000080020007500feff0000820095"], &(0x7f0000000100)='GPL\x00', 0x3, 0xfa, &(0x7f00000007c0)=""/250, 0x0, 0x8}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002700000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r4, r5, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r4}, &(0x7f00000006c0), &(0x7f0000000700)=r3}, 0x20) sendmsg$inet(r2, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0xa00120}], 0x1}, 0x3) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newnexthop={0x28, 0x68, 0x1, 0x100003, 0x7ffffffd, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x15}]}, @NHA_RES_GROUP={0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x4008018}, 0x4000080) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd8073a46b08b94214d816f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb4147000001000000008f2b9000f22425e4097ed62cbc891061017cfa6f6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe68db8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3542646bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) r7 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r8 = socket$inet6(0xa, 0x3, 0x5) r9 = socket$kcm(0x2a, 0x2, 0x0) r10 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r10, 0x6, 0x23, 0xfffffffffffffffd, &(0x7f0000000000)=0x61) sendmsg$kcm(r9, &(0x7f0000001540)={&(0x7f0000000040)=@qipcrtr={0x2a, 0xffffffff, 0xfffffffe}, 0x80, 0x0}, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r8, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x3, 0x9}, 0x20) setsockopt$inet6_int(r8, 0x29, 0x1000000000021, 0x0, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x4e24, @rand_addr=0x64010101}, 0x10) sendmmsg(r8, &(0x7f0000001500)=[{{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @ipv4={'\x00', '\xff\xff', @loopback}, 0x4, 0x1}, 0x80, 0x0}}], 0x1, 0x0) getpid() sendmsg$netlink(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000003e00)=[{&(0x7f0000000200)={0x114, 0x2e, 0x1, 0x0, 0x0, "", [@nested={0x101, 0x0, 0x0, 0x1, [@typed={0xc, 0x1, 0x0, 0x0, @u64=0x3}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00'}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe8101000000010000008b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd"]}]}, 0x114}, {0x0}], 0x2}, 0x84) socket$nl_netfilter(0x10, 0x3, 0xc) 829.771813ms ago: executing program 3 (id=2696): r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) setsockopt$sock_int(r0, 0x1, 0x8, 0x0, 0x0) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000200)="0000000000aa303e97380e90231bdbdaf6a4bd866226b7cdb7c26858c4e4fd703be2f51ed6ddc4a47116ec2db75c7042a22491af0ffea4174a9de3350c0a498396b28c7d1784d04aa38922721cb7816094cb82950fd012efd26d", 0x5a}, {&(0x7f0000000900)="0f198d5aa5caa1c55b84b414797cbdd4e8c576a921a070fc828060506683fd1106a961ac55b5b8ea3342ca7de5559ca2c14e05e42aed8ba14b2c78cb540f71a817d80fbf1945a046ebda494a8048a106a4d49d7f214735ada53397db3b203885ce39ee48d69465935eade21ce36e61826c52c82f038341d9bab5687c740ed3c18897094e7e1391eb84a4052e03c0c7c39ae86d454938f65e284620b99481c33d9f5e5b7a6c0d7548723f55b213c76be37f40c850c38e265758ebd8238257a146d6eced16fd658a784c928fea7a841db1a7fd6520442dae5fc0d3a3d3a5f16fcf6fe4f062ecdad7d0f3c6cd339339533c0ef28ad1e2729907094c3de93c1b1b00ad6df89507000000fb7565d3a8e9eaea020ed173c2179fb03e0944460989240a689c7fe795d310be4e7a6b778a903280dbf426b39c3603c49049980767e31edb997f59785184cbd7b9070400000073c745f71db0906cb51780f908fa61634af8ac85d9f04f3dff0a948e81cd3229a59aaeb00995358155343e3239588a0383e4df109d5ca24276d0d83a27d0e9bf681c1bbea12a6f3c20ad50f63430333bb327eb6ae32fe8809065bce26d2dc2fbb2b48d404637d61fd86852e0e1b6ccc6f75b1107aaa5f60ef45f94e953b3f213c3cb4ca4c716565078c666f84e1a99bb4cb5c7190648132f6ff1f6cb79b93f20752753c938da6241607a742361d995188b23cb4b8269e98e822585695962620673433748e476f7cc3e37db88639c525ff3a502c82c283b00aecfe7734ab369e1ed7c75e27a5a333641817baa3ea37844e20e6266c5095abf9d47ca5f8ad93f1a4d8795daec222ada00d65cf91425fae7939ceaa8d94ec1ab5082e1d251c27b3132119b350e81771f3733be232ffb90c03a818bf458aac3314007c3e35d5e4bed6b897608b01e7e26a54433e5f5c74a2ee3c2fc50067be05a677f122b7dba7010830b879a41b579d44158fb89ea05761d2d369853bea84dfb8081ed7b891dcb3bb3361534fdc5252e4964aed936ad2838e7af14fc65c7c1c6d44c6256f2462ae83cfd6a6b2651da607fe79d345e5080098e9e6e7482cc5c267e00d8d09dcde70b60fe6220fe9530547201664db91cf1885ecc2f106b66cd99131523c99f6102ddd7403791b3a7ac59b256cc4c938fe01740ae4f19b5204ca305b1666b0c2a7e5015d6d530995843adfbac3954306d4cd82257d4d2c3283d45dbae43548fed9879328f114f7c8238ac955391b24614d91be1701ae07c170a9c299fcf3d0ac4cea07e88fbf66b697883af17a06ac3f9954eb2fbd20f101802cd023fc48c5d464c16059cc9dce8558c5322ac7612db0e2725427628c2c41a21f0d2f3962e32f710bf9e216ff1694e8d88c8a81328744b36d9ef9f08c0ea3ccd4f8729e2f00a048162834a95", 0x3f1}, {&(0x7f00000003c0)="128b9306006d4810e5ac5040ad9201847839fc378469d5765b9cc241840896c1498194a7197b45d74a8532b82037b02c9e6045c361eb", 0x36}], 0x3}, 0x0) setsockopt$RDS_CONG_MONITOR(r0, 0x114, 0x6, &(0x7f0000000680)=0x1, 0x4) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[], 0x30}}, 0x40) recvmmsg(r0, &(0x7f00000040c0)=[{{0x0, 0x0, 0x0}, 0x6}, {{0x0, 0x0, 0x0}, 0x6}], 0x2, 0x100, 0x0) 790.767936ms ago: executing program 4 (id=2697): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0xc7}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000b80)=@gcm_128={{0x303}, "cfc86a00", "4617a9f6040839230fb7fead776dd8dc", "c6db0872", "a44a883fca4400"}, 0x28) socket(0x400000000010, 0x3, 0x0) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) socket$kcm(0x2, 0x200000000000001, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB, @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000120000002400000008000000850000000500000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x10) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0x8000000000, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x3, 0x0, 0x0, 0x7fffffff, 0xfffffffffffffffc}, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000a00)=[{{0x0, 0x0, 0x0}, 0x1000}], 0x4000000000000c4, 0x10160, 0x0) 721.782802ms ago: executing program 7 (id=2698): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xf, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000800b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r1}, 0x10) bpf$MAP_CREATE(0x700000000000000, &(0x7f0000000a40)=ANY=[@ANYBLOB="1d000000a1000000020000000000000001020000", @ANYRES32, @ANYBLOB="00000000000000008fac00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0100000005000000fcffffff00"], 0x50) vmsplice(0xffffffffffffffff, &(0x7f0000002440)=[{&(0x7f00000002c0)="62af263ea3c1befb3bd81deb2fc1cacaa4d2f3c7d8ed578a43f7c4bb44173641f1fd8524ba1d6678d41a89626989170aadb2c8de3262863630637e1f80b2b4b51ee58b9299e10879e5e7cf131a96d45102b25ddcd1a9c1396236f8a9e1be48f3df174a31122fc89187100d16d31e65e68a314119e411a442d36d25fa1a910a16926bbe70937af1a2daffcd5c3a62c21741d80998ec5bdc21609f993fe686eab92a3d9509e824ba65d8ca5a278c2daaa30bae078462870b37ea7868c8f4793a95dfe47a9c60ea83231e51dda3ae07e726e228a4b101565798f3c4d0633da550910f4615720e9ca37e6f3e77bb52ae52a1312724d2f1a641035db3e81b35e55ca077ae17a98a375b6c3f56395c052113c3f125304a41a735b325b05243c1b8a0b8e47ad70f831e640e4d68e32614faef764f07940dbd655c7c45a7a22630e1c3d77bd86fd2c51621f5196efd4844bc327210f9d34141daa5acc425005e38ccdbeba7eafd392b4f3eb9f297aa6dbc28320b48b3f878d9e45916396519eb2f5c4084d210892cc8bd34489e4e12d78c16e5abcf841243e65dddfd7cbe36ec49b51d4ad368a01bba176ecdd8d147bedd7464a07dc59ad833ab8d26639de4131d324c8c1c1401a6758e660e0c7f0c9bd612f5f3589acba3b06198c30d6beb86a76c18cffff86ea6ebc282411a12ea8959b84672e17f10146575abcf6064ff36821f10c23c2e555b4c8d0af9f368e7db70ba47218a5947a1ecd42e08e6dc08ec3f3d51c522caed9d102a44f6d8f5944fa3307b7234f27483b285ef16925815cd9c05fbeee24b369c18fd05d3e7f034e99462de5f6b45c54f137b4b86e88ae17906071194223638760200d6e185e111301f039780bd9ab2d62682da82b0b752ef85f36a2308ced8b395405d2d30c3c883754767ed379aefbb8e4ff465ac1c6e938a41cb04915a16ab25eed7c2e54cd151821e0620fc314472c57b51d003d07a287d256744b8c8f6ac08fb3c143670b3b8318218d6be5e2ee5b71ad03a7c327a272de129875f170b5f1ea10473c3dac826e96a845aa809905b02c8e3e2e1b451d00f437271af7689f93920db839aba8c8c632cc31c7043b3b7e358c4f5725b31db55aa4f260504f6a78c6ff74d59c480b6f4276433eec67beef368c238bba859d2f4f4c28ab94a65821f55045e540914677befa72c15071d28435a016387cf0c69cef003550d83ef4f866ee78add21e6e69a19ca03ba5381791e38b4fb91d725d3e8c0bc7cfa95aa35f48a9127eb93dd67e9746ab92b9cdc9519f2bca2d5d2eaf864381ee2c6a76db4d1b0440dd3aa65b34fbcb3dbfd649c5886cb9b9be8e6aa0a1e5e09ad0afa6a70c203344468ae3e3750af30aff7b140d0906112767a4f5ce3147206ebe7478af7a3ec636f898f09063d138cf90b715bf1bcfb9f8132f9c612db07b458c249244a737095bbb428722e4473e4ef36494ebca4c6463e217ecea9beb0b9df3172e928464a67d0747ef707ee4a9ea8c1d0a8a608243305b8454a28230cf7632b5d6d67b176aadd4aa532b28a3b66a30aca5fcaf7cb2564c3543f97878cb1e35b6a636ab54e54f4cb6eab7c2315128dae5525db24b576ce67e50e2624ecdfedcda8f092a4622e8df12626c9036432f06f6e195dbbe3a1248000607a6ce5624d046239f5931ec6a4930abc7e5a42988a288bf781301c372d98b4236bba6151d51235db9e585cac207dfa16ca0eb6dfc748bdd091f39c86e5fbba9dc32abad2387ecf64d611ed8f433a42d2d12a7c603e86d70219469751108bf822934709171d54211d80e094be85cd034a4930e227b18907bceac6c441988c2e51f053abb79cb82df556b8e1db7dafd436002cd787773e5f58a1421784e402eea625e818d2fdbfcc2fc6480d98f6df816c3392a867a06cbcb8702f95588b919b7641f6fcac161994c399ebd24fbf1e4fe0a3c44aa921270e2246c37a43c64ffd4a0127733c1791a5fcb14b1c02d092e79b024e881fcdb44996e3fa669bea354bf81bbdc6efec3bd4f139b2bf42f52d9568dc6914117854228a7d5094814e739f738a6f5d97a60e17db7def18a7144f7e9bbe8585650b2993aff9d60d583ef8a2cdff8aca32d95df2f3c41c85c37178d82187379474fed55b657dc8ce8f6416243a370a495f26e5f48bd4", 0x604}], 0x1, 0x9) socket$nl_generic(0x10, 0x3, 0x10) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.time_recursive\x00', 0x275a, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x13, 0xb, &(0x7f0000000180)=ANY=[], 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x94) ioctl$sock_SIOCBRADDBR(r3, 0x89a0, &(0x7f00000002c0)='ip6_vti0\x00') r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2}, 0x2000400c) bpf$TOKEN_CREATE(0x24, &(0x7f0000000340), 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x1, 0x6a, 0x0, 0x0, 0xf7ffff7e, 0x0, 0x0, 0x0, 0xe}, 0x94) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r6 = accept4(r5, 0x0, 0x0, 0x800) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x9}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000050) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r8, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r9, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 648.013028ms ago: executing program 4 (id=2699): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x19, 0x4, 0x4, 0xc, 0x0, 0xffffffffffffffff, 0x6}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000000000000850000007b00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='mmap_lock_acquire_returned\x00', r1}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x0, 0x0, &(0x7f0000000080)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x94) 619.03087ms ago: executing program 3 (id=2700): bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r0 = socket$can_bcm(0x1d, 0x2, 0x2) recvmsg$can_bcm(r0, &(0x7f0000000280)={&(0x7f0000000140)=@xdp, 0x80, 0x0}, 0x2000) recvmsg$can_bcm(0xffffffffffffffff, &(0x7f00000029c0)={&(0x7f0000002540)=@qipcrtr, 0x80, &(0x7f00000028c0)=[{0x0}, {&(0x7f00000026c0)=""/154, 0x9a}, {&(0x7f0000002780)=""/145, 0x91}, {&(0x7f0000002840)=""/127, 0x7f}], 0x4, &(0x7f0000002900)=""/140, 0x8c}, 0x40010020) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) connect$can_bcm(r0, &(0x7f0000000040)={0x1d, r1}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan0\x00'}) sendmsg$nl_route_sched(r2, 0x0, 0x40044) 524.625878ms ago: executing program 4 (id=2701): r0 = socket$kcm(0x2b, 0x1, 0x0) sendmsg$inet(r0, &(0x7f00000009c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x20044818) sendmsg$sock(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)='k', 0x1}], 0x1, &(0x7f0000000080)=[@timestamping={{0x14, 0x1, 0x25, 0x303}}], 0x28}, 0x4000081) 457.006523ms ago: executing program 7 (id=2702): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003088700fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) 316.056534ms ago: executing program 4 (id=2703): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x44}, 0x1, 0x0, 0x0, 0x40040c0}, 0xc000) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, 0x0, 0x0, 0x40000844) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) 236.517691ms ago: executing program 4 (id=2704): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001280)="b7f2288a911993f08d3aaea2bc0000de", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000000580)=[{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000a80)="9f1ac09f155c1291fc8baa01adb9b575260400877ef8644bccc1353c6da6123e4e81e2a13e7fcca4b10085ea82589f9511a2f87ee914c9e0894139310b5457cfe7ca3ae3dade5d7a11f014f2bbdec62e2df3daf9875c79c6763fdcb8830f378346bd7c5c71ab8fffc299f6aea8ae05a727e64cbf8c3de5c36604fa3a7f43c2d51832aa29a52a9d0800823bc89a7cc268e91fff7160c2accb039cbf2cfb99a47371db803c3dce71aa0555a2c0fdb6c8e812ac6974d7b3d749bbc7f90a6a79dd2d20ff1637187bf9b58377bd5ae528ea9724f55170710f20afb05daee9af157462e409255943c5beacc8f0c9140b82f1a835cfd1675c0a83ee32324dd37a901d33d11497fcc9cb46928db1631d0e09b00497628399389129d30e098b5547c985ae9ac28c6cd154fe71cfddd82fb86bf475a11ec27304ff1b1c649cba8392740ba625241e5b4aa5b704e2bb09b2f1ceb9accc75221505f782869880418bc49700"/362, 0x16a}, {&(0x7f00000012c0)="8e39308f7428bb361aa0e207e2191e9248da9eac174411869ef60059a981c6a11223cca963f4b365a2419adcb920c2a14965defd6186c5bfc157b6c1c219985ea4badc7bf93f3c939e452c503f86abee100fd05e2367155747876bd524b58bf60f115d5ac1d8bcd3dc85840f8ee47f46c74a4d11f53e68baa8de704b0d9b419407f8ddf3ec6b5dffa0d41dea9381328cacda24d9a3abd058062ad7ad510b02816e20128a7dedd60e86cb5e679599faad3d09e770721f2d5db2e56b1e0972c331f365076d7bdeff03a3ca3f9926227c5a8cd0a43538d37240503464cea7ad56fcdd32a12249d89d50685ff6742a95f669b780b80cfb70e90dee859d9ba7cf3485464ec7c3caefd5c605e66a3d78b6009a7ff6a92ae0fb552ea843c28f734ffa9d9c09cf3880d8c2fb2d69c43a2f226b82540e3d5ff90ab3dfebea678aefae560a219fc38ec4003d06d073f7d0c0b00e507ab3434fd940f78b533fa8a1b87eb1ef9a02847fb04ca2", 0x167}], 0x2, 0x0, 0x0, 0x44000}], 0x1, 0x0) recvmmsg(r1, &(0x7f0000000a00)=[{{0x0, 0x0, 0x0}, 0xffffff0b}, {{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f00000028c0)=""/4096, 0x1000}], 0x1}, 0xf}], 0x2, 0x2101, 0x0) 152.381658ms ago: executing program 7 (id=2705): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x14}, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[], 0x3c}}, 0x0) r3 = socket(0x1, 0x803, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newlink={0x58, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90646}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x18, 0x2, 0x0, 0x1, [@IFLA_VLAN_FLAGS={0xc, 0x2, {0x1f, 0x1f}}, @IFLA_VLAN_ID={0x6, 0x1, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r4}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x58}, 0x1, 0x0, 0x0, 0x600}, 0x0) 45.509547ms ago: executing program 7 (id=2706): socket$nl_route(0x10, 0x3, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_buf(r0, 0x29, 0x3d, &(0x7f0000000080)=""/146, &(0x7f0000000000)=0x92) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x6, 0x0) syz_pidfd_open(0x0, 0x0) prlimit64(0x0, 0xc, &(0x7f0000000140)={0x40000000000000, 0x88}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) chdir(&(0x7f0000000080)='./file1\x00') r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) signalfd(0xffffffffffffffff, 0x0, 0x0) setpgid(r2, 0x0) setpgid(0x0, r2) mount$9p_fd(0x0, &(0x7f00000001c0)='./file1\x00', 0x0, 0x10000, &(0x7f0000000480)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX, @ANYBLOB, @ANYRESHEX, @ANYBLOB]) mkdir(0x0, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000003c0)=@generic={&(0x7f0000000440)='./file1\x00', 0x0, 0x8}, 0x18) r3 = socket(0x10, 0x3, 0x0) recvmmsg$unix(r3, &(0x7f00000037c0)=[{{0x0, 0x0, &(0x7f0000003700)=[{0x0}, {&(0x7f00000024c0)=""/225, 0xe1}, {&(0x7f00000025c0)=""/4096, 0x1000}, {&(0x7f00000035c0)=""/139, 0x8b}], 0x4}}], 0x1, 0x2, 0x0) sendmsg$nl_route(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)=@bridge_getvlan={0x20, 0x72, 0x7e3bfe4fa73db39f, 0x0, 0x0, {}, [@BRIDGE_VLANDB_DUMP_FLAGS={0x8, 0x1, 0x1}]}, 0x20}}, 0x0) mount$afs(0x0, &(0x7f0000000200)='./file1\x00', 0x0, 0x88, 0x0) r4 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) ioctl$AUTOFS_IOC_READY(r4, 0x9360, 0x800000000000001) name_to_handle_at(r1, &(0x7f0000000180)='./file1\x00', &(0x7f0000000240)=@isofs={0x14, 0x1, {0x5, 0x5, 0x7, 0x10000, 0x0, 0x6}}, &(0x7f0000000280), 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) timer_create(0x0, 0x0, 0x0) mprotect(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2) 0s ago: executing program 4 (id=2707): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0xc7}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000b80)=@gcm_128={{0x303}, "cfc86a00", "4617a9f6040839230fb7fead776dd8dc", "c6db0872", "a44a883fca4400"}, 0x28) socket(0x400000000010, 0x3, 0x0) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) socket$kcm(0x2, 0x200000000000001, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000120000002400000008000000850000000500000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x10) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0x8000000000, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x3, 0x0, 0x0, 0x7fffffff, 0xfffffffffffffffc}, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000a00)=[{{0x0, 0x0, 0x0}, 0x1000}], 0x4000000000000c4, 0x10160, 0x0) kernel console output (not intermixed with test programs): exists on: batadv_slave_0 [ 357.782681][ T9749] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 357.811216][ T9749] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 357.837461][ T9749] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 357.912139][ T9749] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 357.929525][ T9749] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 357.944192][ T9749] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 357.954375][ T9897] ptrace attach of "./syz-executor exec"[7317] was attempted by "./syz-executor exec"[9897] [ 357.959523][ T9749] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 358.567249][ T9749] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 358.593297][ T9749] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 358.613298][ T9749] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 358.623451][ T9749] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 358.635390][ T9749] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 358.648522][ T9749] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 358.658927][ T9749] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 358.667901][ T9749] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 358.685271][ T9749] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 358.719002][ T9749] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 