last executing test programs: 7.644151302s ago: executing program 4 (id=33): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) r0 = syz_io_uring_setup(0x239, &(0x7f0000000080)={0x0, 0x0, 0x10100}, &(0x7f0000000000)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000380)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x464}}) io_uring_enter(r0, 0x2def, 0x0, 0x0, 0x0, 0x0) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/rcu_normal', 0x42, 0x0) syz_usb_connect(0x2, 0x36, &(0x7f0000001a00)=ANY=[@ANYBLOB="120100028b04d610ac0581d1a2b401020301090224000105ff00800904940102fffd010609050c01ff03fa075709050d72"], &(0x7f0000002080)={0x0, 0x0, 0x0, 0x0}) syz_usb_connect(0x0, 0x2d, &(0x7f00000003c0)={{0x12, 0x1, 0x0, 0x3a, 0x62, 0xdb, 0x10, 0xa2c, 0x8, 0xb425, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xc2, 0x0, 0x1, 0x96, 0x76, 0x0, 0x0, [], [{{0x9, 0x5, 0x8, 0x0, 0x20, 0x0, 0x1d, 0x7}}]}}]}}]}}, 0x0) sendfile(r3, r3, 0x0, 0xa) write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000000)='vegas\x00', 0x6) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) (async) syz_io_uring_setup(0x239, &(0x7f0000000080)={0x0, 0x0, 0x10100}, &(0x7f0000000000), &(0x7f00000001c0)) (async) syz_io_uring_submit(r1, r2, &(0x7f0000000380)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x464}}) (async) io_uring_enter(r0, 0x2def, 0x0, 0x0, 0x0, 0x0) (async) openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/rcu_normal', 0x42, 0x0) (async) syz_usb_connect(0x2, 0x36, &(0x7f0000001a00)=ANY=[@ANYBLOB="120100028b04d610ac0581d1a2b401020301090224000105ff00800904940102fffd010609050c01ff03fa075709050d72"], &(0x7f0000002080)={0x0, 0x0, 0x0, 0x0}) (async) syz_usb_connect(0x0, 0x2d, &(0x7f00000003c0)={{0x12, 0x1, 0x0, 0x3a, 0x62, 0xdb, 0x10, 0xa2c, 0x8, 0xb425, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xc2, 0x0, 0x1, 0x96, 0x76, 0x0, 0x0, [], [{{0x9, 0x5, 0x8, 0x0, 0x20, 0x0, 0x1d, 0x7}}]}}]}}]}}, 0x0) (async) sendfile(r3, r3, 0x0, 0xa) (async) write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000000)='vegas\x00', 0x6) (async) 7.512907705s ago: executing program 0 (id=35): r0 = syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa401) unshare(0x2000300) sync_file_range(0xffffffffffffffff, 0x7f, 0x5, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0xfb, 0x323, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) unshare(0x20040600) r1 = socket(0x1d, 0x2, 0x6) bind$can_j1939(r1, 0x0, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0020}]}) r2 = timerfd_create(0x0, 0x0) timerfd_settime(r2, 0x3, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) lsm_get_self_attr(0x64, 0x0, 0x0, 0x0) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="002201"], 0x0}, 0x0) syz_usb_ep_write(r3, 0x81, 0x15, &(0x7f00000002c0)="b9425b44651dd23241963599000000110000004a16") ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, &(0x7f0000000000)={0x400, 0x2, "ec9fe44d4dbe56a65274d7c727e7e53c1bb714e315eeb406bfdd63835e57efa94b1a0275781c647aa7e3470c6028642b17832b10b386a6f73791011c26a9aa141f406e312295ee620a9a46577b9249b738fe7750bec83bf6ed5b67213fa7d6c0823fd154ed29ed7eff0d26ff199ee1ff379742c3f0b46caa357d70ee438f901d7645c3f87e4b21482b76f2ad8eaac090272081f98fd2e3e5a63e006204df635e731a5bfcf142f4529517454618de595cd179445b4bdbf698b9986356f0ebf7d25a57774ef474f86a3ad24ae9f0bf94b99e6b87de5f79d383d05bb32701daed400785a49788f08caecc9e0c48a3740bbe6e1c1fd400cfdfe756bcb7d08e36655c"}) r4 = syz_open_dev$vim2m(&(0x7f0000000200), 0x11, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r4, 0xc0405602, &(0x7f0000000180)={0xa, 0x1, 0x0, "f819ebf4560874d486d27e060000000c040000e40006f1000000000000ef00", 0x38416761}) ioctl$USBDEVFS_CONTROL(r0, 0xc0185500, &(0x7f00000001c0)={0xa1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 7.124691908s ago: executing program 2 (id=37): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$can_bcm(0x1d, 0x2, 0x2) socket$alg(0x26, 0x5, 0x0) socket(0x10, 0x3, 0x0) socket$rds(0x15, 0x5, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$xdp(0x2c, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) close(0x3) socket$inet_dccp(0x2, 0x6, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)) r1 = socket(0x1, 0x803, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) r3 = socket(0x10, 0x3, 0x0) accept4$alg(r3, 0x0, 0x0, 0x80000) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r6 = socket(0x10, 0x80002, 0x0) r7 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$SO_BINDTODEVICE(r7, 0x88, 0x66, 0x0, 0x20000000) sendmsg$nl_route(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000001100a7cc4affeeaf541d002007000000", @ANYRES32=r5, @ANYBLOB="00000000100000001c001a80080002802d00", @ANYRES16=r6, @ANYRES32=r6], 0x44}}, 0x0) r8 = syz_open_procfs$userns(0xffffffffffffffff, &(0x7f0000000080)) r9 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r9}, &(0x7f0000bbdffc)) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="000100001000030400000000fcffffff00000000", @ANYRES32=0x0, @ANYBLOB="7fff00000000040008000500850be7da40d90011b877898db2e4e8c2393466949d1cc6278a77a06e0231a5e8ba2303b526e0b50226", @ANYRES32=r2, @ANYBLOB="c80012800b0001006970367674690000b800028014000500fe8000000000000000000000000000aa14000400fe880000000000000000000000000101080006000600000008000600020000000800020005000000080003000000000008000200af090000080003000200000008000100", @ANYRES32=r2, @ANYBLOB="080002008100000008000100", @ANYRES32=r2, @ANYBLOB="08000600070000001400040000000000000000000000ffffac14142c14000500fc010000000000000000000000000001140004002001000000000000000000000000000208001300", @ANYRES32=r9, @ANYBLOB="08001c00", @ANYRES32=r8, @ANYBLOB], 0x100}}, 0x0) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000040)=0x8, 0x4) 7.071940213s ago: executing program 3 (id=39): r0 = gettid() syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201010200000008ac0540123c00010203010902f2abdfd0d7418519a8e662"], &(0x7f0000000580)={0x0, 0x0, 0x26, 0x0}) timer_create(0x7, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) timer_settime(r1, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000240), 0xa000, 0x0) readv(r2, &(0x7f0000002540)=[{&(0x7f0000000280)=""/34, 0x22}, {0x0, 0x18}], 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0xffffd000) mremap(&(0x7f0000b08000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f00001e4000/0x2000)=nil) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) (async) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) (async) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) (async) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) mlock(&(0x7f0000353000/0x4000)=nil, 0x4000) (async) mlock(&(0x7f0000353000/0x4000)=nil, 0x4000) quotactl$Q_SYNC(0xffffffff80000101, 0x0, 0x0, 0x0) 6.564946015s ago: executing program 2 (id=40): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) rt_sigqueueinfo(0x0, 0x40, &(0x7f00000000c0)={0x3e, 0x3, 0x80}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r3, 0x4068aea3, &(0x7f0000000080)) ioctl$KVM_SET_GSI_ROUTING(r3, 0x4008ae6a, &(0x7f0000000100)=ANY=[]) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000040)={0xfffffffffffffffe, 0x4, 0x8, 0xffffffffffffffff, 0x80fff1}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_SIOCINQ(r5, 0x541b, &(0x7f0000000080)) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002, 0x3}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x2004085, &(0x7f0000b63fe4)={0xa, 0x4e21, 0xfffffffd, @local, 0x5}, 0xffffff0b) shutdown(r4, 0x1) 5.781380805s ago: executing program 2 (id=42): fsopen(&(0x7f0000000280)='ceph\x00', 0x0) socket$netlink(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="240000001a00010000000000000000000200000100000020001000000800", @ANYRES32=r0], 0x24}, 0x1, 0x0, 0x0, 0x811}, 0x20004000) 5.704678441s ago: executing program 4 (id=43): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)=ANY=[@ANYBLOB="0100000000000800f103"]) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="48000000100001002bbd60000000000000000000", @ANYRES32=0x0, @ANYBLOB="043000000000000014001680100001800c00040006000000f300000014000300636169663000"/48], 0x48}, 0x1, 0x0, 0x0, 0x40000}, 