359.170532][ T3485] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 359.188870][ T3485] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 359.283751][ T9912] netlink: 4 bytes leftover after parsing attributes in process `syz.7.843'. [ 359.299511][ T6007] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 359.329157][ T6007] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 360.890853][ T9924] netlink: 28 bytes leftover after parsing attributes in process `syz.5.847'. [ 360.899909][ T9924] netlink: 32 bytes leftover after parsing attributes in process `syz.5.847'. [ 361.002321][ T9917] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 361.020330][ T9917] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 361.159258][ T9917] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 361.223839][ T9917] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 361.257310][ T9917] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 361.319337][ T9917] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 361.427749][ T9932] ptrace attach of "./syz-executor exec"[7317] was attempted by "./syz-executor exec"[9932] [ 361.630027][ T9941] capability: warning: `syz.5.852' uses deprecated v2 capabilities in a way that may be insecure [ 361.735630][ T5896] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 361.892159][ T5896] usb 1-1: device descriptor read/64, error -71 [ 362.206473][ T5896] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 362.250527][ T5793] Bluetooth: hci1: command 0x0c1a tx timeout [ 362.370645][ T5896] usb 1-1: device descriptor read/64, error -71 [ 362.513672][ T5896] usb usb1-port1: attempt power cycle [ 363.043851][ T5793] Bluetooth: hci2: command 0x0c1a tx timeout [ 363.280678][ T5793] Bluetooth: hci4: command 0x0c1a tx timeout [ 363.287083][ T5793] Bluetooth: hci0: command 0x0c1a tx timeout [ 363.686555][ T5896] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 363.692595][ T9964] netlink: 28 bytes leftover after parsing attributes in process `syz.5.857'. [ 363.705267][ T9964] netlink: 32 bytes leftover after parsing attributes in process `syz.5.857'. [ 363.787183][ T5896] usb 1-1: device descriptor read/8, error -71 [ 364.465423][ T9974] ptrace attach of "./syz-executor exec"[8782] was attempted by "./syz-executor exec"[9974] [ 365.133174][ T9989] autofs4:pid:9989:autofs_fill_super: called with bogus options [ 365.269910][ T9971] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 365.360746][ T5787] Bluetooth: hci4: command 0x0c1a tx timeout [ 366.525162][ T9971] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 366.560650][ T5793] Bluetooth: hci1: command 0x0c1a tx timeout [ 366.590722][ T9971] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 366.610841][ T9971] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 366.694960][ T9999] binder: 9997:9999 ioctl c0306201 200000000080 returned -14 [ 366.808798][ T9999] binder: BINDER_SET_CONTEXT_MGR already set [ 366.835860][ T9999] binder: 9997:9999 ioctl 4018620d 200000000040 returned -16 [ 367.030516][ T5820] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 367.056639][T10012] : renamed from bridge_slave_0 (while UP) [ 367.121076][ T5896] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 367.310652][ T5820] usb 1-1: Using ep0 maxpacket: 8 [ 367.318251][ T5820] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 17 [ 367.353777][ T5820] usb 1-1: New USB device found, idVendor=04a5, idProduct=3003, bcdDevice=c8.07 [ 367.370620][ T5820] usb 1-1: New USB device strings: Mfr=209, Product=185, SerialNumber=60 [ 367.375278][T10016] netlink: 28 bytes leftover after parsing attributes in process `syz.7.870'. [ 367.388995][ T5820] usb 1-1: Product: syz [ 367.397741][T10016] netlink: 32 bytes leftover after parsing attributes in process `syz.7.870'. [ 367.470594][ T5896] usb 6-1: device descriptor read/64, error -71 [ 367.542867][ T5820] usb 1-1: Manufacturer: syz [ 367.592012][ T5820] usb 1-1: SerialNumber: syz [ 367.654786][ T5820] usb 1-1: config 0 descriptor?? [ 367.780492][ T5896] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 367.924567][ T5820] gspca_main: sunplus-2.14.0 probing 04a5:3003 [ 367.941632][ T5896] usb 6-1: device descriptor read/64, error -71 [ 367.946270][ T5820] gspca_sunplus: reg_w_riv err -71 [ 367.960676][ T5820] sunplus: probe of 1-1:0.0 failed with error -71 [ 367.994887][ T5820] usb 1-1: USB disconnect, device number 7 [ 368.138159][ T5896] usb usb6-port1: attempt power cycle [ 368.660015][ T5787] Bluetooth: hci4: command 0x0c1a tx timeout [ 368.666692][ T5793] Bluetooth: hci2: command 0x0c1a tx timeout [ 368.673227][ T5896] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 368.945693][ T5896] usb 6-1: device descriptor read/8, error -71 [ 369.213523][T10044] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 369.317176][T10047] netlink: 8 bytes leftover after parsing attributes in process `syz.9.875'. [ 369.385927][T10047] netlink: 4 bytes leftover after parsing attributes in process `syz.9.875'. [ 369.418254][T10052] autofs4:pid:10052:autofs_fill_super: called with bogus options [ 369.511764][ T5896] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 369.571038][ T5896] usb 6-1: device descriptor read/8, error -71 [ 369.691153][ T5896] usb usb6-port1: unable to enumerate USB device [ 370.481067][T10061] netlink: 28 bytes leftover after parsing attributes in process `syz.0.880'. [ 370.490109][T10061] netlink: 32 bytes leftover after parsing attributes in process `syz.0.880'. [ 370.664425][T10081] netlink: 4 bytes leftover after parsing attributes in process `syz.9.885'. [ 371.055980][T10095] autofs4:pid:10095:autofs_fill_super: called with bogus options [ 371.680663][ T5820] usb 10-1: new high-speed USB device number 7 using dummy_hcd [ 371.862815][ T5820] usb 10-1: device descriptor read/64, error -71 [ 372.150532][ T5820] usb 10-1: new high-speed USB device number 8 using dummy_hcd [ 372.372359][ T5820] usb 10-1: device descriptor read/64, error -71 [ 372.427638][T10128] wg1 speed is unknown, defaulting to 1000 [ 372.453124][T10128] wg1 speed is unknown, defaulting to 1000 [ 372.587179][T10128] wg1 speed is unknown, defaulting to 1000 [ 372.686037][T10128] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 372.713398][ T5820] usb usb10-port1: attempt power cycle [ 372.745772][T10128] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 372.885700][T10128] wg1 speed is unknown, defaulting to 1000 [ 372.942832][T10128] wg1 speed is unknown, defaulting to 1000 [ 372.997840][T10128] wg1 speed is unknown, defaulting to 1000 [ 373.032409][T10128] wg1 speed is unknown, defaulting to 1000 [ 373.049266][T10128] wg1 speed is unknown, defaulting to 1000 [ 373.191441][ T5820] usb 10-1: new high-speed USB device number 9 using dummy_hcd [ 373.254214][ T5820] usb 10-1: device descriptor read/8, error -71 [ 373.397392][T10140] autofs4:pid:10140:autofs_fill_super: called with bogus options [ 373.531085][ T5820] usb 10-1: new high-speed USB device number 10 using dummy_hcd [ 373.587146][ T5820] usb 10-1: device descriptor read/8, error -71 [ 373.716264][ T5820] usb usb10-port1: unable to enumerate USB device [ 375.397347][T10189] : renamed from bridge_slave_0 (while UP) [ 375.416147][T10190] autofs4:pid:10190:autofs_fill_super: called with bogus options [ 375.506210][T10194] binder: BINDER_SET_CONTEXT_MGR already set [ 375.523165][T10194] binder: 10191:10194 ioctl 4018620d 200000000040 returned -16 [ 376.202761][ T5820] usb 8-1: new high-speed USB device number 12 using dummy_hcd [ 376.361763][ T5820] usb 8-1: device descriptor read/64, error -71 [ 376.640710][ T5820] usb 8-1: new high-speed USB device number 13 using dummy_hcd [ 376.811266][ T5820] usb 8-1: device descriptor read/64, error -71 [ 376.956988][ T5820] usb usb8-port1: attempt power cycle [ 377.381218][ T5820] usb 8-1: new high-speed USB device number 14 using dummy_hcd [ 377.421273][ T5820] usb 8-1: device descriptor read/8, error -71 [ 377.700466][ T5820] usb 8-1: new high-speed USB device number 15 using dummy_hcd [ 377.751126][ T5820] usb 8-1: device descriptor read/8, error -71 [ 377.916685][ T5820] usb usb8-port1: unable to enumerate USB device [ 378.561045][T10262] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 378.578374][T10262] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 378.596267][T10262] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 378.888233][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.894806][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.108405][T10276] netlink: 4 bytes leftover after parsing attributes in process `syz.0.921'. [ 379.521513][T10289] autofs4:pid:10289:autofs_fill_super: called with bogus options [ 380.646036][ T5793] Bluetooth: hci4: command 0x0c1a tx timeout [ 380.654330][ T5787] Bluetooth: hci2: command 0x0c1a tx timeout [ 380.660758][ T5782] Bluetooth: hci1: command 0x0c1a tx timeout [ 381.845976][T10337] siw: device registration error -23 [ 381.890715][ T5915] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 381.890875][ T8] usb 8-1: new high-speed USB device number 16 using dummy_hcd [ 382.350479][ T5915] usb 6-1: Using ep0 maxpacket: 16 [ 382.390791][ T8] usb 8-1: device descriptor read/64, error -71 [ 384.620514][ T8] usb 8-1: new high-speed USB device number 17 using dummy_hcd [ 384.901076][ T8] usb 8-1: device descriptor read/64, error -71 [ 384.930336][ T5915] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 384.938451][ T5915] usb 6-1: can't read configurations, error -71 [ 385.081062][ T8] usb usb8-port1: attempt power cycle [ 385.714161][ T6012] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 385.891825][ T6012] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 386.102602][ T6012] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 386.403132][ T6012] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 386.935339][ T5915] libceph: connect (1)[c::]:6789 error -101 [ 386.981122][ T5915] libceph: mon0 (1)[c::]:6789 connect error [ 387.225119][T10375] ceph: No mds server is up or the cluster is laggy [ 387.262719][ T23] libceph: connect (1)[c::]:6789 error -101 [ 387.269895][ T23] libceph: mon0 (1)[c::]:6789 connect error [ 387.966951][ T5793] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 387.979695][ T5793] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 388.033258][ T5793] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 388.058033][ T5793] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 388.081745][ T5793] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 388.092546][ T5793] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 388.393153][T10403] wg1 speed is unknown, defaulting to 1000 [ 388.568006][ T23] usb 8-1: new high-speed USB device number 19 using dummy_hcd [ 388.840818][ T23] usb 8-1: Using ep0 maxpacket: 16 [ 389.629375][T10403] chnl_net:caif_netlink_parms(): no params data found [ 389.929764][ T6012] hsr_slave_0: left promiscuous mode [ 389.936410][ T6012] hsr_slave_1: left promiscuous mode [ 389.950801][ T6012] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 389.968517][ T6012] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 389.985442][ T6012] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 390.023561][ T6012] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 390.098451][ T6012] bridge_slave_1: left allmulticast mode [ 390.141714][ T6012] bridge_slave_1: left promiscuous mode [ 390.160729][ T5787] Bluetooth: hci0: command tx timeout [ 390.170894][ T6012] bridge0: port 2(bridge_slave_1) entered disabled state [ 390.234425][ T6012] : left allmulticast mode [ 390.239240][ T6012] bridge0: port 1() entered disabled state [ 390.269588][ T6012] veth1_macvtap: left promiscuous mode [ 390.275477][ T6012] veth0_macvtap: left promiscuous mode [ 390.284215][ T6012] veth1_vlan: left promiscuous mode [ 390.289832][ T6012] veth0_vlan: left promiscuous mode [ 391.052867][ T5793] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 391.073962][ T5793] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 391.099915][ T5793] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 391.179155][ T5793] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 391.190203][ T5793] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 391.204282][ T5793] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 391.268736][ T23] usb 8-1: unable to get BOS descriptor or descriptor too short [ 391.320693][ T23] usb 8-1: unable to read config index 0 descriptor/start: -71 [ 391.328601][ T23] usb 8-1: can't read configurations, error -71 [ 392.242264][ T5793] Bluetooth: hci0: command tx timeout [ 392.260748][ T23] usb 8-1: new high-speed USB device number 20 using dummy_hcd [ 392.450851][ T23] usb 8-1: Using ep0 maxpacket: 32 [ 392.469049][ T23] usb 8-1: config 0 has an invalid interface number: 51 but max is 0 [ 392.484063][ T6012] team0 (unregistering): Port device team_slave_1 removed [ 392.500665][ T23] usb 8-1: config 0 has no interface number 0 [ 392.510148][ T23] usb 8-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 392.543564][ T23] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 392.576010][ T23] usb 8-1: Product: syz [ 392.580504][ T23] usb 8-1: Manufacturer: syz [ 392.595712][ T23] usb 8-1: SerialNumber: syz [ 392.628045][ T23] usb 8-1: config 0 descriptor?? [ 392.653328][ T23] quatech2 8-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 392.712489][ T6012] team0 (unregistering): Port device team_slave_0 removed [ 392.843273][ T6012] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 392.886957][ T23] usb 8-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 392.925297][ T23] usb 8-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 393.039220][ T6012] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 393.288211][ T5793] Bluetooth: hci3: command tx timeout [ 393.292402][ T8] usb 8-1: USB disconnect, device number 20 [ 393.294448][ C1] usb 8-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 393.307231][ T8] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 393.339509][ T8] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 393.357059][ T8] quatech2 8-1:0.51: device disconnected [ 393.748669][ T6012] bond0 (unregistering): Released all slaves [ 393.967602][T10403] bridge0: port 1(bridge_slave_0) entered blocking state [ 393.975598][T10403] bridge0: port 1(bridge_slave_0) entered disabled state [ 393.984332][T10403] bridge_slave_0: entered allmulticast mode [ 393.992402][T10403] bridge_slave_0: entered promiscuous mode [ 394.000333][T10446] wg1 speed is unknown, defaulting to 1000 [ 394.001525][T10403] bridge0: port 2(bridge_slave_1) entered blocking state [ 394.014228][T10403] bridge0: port 2(bridge_slave_1) entered disabled state [ 394.022547][T10403] bridge_slave_1: entered allmulticast mode [ 394.034523][T10403] bridge_slave_1: entered promiscuous mode [ 394.113531][T10403] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 394.153165][T10403] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 394.321247][ T5793] Bluetooth: hci0: command tx timeout [ 394.416294][T10403] team0: Port device team_slave_0 added [ 394.437747][T10403] team0: Port device team_slave_1 added [ 394.606543][T10403] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 394.623454][T10403] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 394.654199][T10403] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 394.755760][T10403] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 394.786754][T10403] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 394.886613][T10403] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 395.101842][T10403] hsr_slave_0: entered promiscuous mode [ 395.108645][T10403] hsr_slave_1: entered promiscuous mode [ 395.121341][T10403] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 395.131168][T10403] Cannot create hsr debugfs directory [ 395.157391][T10446] chnl_net:caif_netlink_parms(): no params data found [ 395.266268][ T6012] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 395.361101][ T5793] Bluetooth: hci3: command tx timeout [ 395.457928][ T5787] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 395.468174][ T5787] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 395.476840][ T5787] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 395.486196][ T5787] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 395.499141][ T5787] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 395.506735][ T5787] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 395.586863][ T6012] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 395.715503][ T6012] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 395.849485][ T6012] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 396.027649][T10446] bridge0: port 1(bridge_slave_0) entered blocking state [ 396.050923][T10446] bridge0: port 1(bridge_slave_0) entered disabled state [ 396.072841][T10446] bridge_slave_0: entered allmulticast mode [ 396.095672][T10446] bridge_slave_0: entered promiscuous mode [ 396.122474][T10446] bridge0: port 2(bridge_slave_1) entered blocking state [ 396.129794][T10511] wg1 speed is unknown, defaulting to 1000 [ 396.148463][T10446] bridge0: port 2(bridge_slave_1) entered disabled state [ 396.174591][T10446] bridge_slave_1: entered allmulticast mode [ 396.197685][T10446] bridge_slave_1: entered promiscuous mode [ 396.400606][ T5787] Bluetooth: hci0: command tx timeout [ 396.548391][T10446] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 396.629182][T10446] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 397.060686][ T6012] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.125273][T10446] team0: Port device team_slave_0 added [ 397.318265][ T6012] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.369839][T10446] team0: Port device team_slave_1 added [ 397.440614][ T5787] Bluetooth: hci3: command tx timeout [ 397.494236][T10446] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 397.510301][T10446] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 397.545562][T10446] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 397.593743][ T6012] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 397.600954][ T5787] Bluetooth: hci1: command tx timeout [ 397.666251][T10446] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 397.687050][T10446] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 397.726025][T10446] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 397.803050][ T6012] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 398.022536][T10446] hsr_slave_0: entered promiscuous mode [ 398.048815][T10446] hsr_slave_1: entered promiscuous mode [ 398.060030][T10446] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 398.069530][T10446] Cannot create hsr debugfs directory [ 398.140297][T10511] chnl_net:caif_netlink_parms(): no params data found [ 398.705969][T10511] bridge0: port 1(bridge_slave_0) entered blocking state [ 398.742454][T10511] bridge0: port 1(bridge_slave_0) entered disabled state [ 398.750109][T10511] bridge_slave_0: entered allmulticast mode [ 398.812029][T10511] bridge_slave_0: entered promiscuous mode [ 398.843768][T10511] bridge0: port 2(bridge_slave_1) entered blocking state [ 398.858163][T10511] bridge0: port 2(bridge_slave_1) entered disabled state [ 398.866465][T10511] bridge_slave_1: entered allmulticast mode [ 398.882040][T10511] bridge_slave_1: entered promiscuous mode [ 399.309661][T10511] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 399.328787][T10511] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 399.518123][T10511] team0: Port device team_slave_0 added [ 399.521034][ T5787] Bluetooth: hci3: command tx timeout [ 399.527078][T10511] team0: Port device team_slave_1 added [ 399.645216][T10511] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 399.661817][T10511] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 399.688387][ C1] vkms_vblank_simulate: vblank timer overrun [ 399.700566][ T5787] Bluetooth: hci1: command tx timeout [ 399.706714][T10511] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 399.708962][T10511] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 399.733314][T10511] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 399.777214][T10511] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 399.944708][T10601] netlink: 4 bytes leftover after parsing attributes in process `syz.7.967'. [ 400.026210][T10511] hsr_slave_0: entered promiscuous mode [ 400.035421][T10511] hsr_slave_1: entered promiscuous mode [ 400.047149][T10511] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 400.065389][T10511] Cannot create hsr debugfs directory [ 400.689991][T10446] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 400.967266][T10446] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 401.098586][T10446] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 401.143946][ T5820] usb 8-1: new high-speed USB device number 21 using dummy_hcd [ 401.236177][T10446] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 401.341777][ T5820] usb 8-1: Using ep0 maxpacket: 8 [ 401.368868][ T5820] usb 8-1: New USB device found, idVendor=10c4, idProduct=8244, bcdDevice=dc.00 [ 401.399006][ T5820] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 401.408115][ T6012] hsr_slave_0: left promiscuous mode [ 401.425981][ T5820] usb 8-1: Product: syz [ 401.449451][ T5820] usb 8-1: Manufacturer: syz [ 401.454772][ T5820] usb 8-1: SerialNumber: syz [ 401.466715][ T5820] usb 8-1: config 0 descriptor?? [ 401.475898][ T6012] hsr_slave_1: left promiscuous mode [ 401.483830][ T5820] radio-usb-si4713 8-1:0.0: Si4713 development board discovered: (10C4:8244) [ 401.493389][ T6012] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 401.501353][ T6012] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 401.509496][ T6012] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 401.517564][ T6012] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 401.526111][ T6012] bridge_slave_1: left allmulticast mode [ 401.532327][ T6012] bridge_slave_1: left promiscuous mode [ 401.538193][ T6012] bridge0: port 2(bridge_slave_1) entered disabled state [ 401.549510][ T6012] : left allmulticast mode [ 401.556608][ T6012] bridge0: port 1() entered disabled state [ 401.578910][ T6012] hsr_slave_0: left promiscuous mode [ 401.596936][ T6012] hsr_slave_1: left promiscuous mode [ 401.609407][ T6012] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 401.619630][ T6012] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 401.636011][ T6012] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 401.647219][ T6012] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 401.660205][ T6012] bridge_slave_1: left allmulticast mode [ 401.666770][ T6012] bridge_slave_1: left promiscuous mode [ 401.673222][ T6012] bridge0: port 2(bridge_slave_1) entered disabled state [ 401.683238][ T6012] : left allmulticast mode [ 401.687958][ T6012] bridge0: port 1() entered disabled state [ 401.769405][ T5787] Bluetooth: hci1: command tx timeout [ 401.801068][ T6012] veth1_macvtap: left promiscuous mode [ 401.806786][ T6012] veth0_macvtap: left promiscuous mode [ 401.813088][ T6012] veth1_vlan: left promiscuous mode [ 401.818547][ T6012] veth0_vlan: left promiscuous mode [ 401.828122][ T6012] veth1_macvtap: left promiscuous mode [ 401.834228][ T6012] veth0_macvtap: left promiscuous mode [ 401.839937][ T6012] veth1_vlan: left promiscuous mode [ 401.845983][ T6012] veth0_vlan: left promiscuous mode [ 402.349988][ T5820] radio-usb-si4713: probe of 8-1:0.0 failed with error -71 [ 402.370077][ T5820] usbhid 8-1:0.0: couldn't find an input interrupt endpoint [ 402.393551][ T5820] usb 8-1: USB disconnect, device number 21 [ 402.666484][ T6012] team0 (unregistering): Port device team_slave_1 removed [ 402.718716][ T6012] team0 (unregistering): Port device team_slave_0 removed [ 402.770882][ T6012] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 402.826658][ T6012] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 403.683352][ T6012] bond0 (unregistering): Released all slaves [ 403.845596][ T5787] Bluetooth: hci1: command tx timeout [ 404.500962][ T6012] team0 (unregistering): Port device team_slave_1 removed [ 404.568304][ T6012] team0 (unregistering): Port device team_slave_0 removed [ 404.631871][ T6012] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 404.693172][ T6012] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 405.238996][ T6012] bond0 (unregistering): Released all slaves [ 405.321287][ T27] wg1 speed is unknown, defaulting to 1000 [ 405.472861][T10446] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 405.501948][T10446] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 405.541458][T10446] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 405.592147][T10446] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 405.680745][T10576] usb 8-1: new high-speed USB device number 22 using dummy_hcd [ 405.797718][T10403] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 405.822363][T10403] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 405.892425][T10576] usb 8-1: Using ep0 maxpacket: 16 [ 405.922118][T10576] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 405.960056][T10576] usb 8-1: New USB device found, idVendor=1770, idProduct=ff00, bcdDevice= 0.00 [ 405.973712][T10576] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 405.994279][T10576] usb 8-1: config 0 descriptor?? [ 406.012750][T10576] usbhid 8-1:0.0: can't add hid device: -22 [ 406.018796][T10576] usbhid: probe of 8-1:0.0 failed with error -22 [ 406.038276][T10403] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 406.072092][T10403] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 406.355531][T10446] 8021q: adding VLAN 0 to HW filter on device bond0 [ 406.518285][T10446] 8021q: adding VLAN 0 to HW filter on device team0 [ 406.671369][ T42] bridge0: port 1(bridge_slave_0) entered blocking state [ 406.678535][ T42] bridge0: port 1(bridge_slave_0) entered forwarding state [ 406.733705][ T42] bridge0: port 2(bridge_slave_1) entered blocking state [ 406.741062][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state [ 406.859755][ T6012] IPVS: stop unused estimator thread 0... [ 407.537676][T10403] 8021q: adding VLAN 0 to HW filter on device bond0 [ 407.573774][T10403] 8021q: adding VLAN 0 to HW filter on device team0 [ 407.645446][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 407.652704][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 407.662436][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 407.669720][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 407.874482][T10511] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 407.900038][T10511] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 407.913025][T10511] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 407.931852][T10511] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 408.128099][T10511] 8021q: adding VLAN 0 to HW filter on device bond0 [ 408.195688][T10511] 8021q: adding VLAN 0 to HW filter on device team0 [ 408.239552][ T6014] bridge0: port 1(bridge_slave_0) entered blocking state [ 408.247259][ T6014] bridge0: port 1(bridge_slave_0) entered forwarding state [ 408.275531][ T6014] bridge0: port 2(bridge_slave_1) entered blocking state [ 408.282830][ T6014] bridge0: port 2(bridge_slave_1) entered forwarding state [ 408.379719][T10511] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 408.421574][T10446] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 408.466255][T10403] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 408.659159][T10403] veth0_vlan: entered promiscuous mode [ 408.693924][T10403] veth1_vlan: entered promiscuous mode [ 408.779907][T10602] usb 8-1: USB disconnect, device number 22 [ 408.787832][T10403] veth0_macvtap: entered promiscuous mode [ 408.839274][T10403] veth1_macvtap: entered promiscuous mode [ 408.913665][T10403] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 408.929652][T10403] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 408.961728][T10403] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 408.989999][T10403] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 409.017208][T10403] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 409.054889][T10403] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 409.070333][T10403] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 409.082853][T10403] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 409.095437][T10403] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 409.107299][T10403] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 409.118909][T10403] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 409.128895][T10403] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 409.137971][T10403] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 409.147253][T10403] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 409.197481][T10511] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 409.337393][T10446] veth0_vlan: entered promiscuous mode [ 409.360091][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 409.369774][T10446] veth1_vlan: entered promiscuous mode [ 409.370541][ T5846] usb 8-1: new high-speed USB device number 23 using dummy_hcd [ 409.392748][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 409.396057][T10511] veth0_vlan: entered promiscuous mode [ 409.485360][T10511] veth1_vlan: entered promiscuous mode [ 409.497325][ T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 409.513748][T10446] veth0_macvtap: entered promiscuous mode [ 409.519980][ T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 409.546623][T10446] veth1_macvtap: entered promiscuous mode [ 409.580870][ T5846] usb 8-1: Using ep0 maxpacket: 16 [ 409.599026][ T5846] usb 8-1: config 0 has an invalid interface number: 53 but max is 0 [ 409.625250][T10511] veth0_macvtap: entered promiscuous mode [ 409.631561][ T5846] usb 8-1: config 0 has no interface number 0 [ 409.641343][ T5846] usb 8-1: New USB device found, idVendor=03fd, idProduct=ebbe, bcdDevice=ed.e2 [ 409.651899][ T5846] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 409.659930][ T5846] usb 8-1: Product: syz [ 409.698201][T10511] veth1_macvtap: entered promiscuous mode [ 409.707890][ T5846] usb 8-1: Manufacturer: syz [ 409.752400][ T5846] usb 8-1: SerialNumber: syz [ 409.906332][T10739] hugetlbfs: syz.2.941 (10739): Using mlock ulimits for SHM_HUGETLB is obsolete [ 410.080097][T10446] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 410.107624][ T5846] usb 8-1: config 0 descriptor?? [ 410.148790][T10446] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 410.237559][T10446] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 410.268684][T10446] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 410.282031][T10446] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 410.294958][T10446] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 410.309519][T10446] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 410.332521][ T5827] usb 8-1: USB disconnect, device number 23 [ 410.357044][T10446] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 410.380835][T10446] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 410.391307][T10446] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 410.404197][T10446] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 410.414314][T10446] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 410.425347][T10446] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 410.436937][T10446] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 410.450082][T10446] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 410.459402][T10446] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 410.468567][T10446] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 410.477736][T10446] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 410.527722][T10511] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 410.547012][T10511] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 410.559076][T10511] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 410.571216][T10511] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 410.582423][T10511] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 410.593235][T10511] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 410.603342][T10511] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 410.614965][T10511] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 410.627041][T10511] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 410.638641][T10511] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 410.650741][T10511] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 410.661368][T10511] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 410.672073][T10511] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 410.681983][T10511] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 410.692751][T10511] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 410.702636][T10511] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 410.713904][T10511] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 410.725724][T10511] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 410.747759][T10511] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 410.768274][T10511] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 410.789075][T10511] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 410.799722][T10511] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 410.948506][ T6012] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 411.048814][ T6012] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 411.359891][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 411.419468][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 411.637265][ T3485] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 411.659348][ T3485] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 411.789499][T10751] netlink: 4 bytes leftover after parsing attributes in process `syz.7.973'. [ 411.811249][T10755] netlink: 20 bytes leftover after parsing attributes in process `syz.4.952'. [ 411.884966][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 411.962636][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 412.230487][T10774] : renamed from bridge_slave_0 (while UP) [ 413.290575][ T5846] usb 8-1: new high-speed USB device number 24 using dummy_hcd [ 413.490633][ T5846] usb 8-1: Using ep0 maxpacket: 16 [ 413.499791][ T5846] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 413.526247][ T5846] usb 8-1: New USB device found, idVendor=1770, idProduct=ff00, bcdDevice= 0.00 [ 413.585882][ T5846] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 413.629917][ T5846] usb 8-1: config 0 descriptor?? [ 413.669172][ T5846] usbhid 8-1:0.0: can't add hid device: -22 [ 413.685708][ T5846] usbhid: probe of 8-1:0.0 failed with error -22 [ 415.180856][T10801] netlink: 'syz.2.982': attribute type 10 has an invalid length. [ 415.188641][T10801] netlink: 40 bytes leftover after parsing attributes in process `syz.2.982'. [ 415.257506][T10801] team0: entered promiscuous mode [ 415.268074][T10801] team_slave_0: entered promiscuous mode [ 415.276020][T10801] team_slave_1: entered promiscuous mode [ 415.286081][T10801] team0: entered allmulticast mode [ 415.291679][T10801] team_slave_0: entered allmulticast mode [ 415.297617][T10801] team_slave_1: entered allmulticast mode [ 415.315867][T10801] bridge0: port 3(team0) entered blocking state [ 415.327404][T10801] bridge0: port 3(team0) entered disabled state [ 415.364708][T10801] bridge0: port 3(team0) entered blocking state [ 415.371207][T10801] bridge0: port 3(team0) entered forwarding state [ 416.164592][ T5827] usb 8-1: USB disconnect, device number 24 [ 416.258233][T10811] netlink: 4 bytes leftover after parsing attributes in process `syz.2.985'. [ 417.172227][ T5873] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 417.390892][ T5873] usb 5-1: Using ep0 maxpacket: 8 [ 417.498759][ T5873] usb 5-1: New USB device found, idVendor=10c4, idProduct=8244, bcdDevice=dc.00 [ 417.508558][ T5873] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 417.517311][ T5873] usb 5-1: Product: syz [ 417.526237][ T5873] usb 5-1: Manufacturer: syz [ 417.533117][ T5873] usb 5-1: SerialNumber: syz [ 417.579468][ T5873] usb 5-1: config 0 descriptor?? [ 417.671525][ T5873] radio-usb-si4713 5-1:0.0: Si4713 development board discovered: (10C4:8244) [ 417.999935][T10846] : renamed from bridge_slave_0 (while UP) [ 418.280578][ T27] usb 8-1: new high-speed USB device number 25 using dummy_hcd [ 418.354085][ T5873] radio-usb-si4713: probe of 5-1:0.0 failed with error -71 [ 418.371931][ T5873] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 418.392991][ T5873] usb 5-1: USB disconnect, device number 7 [ 419.230682][ T27] usb 8-1: Using ep0 maxpacket: 16 [ 419.248540][ T27] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 419.265771][ T27] usb 8-1: New USB device found, idVendor=1770, idProduct=ff00, bcdDevice= 0.00 [ 419.279597][ T27] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 419.317535][ T27] usb 8-1: config 0 descriptor?? [ 419.349636][ T27] usbhid 8-1:0.0: can't add hid device: -22 [ 419.361282][ T27] usbhid: probe of 8-1:0.0 failed with error -22 [ 421.922131][T10578] usb 8-1: USB disconnect, device number 25 [ 421.944594][T10904] input: syz1 as /devices/virtual/input/input8 [ 422.037200][T10904] binder: 10903:10904 ioctl c0306201 200000000080 returned -14 [ 422.087863][T10904] binder_alloc: 10903: binder_alloc_buf, no vma [ 422.420875][T10919] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1003'. [ 422.560466][T10578] usb 8-1: new high-speed USB device number 26 using dummy_hcd [ 422.750745][T10578] usb 8-1: Using ep0 maxpacket: 8 [ 422.774900][T10578] usb 8-1: New USB device found, idVendor=10c4, idProduct=8244, bcdDevice=dc.00 [ 422.797991][T10578] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 422.847981][T10578] usb 8-1: Product: syz [ 422.867508][T10578] usb 8-1: Manufacturer: syz [ 422.895323][T10578] usb 8-1: SerialNumber: syz [ 422.932063][T10578] usb 8-1: config 0 descriptor?? [ 