0x40) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000180)="e6d3618b6ccc3714965a0fb1f24df2bd31884c40fe2ee3efc6fb197c24de5c2cc4afb8287aaf8835d3f97ad957de9064ad0731ea6b0384e4d3b0aafe1a98b8f6c5c7f95ffe6810fa6e862ceee554a47a2c2929b3532a3abd5b59e5748a9dafa39c1dac943d8a9c04966d7f9e319b973804b1ed50a59a3cb3e1390e88fdc2b5dd70f7fabaad508f792098c6b790b1f064f250aa3bd0388d209e6f4b1c2f337fd7b2d87c27ffb409b1f5c3edde874939ec68a867c27b11ee4a3e2b09ecce534736f818b0478ae0a120ebc16b9f2027a0559a63733f7f248f7d67bfe2d890638c2c930a1434a527310e55cc", 0xea) openat$kvm(0xffffff9c, &(0x7f0000000140), 0x71000, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_CLOCK(r6, 0x4030ae7b, &(0x7f0000000080)={0xdf09, 0x8, 0xffffffff, 0x0, 0x6e89}) r7 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) r10 = socket$inet6_sctp(0xa, 0x1, 0x84) r11 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r11, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_CONTEXT(r10, 0x84, 0x11, &(0x7f0000000000)={r12, 0x5}, 0x8) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r9, 0x84, 0x6d, &(0x7f0000000300)={r12, 0xc0, "64af4c9f3915af537192c1bf50c4a778aca67daac8ad2819fc1daa2db341f10516222b9960df1bb352227beb7ca1ac7101c520aafc16503771b09356bede0175d0bf410cbb44ab59e9668905ff372b72f38afb60fee6572fa41fb6c2a1cc6bee676e272fe19e684056cb1dca24b04115639aec810f8eda0c41c7c869204b63a333ca79a35cc67c53956a202988cbaef577fe36824723403f8b2ab325cff0ca403439b5062f2d1af1e3058252a16cd81dc4e9b58cbde251af49ee1b07498eebdf"}, &(0x7f0000000400)=0xc8) setsockopt$inet6_tcp_TCP_MD5SIG(r8, 0x6, 0xe, &(0x7f0000000440)={@in={{0x2, 0x4e24, @broadcast}}, 0x0, 0x0, 0x79, 0x0, "f914c5a45e2aac3c0935d843352afe7d52ef8ea6a9f41e278015b3029adba21696a53c95c53388903f7ee7b6908f10db16bf429bffcd933bb3ac406afee36752c9cfd3f813eb45b2b86acf32c79d2b74"}, 0xd8) setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, &(0x7f0000000f40)=@filter={'filter\x00', 0x4, 0x4, 0x470, 0xffffffff, 0x218, 0x0, 0xe8, 0xfeffffff, 0xffffffff, 0x3a0, 0x3a0, 0x3a0, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffffff, 0xff, 0xff, 0xff000000], [0x0, 0xff, 0xff000000, 0xffffff00], 'macvtap0\x00', 'veth1_to_hsr\x00', {}, {}, 0x3c, 0x6, 0x4, 0x30}, 0x2f2, 0xa8, 0xe8}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x0, 0x5, {0x7}}}}, {{@ipv6={@private2, @empty, [], [], 'sit0\x00', 'batadv_slave_1\x00'}, 0x0, 0xf0, 0x130, 0x0, {}, [@common=@dst={{0x48}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x0, 0x57, {0x2000000}}}}, {{@ipv6={@empty, @mcast1, [], [0x0, 0xffffff00], 'ip6tnl0\x00', 'dvmrp0\x00'}, 0x0, 0x160, 0x188, 0x0, {}, [@common=@unspec=@addrtype1={{0x28}, {0x21, 0x180, 0x5}}, @common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @loopback, @mcast1, @private1, [0x0, 0x0, 0xff], [0x0, 0x0, 0xffffff00], [], 0x843, 0x1400}}]}, @REJECT={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4d0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x0, &(0x7f00000000c0)}) r13 = getpgrp(0x0) socket$netlink(0x10, 0x3, 0x6) r14 = syz_pidfd_open(r13, 0x0) pidfd_send_signal(r14, 0x0, 0x0, 0x0) 5.510119446s ago: executing program 2 (id=45): ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, 0x0) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000600)=ANY=[@ANYBLOB="12010000a3b370086d04ae08581101020301090212000d000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_disconnect(r0) r1 = socket(0x10, 0x3, 0x0) setitimer(0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7, 0x0, 0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x29}]}, @NFT_MSG_NEWSETELEM={0x3c, 0x1e, 0xa, 0x105, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x8, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xc0}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r1) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb34902, 0x1000006, 0x28011, 0xffffffffffffffff, 0x0) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, &(0x7f00000000c0)={0x4000, 0x80600}) r3 = openat$kvm(0xffffffffffffff9c, 0x0, 0x8001, 0x0) unshare(0x22020400) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='cgroup\x00') preadv(r4, &(0x7f00000000c0)=[{&(0x7f0000000480)=""/128, 0x80}], 0x1, 0x12e, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x7, @loopback, 0xfcb}, 0x1c) 4.324940044s ago: executing program 4 (id=46): rt_sigreturn() rt_sigreturn() (fail_nth: 3) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_mount_image$fuse(0x0, 0x0, 0xa, 0x0, 0x1, 0x0, 0x0) readv(0xffffffffffffffff, 0x0, 0x0) r0 = io_uring_setup(0x1f60, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, 0x0, 0x0) 3.866177693s ago: executing program 4 (id=47): r0 = syz_open_dev$media(&(0x7f0000000780), 0x0, 0x20004) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000000)=ANY=[@ANYRES32=r0, @ANYRESOCT=r0], 0x20) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$MEDIA_IOC_ENUM_ENTITIES(r0, 0xc1007c01, &(0x7f0000000f40)) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) times(0x0) madvise(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xf) fcntl$setlease(r0, 0x400, 0x2) syz_emit_ethernet(0x9e, &(0x7f00000000c0)={@broadcast, @random="1711b45adbde", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x90, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0xe0, 0x0, 0xe000, {0x1b, 0x4, 0x0, 0x17, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty=0xac1414aa, @empty, {[@ssrr={0x89, 0x17, 0xac, [@local, @broadcast, @initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010100, @multicast2]}, @rr={0x7, 0x3}, @timestamp_prespec={0x44, 0x3c, 0x0, 0x3, 0x0, [{@private=0xa010108}, {@multicast2}, {@local}, {@remote}, {@private}, {@dev}, {@private}]}]}}, "4c2d3da60ae19fa0"}}}}}, 0x0) 3.608729667s ago: executing program 4 (id=48): r0 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000300), 0x82000, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000040)=0x91, 0x4) connect$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000003cc0)=[{{0x0, 0x11, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) get_mempolicy(0x0, 0x0, 0x0, &(0x7f00003c9000/0x3000)=nil, 0x2) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000002c0)='ip_vti0\x00', 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x7e, &(0x7f0000000800)={@broadcast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @dest_unreach={0x3, 0xa, 0x0, 0x0, 0x0, 0x0, {0x15, 0x4, 0x0, 0x3c, 0x0, 0x0, 0x4de, 0x0, 0x1, 0x0, @dev, @local, {[@ra={0x94, 0x4}, @timestamp_prespec={0x44, 0x3c, 0x28, 0x3, 0xc, [{@remote, 0x3}, {@empty, 0x2}, {@multicast2, 0x9}, {@local, 0xe82}, {@dev={0xac, 0x14, 0x14, 0x41}, 0x10}, {@local, 0x180000}, {@dev={0xac, 0x14, 0x14, 0x11}, 0x1}]}]}}}}}}}, 0x0) ioctl$IMADDTIMER(r0, 0x80044940, &(0x7f0000000340)=0xffffffffffffffff) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a300000001f0900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x715a9d1e7a68469f, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_USERDATA={0x5, 0x7, 0x1, 0x0, "a2"}]}], {0x14}}, 0x7c}}, 0x0) ioctl$IMDELTIMER(r0, 0x80044941, &(0x7f00000003c0)=0x3) 3.368909095s ago: executing program 0 (id=49): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000caefb8)={0x8, 0x3, &(0x7f0000000080)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x8b, 0x54}}, &(0x7f0000281ffc)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) r2 = socket$packet(0x11, 0x2, 0x300) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000480)=[{0x20, 0xfc, 0xff, 0xfffff00c}, {0x6, 0xfc, 0x2, 0x4}]}, 0x10) syz_emit_ethernet(0x15, &(0x7f0000000400)={@local, @remote, @val={@void}, {@mpls_uc={0x8847, {[], @llc={@llc={0x0, 0xfc, '='}}}}}}, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_MSRS(r3, 0xc008ae88, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000ecffffff9f000040"]) 3.234913815s ago: executing program 4 (id=50): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) (async, rerun: 64) r1 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010100000000000000002b00000008000300", @ANYRES32=r2, @ANYBLOB="04004600040018010a0034000101010101010000080026006c090000632f5c0e3cb576cab639bdf659015b51bff26922295f75dd46dee8dead11"], 0x38}}, 0x4844) (async) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000011c0)=ANY=[@ANYBLOB="12010001090003206d0414c340000000000109022400010000a0000904000001030101000921000800012203000905", @ANYRES64], 