422.958898][T10578] radio-usb-si4713 8-1:0.0: Si4713 development board discovered: (10C4:8244) [ 423.396204][T10951] input: syz1 as /devices/virtual/input/input9 [ 423.438071][T10951] binder: 10950:10951 ioctl c0306201 200000000080 returned -14 [ 423.457574][T10951] binder_alloc: 10950: binder_alloc_buf, no vma [ 423.480517][ T5873] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 423.579381][T10578] radio-usb-si4713: probe of 8-1:0.0 failed with error -71 [ 423.598746][T10578] usbhid 8-1:0.0: couldn't find an input interrupt endpoint [ 423.622175][T10578] usb 8-1: USB disconnect, device number 26 [ 423.693571][ T5873] usb 5-1: Using ep0 maxpacket: 8 [ 423.701093][T10577] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 423.714095][ T5873] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 423.730547][ T5873] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 423.773424][ T5873] usb 5-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 423.792689][ T5873] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 423.806461][ T5873] usb 5-1: Product: syz [ 423.819176][ T5873] usb 5-1: Manufacturer: syz [ 423.824262][ T5873] usb 5-1: SerialNumber: syz [ 423.863023][ T5873] usb 5-1: config 0 descriptor?? [ 423.901950][T10577] usb 3-1: Using ep0 maxpacket: 16 [ 423.920849][T10577] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 423.940315][T10577] usb 3-1: New USB device found, idVendor=1770, idProduct=ff00, bcdDevice= 0.00 [ 423.955956][T10577] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 423.973443][T10577] usb 3-1: config 0 descriptor?? [ 423.992902][T10577] usbhid 3-1:0.0: can't add hid device: -22 [ 424.009283][T10577] usbhid: probe of 3-1:0.0 failed with error -22 [ 424.199228][T10976] "syz.7.1018" (10976) uses obsolete ecb(arc4) skcipher [ 424.344049][T10980] netlink: 'syz.7.1019': attribute type 1 has an invalid length. [ 425.496858][T10577] IPVS: starting estimator thread 0... [ 425.541031][T11004] ieee802154 phy0 wpan0: encryption failed: -22 [ 425.643984][T11005] IPVS: using max 20 ests per chain, 48000 per kthread [ 425.662343][T11010] input: syz1 as /devices/virtual/input/input10 [ 425.683856][T11010] binder: 11008:11010 ioctl c0306201 200000000080 returned -14 [ 426.252635][T10577] usb 5-1: USB disconnect, device number 8 [ 426.451455][ T5873] usb 8-1: new high-speed USB device number 27 using dummy_hcd [ 426.581825][ T5846] usb 3-1: USB disconnect, device number 6 [ 426.681307][ T5873] usb 8-1: Using ep0 maxpacket: 8 [ 426.704735][ T5873] usb 8-1: New USB device found, idVendor=10c4, idProduct=8244, bcdDevice=dc.00 [ 426.726652][ T5873] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 426.753413][ T5873] usb 8-1: Product: syz [ 426.769468][ T5873] usb 8-1: Manufacturer: syz [ 426.794386][ T5873] usb 8-1: SerialNumber: syz [ 426.817985][ T5873] usb 8-1: config 0 descriptor?? [ 426.845479][ T5873] radio-usb-si4713 8-1:0.0: Si4713 development board discovered: (10C4:8244) [ 427.017168][T11051] input: syz1 as /devices/virtual/input/input11 [ 427.069599][T11051] binder: 11050:11051 ioctl c0306201 200000000080 returned -14 [ 427.117870][ T8939] udevd[8939]: setting mode of /dev/input/event4 to 020660 failed: No such file or directory [ 427.147234][ T8939] udevd[8939]: setting owner of /dev/input/event4 to uid=0, gid=104 failed: No such file or directory [ 427.458950][ T5873] radio-usb-si4713: probe of 8-1:0.0 failed with error -71 [ 427.517765][ T5873] usbhid 8-1:0.0: couldn't find an input interrupt endpoint [ 427.570643][ T5873] usb 8-1: USB disconnect, device number 27 [ 428.049579][T11075] binder: BINDER_SET_CONTEXT_MGR already set [ 428.077049][T11075] binder: 11074:11075 ioctl 4018620d 200000000040 returned -16 [ 428.320643][T11084] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1040'. [ 430.468989][T11127] binder: 11126:11127 ioctl c0306201 0 returned -14 [ 430.816538][T11138] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1052'. [ 430.830726][ T5873] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 431.040648][ T5873] usb 4-1: Using ep0 maxpacket: 8 [ 431.060058][ T5873] usb 4-1: New USB device found, idVendor=10c4, idProduct=8244, bcdDevice=dc.00 [ 431.097769][ T5873] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 431.118020][ T5873] usb 4-1: Product: syz [ 431.128137][ T5873] usb 4-1: Manufacturer: syz [ 431.148482][ T5873] usb 4-1: SerialNumber: syz [ 431.166927][ T5873] usb 4-1: config 0 descriptor?? [ 431.223946][ T5873] radio-usb-si4713 4-1:0.0: Si4713 development board discovered: (10C4:8244) [ 432.159241][ T5873] radio-usb-si4713: probe of 4-1:0.0 failed with error -71 [ 432.172596][ T5873] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 432.182322][ T5873] usb 4-1: USB disconnect, device number 7 [ 432.393930][T11172] binder: 11171:11172 ioctl c0306201 0 returned -14 [ 432.803391][T11185] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1065'. [ 433.551641][ T27] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 433.810456][ T27] usb 4-1: Using ep0 maxpacket: 8 [ 434.045350][ T27] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 434.084523][T11206] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1072'. [ 434.087669][ T27] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 434.127046][ T27] usb 4-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 434.141061][ T27] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 434.166212][ T27] usb 4-1: Product: syz [ 434.166233][T11206] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1072'. [ 434.180553][ T27] usb 4-1: Manufacturer: syz [ 434.205086][ T27] usb 4-1: SerialNumber: syz [ 434.238644][ T27] usb 4-1: config 0 descriptor?? [ 434.251280][T11208] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1072'. [ 435.350726][ T5873] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 435.599759][ T5873] usb 5-1: Using ep0 maxpacket: 8 [ 435.609359][ T5873] usb 5-1: New USB device found, idVendor=10c4, idProduct=8244, bcdDevice=dc.00 [ 435.635891][ T5873] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 435.644627][ T5873] usb 5-1: Product: syz [ 435.649068][ T5873] usb 5-1: Manufacturer: syz [ 435.656201][ T5873] usb 5-1: SerialNumber: syz [ 435.664290][ T5873] usb 5-1: config 0 descriptor?? [ 435.686959][ T5873] radio-usb-si4713 5-1:0.0: Si4713 development board discovered: (10C4:8244) [ 435.747547][T11254] Bluetooth: MGMT ver 1.22 [ 436.052481][ T27] usb 4-1: USB disconnect, device number 8 [ 436.763613][ T5873] radio-usb-si4713: probe of 5-1:0.0 failed with error -71 [ 436.771293][ T5873] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 436.785502][ T5873] usb 5-1: USB disconnect, device number 9 [ 437.047155][T11274] input: syz1 as /devices/virtual/input/input12 [ 437.129753][T11274] binder: 11271:11274 ioctl c0306201 200000000080 returned -14 [ 437.157337][T11274] binder: BINDER_SET_CONTEXT_MGR already set [ 437.172830][T11274] binder: 11271:11274 ioctl 4018620d 200000000240 returned -16 [ 440.048658][T10578] IPVS: starting estimator thread 0... [ 440.060704][ T5846] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 440.070785][T11348] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.188466][T11350] IPVS: using max 22 ests per chain, 52800 per kthread [ 440.271299][ T5846] usb 3-1: Using ep0 maxpacket: 8 [ 440.307466][ T5846] usb 3-1: New USB device found, idVendor=10c4, idProduct=8244, bcdDevice=dc.00 [ 440.326228][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.330180][ T5846] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 440.332826][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.375048][ T5846] usb 3-1: Product: syz [ 440.410566][ T5846] usb 3-1: Manufacturer: syz [ 440.435603][ T5846] usb 3-1: SerialNumber: syz [ 440.461171][ T5846] usb 3-1: config 0 descriptor?? [ 440.498295][ T5846] radio-usb-si4713 3-1:0.0: Si4713 development board discovered: (10C4:8244) [ 441.133010][ T5846] radio-usb-si4713: probe of 3-1:0.0 failed with error -71 [ 441.178849][ T5846] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 441.207886][ T5846] usb 3-1: USB disconnect, device number 7 [ 443.466278][ T5846] usb 8-1: new high-speed USB device number 28 using dummy_hcd [ 443.681712][ T5846] usb 8-1: Using ep0 maxpacket: 8 [ 443.690174][ T5846] usb 8-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 443.754989][ T5846] usb 8-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 443.767278][ T5846] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 443.778895][ T5846] usb 8-1: Product: syz [ 443.800804][ T5846] usb 8-1: Manufacturer: syz [ 443.806424][ T5846] usb 8-1: SerialNumber: syz [ 443.818635][ T5846] usb 8-1: config 0 descriptor?? [ 446.030099][ T5846] usb 8-1: USB disconnect, device number 28 [ 447.000844][ T5846] usb 8-1: new high-speed USB device number 29 using dummy_hcd [ 447.190672][ T5846] usb 8-1: Using ep0 maxpacket: 8 [ 447.209756][ T5846] usb 8-1: New USB device found, idVendor=10c4, idProduct=8244, bcdDevice=dc.00 [ 447.235535][ T5846] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 447.256914][ T5846] usb 8-1: Product: syz [ 447.278254][ T5846] usb 8-1: Manufacturer: syz [ 447.302813][ T5846] usb 8-1: SerialNumber: syz [ 447.325691][ T5846] usb 8-1: config 0 descriptor?? [ 447.353069][ T5846] radio-usb-si4713 8-1:0.0: Si4713 development board discovered: (10C4:8244) [ 447.967474][ T5846] radio-usb-si4713: probe of 8-1:0.0 failed with error -71 [ 447.992878][ T5846] usbhid 8-1:0.0: couldn't find an input interrupt endpoint [ 448.023430][ T5846] usb 8-1: USB disconnect, device number 29 [ 451.767038][T11542] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1129'. [ 452.447604][ T5846] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 452.572590][T11561] netlink: 'syz.2.1131': attribute type 1 has an invalid length. [ 452.629665][T11561] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 452.652967][T11561] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 452.681247][ T5846] usb 4-1: Using ep0 maxpacket: 8 [ 452.694482][ T5846] usb 4-1: New USB device found, idVendor=10c4, idProduct=8244, bcdDevice=dc.00 [ 452.709014][ T5846] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 452.717715][ T5846] usb 4-1: Product: syz [ 452.723110][ T5846] usb 4-1: Manufacturer: syz [ 452.736672][ T5846] usb 4-1: SerialNumber: syz [ 452.744026][T11563] gretap1: entered promiscuous mode [ 452.750304][ T5846] usb 4-1: config 0 descriptor?? [ 452.766098][ T5846] radio-usb-si4713 4-1:0.0: Si4713 development board discovered: (10C4:8244) [ 452.849570][T11563] bond1: (slave gretap1): making interface the new active one [ 452.901948][T11563] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 453.674323][ T5846] radio-usb-si4713: probe of 4-1:0.0 failed with error -71 [ 453.802893][ T5846] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 453.839776][ T5846] usb 4-1: USB disconnect, device number 9 [ 453.865545][ T8891] udevd[8891]: setting owner of /dev/bus/usb/004/009 to uid=0, gid=0 failed: No such file or directory [ 455.070644][T11600] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1140'. [ 458.645560][T11678] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1151'. [ 458.828842][T10577] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 458.949729][T10577] hid-generic 0000:0000:0000.0006: hidraw0: HID v0.00 Device [syz1] on syz0 [ 460.365493][T11711] : renamed from bridge_slave_0 (while UP) [ 461.932045][T11740] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1167'. [ 462.020633][T10577] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 462.240873][T10577] usb 3-1: Using ep0 maxpacket: 32 [ 462.263442][T10577] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 462.311050][T10577] usb 3-1: config 0 has no interfaces? [ 462.358813][T10577] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 462.394428][T10577] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 462.410513][T10577] usb 3-1: Product: syz [ 462.425057][T10577] usb 3-1: Manufacturer: syz [ 462.429713][T10577] usb 3-1: SerialNumber: syz [ 462.461543][T10577] usb 3-1: config 0 descriptor?? [ 463.503532][T11792] lo speed is unknown, defaulting to 1000 [ 463.539015][T11792] lo speed is unknown, defaulting to 1000 [ 463.556500][T11792] lo speed is unknown, defaulting to 1000 [ 463.627341][T11792] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 463.836940][T11792] lo speed is unknown, defaulting to 1000 [ 463.895915][T11792] lo speed is unknown, defaulting to 1000 [ 463.937138][T11792] lo speed is unknown, defaulting to 1000 [ 463.975545][T11792] lo speed is unknown, defaulting to 1000 [ 464.008874][T11792] lo speed is unknown, defaulting to 1000 [ 464.652246][ T27] usb 8-1: new high-speed USB device number 30 using dummy_hcd [ 464.724504][ T5846] usb 3-1: USB disconnect, device number 8 [ 464.860540][ T27] usb 8-1: Using ep0 maxpacket: 8 [ 464.886007][ T27] usb 8-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 464.940477][ T27] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 464.961452][ T27] usb 8-1: Product: syz [ 464.965666][ T27] usb 8-1: Manufacturer: syz [ 464.970279][ T27] usb 8-1: SerialNumber: syz [ 465.017233][ T27] usb 8-1: config 0 descriptor?? [ 465.030244][ T27] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 465.409646][T11834] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1187'. [ 465.461973][ T27] gspca_sonixj: reg_r err -32 [ 465.484441][ T27] sonixj: probe of 8-1:0.0 failed with error -32 [ 465.518657][ T27] usb 8-1: USB disconnect, device number 30 [ 466.690599][T10577] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 466.822998][T11870] input: syz1 as /devices/virtual/input/input13 [ 466.894109][T10577] usb 4-1: Using ep0 maxpacket: 32 [ 466.901646][T11870] binder: 11869:11870 ioctl c0306201 200000000080 returned -14 [ 466.930690][T10577] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 466.960536][T10577] usb 4-1: config 0 has no interfaces? [ 466.975514][T10577] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 466.991431][T10577] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 467.028953][T10577] usb 4-1: Product: syz [ 467.043882][T10577] usb 4-1: Manufacturer: syz [ 467.084487][T10577] usb 4-1: SerialNumber: syz [ 467.111802][T10577] usb 4-1: config 0 descriptor?? [ 468.209234][T11913] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1199'. [ 468.887921][T11931] input: syz1 as /devices/virtual/input/input14 [ 468.902928][T10578] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 468.906548][T11931] binder: 11930:11931 ioctl c0306201 200000000080 returned -14 [ 469.211741][T10578] usb 5-1: Using ep0 maxpacket: 8 [ 469.250753][T10578] usb 5-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 469.270797][T10578] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 469.514005][T10578] usb 5-1: Product: syz [ 469.533869][T10578] usb 5-1: Manufacturer: syz [ 469.550144][T10578] usb 5-1: SerialNumber: syz [ 469.562772][T10577] usb 4-1: USB disconnect, device number 10 [ 469.614499][T10578] usb 5-1: config 0 descriptor?? [ 469.647721][T10578] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 469.839597][T11932] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 469.880767][T11932] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 469.896493][T11932] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 469.975362][T11932] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 470.011414][T11932] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 470.042981][T11932] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 470.091859][T11932] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 470.105729][T10578] gspca_sonixj: reg_r err -32 [ 470.113703][T10578] sonixj: probe of 5-1:0.0 failed with error -32 [ 470.123454][T11932] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 470.163874][T11932] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 470.170475][T10578] usb 5-1: USB disconnect, device number 10 [ 470.209608][T11932] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 471.041201][ T5787] Bluetooth: hci2: command 0x0c1a tx timeout [ 471.252815][T11974] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1208'. [ 471.920570][ T5787] Bluetooth: hci0: command 0x0c1a tx timeout [ 471.953664][T11988] input: syz1 as /devices/virtual/input/input15 [ 471.974085][T11988] binder: 11987:11988 ioctl c0306201 200000000080 returned -14 [ 472.080646][ T5787] Bluetooth: hci3: command 0x0c1a tx timeout [ 472.161035][ T5787] Bluetooth: hci1: command 0x0c1a tx timeout [ 473.099115][T12003] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 473.155981][T12003] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 473.172498][T12003] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 473.216116][T12003] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 473.407459][T12021] netlink: 88 bytes leftover after parsing attributes in process `syz.2.1221'. [ 473.705722][T12032] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1220'. [ 474.320735][ T5787] Bluetooth: hci2: command 0x0c1a tx timeout [ 474.658888][T12047] netlink: 'syz.7.1225': attribute type 1 has an invalid length. [ 475.200672][ T5787] Bluetooth: hci3: command 0x0c1a tx timeout [ 475.207132][ T5793] Bluetooth: hci0: command 0x0c1a tx timeout [ 475.280855][ T5787] Bluetooth: hci1: command 0x0c1a tx timeout [ 476.225511][T12066] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 476.235880][T12066] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 476.316465][T12066] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 476.348024][T12066] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 476.645504][T12088] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1235'. [ 477.330691][T10578] usb 8-1: new high-speed USB device number 31 using dummy_hcd [ 477.364091][ T5787] Bluetooth: hci2: command 0x0c1a tx timeout [ 477.553681][T10578] usb 8-1: Using ep0 maxpacket: 8 [ 477.663468][T10578] usb 8-1: no configurations [ 477.668177][T10578] usb 8-1: can't read configurations, error -22 [ 477.970546][T10578] usb 8-1: new high-speed USB device number 32 using dummy_hcd [ 478.081790][ T5827] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 478.171077][T10578] usb 8-1: Using ep0 maxpacket: 8 [ 478.188686][T10578] usb 8-1: no configurations [ 478.203746][T10578] usb 8-1: can't read configurations, error -22 [ 478.240885][ T5827] usb 4-1: device descriptor read/64, error -71 [ 478.248469][T10578] usb usb8-port1: attempt power cycle [ 478.320822][ T5787] Bluetooth: hci0: command 0x0c1a tx timeout [ 478.400770][ T5793] Bluetooth: hci3: command 0x0c1a tx timeout [ 478.406983][ T5787] Bluetooth: hci1: command 0x0c1a tx timeout [ 478.413675][T12127] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1246'. [ 478.554564][ T5827] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 478.700992][T10578] usb 8-1: new high-speed USB device number 33 using dummy_hcd [ 478.720995][ T5772] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 478.729587][ T5827] usb 4-1: device descriptor read/64, error -71 [ 478.741620][T10578] usb 8-1: Using