0x0) syz_usb_control_io$hid(r3, &(0x7f00000001c0)={0x24, &(0x7f0000001180)=ANY=[@ANYBLOB="00020c0000000c0002"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r3, 0x0, &(0x7f0000001300)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) madvise(&(0x7f0000ff9000/0x2000)=nil, 0x2000, 0x80000000e) (async, rerun: 64) mbind(&(0x7f0000ff4000/0xc000)=nil, 0xc000, 0x2, &(0x7f0000000000)=0x5, 0x4, 0x0) (async, rerun: 64) mlock2(&(0x7f0000ff5000/0x9000)=nil, 0x9000, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r4, 0x89f1, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x8000, 0x40, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x66, 0xffff, 0xfd, 0x4, 0x0, @empty}}}}) (async) socket$can_bcm(0x1d, 0x2, 0x2) syz_usb_control_io(r3, 0x0, 0x0) 2.762190532s ago: executing program 0 (id=51): r0 = memfd_create(&(0x7f0000000280)='%\x00', 0x4) r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000140), 0x8, 0x0) io_setup(0x1, &(0x7f0000000b80)=0x0) write$FUSE_BMAP(r1, 0x0, 0x0) io_submit(r2, 0x1, &(0x7f0000001d00)=[&(0x7f0000001a80)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) r3 = syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x802) ioctl$EVIOCGABS20(r3, 0x80184520, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x1, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="b700000000c300002f000000000000009500000000000000a9171809f8dcf159569d5475991f7de1a0d0c119cfcf6b98741c23fb7f8d3002ec85db75af955427e91496087a51a0a78f269a9e216a0d0177c4fe3552396a180330807a5b6e8c79aa92038c78d1f16c1323f0e0c8d45c641a21757847cb22230e4321cc3581e40c62c4defee8cffe359c"], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r4, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r4, 0x4008af03, &(0x7f0000000340)={0x1, 0x0, [{0x1, 0x0, 0x0}]}) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x8, 0x4, &(0x7f0000000080)=ANY=[@ANYRESHEX=r3, @ANYRES32, @ANYRES8=r0], &(0x7f0000000140)='GPL\x00', 0xa, 0x95, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @cgroup_skb=0x1, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x10, 0x2, @void, @value}, 0x94) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x200000f, 0x4002012, r0, 0x0) readv(r0, &(0x7f0000001480)=[{0x0}, {&(0x7f0000000140)=""/67, 0x43}], 0x2) 2.202164527s ago: executing program 3 (id=52): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$SMC_PNETID_DEL(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, r1, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_batadv\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x40}, 0x800) 2.202027766s ago: executing program 3 (id=53): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x39, &(0x7f0000000000)=@dstopts={0x2, 0x2, '\x00', [@enc_lim={0x4, 0x1, 0x1}, @padn={0x1, 0x8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @ra={0x5, 0x2, 0x1}]}, 0x20) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000180)=0x207f, 0x4) sendmmsg$inet6(r0, &(0x7f0000005c80)=[{{&(0x7f0000000200)={0xa, 0x4e22, 0x0, @dev}, 0x1c, 0x0}}], 0x1, 0xb80b) sendto$l2tp6(r0, 0x0, 0x0, 0x4000000, 0x0, 0x0) 1.493311101s ago: executing program 0 (id=54): read$FUSE(0xffffffffffffffff, &(0x7f0000000340)={0x2020}, 0x2020) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) dup(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) write$tun(r1, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000004000000060ec97000fc83c00fe8000000000000000000000000000aaff02000000000000000000000000000106"], 0xffe) mprotect(&(0x7f0000000000/0x800000)=nil, 0x80000c, 0x2) 1.492900077s ago: executing program 3 (id=55): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000080)={{{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x4e23, 0xfffe, 0x0, 0x0, 0x20}, {0x10004, 0x0, 0xddcf, 0x0, 0x0, 0xa00}, {}, 0x0, 0x0, 0x0, 0x0, 0x2}, {{@in6=@private2, 0x4d5}, 0x0, @in6=@empty}}, 0xe8) (async) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_pressure(r1, &(0x7f0000000040)='memory.pressure\x00', 0x2, 0x0) (async) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000240)=[{0x6, 0x0, 0x0, 0x7fff7ffa}]}) close_range(r2, 0xffffffffffffffff, 0x0) (async) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) (async) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r0, &(0x7f0000000040), 0x400000000000284, 0x2b, 0x0) setsockopt$inet6_int(r0, 0x29, 0x3a, &(0x7f0000000000)=0x1, 0x4) (async) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) (async) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x71, 0x10, 0x51}, [@ldst={0x6}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd96, &(0x7f0000000080)=""/201, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffd56, 0x10, &(0x7f0000000000), 0x1dd, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) (async) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x8400, 0x112) statx(r3, &(0x7f0000000340)='./file0\x00', 0x4000, 0x4, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) quotactl_fd$Q_GETINFO(r0, 0xffffffff80000501, r4, &(0x7f00000002c0)) 1.485788377s ago: executing program 2 (id=56): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'tunl0\x00', 0x0, 0x7, 0x8, 0x3, 0xc, {{0xa, 0x4, 0x0, 0x1e, 0x28, 0x67, 0x0, 0xf0, 0x4, 0x0, @local, @broadcast, {[@rr={0x7, 0x13, 0x66, [@local, @remote, @rand_addr=0x64010102, @broadcast]}]}}}}}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000000)=@bridge_getvlan={0x28, 0x72, 0x200, 0x70bd29, 0x25dfdbff, {0x7, 0x0, 0x0, r1}, [@BRIDGE_VLANDB_DUMP_FLAGS={0x8}, @BRIDGE_VLANDB_DUMP_FLAGS={0x8}]}, 0x28}}, 0x0) 1.485121204s ago: executing program 3 (id=57): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) timer_create(0x0, &(0x7f0000000680)={0x0, 0x21, 0x0, @tid=0xffffffffffffffff}, &(0x7f0000000100)) timer_settime(0x0, 0x0, &(0x7f0000000500)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x2, 0x0, 0x7fffffff}]}) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x4, r0}) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1000006, 0x4132, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2ce440, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r2, 0xc008aec1, &(0x7f0000000000)) mremap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000001000/0x4000)=nil) r3 = socket$netlink(0x10, 0x3, 0x10) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r4) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r4, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r5, 0x0) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x8, 0x0, 0x0, 0x0, 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x8, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) connect$inet(r6, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), r3) sendmsg$MPTCP_PM_CMD_SET_FLAGS(r3, 0x0, 0x8001) pselect6(0x40, &(0x7f0000000100)={0x8, 0x80000001, 0x4, 0x3, 0x8, 0x8, 0x100000, 0x3}, &(0x7f0000000140)={0x2, 0x3, 0x3ff, 0x257, 0xfffffffffffffff7, 0x4, 0x3, 0x7ff}, &(0x7f0000000200)={0x9, 0x7, 0xf, 0x5, 0x401, 0xe, 0x3, 0x4}, &(0x7f0000000280), &(0x7f0000000340)={&(0x7f0000000300)={[0x43a458a3]}, 0x8}) r7 = socket$nl_generic(0x10, 0x3, 0x10) openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)={0x14, r8, 0x7}, 0x14}}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r9 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x458, 0x5016, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x4, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x3}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0xee}}}}}]}}]}}, 0x0) syz_usb_control_io(r9, 0x0, 0x0) 1.484141388s ago: executing program 0 (id=58): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'ghash-clmulni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d0ff0f1d0dbd30", 0x10) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$unix(r1, &(0x7f0000002c80)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000340)="4c7720c1abb5ab736db6d03fcb5f4734b3b18274794eb851bd08c95f625f6938a114234c8e3e9b6888165d9dfb417816b2c91b4a3562c2175ec33cdc06f08c3480bef67691a9f5f61bba7ccca1a7ef44aab1dd7ca296d369f954c985305eeac39dd5c17638f54086b0b6abfae87079ce0421678425a0bf5e498af1ad7bbe3ab4a84e72b0bf83c5ad43adb59a33485f0cd04554a59df4ec8fac071aa6ae5db6b9b1343810be978334cc0e77d7f530c34c85ce37a4736f1be55d2060ef68068b6e0c811e7ef17a5632c8847c5c5a2b04b553c537091441f52253b5872613a5254077b2030e778950", 