ep0 maxpacket: 8 [ 478.762680][T10578] usb 8-1: no configurations [ 478.772193][T10578] usb 8-1: can't read configurations, error -22 [ 478.872816][ T5827] usb usb4-port1: attempt power cycle [ 478.910580][ T5772] usb 3-1: Using ep0 maxpacket: 32 [ 478.919029][ T5772] usb 3-1: config 0 has an invalid interface number: 51 but max is 0 [ 478.930663][T10578] usb 8-1: new high-speed USB device number 34 using dummy_hcd [ 478.943174][ T5772] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 478.954267][ T5772] usb 3-1: config 0 has no interface number 0 [ 478.962648][T10578] usb 8-1: Using ep0 maxpacket: 8 [ 478.966349][ T5772] usb 3-1: config 0 interface 51 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 478.975265][T10578] usb 8-1: no configurations [ 478.997276][T10578] usb 8-1: can't read configurations, error -22 [ 479.000210][ T5772] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 479.026305][ T5772] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 479.029683][T10578] usb usb8-port1: unable to enumerate USB device [ 479.048052][ T5772] usb 3-1: Product: syz [ 479.064924][ T5772] usb 3-1: Manufacturer: syz [ 479.074412][ T5772] usb 3-1: SerialNumber: syz [ 479.095004][ T5772] usb 3-1: config 0 descriptor?? [ 479.116670][ T5772] quatech2 3-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 479.302678][ T5827] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 479.332519][ T5772] usb 3-1: qt2_setup_urbs - submit read urb failed -8 [ 479.353964][ T5827] usb 4-1: device descriptor read/8, error -71 [ 479.354045][ T5772] quatech2: probe of 3-1:0.51 failed with error -8 [ 479.561355][ T5772] usb 3-1: USB disconnect, device number 9 [ 479.640773][ T5827] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 479.681668][ T5827] usb 4-1: device descriptor read/8, error -71 [ 479.794576][T12193] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1251'. [ 479.822177][ T5827] usb usb4-port1: unable to enumerate USB device [ 481.385819][T12227] binder: 12224:12227 ioctl c0306201 200000000080 returned -14 [ 481.417945][T12227] binder: 12224:12227 ioctl c0306201 0 returned -14 [ 481.473816][T12233] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1260'. [ 481.811821][ T5827] usb 8-1: new high-speed USB device number 35 using dummy_hcd [ 482.021890][ T5827] usb 8-1: Using ep0 maxpacket: 8 [ 482.035920][ T5827] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 482.072420][ T5827] usb 8-1: config 0 has no interfaces? [ 482.260574][ T5772] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 482.348485][ T5827] usb 8-1: New USB device found, idVendor=04a5, idProduct=3003, bcdDevice=c8.07 [ 482.549989][ T5827] usb 8-1: New USB device strings: Mfr=209, Product=185, SerialNumber=60 [ 482.560542][ T5827] usb 8-1: Product: syz [ 482.565780][ T5827] usb 8-1: Manufacturer: syz [ 482.571559][ T5827] usb 8-1: SerialNumber: syz [ 482.584249][ T5827] usb 8-1: config 0 descriptor?? [ 482.589593][ T5772] usb 3-1: device descriptor read/64, error -71 [ 482.943197][ T5772] usb 3-1: new high-speed USB device number 11 using dummy_hcd [ 483.120878][ T5772] usb 3-1: device descriptor read/64, error -71 [ 483.211195][T12271] binder: 12270:12271 ioctl c0306201 200000000080 returned -14 [ 483.250992][T12271] binder: 12270:12271 ioctl c0306201 0 returned -14 [ 483.261926][ T5772] usb usb3-port1: attempt power cycle [ 483.690742][ T5772] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 483.739227][ T5772] usb 3-1: device descriptor read/8, error -71 [ 484.080681][ T5772] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 484.108210][T12274] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 484.141844][ T5772] usb 3-1: device descriptor read/8, error -71 [ 484.197772][T12274] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 484.216744][T12274] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 484.237299][T12274] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 484.268856][ T5772] usb usb3-port1: unable to enumerate USB device [ 484.595609][ T5827] usb 8-1: USB disconnect, device number 35 [ 485.283198][T12309] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1274'. [ 485.360625][ T5787] Bluetooth: hci2: command 0x0c1a tx timeout [ 486.248287][ T5787] Bluetooth: hci1: command 0x0c1a tx timeout [ 486.255264][ T5787] Bluetooth: hci3: command 0x0c1a tx timeout [ 486.261445][ T5787] Bluetooth: hci0: command 0x0c1a tx timeout [ 486.330304][T12329] binder: 12328:12329 ioctl c0306201 200000000080 returned -14 [ 486.625699][ T5873] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 486.810828][ T5873] usb 5-1: Using ep0 maxpacket: 32 [ 486.850056][ T5873] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 486.870922][ T5873] usb 5-1: config 0 has no interface number 0 [ 486.877682][ T5873] usb 5-1: config 0 interface 51 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 486.958770][ T5873] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 486.977144][ T5873] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 487.011076][ T5873] usb 5-1: Product: syz [ 487.015419][ T5873] usb 5-1: Manufacturer: syz [ 487.020451][ T5873] usb 5-1: SerialNumber: syz [ 487.048530][ T5873] usb 5-1: config 0 descriptor?? [ 487.069292][ T5873] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 487.343370][ T5873] usb 5-1: qt2_setup_urbs - submit read urb failed -8 [ 487.403368][ T5873] quatech2: probe of 5-1:0.51 failed with error -8 [ 487.743952][T10577] usb 5-1: USB disconnect, device number 11 [ 487.807724][T12327] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 487.825651][T12327] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 487.859531][T12327] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 487.874042][T12327] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 488.403388][ T5793] Bluetooth: hci2: command 0x0c1a tx timeout [ 488.714506][T12363] netlink: 'syz.2.1289': attribute type 9 has an invalid length. [ 488.797227][T12362] veth3: entered promiscuous mode [ 488.820885][T12368] binder: 12367:12368 ioctl c0306201 200000000080 returned -14 [ 488.893707][T12362] netlink: 200 bytes leftover after parsing attributes in process `syz.2.1289'. [ 489.902430][ T5793] Bluetooth: hci0: command 0x0c1a tx timeout [ 489.933757][ T5793] Bluetooth: hci1: command 0x0c1a tx timeout [ 489.939843][ T5793] Bluetooth: hci3: command 0x0c1a tx timeout [ 490.981486][T12386] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 491.001625][T12386] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 491.039036][T12386] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 491.097290][T12386] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 491.377896][T12413] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1302'. [ 491.410701][ T5827] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 491.591460][ T5827] usb 4-1: Using ep0 maxpacket: 32 [ 491.654043][ T5827] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 491.667995][ T5827] usb 4-1: config 0 has no interface number 0 [ 491.694031][ T5827] usb 4-1: config 0 interface 51 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 491.761738][ T5827] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 491.810141][ T5827] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 491.853374][ T5827] usb 4-1: Product: syz [ 491.868793][ T5827] usb 4-1: Manufacturer: syz [ 491.888553][ T5827] usb 4-1: SerialNumber: syz [ 491.933891][ T5827] usb 4-1: config 0 descriptor?? [ 491.963997][ T5827] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 492.249437][ T5787] Bluetooth: hci2: command 0x0c1a tx timeout [ 492.559050][ T5827] usb 4-1: qt2_setup_urbs - submit read urb failed -8 [ 492.572170][ T5827] quatech2: probe of 4-1:0.51 failed with error -8 [ 492.758863][ T5827] usb 4-1: USB disconnect, device number 15 [ 493.041807][ T5793] Bluetooth: hci3: command 0x0c1a tx timeout [ 493.048054][ T5793] Bluetooth: hci0: command 0x0c1a tx timeout [ 493.120550][ T5787] Bluetooth: hci1: command 0x0c1a tx timeout [ 493.969605][T12438] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 494.068503][T12438] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 494.111613][T12438] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 494.118139][T12438] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 494.535645][T12463] lo speed is unknown, defaulting to 1000 [ 494.970492][ T5787] Bluetooth: hci2: command 0x0c1a tx timeout [ 496.080607][ T5787] Bluetooth: hci0: command 0x0c1a tx timeout [ 496.171784][ T5793] Bluetooth: hci3: command 0x0c1a tx timeout [ 496.330508][ T5787] Bluetooth: hci1: command 0x0c1a tx timeout [ 497.506463][T12496] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 497.531054][T12496] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 497.620811][T12496] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 497.683003][T12496] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 498.641126][ T5787] Bluetooth: hci2: command 0x0c1a tx timeout [ 499.600594][ T5787] Bluetooth: hci0: command 0x0c1a tx timeout [ 499.680821][ T5787] Bluetooth: hci3: command 0x0c1a tx timeout [ 499.760535][ T5787] Bluetooth: hci1: command 0x0c1a tx timeout [ 500.150801][ T5827] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 500.330653][ T5827] usb 3-1: device descriptor read/64, error -71 [ 500.600489][ T5827] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 500.770892][ T5827] usb 3-1: device descriptor read/64, error -71 [ 500.910622][ T5827] usb usb3-port1: attempt power cycle [ 501.363634][ T5827] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 501.441252][ T5827] usb 3-1: device descriptor read/8, error -71 [ 501.765670][ T5827] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 501.766455][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.783265][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.861722][ T5827] usb 3-1: device descriptor read/8, error -71 [ 502.232194][ T5827] usb usb3-port1: unable to enumerate USB device [ 504.247209][T12647] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1349'. [ 506.720487][ T23] usb 8-1: new high-speed USB device number 36 using dummy_hcd [ 506.908386][ T23] usb 8-1: device descriptor read/64, error -71 [ 507.210545][ T23] usb 8-1: new high-speed USB device number 37 using dummy_hcd [ 507.380555][ T23] usb 8-1: device descriptor read/64, error -71 [ 507.520843][ T23] usb usb8-port1: attempt power cycle [ 507.960469][ T23] usb 8-1: new high-speed USB device number 38 using dummy_hcd [ 508.040754][ T23] usb 8-1: device descriptor read/8, error -71 [ 508.310817][ T23] usb 8-1: new high-speed USB device number 39 using dummy_hcd [ 508.343172][ T23] usb 8-1: device descriptor read/8, error -71 [ 508.460751][ T23] usb usb8-port1: unable to enumerate USB device [ 508.462592][T12717] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1360'. [ 510.640630][ T5793] Bluetooth: hci1: command 0x0c1a tx timeout [ 510.993408][T12780] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1371'. [ 511.710505][ T5772] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 511.940820][ T5772] usb 3-1: Using ep0 maxpacket: 8 [ 511.990916][ T5772] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 512.060454][ T5772] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 17 [ 512.115313][ T5772] usb 3-1: New USB device found, idVendor=04a5, idProduct=3003, bcdDevice=c8.07 [ 512.182841][ T5772] usb 3-1: New USB device strings: Mfr=209, Product=185, SerialNumber=60 [ 512.208651][ T5772] usb 3-1: Product: syz [ 512.224906][ T5772] usb 3-1: Manufacturer: syz [ 512.239442][ T5772] usb 3-1: SerialNumber: syz [ 512.265627][ T5772] usb 3-1: config 0 descriptor?? [ 513.775138][T12860] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1382'. [ 514.332552][T12872] binder: 12870:12872 ioctl c0306201 200000000080 returned -14 [ 514.534628][ T5772] usb 3-1: USB disconnect, device number 18 [ 516.325734][T12928] binder: 12926:12928 ioctl c0306201 200000000080 returned -14 [ 516.706455][T12939] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1394'. [ 518.028750][T12966] sctp: [Deprecated]: syz.7.1401 (pid 12966) Use of struct sctp_assoc_value in delayed_ack socket option. [ 518.028750][T12966] Use struct sctp_sack_info instead [ 518.052508][T12970] binder: 12967:12970 ioctl c0306201 200000000080 returned -14 [ 518.998298][T12998] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1406'. [ 522.223263][T13074] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1419'. [ 524.428015][T13117] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 524.633361][T13117] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 524.798780][T13117] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 525.057819][T13117] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 525.242320][T13117] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 525.301870][T13117] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 525.374552][T13117] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 525.473905][T13117] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 525.539985][T13153] syzkaller1: entered allmulticast mode [ 525.580093][T13155] netlink: 28 bytes leftover after parsing attributes in process `syz.7.1432'. [ 525.627837][T13155] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1432'. [ 529.646977][T13277] tipc: Started in network mode [ 529.656109][T13277] tipc: Node identity 267366cbb683, cluster identity 4711 [ 529.665724][T13277] tipc: Enabled bearer , priority 0 [ 529.676984][T13277] syzkaller0: entered promiscuous mode [ 529.683649][T13277] syzkaller0: entered allmulticast mode [ 529.729800][T13277] tipc: Resetting bearer [ 529.750166][T13276] tipc: Resetting bearer [ 529.787809][T13276] tipc: Disabling bearer [ 530.351228][ T5827] usb 8-1: new high-speed USB device number 40 using dummy_hcd [ 530.550584][ T5827] usb 8-1: Using ep0 maxpacket: 8 [ 530.578143][ T5827] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 530.618873][ T5827] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 530.642086][ T5827] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 530.653454][ T5827] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 530.677521][ T5827] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 530.707306][ T5827] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 530.983717][ T5827] usb 8-1: usb_control_msg returned -32 [ 531.019473][ T5827] usbtmc 8-1:16.0: can't read capabilities [ 531.063829][ T5827] usb 8-1: USB disconnect, device number 40 [ 532.410817][T13367] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1481'. [ 532.852203][ T5827] usb 8-1: new high-speed USB device number 41 using dummy_hcd [ 533.072025][T13374] lo speed is unknown, defaulting to 1000 [ 533.161362][ T5827] usb 8-1: Using ep0 maxpacket: 8 [ 533.205246][ T5827] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 17 [ 533.234337][ T5827] usb 8-1: New USB device found, idVendor=04a5, idProduct=3003, bcdDevice=c8.07 [ 533.250773][ T5827] usb 8-1: New USB device strings: Mfr=209, Product=185, SerialNumber=60 [ 533.269688][ T5827] usb 8-1: Product: syz [ 533.282312][ T5827] usb 8-1: Manufacturer: syz [ 533.287048][ T5827] usb 8-1: SerialNumber: syz [ 533.317568][ T5827] usb 8-1: config 0 descriptor?? [ 533.654041][ T5827] gspca_main: sunplus-2.14.0 probing 04a5:3003 [ 533.738297][ T5827] gspca_sunplus: reg_w_riv err -71 [ 533.750636][ T5827] sunplus: probe of 8-1:0.0 failed with error -71 [ 533.765576][ T5827] usb 8-1: USB disconnect, device number 41 [ 533.901804][T13394] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1488'. [ 534.628979][T13425] veth0_to_bridge: entered promiscuous mode [ 534.640848][T13424] veth0_to_bridge: left promiscuous mode [ 535.786959][T13451] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 535.818612][T13451] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 535.830025][T13451] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 535.888632][T13451] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 536.508778][T13470] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1503'. [ 536.695285][T13480] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1505'. [ 537.840542][ T5787] Bluetooth: hci0: command 0x0c1a tx timeout [ 537.846983][ T5793] Bluetooth: hci3: command 0x0c1a tx timeout [ 537.920475][ T5793] Bluetooth: hci1: command 0x0c1a tx timeout [ 538.428126][T13507] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 538.459846][T13507] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 538.503951][T13507] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 538.560793][T13507] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 538.864975][T13530] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1517'. [ 538.985615][T13532] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1519'. [ 539.298409][ T2130] usb 8-1: new high-speed USB device number 42 using dummy_hcd [ 539.492160][ T2130] usb 8-1: Using ep0 maxpacket: 8 [ 539.506275][ T2130] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 17 [ 539.533418][ T2130] usb 8-1: New USB device found, idVendor=04a5, idProduct=3003, bcdDevice=c8.07 [ 539.546796][ T2130] usb 8-1: New USB device strings: Mfr=209, Product=185, SerialNumber=60 [ 539.557843][ T2130] usb 8-1: Product: syz [ 539.562783][ T2130] usb 8-1: Manufacturer: syz [ 539.567671][ T2130] usb 8-1: SerialNumber: syz [ 539.576739][ T2130] usb 8-1: config 0 descriptor?? [ 539.600489][ T5793] Bluetooth: hci2: command 0x0c1a tx timeout [ 539.804093][ T2130] gspca_main: sunplus-2.14.0 probing 04a5:3003 [ 539.813697][ T2130] gspca_sunplus: reg_w_riv err -71 [ 539.874129][ T2130] sunplus: probe of 8-1:0.0 failed with error -71 [ 540.292201][ T2130] usb 8-1: USB disconnect, device number 42 [ 540.464205][T13567] netlink: set zone limit has 8 unknown bytes [ 540.486696][ T5793] Bluetooth: hci0: command 0x0c1a tx timeout [ 540.560627][ T5793] Bluetooth: hci3: command 0x0c1a tx timeout [ 540.642701][ T5793] Bluetooth: hci1: command 0x0c1a tx timeout [ 541.033289][T13594] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1531'. [ 543.739746][T13660] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1543'. [ 546.992859][T13721] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1562'. [ 547.364535][T13729] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1566'. [ 547.689503][T13741] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1570'. [ 548.367122][T13743] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1568'. [ 549.889042][T13776] Driver unsupported XDP return value 0 on prog (id 173) dev N/A, expect packet loss! [ 549.905376][T13784] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1579'. [ 550.029239][T13789] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1582'. [ 551.804152][T13837] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1592'. [ 552.529942][T13858] sctp: [Deprecated]: syz.3.1599 (pid 13858) Use of int in maxseg socket option. [ 552.529942][T13858] Use struct sctp_assoc_value instead [ 553.722048][T13886] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1608'. [ 