0xe7}, {&(0x7f0000001540)="7fa78b270d19eaffde9c75070c46546690c4283e213cf89cb7763c5f7a382f0a2fd464d66936cbc8829b685adbcd6b5d2489853ade8022f00750d4d7c0abdde0de742875fcedfbb65aa153c5ea352ab55723a825287aac495cd376c5ad4c7708cb8c201124ee101b63b9e3dc656e10d011df85afced317c63c81b374aa15c404363b47639c7b42868c5690adef752dc58624aaa384b7f7d2041a6fb8df53d024ccf1e97c2498607d9821253963512854c72e7e1b4dfb041a6f550b7ab5fc68040528c6ed2dc62a1fb009ffa29d727ad22334f87b1334a6fb1ea6222e539b0bc486cb4c2768eddf43b455163998e67c4d5cc3a9cf55", 0xf5}, {&(0x7f0000001640)="f3eb3e4004", 0x5}], 0x3, 0x0, 0x0, 0x4040010}, 0x90) socket$packet(0x11, 0x3, 0x300) r2 = socket$pppoe(0x18, 0x1, 0x0) syz_usb_connect(0x3, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d895dd102d8e084edcdf4602030109021200010000e000ff99e70d620bcc74fd73d8b0b17fc8bd114abbcfbede64343b40ea132a24713b282cd176635ad32e9ffcdebc734a972b5fe1389cd5e34395a2bd67d71eaa7a2ed858a48a597066c2bec9946b27168dc6910f89046c8ec228b5900efa871effc33b2f0feb"], 0x0) connect$pppoe(r2, &(0x7f00000001c0)={0x18, 0x0, {0x2, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, 'batadv_slave_1\x00'}}, 0x1e) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$EVIOCGPROP(r3, 0x40047438, &(0x7f0000000180)=""/246) openat$audio1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r4 = syz_open_dev$loop(&(0x7f00000000c0), 0x7, 0x3c9041) r5 = dup(r4) ioctl$PPPIOCCONNECT(r5, 0x40047435, 0x0) 1.48379314s ago: executing program 2 (id=59): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0x8, 0x3a0, 0x5, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0xffffffffffffffff, 0x0, &(0x7f0000000080), &(0x7f0000000240), 0x1800, r0}, 0x38) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010000030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a3200000000b8000000060a01040000f700000000000100000008000b400000000090000480340001800b000100657874686472000024000280080001400000000c080003400000000008000440000000220500020007000000580001800c000100626974776973650048000280080003400000000208000140000000140800024000000012240007800400010004000100150001048da699637b968d0b9e2ba0ef8bfb60ad3c00000008000640000000010900010073797a30"], 0x12c}}, 0x0) r2 = syz_usb_connect(0x3, 0x24, &(0x7f0000000100)=ANY=[@ANYRES64=r1], 0x0) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f00000003c0)={0xffff}, 0x10) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r4, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) setrlimit(0x40000000000008, &(0x7f0000000000)) sendto$inet(r4, 0x0, 0x0, 0xc806, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x37}}, 0x10) sendto$inet(r4, &(0x7f00000002c0)="9b", 0x12, 0x400c084, 0x0, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="300000001e008d2a"], 0x30}}, 0x4044) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000040)={0x1, 0x0, [{0x48, 0x0, 0x100000005}]}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000280)={0x2, &(0x7f0000000080)=[{0xfff1, 0xd4, 0x2, 0x22}, {0x9, 0x7, 0x0, 0x7}]}) syz_usb_control_io$hid(r2, 0x0, 0x0) 1.202999139s ago: executing program 1 (id=60): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x1}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) dup3(r1, r0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, r2, 0x0) r3 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r3, 0x84, 0x21, &(0x7f0000000000), 0x4) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0x98, 0x0, &(0x7f0000001540)=[@acquire, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) 873.036321ms ago: executing program 1 (id=61): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_INFO(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, r1, 0x4, 0x70bd27, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DAEMON={0x14, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x334}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}]}, 0x38}, 0x1, 0x0, 0x0, 0x40050}, 0x20000000) sendmsg$IPVS_CMD_GET_SERVICE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x1c, r1, 0x1, 0x70bd26, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1998}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008885}, 0x4004090) (async) sendmsg$IPVS_CMD_GET_SERVICE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x1c, r1, 0x1, 0x70bd26, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1998}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008885}, 0x4004090) prctl$PR_SET_NAME(0xf, &(0x7f0000000000)='E$:\x00') (async) prctl$PR_SET_NAME(0xf, &(0x7f0000000000)='E$:\x00') recvmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="3800000056000100000000f70000000007020000", @ANYRES32=r2, @ANYBLOB="200001"], 0x38}}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x80, 0x80, 0x7fff0006}]}) getuid() (async) getuid() sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="140000001000010400000000000000000000000a20000000000a01080000000000000000030000000900010073797a310000000014000000020a010400000000cf48b2900000000020000000000a010800000000000000000a0001000000000000797a310000000034000000140a030000000000000000000300000008000340000000000900010073797a3100000000090002"], 0xb0}}, 0x0) sendmsg$IPSET_CMD_HEADER(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="600000000c06050000000000000c0eefea8b03488e00010007000000050001000700000005000100070000000900020073797a303b870000050001000700000f000001000700000f3300020073797a31000000000900020073797a3000000000"], 0x60}}, 0x8048000) sendmsg$NFT_MSG_GETOBJ(r0, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000240)={0xcc, 0x13, 0xa, 0x301, 0x0, 0x0, {0x7, 0x0, 0x1}, [@NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0xa}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x3}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0xa}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x3}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x1}, @NFTA_OBJ_USERDATA={0x50, 0x8, "c28b79589fea2ea1f8d9d96c2ee74aa0975a88bb3a2eeb1973d1078554fa5d847d8269c8d5c6623c104382ceac8fa58774b0847be3e14f1894125a92d69272845415c10b8a2dcc9d7af8ee14"}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_OBJ_USERDATA={0x28, 0x8, "83ee39650cb0e9fd2a922f422fbafc4ea70b912b0f31536fd7abef11c541f1a4637fa970"}]}, 0xcc}, 0x1, 0x0, 0x0, 0x44000}, 0x10) 605.07685ms ago: executing program 1 (id=62): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[], 0x50}}, 0x0) 485.501013ms ago: executing program 3 (id=63): r0 = syz_usb_connect$hid(0x1, 0x49, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000000000040341d0a0000000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) syz_usb_connect(0x0, 0x24, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x8a, 0x31, 0x7c, 0x40, 0x545, 0x800d, 0x30a, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xb3, 0x8e, 0xd1}}]}}]}}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'bridge_slave_0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="b400000010000904000000000000000000002200", @ANYRES32=0x0, @ANYBLOB="fffffffed9526cfd8400128009000100766c616e000000007400028006000100000600000c000200367da1650e000000280003800c00010001800000002000000c000100a1000000c84200000c0001000800000008000000340004800c00010006000000ff0300000c00010004000000080000000c00010004000000020000000c000100050000000300000008000500", @ANYRES32=r2, @ANYBLOB='\b\x00\n\x00', @ANYRESOCT], 0xb4}}, 0x0) r4 = syz_open_dev$mouse(&(0x7f0000000140), 0x8, 0x400000) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000002c0)={0xffffffffffffffff, 0x20, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000000240)=""/18, 0x12}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x5f, '\x00', 0x0, @lirc_mode2=0x10, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x1, @void, @value}, 0x94) r6 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000280)=@generic={&(0x7f0000000240)='./file0\x00', 0x0, 0x8}, 0x18) r7 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r8 = dup(r7) write$6lowpan_enable(r8, &(0x7f0000000000)='0', 0xfffffd2c) bind$alg(r8, 0x0, 0x0) r9 = openat$null(0xffffffffffffff9c, &(0x7f00000002c0), 0x408240, 0x0) syz_open_dev$usbmon(&(0x7f0000000640), 0x6d, 0x20100) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000380)={{0x1, 0xffffffffffffffff}, &(0x7f0000000300), &(0x7f0000000340)='%-010d \x00'}, 