555.412343][T13915] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1617'. [ 555.758706][T13927] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 560.020578][ T23] usb 8-1: new high-speed USB device number 43 using dummy_hcd [ 560.221046][ T23] usb 8-1: Using ep0 maxpacket: 8 [ 560.248261][ T23] usb 8-1: config 0 has 1 interface, different from the descriptor's value: 17 [ 560.272531][ T23] usb 8-1: New USB device found, idVendor=04a5, idProduct=3003, bcdDevice=c8.07 [ 560.292580][ T23] usb 8-1: New USB device strings: Mfr=209, Product=185, SerialNumber=60 [ 560.313897][ T23] usb 8-1: Product: syz [ 560.318140][ T23] usb 8-1: Manufacturer: syz [ 560.350438][ T23] usb 8-1: SerialNumber: syz [ 560.378807][ T23] usb 8-1: config 0 descriptor?? [ 560.861351][ T23] gspca_main: sunplus-2.14.0 probing 04a5:3003 [ 560.869756][ T23] gspca_sunplus: reg_w_riv err -71 [ 560.901407][ T23] sunplus: probe of 8-1:0.0 failed with error -71 [ 560.928324][ T23] usb 8-1: USB disconnect, device number 43 [ 562.569500][T14073] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1659'. [ 563.277791][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.284497][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 564.116558][T14102] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1667'. [ 564.131962][T14102] bridge0: port 3(team0) entered disabled state [ 564.144292][T14102] bridge_slave_1: left allmulticast mode [ 564.158818][T14102] bridge_slave_1: left promiscuous mode [ 564.183607][T14102] bridge0: port 2(bridge_slave_1) entered disabled state [ 564.235001][T14102] : left allmulticast mode [ 564.275335][T14102] : left promiscuous mode [ 564.290653][T14102] bridge0: port 1() entered disabled state [ 564.730906][ T23] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 564.930623][ T23] usb 4-1: Using ep0 maxpacket: 32 [ 565.006805][ T23] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 565.050512][ T23] usb 4-1: config 0 has no interface number 0 [ 565.077629][ T23] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 565.171732][ T23] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 565.181819][ T23] usb 4-1: Product: syz [ 565.186239][ T23] usb 4-1: Manufacturer: syz [ 565.191125][ T23] usb 4-1: SerialNumber: syz [ 565.199699][ T23] usb 4-1: config 0 descriptor?? [ 565.241232][ T23] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 565.581199][ T23] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 565.614795][ T23] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 565.777371][T14140] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1674'. [ 565.971261][ C1] usb 4-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 565.985025][ T5847] usb 4-1: USB disconnect, device number 16 [ 565.992030][T14144] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 566.001037][ T5787] Bluetooth: hci1: command 0x0c1a tx timeout [ 566.024915][ T5847] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 566.068207][T14144] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 566.140928][T14144] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 566.144417][ T5847] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 566.147137][T14144] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 566.415573][ T5847] quatech2 4-1:0.51: device disconnected [ 568.010698][ T5793] Bluetooth: hci0: command 0x0c1a tx timeout [ 568.010770][ T5787] Bluetooth: hci2: command 0x0c1a tx timeout [ 568.302095][ T5787] Bluetooth: hci1: command 0x0c1a tx timeout [ 568.302291][ T5793] Bluetooth: hci3: command 0x0c1a tx timeout [ 569.460651][T14184] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 569.569552][T14184] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 569.640288][T14184] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 569.700681][T14184] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 570.839053][ T5793] Bluetooth: hci2: command 0x0c1a tx timeout [ 571.601285][ T5793] Bluetooth: hci0: command 0x0c1a tx timeout [ 571.680738][ T5793] Bluetooth: hci3: command 0x0c1a tx timeout [ 571.760755][ T5793] Bluetooth: hci1: command 0x0c1a tx timeout [ 576.811542][T14414] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1702'. [ 577.450887][ T5864] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 577.680930][ T5864] usb 5-1: Using ep0 maxpacket: 8 [ 577.708018][ T5864] usb 5-1: New USB device found, idVendor=10c4, idProduct=8244, bcdDevice=dc.00 [ 577.750794][ T5864] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 577.758846][ T5864] usb 5-1: Product: syz [ 577.789723][ T5864] usb 5-1: Manufacturer: syz [ 577.811498][ T5864] usb 5-1: SerialNumber: syz [ 577.838323][ T5864] usb 5-1: config 0 descriptor?? [ 578.839868][T14489] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1720'. [ 579.712784][T14508] tipc: Can't bind to reserved service type 0 [ 579.787019][T14482] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 579.796020][T14482] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 579.817571][T14482] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 579.841860][T14482] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 580.235669][ T23] usb 5-1: USB disconnect, device number 12 [ 580.800534][ T5793] Bluetooth: hci2: command 0x0c1a tx timeout [ 580.882383][T14531] veth0_to_bridge: entered promiscuous mode [ 580.937692][T14528] veth0_to_bridge: left promiscuous mode [ 581.519955][T14553] !: renamed from dummy0 (while UP) [ 581.841332][T14555] lo speed is unknown, defaulting to 1000 [ 581.847586][ T5793] Bluetooth: hci0: command 0x0c1a tx timeout [ 581.847606][ T5787] Bluetooth: hci1: command 0x0c1a tx timeout [ 581.853820][ T5793] Bluetooth: hci3: command 0x0c1a tx timeout [ 582.087691][T14583] sctp: [Deprecated]: syz.7.1744 (pid 14583) Use of int in maxseg socket option. [ 582.087691][T14583] Use struct sctp_assoc_value instead [ 584.846069][ T5846] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 585.070470][ T5846] usb 4-1: Using ep0 maxpacket: 8 [ 585.087855][ T5846] usb 4-1: New USB device found, idVendor=10c4, idProduct=8244, bcdDevice=dc.00 [ 585.118611][ T5846] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 585.147362][ T5846] usb 4-1: Product: syz [ 585.157736][ T5846] usb 4-1: Manufacturer: syz [ 585.160747][T14655] veth0_to_bridge: entered promiscuous mode [ 585.169602][T14654] veth0_to_bridge: left promiscuous mode [ 585.179839][ T5846] usb 4-1: SerialNumber: syz [ 585.221960][ T5846] usb 4-1: config 0 descriptor?? [ 585.232873][ T5846] radio-usb-si4713 4-1:0.0: Si4713 development board discovered: (10C4:8244) [ 585.858834][ T5846] radio-usb-si4713: probe of 4-1:0.0 failed with error -71 [ 585.905407][ T5846] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 586.037799][ T5846] usb 4-1: USB disconnect, device number 17 [ 586.470127][T14688] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1772'. [ 586.781745][T14688] bridge1: port 1(veth3) entered blocking state [ 586.788150][T14688] bridge1: port 1(veth3) entered disabled state [ 586.816189][T14688] veth3: entered allmulticast mode [ 586.827640][T14688] veth3: entered promiscuous mode [ 586.914112][T14690] bridge1: port 2(veth0_to_bond) entered blocking state [ 586.979639][T14690] bridge1: port 2(veth0_to_bond) entered disabled state [ 587.006704][T14690] veth0_to_bond: entered allmulticast mode [ 587.035764][T14690] veth0_to_bond: entered promiscuous mode [ 587.119453][T14696] vlan2: entered allmulticast mode [ 587.148368][T14696] veth0_to_hsr: entered allmulticast mode [ 587.163901][T14696] bridge1: port 3(vlan2) entered blocking state [ 587.176071][T14696] bridge1: port 3(vlan2) entered disabled state [ 587.195244][T14696] vlan2: entered promiscuous mode [ 587.207970][T14696] veth0_to_hsr: entered promiscuous mode [ 587.488455][T14712] veth0_to_bridge: entered promiscuous mode [ 587.541562][T14710] veth0_to_bridge: left promiscuous mode [ 588.111175][T14727] tipc: Enabled bearer , priority 0 [ 588.149939][T14727] syzkaller0: entered promiscuous mode [ 588.174802][T14727] syzkaller0: entered allmulticast mode [ 588.360085][T14727] tipc: Resetting bearer [ 589.113588][ T5820] tipc: Node number set to 2431674059 [ 589.690688][T14726] tipc: Resetting bearer [ 589.769854][T14726] tipc: Disabling bearer [ 590.400479][T14573] Bluetooth: hci1: command 0x0c1a tx timeout [ 592.168699][T14825] tipc: Enabled bearer , priority 0 [ 592.212940][T14825] syzkaller0: entered promiscuous mode [ 592.220760][T14825] syzkaller0: entered allmulticast mode [ 592.244416][T14825] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 592.281321][T14825] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1813'. [ 592.302504][T14823] tipc: Resetting bearer [ 592.357781][T14823] tipc: Disabling bearer [ 592.500395][T10603] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 592.500430][ T5820] usb 8-1: new high-speed USB device number 44 using dummy_hcd [ 592.704523][ T5820] usb 8-1: Using ep0 maxpacket: 32 [ 592.710715][T10603] usb 4-1: Using ep0 maxpacket: 8 [ 592.713060][ T5820] usb 8-1: config 0 has an invalid interface number: 51 but max is 0 [ 592.736155][ T5820] usb 8-1: config 0 has no interface number 0 [ 592.764280][T10603] usb 4-1: New USB device found, idVendor=10c4, idProduct=8244, bcdDevice=dc.00 [ 592.791096][T10603] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 592.799806][T10603] usb 4-1: Product: syz [ 592.805129][T10603] usb 4-1: Manufacturer: syz [ 592.810656][T10603] usb 4-1: SerialNumber: syz [ 592.835724][T10603] usb 4-1: config 0 descriptor?? [ 592.855225][T10603] radio-usb-si4713 4-1:0.0: Si4713 development board discovered: (10C4:8244) [ 592.855731][ T5820] usb 8-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 592.923077][ T5820] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 592.933525][ T5820] usb 8-1: Product: syz [ 592.952320][ T5820] usb 8-1: Manufacturer: syz [ 592.995178][ T5820] usb 8-1: SerialNumber: syz [ 593.178127][ T5820] usb 8-1: config 0 descriptor?? [ 593.296015][ T5820] quatech2 8-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 593.487064][ T5820] usb 8-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 593.526548][ T5820] usb 8-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 593.593223][T10603] radio-usb-si4713: probe of 4-1:0.0 failed with error -71 [ 593.628333][T10603] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 593.658682][T10603] usb 4-1: USB disconnect, device number 18 [ 593.926387][ C0] usb 8-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 593.927433][T10602] usb 8-1: USB disconnect, device number 44 [ 593.958016][T10602] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 594.002897][T10602] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 594.016040][T10602] quatech2 8-1:0.51: device disconnected [ 594.031327][ T5820] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 594.231061][ T5820] usb 5-1: Using ep0 maxpacket: 8 [ 594.247858][ T5820] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 17 [ 594.269825][ T5820] usb 5-1: New USB device found, idVendor=04a5, idProduct=3003, bcdDevice=c8.07 [ 594.289375][ T5820] usb 5-1: New USB device strings: Mfr=209, Product=185, SerialNumber=60 [ 594.304403][ T5820] usb 5-1: Product: syz [ 594.319014][ T5820] usb 5-1: Manufacturer: syz [ 594.346137][ T5820] usb 5-1: SerialNumber: syz [ 594.376941][ T5820] usb 5-1: config 0 descriptor?? [ 594.905447][ T5820] gspca_main: sunplus-2.14.0 probing 04a5:3003 [ 595.090043][ T5820] gspca_sunplus: reg_w_riv err -71 [ 595.149545][ T5820] sunplus: probe of 5-1:0.0 failed with error -71 [ 595.344178][ T5820] usb 5-1: USB disconnect, device number 13 [ 597.770695][ T5782] Bluetooth: hci1: command 0x0c1a tx timeout [ 598.651595][T14986] tipc: Started in network mode [ 598.661308][T14986] tipc: Node identity ea2c83e3f697, cluster identity 4711 [ 598.668648][T14986] tipc: Enabled bearer , priority 0 [ 598.731998][T14980] tipc: Resetting bearer [ 598.812512][T14979] tipc: Disabling bearer [ 599.020534][ T5772] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 599.240510][ T5772] usb 3-1: Using ep0 maxpacket: 32 [ 599.274607][ T5772] usb 3-1: config 0 has an invalid interface number: 51 but max is 0 [ 599.293533][ T5772] usb 3-1: config 0 has no interface number 0 [ 599.316415][ T5772] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 599.340401][ T5772] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 599.348463][ T5772] usb 3-1: Product: syz [ 599.372237][ T5772] usb 3-1: Manufacturer: syz [ 599.379088][ T5772] usb 3-1: SerialNumber: syz [ 599.388789][ T5772] usb 3-1: config 0 descriptor?? [ 599.432936][ T5772] quatech2 3-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 599.653925][ T5772] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 599.702262][ T5772] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 600.080858][ T5782] Bluetooth: hci1: command 0x0c1a tx timeout [ 600.091082][ C1] usb 3-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 600.100076][ T5772] usb 3-1: USB disconnect, device number 19 [ 600.114246][ T5772] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 600.149572][ T5772] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 600.164788][ T5772] quatech2 3-1:0.51: device disconnected [ 600.492368][T15053] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1870'. [ 600.797412][T15058] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 601.375889][T15090] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1881'. [ 601.448403][T15090] bridge2: port 1(veth5) entered blocking state [ 601.455518][T15090] bridge2: port 1(veth5) entered disabled state [ 601.462885][T15090] veth5: entered allmulticast mode [ 601.486403][T15090] veth5: entered promiscuous mode [ 601.532753][T15097] veth0_to_bond: left allmulticast mode [ 601.559406][T15097] veth0_to_bond: left promiscuous mode [ 601.592060][T15097] bridge1: port 2(veth0_to_bond) entered disabled state [ 601.654915][T15097] bridge2: port 2(veth0_to_bond) entered blocking state [ 601.671075][T15097] bridge2: port 2(veth0_to_bond) entered disabled state [ 601.702344][T15097] veth0_to_bond: entered allmulticast mode [ 601.725015][T15097] veth0_to_bond: entered promiscuous mode [ 601.764132][T15111] syzkaller0: entered promiscuous mode [ 601.769669][T15111] syzkaller0: entered allmulticast mode [ 601.827655][T15085] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1880'. [ 601.906728][T15111] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 601.967546][T15106] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1884'. [ 602.161005][T14573] Bluetooth: hci1: command 0x0c1a tx timeout [ 602.693244][T15143] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1895'. [ 602.851884][T15143] bridge3: port 1(veth7) entered blocking state [ 602.858278][T15143] bridge3: port 1(veth7) entered disabled state [ 602.922157][T15143] veth7: entered allmulticast mode [ 602.928784][T15143] veth7: entered promiscuous mode [ 602.992465][T15151] veth0_to_bond: left allmulticast mode [ 602.998085][T15151] veth0_to_bond: left promiscuous mode [ 603.030740][T15151] bridge2: port 2(veth0_to_bond) entered disabled state [ 603.056526][T15151] bridge3: port 2(veth0_to_bond) entered blocking state [ 603.074277][T15151] bridge3: port 2(veth0_to_bond) entered disabled state [ 603.080094][T15160] netlink: 180 bytes leftover after parsing attributes in process `syz.7.1900'. [ 603.092799][T15151] veth0_to_bond: entered allmulticast mode [ 603.108702][T15160] NCSI netlink: No device for ifindex 0 [ 603.112296][T15151] veth0_to_bond: entered promiscuous mode [ 603.145598][T15152] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1896'. [ 603.181582][T15157] veth0_to_bridge: entered promiscuous mode [ 603.189496][T15156] veth0_to_bridge: left promiscuous mode [ 603.810916][T15186] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1905'. [ 603.895930][T15191] A link change request failed with some changes committed already. Interface wg0 may have been left with an inconsistent configuration, please check. [ 604.118799][T15198] netlink: 12 bytes leftover after parsing attributes in process `syz.7.1910'. [ 604.178396][T15200] veth0_to_bridge: entered promiscuous mode [ 604.194422][T15199] veth0_to_bridge: left promiscuous mode [ 604.262286][T15198] bridge1: port 1(veth3) entered blocking state [ 604.310134][T15198] bridge1: port 1(veth3) entered disabled state [ 604.329903][T15198] veth3: entered allmulticast mode [ 604.358280][T15198] veth3: entered promiscuous mode [ 604.441340][T15207] bridge1: port 2(veth0_to_bond) entered blocking state [ 604.487494][T15207] bridge1: port 2(veth0_to_bond) entered disabled state [ 604.520696][T15207] veth0_to_bond: entered allmulticast mode [ 604.539658][T15207] veth0_to_bond: entered promiscuous mode [ 604.630154][T15211] vlan2: entered allmulticast mode [ 604.653837][T15211] veth0_to_hsr: entered allmulticast mode [ 604.697088][T15227] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1916'. [ 605.053287][T15241] veth0_to_bridge: entered promiscuous mode [ 605.071882][T15240] veth0_to_bridge: left promiscuous mode [ 610.100111][T15302] tipc: Enabled bearer , priority 0 [ 610.202315][T15303] syzkaller0: entered promiscuous mode [ 610.208064][T15303] syzkaller0: entered allmulticast mode [ 610.478323][T15302] tipc: Resetting bearer [ 610.718084][T15301] tipc: Resetting bearer [ 610.811850][T15301] tipc: Disabling bearer [ 611.496103][T15344] __nla_validate_parse: 2 callbacks suppressed [ 611.496120][T15344] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1952'. [ 611.569984][T15344] netlink: set zone limit has 8 unknown bytes [ 614.117086][T15364] netlink: set zone limit has 8 unknown bytes [ 614.337554][T15367] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1954'. [ 614.545140][T15367] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 614.552717][T15367] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 614.599252][T15367] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 614.610395][T15367] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 614.968324][T15389] tipc: Enabled bearer , priority 0 [ 614.995291][T15389] syzkaller0: entered promiscuous mode [ 615.021279][T15389] syzkaller0: entered allmulticast mode [ 615.085938][T15389] tipc: Resetting bearer [ 615.113935][T15387] tipc: Resetting bearer [ 615.219927][T15387] tipc: Disabling bearer [ 616.678182][T15419] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 616.688105][T15435] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1969'. [ 616.688919][T15419] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 616.723830][T15419] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 616.734369][T15419] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 617.690482][T14573] Bluetooth: hci2: command 0x0c1a tx timeout [ 617.946193][T15477] netlink: 212 bytes leftover after parsing attributes in process `syz.2.1980'. [ 618.724719][T14573] Bluetooth: hci0: command 0x0c1a tx timeout [ 618.801870][T14573] Bluetooth: hci1: command 0x0c1a tx timeout [ 618.802236][ T5782] Bluetooth: hci3: command 0x0c1a tx timeout [ 618.871179][T15480] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 618.945076][T15480] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 618.958861][T15480] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 619.253591][T15480] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 619.346354][T15487] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 619.727971][T15517] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1993'. [ 619.813349][T15517] bridge1: port 1(veth3) entered blocking state [ 619.822363][T15517] bridge1: port 1(veth3) entered disabled state [ 619.833456][T15517] veth3: entered allmulticast mode [ 619.856291][T15517] veth3: entered promiscuous mode [ 619.879341][T15523] vlan2: entered allmulticast mode [ 619.908913][T15523] veth0_to_hsr: entered allmulticast mode [ 619.932825][T15523] bridge1: port 2(vlan2) entered blocking state [ 619.940104][T15523] bridge1: port 2(vlan2) entered disabled state [ 619.955468][T15523] vlan2: entered promiscuous mode [ 619.975401][T15523] veth0_to_hsr: entered promiscuous mode [ 620.160517][ T5782] Bluetooth: hci2: command 0x0c1a tx timeout [ 620.960803][ T5782] Bluetooth: hci3: command 0x0c1a tx timeout [ 620.980860][ T5782] Bluetooth: hci0: command 0x0c1a tx timeout [ 621.197048][T15540] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 621.204243][T15540] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 621.227809][T15540] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 621.280761][ T5782] Bluetooth: hci1: command 0x0c1a tx timeout [ 621.332440][T15540] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 621.389592][T15544] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 623.280561][ T5782] Bluetooth: hci3: command 0x0c1a tx timeout [ 623.289924][T14573] Bluetooth: hci0: command 0x0c1a tx timeout [ 623.360527][ T5782] Bluetooth: hci1: command 0x0c1a tx timeout [ 623.620452][T15589] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 623.626866][T15589] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 623.708414][T15589] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 623.722559][T15589] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 624.124596][T15639] tipc: Enabling of bearer rejected, failed to enable media [ 624.322100][ T5782] Bluetooth: hci2: command 0x0c1a tx timeout [ 624.372389][T15650] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2024'. [ 624.647483][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.654009][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 625.690551][ T5782] Bluetooth: hci0: command 0x0c1a tx timeout [ 625.761872][ T5782] Bluetooth: hci1: command 0x0c1a tx timeout [ 625.764561][T14573] Bluetooth: hci3: command 0x0c1a tx timeout [ 625.892452][T15657] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 625.909317][T15657] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 625.927779][T15657] bond0 (unregistering): Released all slaves [ 626.051451][T15668] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 626.060768][T15668] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 626.093869][T15668] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 626.127770][T15668] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 628.090725][T14573] Bluetooth: hci0: command 0x0c1a tx timeout [ 628.096973][T14573] Bluetooth: hci2: command 0x0c1a tx timeout [ 628.170791][T14573] Bluetooth: hci1: command 0x0c1a tx timeout [ 628.176448][ T5782] Bluetooth: hci3: command 0x0c1a tx timeout [ 630.671647][T15716] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 630.689790][T15716] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 630.705731][T15716] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 630.735335][T15716] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 630.961512][T15747] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2050'. [ 631.132094][T15754] vlan3: entered allmulticast mode [ 631.189442][T15754] bond1: entered allmulticast mode [ 632.519840][T15781] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 632.570362][T15810] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2065'. [ 632.608062][T15781] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 632.637055][T15781] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 632.650603][T15781] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 634.251367][T15848] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 634.266754][T15848] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 634.284566][T15848] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 634.315800][T15848] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 634.474308][T15879] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2083'. [ 636.025748][T15913] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 636.061900][T15913] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 636.088111][T15913] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 636.123684][T15913] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 637.287695][T14573] Bluetooth: hci2: command 0x0c1a tx timeout [ 637.692021][T15977] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 637.698133][T15977] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 637.771875][T15977] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 637.777956][T15977] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 637.924001][T15993] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2110'. [ 639.339014][T16022] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 639.362602][T16022] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 639.371951][T16022] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 639.379937][T16022] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 640.262576][T16083] tipc: Enabled bearer , priority 0 [ 640.284538][T16083] tipc: Resetting bearer [ 640.316716][T16082] tipc: Disabling bearer [ 640.640865][ T5782] Bluetooth: hci2: command 0x0c1a tx timeout [ 641.193111][T16100] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 641.217859][T16100] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 641.246587][T16100] bond0 (unregistering): Released all slaves [ 641.313525][T16117] netlink: 'syz.7.2144': attribute type 1 has an invalid length. [ 641.406814][T16117] bond1: entered promiscuous mode [ 641.412780][T16117] 8021q: adding VLAN 0 to HW filter on device bond1 [ 641.440601][T14573] Bluetooth: hci3: command 0x0c1a tx timeout [ 641.446694][T14573] Bluetooth: hci0: command 0x0c1a tx timeout [ 641.453078][ T5782] Bluetooth: hci1: command 0x0c1a tx timeout [ 641.501143][T16120] bond1: (slave bridge2): making interface the new active one [ 641.508828][T16120] bridge2: entered promiscuous mode [ 641.517255][T16120] bond1: (slave bridge2): Enslaving as an active interface with an up link [ 641.652308][T16133] tipc: Enabled bearer , priority 0 [ 641.705683][T16133] tipc: Resetting bearer [ 641.819406][T16132] tipc: Disabling bearer [ 642.505332][T16152] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 642.535504][T16152] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 642.551482][T16152] bond0 (unregistering): Released all slaves [ 643.520613][T14573] Bluetooth: hci1: command 0x0c1a tx timeout [ 645.600771][T14573] Bluetooth: hci1: command 0x0c1a tx timeout [ 646.056805][T16341] syzkaller0: entered promiscuous mode [ 646.062497][T16341] syzkaller0: entered allmulticast mode [ 647.207409][T16385] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2226'. [ 647.376922][T16394] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2227'. [ 647.680605][T14573] Bluetooth: hci1: command 0x0c1a tx timeout [ 648.017085][T16417] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2238'. [ 649.845881][T14573] Bluetooth: hci1: command 0x0c1a tx timeout [ 650.361738][T16427] veth0_to_bond: left allmulticast mode [ 650.443435][T16427] veth0_to_bond: left promiscuous mode [ 650.573329][T16427] bridge3: port 2(veth0_to_bond) entered disabled state [ 651.616920][T16440] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2243'. [ 651.766764][T16451] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2247'. [ 651.920618][T14573] Bluetooth: hci1: command 0x0c1a tx timeout [ 651.966417][T16462] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2249'. [ 652.720523][T16496] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2259'. [ 653.010417][T16508] netlink: 180 bytes leftover after parsing attributes in process `syz.2.2266'. [ 653.019738][T16508] NCSI netlink: No device for ifindex 0 [ 653.305659][T16503] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 653.332707][T16503] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 653.344977][T16503] bond0 (unregistering): Released all slaves [ 653.743371][T16531] netlink: 'syz.2.2275': attribute type 4 has an invalid length. [ 653.780652][T16531] netlink: 136 bytes leftover after parsing attributes in process `syz.2.2275'. [ 654.000502][T14573] Bluetooth: hci1: command 0x0c1a tx timeout [ 654.188580][T16549] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2280'. [ 654.401954][T16555] netlink: 'syz.4.2278': attribute type 1 has an invalid length. [ 654.409976][T16555] netlink: 'syz.4.2278': attribute type 1 has an invalid length. [ 654.445795][T16555] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2278'. [ 654.506329][T16558] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2284'. [ 654.541257][T16558] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2284'. [ 654.558511][T16558] macsec1: entered promiscuous mode [ 654.591152][T16558] macsec1: entered allmulticast mode [ 654.627527][T16558] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2284'. [ 654.709868][T16565] netlink: 'syz.4.2287': attribute type 4 has an invalid length. [ 654.740450][T16565] netlink: 136 bytes leftover after parsing attributes in process `syz.4.2287'. [ 654.971745][T16567] smc: net device bond0 applied user defined pnetid SYZ2 [ 655.026300][T16580] smc: net device bond0 erased user defined pnetid SYZ2 [ 655.267545][T16590] tipc: Enabling of bearer rejected, failed to enable media [ 655.572667][T16606] netlink: 'syz.4.2298': attribute type 4 has an invalid length. [ 655.609864][T16606] netlink: 136 bytes leftover after parsing attributes in process `syz.4.2298'. [ 656.069295][T16629] smc: net device bond0 applied user defined pnetid SYZ2 [ 656.080997][T14573] Bluetooth: hci1: command 0x0c1a tx timeout [ 656.089354][T16629] smc: net device bond0 erased user defined pnetid SYZ2 [ 656.211413][T16636] netlink: 'syz.3.2309': attribute type 4 has an invalid length. [ 656.327166][T16642] tipc: Enabling of bearer rejected, failed to enable media [ 656.832605][T16663] syzkaller0: entered promiscuous mode [ 656.838272][T16663] syzkaller0: entered allmulticast mode [ 656.848932][T16663] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 656.954319][T16667] syzkaller0: entered promiscuous mode [ 656.959991][T16667] syzkaller0: entered allmulticast mode [ 657.112040][T16669] bridge2: port 1(veth5) entered blocking state [ 657.120478][T16669] bridge2: port 1(veth5) entered disabled state [ 657.126909][T16669] veth5: entered allmulticast mode [ 657.144198][T16669] veth5: entered promiscuous mode [ 657.174936][T16672] bridge2: port 2(veth0_to_bond) entered blocking state [ 657.185524][T16672] bridge2: port 2(veth0_to_bond) entered disabled state [ 657.204028][T16672] veth0_to_bond: entered allmulticast mode [ 657.219692][T16672] veth0_to_bond: entered promiscuous mode [ 658.082502][T16700] syzkaller0: entered promiscuous mode [ 658.088233][T16700] syzkaller0: entered allmulticast mode [ 658.161153][T14573] Bluetooth: hci1: command 0x0c1a tx timeout [ 658.245501][T16702] __nla_validate_parse: 6 callbacks suppressed [ 658.245516][T16702] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2331'. [ 658.287196][T16702] bridge0: port 1(veth5) entered blocking state [ 658.298662][T16702] bridge0: port 1(veth5) entered disabled state [ 658.306056][T16702] veth5: entered allmulticast mode [ 658.315265][T16702] veth5: entered promiscuous mode [ 658.334643][T16705] bridge0: port 2(veth0_to_bond) entered blocking state [ 658.349600][T16705] bridge0: port 2(veth0_to_bond) entered disabled state [ 658.357375][T16705] veth0_to_bond: entered allmulticast mode [ 658.364983][T16705] veth0_to_bond: entered promiscuous mode [ 658.387392][T16702] vlan0: entered allmulticast mode [ 658.392917][T16702] veth0_to_hsr: entered allmulticast mode [ 658.398939][T16702] bridge0: port 3(vlan0) entered blocking state [ 658.405953][T16702] bridge0: port 3(vlan0) entered disabled state [ 658.418450][T16702] vlan0: entered promiscuous mode [ 658.423868][T16702] veth0_to_hsr: entered promiscuous mode [ 658.933020][T16734] syzkaller0: entered promiscuous mode [ 658.944687][T16734] syzkaller0: entered allmulticast mode [ 659.180147][T16743] netlink: 'syz.3.2342': attribute type 7 has an invalid length. [ 659.193841][T16743] netlink: 'syz.3.2342': attribute type 8 has an invalid length. [ 659.202154][T16743] netlink: 'syz.3.2342': attribute type 15 has an invalid length. [ 659.550253][T16756] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2346'. [ 659.577029][T16756] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 660.216947][T16793] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2357'. [ 660.240617][T14573] Bluetooth: hci1: command 0x0c1a tx timeout [ 660.558648][T16804] bond0 (unregistering): Released all slaves [ 661.413824][T16837] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2375'. [ 661.728221][T16854] netlink: 'syz.4.2379': attribute type 4 has an invalid length. [ 661.747028][T16854] netlink: 136 bytes leftover after parsing attributes in process `syz.4.2379'. [ 662.320452][ T5782] Bluetooth: hci1: command 0x0c1a tx timeout [ 662.377954][T16882] netlink: 'syz.2.2389': attribute type 4 has an invalid length. [ 662.386069][T16882] netlink: 136 bytes leftover after parsing attributes in process `syz.2.2389'. [ 662.478591][T16884] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2391'. [ 662.747707][T16898] Bluetooth: MGMT ver 1.22 [ 663.231537][T16912] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2401'. [ 664.032268][T16949] veth1_macvtap: left promiscuous mode [ 664.053581][T16949] netlink: 120 bytes leftover after parsing attributes in process `syz.7.2416'. [ 664.131877][T16955] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2412'. [ 664.413220][T14573] Bluetooth: hci1: command 0x0c1a tx timeout [ 664.807343][T16984] bond0 (unregistering): Released all slaves [ 665.305111][T17006] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2435'. [ 665.374084][T17009] tipc: Started in network mode [ 665.380188][T17009] tipc: Node identity 080211000001, cluster identity 4711 [ 665.389259][T17009] tipc: Enabled bearer , priority 0 [ 665.402492][T17009] mac80211_hwsim hwsim27 syzkaller0: entered promiscuous mode [ 665.411620][T17009] mac80211_hwsim hwsim27 syzkaller0: entered allmulticast mode [ 665.436139][T17009] tipc: Resetting bearer [ 666.329066][T17039] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2449'. [ 666.420913][ T5820] tipc: Node number set to 134418688 [ 666.480859][ T5782] Bluetooth: hci1: command 0x0c1a tx timeout [ 666.779590][T17061] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2455'. [ 667.030872][T17072] tipc: Enabling of bearer rejected, failed to enable media [ 667.053828][T17072] syzkaller0: entered promiscuous mode [ 667.059347][T17072] syzkaller0: entered allmulticast mode [ 667.074626][T17072] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 667.113554][T17072] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2460'. [ 668.065804][T17118] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2473'. [ 668.561168][ T5782] Bluetooth: hci1: command 0x0c1a tx timeout [ 669.476963][T17165] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 669.713200][T17177] netlink: 180 bytes leftover after parsing attributes in process `syz.7.2499'. [ 669.844631][T17184] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2502'. [ 670.486232][T17212] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2516'. [ 670.626752][T17218] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2517'. [ 670.643521][ T5782] Bluetooth: hci1: command 0x0c1a tx timeout [ 670.885876][T17233] netlink: 16 bytes leftover after parsing attributes in process `syz.7.2524'. [ 671.278494][T17249] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2531'. [ 671.733889][T17265] tipc: Enabled bearer , priority 0 [ 671.766865][T17265] tipc: Resetting bearer [ 671.792586][T17264] tipc: Disabling bearer [ 672.038989][T17277] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2541'. [ 672.730607][ T5782] Bluetooth: hci1: command 0x0c1a tx timeout [ 672.939856][T17298] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2548'. [ 674.338224][T17351] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2564'. [ 674.342166][T17352] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2566'. [ 674.399197][T17352] veth0_to_bond: left allmulticast mode [ 674.417667][T17352] veth0_to_bond: left promiscuous mode [ 674.427595][T17352] bridge1: port 2(veth0_to_bond) entered disabled state [ 674.458960][T17352] vlan2: entered allmulticast mode [ 675.105635][T17382] __nla_validate_parse: 1 callbacks suppressed [ 675.105651][T17382] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2575'. [ 675.314666][T17392] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2579'. [ 675.563780][T17400] tipc: Enabling of bearer rejected, failed to enable media [ 675.578388][T17400] syzkaller0: entered promiscuous mode [ 675.584932][T17400] syzkaller0: entered allmulticast mode [ 675.595138][T17400] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 675.619761][T17400] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2583'. [ 675.785924][T17407] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2585'. [ 675.846150][ T5782] Bluetooth: hci1: command 0x0c1a tx timeout [ 676.959664][T17440] netlink: 'syz.2.2597': attribute type 7 has an invalid length. [ 676.968658][T17440] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2597'. [ 677.073420][T17425] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 677.087640][T17425] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 677.096968][T17425] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 677.105933][T17425] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 677.422920][T17457] netlink: 32 bytes leftover after parsing attributes in process `syz.7.2605'. [ 678.903030][T17481] netlink: set zone limit has 8 unknown bytes [ 678.914949][T17481] tipc: Failed to remove unknown binding: 66,1,1/0:2623714544/2623714546 [ 678.932121][T17481] tipc: Failed to remove unknown binding: 66,1,1/0:2623714544/2623714546 [ 678.944598][T17484] netlink: 20 bytes leftover after parsing attributes in process `syz.7.2615'. [ 678.955466][T17472] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 678.974142][T17472] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 678.985051][T17481] tipc: Failed to remove unknown