0x20) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000003c0), 0x200, 0x0) r11 = syz_open_dev$vcsa(&(0x7f0000000400), 0x8001, 0x40) r12 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@bloom_filter={0x1e, 0x401, 0x5, 0x8, 0x10000, 0x1, 0x4e3c, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x0, 0xd, @void, @value, @value}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0xf, 0xd, &(0x7f0000000700)=@raw=[@printk={@i, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xab0}}, @jmp={0x5, 0x0, 0xc, 0x2, 0xb, 0xfffffffffffffffc, 0xffffffffffffffff}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x3}, @func={0x85, 0x0, 0x1, 0x0, 0x7}, @map_fd={0x18, 0x0, 0x1, 0x0, 0x1}], &(0x7f0000000040)='syzkaller\x00', 0x6, 0x0, 0x0, 0x41100, 0x60, '\x00', r2, @cgroup_device=0x6, r4, 0x8, &(0x7f0000000180)={0x2, 0x3}, 0x8, 0x10, &(0x7f00000001c0)={0x4, 0x7, 0x9, 0x9}, 0x10, r5, r6, 0x4, &(0x7f0000000500)=[r8, r9, r10, r8, r11, r12, 0x1], &(0x7f0000000540)=[{0x4, 0x4, 0x6, 0xb}, {0x3, 0x5, 0xc, 0x3}, {0x2, 0x2, 0x9, 0x9}, {0x5, 0x1, 0x2, 0x5}], 0x10, 0x0, @void, @value}, 0x94) r13 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a00000804800200090581", @ANYBLOB="f7", @ANYRESOCT], 0x0) r14 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(r13) read$char_usb(r14, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000200)={0x24, 0x0, 0x0, &(0x7f00000004c0)={0x0, 0x22, 0x5, {[@local=@item_4={0x3, 0x2, 0x9, "47ad5809"}]}}, 0x0}, 0x0) 369.940579ms ago: executing program 1 (id=64): r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000140)={[0xfffffffffffffff5]}, 0x8, 0x0) readv(r0, &(0x7f0000000300)=[{&(0x7f0000000340)=""/121, 0x79}], 0x1) r1 = memfd_create(&(0x7f0000000280)='%\x00', 0x4) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x200000f, 0x4002012, r1, 0x0) readv(r1, &(0x7f0000001480)=[{0x0}, {&(0x7f0000000140)=""/67, 0x43}], 0x2) 267.851299ms ago: executing program 1 (id=65): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000180)=0x207f, 0x4) (async) sendmmsg$inet6(r0, &(0x7f0000005c80), 0x0, 0xb80b) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = dup(r2) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r3, 0xc0a85322, 0x0) (async, rerun: 32) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) (rerun: 32) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000002300)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) (async) read$FUSE(r4, &(0x7f0000006340)={0x2020, 0x0, 0x0}, 0x2058) r6 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r6, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x9}, 0x1c) (async) r7 = socket$igmp6(0xa, 0x3, 0x2) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x4001) (async, rerun: 32) sendto$rxrpc(0xffffffffffffffff, &(0x7f0000000580)="af4da7eef46a", 0x6, 0x2000c880, 0x0, 0x0) (async, rerun: 32) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) sendmsg(r6, &(0x7f00000000c0)={0x0, 0x9506, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0x5dc}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) (async) write$FUSE_INIT(r4, &(0x7f0000002200)={0x50, 0x0, r5, {0x7, 0x27, 0x0, 0x1dd880}}, 0x50) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 64) r9 = getgid() (rerun: 64) write$FUSE_ENTRY(r3, &(0x7f0000000240)={0x90, 0x0, r5, {0x4, 0x0, 0x2, 0x8, 0x8000, 0x3, {0x1, 0x0, 0x1, 0x6, 0x7ff, 0x1a83, 0x3, 0x3, 0x80, 0x4000, 0x4, r8, r9, 0x8, 0xb8}}}, 0x90) (async) r10 = socket$inet(0x2, 0x4000000805, 0x0) listen(r10, 0x7) sendmmsg(r10, &(0x7f0000000e40)=[{{&(0x7f0000000000)=@l2tp={0x2, 0x0, @local}, 0x80, &(0x7f0000000300)=[{&(0x7f0000000080)="ac", 0xffffff8e}], 0x1}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000000000084"], 0x18}}], 0x2, 0x4008800) sendto$l2tp6(r0, 0x0, 0x0, 0x4000000, 0x0, 0x0) (async, rerun: 64) r11 = socket$vsock_stream(0x28, 0x1, 0x0) (async, rerun: 64) sendto$l2tp6(r0, &(0x7f0000000040)="1d8fe9d0bd6cb81cebdf593f9d76eb3303271af9860e5cee9d0a2513cb5ac8ddc7966bf46862520f7e1f3cebd598faffdce8e7c5192281ca7ebff78e2dac47f28c460ed2824d79e036531155a0b816e44b7fe84a18f2d57284507a09203eb8602d20216780be979b231811f7c78c6e388ae573d5d4266813e723d16fb4fb143c4555a9acf29a1c931ebb4a260a11", 0x8e, 0x8840, &(0x7f0000000100)={0xa, 0x0, 0x4, @ipv4={'\x00', '\xff\xff', @empty}, 0x0, 0x2}, 0x20) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r11, 0x28, 0x0, &(0x7f0000000000)=0x2, 0x8) 20.812228ms ago: executing program 1 (id=66): ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, 0x0) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000600)=ANY=[@ANYBLOB="12010000a3b370086d04ae08581101020301090212000d000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_disconnect(r0) r1 = socket(0x10, 0x3, 0x0) setitimer(0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7, 0x0, 0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x29}]}, @NFT_MSG_NEWSETELEM={0x3c, 0x1e, 0xa, 0x105, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x8, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xc0}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r1) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb34902, 0x1000006, 0x28011, 0xffffffffffffffff, 0x0) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, &(0x7f00000000c0)={0x4000, 0x80600}) r3 = openat$kvm(0xffffffffffffff9c, 0x0, 0x8001, 0x0) unshare(0x22020400) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='cgroup\x00') preadv(r4, &(0x7f00000000c0)=[{&(0x7f0000000480)=""/128, 0x80}], 0x1, 0x12e, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e21, 0x7, @loopback, 0xfcb}, 0x1c) 0s ago: executing program 0 (id=67): setrlimit(0xf, &(0x7f0000000000)={0x0, 0x3}) timer_create(0x3, 0x0, &(0x7f0000000300)=0x0) timer_create(0x2, 0x0, &(0x7f00000000c0)=0x0) timer_settime(r1, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a320000000050000000060a010400000000000000000100000008000b400000000028000480240001800b0001007470726f78790000140002800800034000fdff03080001400000000a0900010073797a30"], 0xc4}}, 0x0) timer_settime(r0, 0x0, &(0x7f0000000080)={{}, {0x0, 0x3938700}}, 0x0) unshare(0x40000000) r3 = socket(0x10, 0x2, 0x0) sendto$inet6(r3, &(0x7f00000007c0)="7800000018002507b9199b02ffff48000203be040204fe050a02040c5c000900580006020a0200000d0085a168d0bf46d32345653600648d27000b000a00070849935ade4a460c89b6ec0cff3959547f509058ba86c902007a00004a32000407160005000a0000000000e000e218d1dd3b6ed538f6523250", 0x78, 0x0, 0x0, 0xe0ffffff) setrlimit(0xa, &(0x7f0000000040)={0x5, 0x5}) setrlimit(0xf, &(0x7f0000000000)={0x0, 0x3}) (async) timer_create(0x3, 0x0, &(0x7f0000000300)) (async) timer_create(0x2, 0x0, &(0x7f00000000c0)) (async) timer_settime(r1, 0x0, &(0x7f000006b000)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a320000000050000000060a010400000000000000000100000008000b400000000028000480240001800b0001007470726f78790000140002800800034000fdff03080001400000000a0900010073797a30"], 0xc4}}, 0x0) (async) timer_settime(r0, 0x0, &(0x7f0000000080)={{}, {0x0, 0x3938700}}, 0x0) (async) unshare(0x40000000) (async) socket(0x10, 0x2, 0x0) (async) sendto$inet6(r3, &(0x7f00000007c0)="7800000018002507b9199b02ffff48000203be040204fe050a02040c5c000900580006020a0200000d0085a168d0bf46d32345653600648d27000b000a00070849935ade4a460c89b6ec0cff3959547f509058ba86c902007a00004a32000407160005000a0000000000e000e218d1dd3b6ed538f6523250", 0x78, 0x0, 0x0, 0xe0ffffff) (async) setrlimit(0xa, &(0x7f0000000040)={0x5, 0x5}) (async) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.65' (ED25519) to the list of known hosts. [ 73.583734][ T5823] cgroup: Unknown subsys name 'net' [ 73.716308][ T5823] cgroup: Unknown subsys name 'cpuset' [ 73.725364][ T5823] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 75.344873][ T5823] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 77.840165][ T5843] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 77.842265][ T5842] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 77.848520][ T5843] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 77.864560][ T5842] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 77.865718][ T5843] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 77.879484][ T5845] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 77.880106][ T5842] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 