binding: 66,1,1/0:2623714544/2623714546 [ 679.000516][T17472] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 679.006620][T17472] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 679.066655][T17481] netlink: 788 bytes leftover after parsing attributes in process `syz.3.2613'. [ 679.840044][T17517] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2626'. [ 680.789759][T17519] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 680.826158][T17519] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 680.850694][T17519] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 680.880083][T17519] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 680.971554][T17540] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2635'. [ 681.065737][T17544] bpq0: entered promiscuous mode [ 681.244143][T17554] smc: net device bond0 applied user defined pnetid SYZ2 [ 681.256139][T17554] smc: net device bond0 erased user defined pnetid SYZ2 [ 681.526172][T17561] netlink: 'syz.4.2641': attribute type 1 has an invalid length. [ 681.534807][T17561] netlink: 'syz.4.2641': attribute type 1 has an invalid length. [ 681.567511][T17561] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2641'. [ 681.778876][T17568] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2645'. [ 682.005675][T14573] Bluetooth: hci2: command 0x0c1a tx timeout [ 682.113212][T17577] smc: net device bond0 applied user defined pnetid SYZ2 [ 682.126948][T17577] smc: net device bond0 erased user defined pnetid SYZ2 [ 682.327204][T17592] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2655'. [ 682.883988][T17609] smc: net device bond0 applied user defined pnetid SYZ2 [ 682.892869][ T5782] Bluetooth: hci3: command 0x0c1a tx timeout [ 682.899319][ T5793] Bluetooth: hci0: command 0x0c1a tx timeout [ 682.920340][T14573] Bluetooth: hci1: command 0x0c1a tx timeout [ 682.929444][T17609] smc: net device bond0 erased user defined pnetid SYZ2 [ 683.280612][T17623] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2668'. [ 684.347235][T17650] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2678'. [ 684.356793][T17650] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2678'. [ 684.964694][T14573] Bluetooth: hci1: command 0x0c1a tx timeout [ 685.097935][T17679] smc: net device bond0 applied user defined pnetid SYZ2 [ 685.140913][T17679] smc: net device bond0 erased user defined pnetid SYZ2 [ 685.841587][T17713] netlink: 'syz.2.2695': attribute type 1 has an invalid length. [ 685.870562][T17713] netlink: 'syz.2.2695': attribute type 1 has an invalid length. [ 685.878452][T17713] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2695'. [ 686.087993][ C1] ================================================================== [ 686.096113][ C1] BUG: KASAN: slab-use-after-free in rose_timer_expiry+0x46a/0x4b0 [ 686.104145][ C1] Read of size 2 at addr ffff88805f9e482a by task syz-executor/17721 [ 686.112234][ C1] [ 686.114583][ C1] CPU: 1 PID: 17721 Comm: syz-executor Not tainted 6.6.102-syzkaller #0 [ 686.122935][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 686.133089][ C1] Call Trace: [ 686.136359][ C1] [ 686.139194][ C1] dump_stack_lvl+0x16c/0x230 [ 686.143870][ C1] ? __lock_acquire+0x7c80/0x7c80 [ 686.148891][ C1] ? show_regs_print_info+0x20/0x20 [ 686.154082][ C1] ? load_image+0x3b0/0x3b0 [ 686.158582][ C1] ? _raw_spin_lock_irqsave+0xb4/0xf0 [ 686.163965][ C1] ? __virt_addr_valid+0x18c/0x540 [ 686.169069][ C1] ? __virt_addr_valid+0x469/0x540 [ 686.174182][ C1] print_report+0xac/0x220 [ 686.178672][ C1] ? rose_timer_expiry+0x46a/0x4b0 [ 686.183775][ C1] kasan_report+0x117/0x150 [ 686.188362][ C1] ? rose_timer_expiry+0x46a/0x4b0 [ 686.193467][ C1] rose_timer_expiry+0x46a/0x4b0 [ 686.198395][ C1] call_timer_fn+0x16e/0x530 [ 686.203056][ C1] ? rose_start_t1timer+0xd0/0xd0 [ 686.208070][ C1] ? call_timer_fn+0xbf/0x530 [ 686.212876][ C1] ? __run_timers+0x7d0/0x7d0 [ 686.217583][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 686.222876][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 686.228066][ C1] ? rose_start_t1timer+0xd0/0xd0 [ 686.233102][ C1] __run_timers+0x52d/0x7d0 [ 686.237612][ C1] ? detach_timer+0x2b0/0x2b0 [ 686.242384][ C1] ? lock_chain_count+0x20/0x20 [ 686.247322][ C1] run_timer_softirq+0x67/0xf0 [ 686.252085][ C1] handle_softirqs+0x280/0x820 [ 686.256845][ C1] ? __irq_exit_rcu+0xc7/0x190 [ 686.261769][ C1] ? do_softirq+0x180/0x180 [ 686.266263][ C1] ? irqtime_account_irq+0xb6/0x1c0 [ 686.271549][ C1] __irq_exit_rcu+0xc7/0x190 [ 686.276130][ C1] ? irq_exit_rcu+0x20/0x20 [ 686.280621][ C1] irq_exit_rcu+0x9/0x20 [ 686.285036][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 686.290841][ C1] [ 686.293871][ C1] [ 686.296813][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 686.302807][ C1] RIP: 0010:preempt_count_add+0xa6/0x1a0 [ 686.308446][ C1] Code: ff ff ff 7f 39 f8 75 42 48 8b 5c 24 18 48 89 df e8 ef d2 0c 00 85 c0 74 09 31 db 31 ff e8 e2 d2 0c 00 65 4c 8b 35 1a 50 a8 7e <49> 81 c6 c8 14 00 00 4c 89 f0 48 c1 e8 03 42 80 3c 38 00 74 08 4c [ 686.328053][ C1] RSP: 0018:ffffc90003597830 EFLAGS: 00000246 [ 686.334301][ C1] RAX: 0000000000000000 RBX: ffffffff813aa37e RCX: ffffffff96eaa400 [ 686.342401][ C1] RDX: ffff888079d19e00 RSI: 0000000000000001 RDI: ffffffff813aa37e [ 686.350389][ C1] RBP: 0000000000000001 R08: ffffc90003597901 R09: 0000000000000000 [ 686.358367][ C1] R10: ffffc90003597988 R11: fffff520006b2f3d R12: ffffc90003597988 [ 686.366351][ C1] R13: dffffc0000000000 R14: ffff888079d19e00 R15: dffffc0000000000 [ 686.374331][ C1] ? unwind_next_frame+0xbe/0x2970 [ 686.379452][ C1] ? unwind_next_frame+0xbe/0x2970 [ 686.384561][ C1] ? __unwind_start+0x2d2/0x7e0 [ 686.389406][ C1] unwind_next_frame+0xbe/0x2970 [ 686.394374][ C1] ? __lock_acquire+0x1334/0x7c80 [ 686.399401][ C1] ? dput+0x3b/0x1e0 [ 686.403299][ C1] __unwind_start+0x66a/0x7e0 [ 686.407983][ C1] ? stack_trace_save+0xe0/0xe0 [ 686.412841][ C1] arch_stack_walk+0xf8/0x190 [ 686.417525][ C1] ? __unwind_start+0x2d2/0x7e0 [ 686.422378][ C1] stack_trace_save+0x9c/0xe0 [ 686.427145][ C1] ? stack_trace_snprint+0xf0/0xf0 [ 686.432249][ C1] kasan_set_track+0x4e/0x70 [ 686.436850][ C1] ? kmem_cache_free+0xf8/0x280 [ 686.441692][ C1] kasan_save_free_info+0x2e/0x50 [ 686.446707][ C1] ____kasan_slab_free+0x126/0x1e0 [ 686.451806][ C1] slab_free_freelist_hook+0x130/0x1b0 [ 686.457258][ C1] ? do_sys_openat2+0x168/0x1c0 [ 686.462102][ C1] kmem_cache_free+0xf8/0x280 [ 686.467033][ C1] do_sys_openat2+0x168/0x1c0 [ 686.471765][ C1] ? kmem_cache_free+0xf8/0x280 [ 686.476884][ C1] ? do_sys_open+0xe0/0xe0 [ 686.481289][ C1] ? lockdep_hardirqs_on_prepare+0x400/0x760 [ 686.487259][ C1] ? lock_chain_count+0x20/0x20 [ 686.492096][ C1] ? lock_chain_count+0x20/0x20 [ 686.496945][ C1] __x64_sys_openat+0x139/0x160 [ 686.501784][ C1] do_syscall_64+0x55/0xb0 [ 686.506189][ C1] ? clear_bhb_loop+0x40/0x90 [ 686.510857][ C1] ? clear_bhb_loop+0x40/0x90 [ 686.515519][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 686.521472][ C1] RIP: 0033:0x7ff2c6d8d550 [ 686.525888][ C1] Code: 48 89 44 24 20 75 93 44 89 54 24 0c e8 49 94 02 00 44 8b 54 24 0c 89 da 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 38 44 89 c7 89 44 24 0c e8 9c 94 02 00 8b 44 [ 686.545488][ C1] RSP: 002b:00007fff90dc5f10 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 686.553892][ C1] RAX: ffffffffffffffda RBX: 0000000000080001 RCX: 00007ff2c6d8d550 [ 686.561852][ C1] RDX: 0000000000080001 RSI: 00007ff2c6e136a0 RDI: 00000000ffffff9c [ 686.569808][ C1] RBP: 00007ff2c6e136a0 R08: 0000000000000000 R09: 0000000000000000 [ 686.577864][ C1] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000004 [ 686.586003][ C1] R13: 00007fff90dc5fb0 R14: 00000000000a776e R15: 00007fff90dc6520 [ 686.593970][ C1] [ 686.596978][ C1] [ 686.599292][ C1] Allocated by task 11957: [ 686.603693][ C1] kasan_set_track+0x4e/0x70 [ 686.608299][ C1] __kasan_kmalloc+0x8f/0xa0 [ 686.612877][ C1] rose_add_node+0x23a/0xdd0 [ 686.617547][ C1] rose_rt_ioctl+0xa42/0xfb0 [ 686.622471][ C1] rose_ioctl+0x3cf/0x8b0 [ 686.626787][ C1] sock_do_ioctl+0xd7/0x2f0 [ 686.631290][ C1] sock_ioctl+0x623/0x7a0 [ 686.635604][ C1] __se_sys_ioctl+0xfd/0x170 [ 686.640180][ C1] do_syscall_64+0x55/0xb0 [ 686.644581][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 686.650467][ C1] [ 686.652772][ C1] Freed by task 17544: [ 686.656821][ C1] kasan_set_track+0x4e/0x70 [ 686.661404][ C1] kasan_save_free_info+0x2e/0x50 [ 686.666461][ C1] ____kasan_slab_free+0x126/0x1e0 [ 686.671567][ C1] slab_free_freelist_hook+0x130/0x1b0 [ 686.677018][ C1] __kmem_cache_free+0xba/0x1f0 [ 686.681867][ C1] rose_rt_device_down+0x43d/0x490 [ 686.686971][ C1] rose_device_event+0x604/0x690 [ 686.691995][ C1] notifier_call_chain+0x197/0x390 [ 686.697093][ C1] __dev_notify_flags+0x18e/0x2e0 [ 686.702113][ C1] dev_change_flags+0xe8/0x1a0 [ 686.706861][ C1] dev_ifsioc+0x6a7/0xe20 [ 686.711172][ C1] dev_ioctl+0x7e2/0x1170 [ 686.715484][ C1] sock_do_ioctl+0x226/0x2f0 [ 686.720063][ C1] sock_ioctl+0x623/0x7a0 [ 686.724497][ C1] __se_sys_ioctl+0xfd/0x170 [ 686.729072][ C1] do_syscall_64+0x55/0xb0 [ 686.733547][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 686.739619][ C1] [ 686.741940][ C1] Last potentially related work creation: [ 686.747635][ C1] kasan_save_stack+0x3e/0x60 [ 686.752319][ C1] __kasan_record_aux_stack+0xaf/0xc0 [ 686.757880][ C1] call_rcu+0x158/0x930 [ 686.762048][ C1] ip6_route_info_create+0x9c0/0x1200 [ 686.767451][ C1] ip6_route_add+0x28/0x130 [ 686.771949][ C1] addrconf_prefix_route+0x211/0x2b0 [ 686.777228][ C1] inet6_addr_add+0x64a/0xb60 [ 686.781907][ C1] inet6_rtm_newaddr+0x68d/0x940 [ 686.786833][ C1] rtnetlink_rcv_msg+0x7c7/0xf10 [ 686.791761][ C1] netlink_rcv_skb+0x216/0x480 [ 686.796510][ C1] netlink_unicast+0x751/0x8d0 [ 686.801342][ C1] netlink_sendmsg+0x8c1/0xbe0 [ 686.806094][ C1] __sys_sendto+0x46a/0x620 [ 686.810766][ C1] __x64_sys_sendto+0xde/0xf0 [ 686.815524][ C1] do_syscall_64+0x55/0xb0 [ 686.819945][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 686.825836][ C1] [ 686.828165][ C1] Second to last potentially related work creation: [ 686.834876][ C1] kasan_save_stack+0x3e/0x60 [ 686.839554][ C1] __kasan_record_aux_stack+0xaf/0xc0 [ 686.844933][ C1] call_rcu+0x158/0x930 [ 686.849088][ C1] __ip6_del_rt+0xf1/0x150 [ 686.853516][ C1] ip6_del_rt+0xb4/0x100 [ 686.857767][ C1] __ipv6_ifa_notify+0x5be/0xaa0 [ 686.862701][ C1] addrconf_ifdown+0xe6a/0x1880 [ 686.867564][ C1] addrconf_notify+0x6c6/0x1010 [ 686.872463][ C1] notifier_call_chain+0x197/0x390 [ 686.877591][ C1] dev_close_many+0x297/0x400 [ 686.882290][ C1] unregister_netdevice_many_notify+0x4c1/0x1810 [ 686.888708][ C1] default_device_exit_batch+0x9cb/0xa60 [ 686.894357][ C1] cleanup_net+0x77f/0xb90 [ 686.898827][ C1] process_scheduled_works+0xa45/0x15b0 [ 686.904404][ C1] worker_thread+0xa55/0xfc0 [ 686.908996][ C1] kthread+0x2fa/0x390 [ 686.913057][ C1] ret_from_fork+0x48/0x80 [ 686.917466][ C1] ret_from_fork_asm+0x11/0x20 [ 686.922229][ C1] [ 686.924545][ C1] The buggy address belongs to the object at ffff88805f9e4800 [ 686.924545][ C1] which belongs to the cache kmalloc-512 of size 512 [ 686.938783][ C1] The buggy address is located 42 bytes inside of [ 686.938783][ C1] freed 512-byte region [ffff88805f9e4800, ffff88805f9e4a00) [ 686.952550][ C1] [ 686.954950][ C1] The buggy address belongs to the physical page: [ 686.961357][ C1] page:ffffea00017e7900 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88805f9e4000 pfn:0x5f9e4 [ 686.972797][ C1] head:ffffea00017e7900 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 686.981991][ C1] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 686.989986][ C1] page_type: 0xffffffff() [ 686.994322][ C1] raw: 00fff00000000840 ffff888017841c80 ffffea0000963910 ffffea0000946b10 [ 687.002901][ C1] raw: ffff88805f9e4000 0000000000100006 00000001ffffffff 0000000000000000 [ 687.011465][ C1] page dumped because: kasan: bad access detected [ 687.017899][ C1] page_owner tracks the page as allocated [ 687.023599][ C1] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 8738, tgid 8738 (syz-executor), ts 277641589447, free_ts 275227344601 [ 687.046948][ C1] post_alloc_hook+0x1cd/0x210 [ 687.051893][ C1] get_page_from_freelist+0x195c/0x19f0 [ 687.057521][ C1] __alloc_pages+0x1e3/0x460 [ 687.062102][ C1] alloc_slab_page+0x5d/0x170 [ 687.066769][ C1] new_slab+0x87/0x2e0 [ 687.070838][ C1] ___slab_alloc+0xc6d/0x12f0 [ 687.075503][ C1] __kmem_cache_alloc_node+0x1a2/0x260 [ 687.081047][ C1] __kmalloc+0xa4/0x240 [ 687.085289][ C1] fib6_info_alloc+0x32/0xe0 [ 687.089867][ C1] ip6_route_info_create+0x44f/0x1200 [ 687.095320][ C1] addrconf_f6i_alloc+0x1c6/0x400 [ 687.100337][ C1] ipv6_add_addr+0x576/0x1090 [ 687.104998][ C1] inet6_addr_add+0x57e/0xb60 [ 687.109674][ C1] inet6_rtm_newaddr+0x68d/0x940 [ 687.114641][ C1] rtnetlink_rcv_msg+0x7c7/0xf10 [ 687.119582][ C1] netlink_rcv_skb+0x216/0x480 [ 687.124340][ C1] page last free stack trace: [ 687.129000][ C1] __free_pages_ok+0x9b3/0xad0 [ 687.133754][ C1] free_large_kmalloc+0x101/0x1a0 [ 687.138764][ C1] proc_sys_call_handler+0x50f/0x6d0 [ 687.144225][ C1] vfs_read+0x431/0x920 [ 687.148546][ C1] ksys_read+0x147/0x250 [ 687.152777][ C1] do_syscall_64+0x55/0xb0 [ 687.157176][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 687.163159][ C1] [ 687.165463][ C1] Memory state around the buggy address: [ 687.171081][ C1] ffff88805f9e4700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 687.179155][ C1] ffff88805f9e4780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 687.187223][ C1] >ffff88805f9e4800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 687.195727][ C1] ^ [ 687.201288][ C1] ffff88805f9e4880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 687.209637][ C1] ffff88805f9e4900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 687.217778][ C1] ================================================================== [ 687.226103][ C1] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 687.233318][ C1] CPU: 1 PID: 17721 Comm: syz-executor Not tainted 6.6.102-syzkaller #0 [ 687.241679][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 687.251751][ C1] Call Trace: [ 687.255018][ C1] [ 687.257857][ C1] dump_stack_lvl+0x16c/0x230 [ 687.262610][ C1] ? show_regs_print_info+0x20/0x20 [ 687.267807][ C1] ? load_image+0x3b0/0x3b0 [ 687.272329][ C1] panic+0x2c0/0x710 [ 687.276249][ C1] ? bpf_jit_dump+0xd0/0xd0 [ 687.281006][ C1] ? _raw_spin_unlock_irqrestore+0xa9/0x110 [ 687.286978][ C1] ? _raw_spin_unlock_irqrestore+0xae/0x110 [ 687.292874][ C1] ? _raw_spin_unlock+0x40/0x40 [ 687.297719][ C1] ? print_memory_metadata+0x314/0x400 [ 687.303167][ C1] ? rose_timer_expiry+0x46a/0x4b0 [ 687.308267][ C1] check_panic_on_warn+0x84/0xa0 [ 687.313193][ C1] ? rose_timer_expiry+0x46a/0x4b0 [ 687.318297][ C1] end_report+0x6f/0x140 [ 687.322527][ C1] kasan_report+0x128/0x150 [ 687.327022][ C1] ? rose_timer_expiry+0x46a/0x4b0 [ 687.332122][ C1] rose_timer_expiry+0x46a/0x4b0 [ 687.337045][ C1] call_timer_fn+0x16e/0x530 [ 687.341621][ C1] ? rose_start_t1timer+0xd0/0xd0 [ 687.346631][ C1] ? call_timer_fn+0xbf/0x530 [ 687.351292][ C1] ? __run_timers+0x7d0/0x7d0 [ 687.355957][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 687.361154][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 687.366404][ C1] ? rose_start_t1timer+0xd0/0xd0 [ 687.371429][ C1] __run_timers+0x52d/0x7d0 [ 687.376008][ C1] ? detach_timer+0x2b0/0x2b0 [ 687.380672][ C1] ? lock_chain_count+0x20/0x20 [ 687.385509][ C1] run_timer_softirq+0x67/0xf0 [ 687.390267][ C1] handle_softirqs+0x280/0x820 [ 687.395030][ C1] ? __irq_exit_rcu+0xc7/0x190 [ 687.399787][ C1] ? do_softirq+0x180/0x180 [ 687.404287][ C1] ? irqtime_account_irq+0xb6/0x1c0 [ 687.409474][ C1] __irq_exit_rcu+0xc7/0x190 [ 687.414052][ C1] ? irq_exit_rcu+0x20/0x20 [ 687.418541][ C1] irq_exit_rcu+0x9/0x20 [ 687.422874][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 687.428589][ C1] [ 687.431594][ C1] [ 687.434597][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 687.440576][ C1] RIP: 0010:preempt_count_add+0xa6/0x1a0 [ 687.446204][ C1] Code: ff ff ff 7f 39 f8 75 42 48 8b 5c 24 18 48 89 df e8 ef d2 0c 00 85 c0 74 09 31 db 31 ff e8 e2 d2 0c 00 65 4c 8b 35 1a 50 a8 7e <49> 81 c6 c8 14 00 00 4c 89 f0 48 c1 e8 03 42 80 3c 38 00 74 08 4c [ 687.466426][ C1] RSP: 0018:ffffc90003597830 EFLAGS: 00000246 [ 687.472535][ C1] RAX: 0000000000000000 RBX: ffffffff813aa37e RCX: ffffffff96eaa400 [ 687.480490][ C1] RDX: ffff888079d19e00 RSI: 0000000000000001 RDI: ffffffff813aa37e [ 687.488443][ C1] RBP: 0000000000000001 R08: ffffc90003597901 R09: 0000000000000000 [ 687.496487][ C1] R10: ffffc90003597988 R11: fffff520006b2f3d R12: ffffc90003597988 [ 687.504574][ C1] R13: dffffc0000000000 R14: ffff888079d19e00 R15: dffffc0000000000 [ 687.512534][ C1] ? unwind_next_frame+0xbe/0x2970 [ 687.517640][ C1] ? unwind_next_frame+0xbe/0x2970 [ 687.522744][ C1] ? __unwind_start+0x2d2/0x7e0 [ 687.527594][ C1] unwind_next_frame+0xbe/0x2970 [ 687.532558][ C1] ? __lock_acquire+0x1334/0x7c80 [ 687.537657][ C1] ? dput+0x3b/0x1e0 [ 687.541555][ C1] __unwind_start+0x66a/0x7e0 [ 687.546224][ C1] ? stack_trace_save+0xe0/0xe0 [ 687.551061][ C1] arch_stack_walk+0xf8/0x190 [ 687.555723][ C1] ? __unwind_start+0x2d2/0x7e0 [ 687.560569][ C1] stack_trace_save+0x9c/0xe0 [ 687.565236][ C1] ? stack_trace_snprint+0xf0/0xf0 [ 687.570377][ C1] kasan_set_track+0x4e/0x70 [ 687.574978][ C1] ? kmem_cache_free+0xf8/0x280 [ 687.579815][ C1] kasan_save_free_info+0x2e/0x50 [ 687.584929][ C1] ____kasan_slab_free+0x126/0x1e0 [ 687.590026][ C1] slab_free_freelist_hook+0x130/0x1b0 [ 687.595481][ C1] ? do_sys_openat2+0x168/0x1c0 [ 687.600373][ C1] kmem_cache_free+0xf8/0x280 [ 687.605131][ C1] do_sys_openat2+0x168/0x1c0 [ 687.609801][ C1] ? kmem_cache_free+0xf8/0x280 [ 687.614657][ C1] ? do_sys_open+0xe0/0xe0 [ 687.619145][ C1] ? lockdep_hardirqs_on_prepare+0x400/0x760 [ 687.625202][ C1] ? lock_chain_count+0x20/0x20 [ 687.630125][ C1] ? lock_chain_count+0x20/0x20 [ 687.634982][ C1] __x64_sys_openat+0x139/0x160 [ 687.639839][ C1] do_syscall_64+0x55/0xb0 [ 687.644254][ C1] ? clear_bhb_loop+0x40/0x90 [ 687.648919][ C1] ? clear_bhb_loop+0x40/0x90 [ 687.653586][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 687.659471][ C1] RIP: 0033:0x7ff2c6d8d550 [ 687.663874][ C1] Code: 48 89 44 24 20 75 93 44 89 54 24 0c e8 49 94 02 00 44 8b 54 24 0c 89 da 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 38 44 89 c7 89 44 24 0c e8 9c 94 02 00 8b 44 [ 687.683471][ C1] RSP: 002b:00007fff90dc5f10 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 687.691875][ C1] RAX: ffffffffffffffda RBX: 0000000000080001 RCX: 00007ff2c6d8d550 [ 687.699839][ C1] RDX: 0000000000080001 RSI: 00007ff2c6e136a0 RDI: 00000000ffffff9c [ 687.707804][ C1] RBP: 00007ff2c6e136a0 R08: 0000000000000000 R09: 0000000000000000 [ 687.715761][ C1] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000004 [ 687.723731][ C1] R13: 00007fff90dc5fb0 R14: 00000000000a776e R15: 00007fff90dc6520 [ 687.731785][ C1] [ 687.735105][ C1] Kernel Offset: disabled [ 687.739509][ C1] Rebooting in 86400 seconds..