77.880517][ T5843] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 77.896816][ T5843] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 77.903519][ T5845] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 77.909863][ T5843] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 77.916557][ T5845] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 77.923214][ T5843] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 77.930953][ T5845] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 77.944461][ T5845] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 77.956800][ T5843] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 77.964167][ T5841] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 77.973651][ T5841] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 77.982568][ T5843] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 77.989907][ T5844] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 77.990415][ T5846] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 77.998319][ T5841] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 78.006087][ T5846] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 78.019914][ T5838] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 78.028175][ T5843] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 78.032586][ T5846] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 78.043601][ T5846] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 78.051597][ T5846] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 78.062456][ T5846] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 78.070323][ T5843] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 78.521135][ T5849] chnl_net:caif_netlink_parms(): no params data found [ 78.532821][ T5852] chnl_net:caif_netlink_parms(): no params data found [ 78.661515][ T5848] chnl_net:caif_netlink_parms(): no params data found [ 78.774050][ T5851] chnl_net:caif_netlink_parms(): no params data found [ 78.813428][ T5852] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.821554][ T5852] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.830224][ T5852] bridge_slave_0: entered allmulticast mode [ 78.838463][ T5852] bridge_slave_0: entered promiscuous mode [ 78.865328][ T5849] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.872703][ T5849] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.879898][ T5849] bridge_slave_0: entered allmulticast mode [ 78.887100][ T5849] bridge_slave_0: entered promiscuous mode [ 78.899428][ T5849] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.907748][ T5849] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.915116][ T5849] bridge_slave_1: entered allmulticast mode [ 78.921876][ T5849] bridge_slave_1: entered promiscuous mode [ 78.929253][ T5852] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.936989][ T5852] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.944562][ T5852] bridge_slave_1: entered allmulticast mode [ 78.951383][ T5852] bridge_slave_1: entered promiscuous mode [ 78.988012][ T5853] chnl_net:caif_netlink_parms(): no params data found [ 79.067920][ T5852] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.097234][ T5848] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.104807][ T5848] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.112249][ T5848] bridge_slave_0: entered allmulticast mode [ 79.119267][ T5848] bridge_slave_0: entered promiscuous mode [ 79.128629][ T5849] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.140006][ T5852] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.171109][ T5848] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.178583][ T5848] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.187035][ T5848] bridge_slave_1: entered allmulticast mode [ 79.194109][ T5848] bridge_slave_1: entered promiscuous mode [ 79.214217][ T5849] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.269247][ T5852] team0: Port device team_slave_0 added [ 79.277885][ T5852] team0: Port device team_slave_1 added [ 79.284697][ T5851] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.291943][ T5851] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.300148][ T5851] bridge_slave_0: entered allmulticast mode [ 79.307130][ T5851] bridge_slave_0: entered promiscuous mode [ 79.326258][ T5848] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.358127][ T5851] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.366571][ T5851] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.374419][ T5851] bridge_slave_1: entered allmulticast mode [ 79.381281][ T5851] bridge_slave_1: entered promiscuous mode [ 79.400088][ T5848] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.411843][ T5849] team0: Port device team_slave_0 added [ 79.420948][ T5849] team0: Port device team_slave_1 added [ 79.447032][ T5853] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.454553][ T5853] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.461756][ T5853] bridge_slave_0: entered allmulticast mode [ 79.468920][ T5853] bridge_slave_0: entered promiscuous mode [ 79.505162][ T5852] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.512619][ T5852] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.539258][ T5852] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.567677][ T5853] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.578955][ T5853] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.586358][ T5853] bridge_slave_1: entered allmulticast mode [ 79.594482][ T5853] bridge_slave_1: entered promiscuous mode [ 79.611320][ T5848] team0: Port device team_slave_0 added [ 79.619662][ T5848] team0: Port device team_slave_1 added [ 79.635066][ T5849] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.642088][ T5849] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.668316][ T5849] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.681042][ T5852] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.689150][ T5852] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.715890][ T5852] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.730593][ T5851] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.767997][ T5849] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.775152][ T5849] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.801826][ T5849] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.826312][ T5851] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.847900][ T5853] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.857781][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.865110][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.891164][ T5848] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.904047][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.911056][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.937084][ T5848] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.976480][ T5849] hsr_slave_0: entered promiscuous mode [ 79.983550][ T5849] hsr_slave_1: entered promiscuous mode [ 80.003131][ T5845] Bluetooth: hci3: command tx timeout [ 80.007409][ T5851] team0: Port device team_slave_0 added [ 80.017212][ T5853] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.054413][ T5851] team0: Port device team_slave_1 added [ 80.082604][ T5845] Bluetooth: hci1: command tx timeout [ 80.082611][ T5846] Bluetooth: hci0: command tx timeout [ 80.153219][ T5848] hsr_slave_0: entered promiscuous mode [ 80.159715][ T5848] hsr_slave_1: entered promiscuous mode [ 80.165467][ T5845] Bluetooth: hci4: command tx timeout [ 80.165916][ T5845] Bluetooth: hci2: command tx timeout [ 80.178085][ T5848] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 80.186079][ T5848] Cannot create hsr debugfs directory [ 80.195482][ T5852] hsr_slave_0: entered promiscuous mode [ 80.204582][ T5852] hsr_slave_1: entered promiscuous mode [ 80.211189][ T5852] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 80.218833][ T5852] Cannot create hsr debugfs directory [ 80.254455][ T5853] team0: Port device team_slave_0 added [ 80.263233][ T5853] team0: Port device team_slave_1 added [ 80.278392][ T5851] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 80.290110][ T5851] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 80.316618][ T5851] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 80.329794][ T5851] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.336894][ T5851] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 80.362942][ T5851] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.422035][ T5853] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 80.429326][ T5853] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 80.455488][ T5853] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 80.494874][ T5853] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.501880][ T5853] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 80.528306][ T5853] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.649582][ T5851] hsr_slave_0: entered promiscuous mode [ 80.656542][ T5851] hsr_slave_1: entered promiscuous mode [ 80.663151][ T5851] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 80.670781][ T5851] Cannot create hsr debugfs directory [ 80.718318][ T5853] hsr_slave_0: entered promiscuous mode [ 80.725080][ T5853] hsr_slave_1: entered promiscuous mode [ 80.731569][ T5853] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 80.739852][ T5853] Cannot create hsr debugfs directory [ 80.938674][ T5849] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 80.959828][ T5849] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 81.001578][ T5849] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 81.028693][ T5849] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 81.062066][ T5852] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 81.071885][ T5852] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 81.087481][ T5852] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 81.097683][ T5852] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 81.171417][ T5848] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 81.183581][ T5848] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 81.198304][ T5848] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 81.209223][ T5848] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 81.267114][ T5851] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 81.281443][ T5851] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 81.306915][ T5851] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 81.335984][ T5851] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 81.425533][ T5853] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 81.438538][ T5853] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 81.471088][ T5853] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 81.497719][ T5853] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 81.518987][ T5849] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.555749][ T5848] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.612084][ T5849] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.624662][ T5848] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.643896][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.651153][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.671603][ T3480] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.678808][ T3480] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.710315][ T3480] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.717498][ T3480] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.731516][ T5852] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.795973][ T3480] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.803181][ T3480] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.836041][ T5852] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.864795][ T5851] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.904985][ T52] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.912103][ T52] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.930298][ T5851] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.945830][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.953041][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.983464][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.990624][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.038066][ T52] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.045277][ T52] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.083490][ T5853] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.083751][ T5845] Bluetooth: hci3: command tx timeout [ 82.110750][ T5849] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.139752][ T5853] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.162840][ T5845] Bluetooth: hci0: command tx timeout [ 82.163133][ T5846] Bluetooth: hci1: command tx timeout [ 82.179958][ T5848] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.221866][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.229065][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.243740][ T5846] Bluetooth: hci4: command tx timeout [ 82.244281][ T5845] Bluetooth: hci2: command tx timeout [ 82.250603][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.262013][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.313449][ T5852] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.364706][ T5849] veth0_vlan: entered promiscuous mode [ 82.429669][ T5849] veth1_vlan: entered promiscuous mode [ 82.489117][ T5848] veth0_vlan: entered promiscuous mode [ 82.527299][ T5848] veth1_vlan: entered promiscuous mode [ 82.539684][ T5852] veth0_vlan: entered promiscuous mode [ 82.564379][ T5849] veth0_macvtap: entered promiscuous mode [ 82.575749][ T5849] veth1_macvtap: entered promiscuous mode [ 82.599877][ T5849] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 82.623567][ T5849] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 82.631741][ T5852] veth1_vlan: entered promiscuous mode [ 82.654157][ T5849] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.663906][ T5849] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.672892][ T5849] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.681635][ T5849] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.701436][ T5851] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.714686][ T5853] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.744718][ T5848] veth0_macvtap: entered promiscuous mode [ 82.785695][ T5848] veth1_macvtap: entered promiscuous mode [ 82.840938][ T5852] veth0_macvtap: entered promiscuous mode [ 82.850447][ T5848] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 82.862040][ T5848] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.874152][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 82.897871][ T5852] veth1_macvtap: entered promiscuous mode [ 82.917988][ T5848] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 82.930580][ T5848] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 82.944322][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 82.982706][ T3480] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.984189][ T5848] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.990717][ T3480] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.010134][ T5848] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.019285][ T5848] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.029150][ T5848] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.051639][ T5853] veth0_vlan: entered promiscuous mode [ 83.087312][ T5851] veth0_vlan: entered promiscuous mode [ 83.098345][ T5852] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 83.110370][ T5852] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.120667][ T5852] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 83.132713][ T5852] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.144137][ T5852] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.161363][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.170208][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.197018][ T5851] veth1_vlan: entered promiscuous mode [ 83.213729][ T5852] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 83.224806][ T5852] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.237592][ T5852] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 83.248368][ T5852] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.259976][ T5852] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.301853][ T5852] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.302449][ T5849] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 83.311045][ T5852] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.334912][ T5852] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.344215][ T5852] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.355986][ T5853] veth1_vlan: entered promiscuous mode [ 83.400256][ T5853] veth0_macvtap: entered promiscuous mode [ 83.454523][ T5853] veth1_macvtap: entered promiscuous mode [ 83.525711][ T5851] veth0_macvtap: entered promiscuous mode [ 83.539806][ T3480] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.561563][ T3480] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.574353][ T5853] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 83.591771][ T5853] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.603415][ T5853] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 83.614011][ T5853] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.624292][ T5853] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 83.634848][ T5853] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.647768][ T5853] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.709445][ T5896] syz.0.1 uses obsolete (PF_INET,SOCK_PACKET) [ 83.724077][ T5853] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 83.736116][ T5853] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.748211][ T5853] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 83.759832][ T5853] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.770789][ T5853] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 83.787095][ T5853] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.799127][ T5853] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.827406][ T5851] veth1_macvtap: entered promiscuous mode [ 83.848147][ T3480] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.863996][ T5853] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.878854][ T3480] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.888775][ T5853] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.900593][ T5853] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.910191][ T5853] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.037876][ T52] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.052815][ T5851] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.064519][ T52] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.073066][ T5851] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.097681][ T5851] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.113428][ T5851] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.127033][ T5851] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.141711][ T5851] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.160618][ T5851] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.172995][ T5845] Bluetooth: hci3: command tx timeout [ 84.178520][ T5851] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.193152][ T5851] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.243281][ T5845] Bluetooth: hci1: command tx timeout [ 84.243344][ T5846] Bluetooth: hci0: command tx timeout [ 84.257691][ T5851] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 84.286730][ T5851] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.301363][ T5851] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 84.315389][ T5851] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.322666][ T5846] Bluetooth: hci4: command tx timeout [ 84.330825][ T5846] Bluetooth: hci2: command tx timeout [ 84.340317][ T5851] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 84.366775][ T5851] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.382427][ T5851] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 84.397356][ T5851] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.414039][ T5851] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.454004][ T5851] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.472315][ T5851] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.481103][ T5851] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.497961][ T5851] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.543917][ T3480] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.562096][ T3480] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.595432][ T3480] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.617474][ T3480] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.632096][ T3505] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.650439][ T3505] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.803154][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 84.842599][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 84.992529][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 85.022485][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 85.047134][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.067411][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.277315][ T52] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.286216][ T52] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.532733][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 85.541082][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 85.549672][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 85.558199][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 85.567124][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 85.576464][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 85.764744][ T5890] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 85.803807][ T5916] Context (ID=0x1) not attached to queue pair (handle=0x1:0x0) [ 85.932340][ T5890] usb 1-1: Using ep0 maxpacket: 32 [ 85.966400][ T5890] usb 1-1: config 0 has an invalid interface number: 12 but max is 0 [ 85.998361][ T5890] usb 1-1: config 0 has no interface number 0 [ 86.023282][ T51] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 86.042433][ T25] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 86.050368][ T5890] usb 1-1: too many endpoints for config 0 interface 12 altsetting 2: 235, using maximum allowed: 30 [ 86.118218][ T5890] usb 1-1: config 0 interface 12 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 86.146529][ T5890] usb 1-1: config 0 interface 12 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 86.188608][ T5890] usb 1-1: config 0 interface 12 altsetting 2 has 2 endpoint descriptors, different from the interface descriptor's value: 235 [ 86.226925][ T25] usb 5-1: device descriptor read/64, error -71 [ 86.242739][ T5846] Bluetooth: hci3: command tx timeout [ 86.244522][ T51] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 86.262032][ T5890] usb 1-1: config 0 interface 12 has no altsetting 0 [ 86.292498][ T51] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 86.304474][ T5890] usb 1-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 86.328616][ T5846] Bluetooth: hci1: command tx timeout [ 86.334762][ T5846] Bluetooth: hci0: command tx timeout [ 86.366249][ T5890] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 86.376985][ T51] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 86.405636][ T5845] Bluetooth: hci2: command tx timeout [ 86.405651][ T5846] Bluetooth: hci4: command tx timeout [ 86.418740][ T5890] usb 1-1: Product: syz [ 86.423357][ T51] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 86.434983][ T5890] usb 1-1: Manufacturer: syz [ 86.448082][ T5890] usb 1-1: SerialNumber: syz [ 86.494362][ T51] usb 4-1: config 0 descriptor?? [ 86.502742][ T5890] usb 1-1: config 0 descriptor?? [ 86.520577][ T5890] f81534 1-1:0.12: unsupported endpoint max packet size [ 86.528079][ T25] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 86.662440][ T25] usb 5-1: device descriptor read/64, error -71 [ 86.717014][ T5890] usb 1-1: USB disconnect, device number 2 [ 86.804241][ T25] usb usb5-port1: attempt power cycle [ 86.956274][ T5845] Bluetooth: hci1: SCO packet for unknown connection handle 0 [ 87.172301][ T25] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 87.362502][ T25] usb 5-1: device descriptor read/8, error -71 [ 87.632480][ T25] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 87.663099][ T25] usb 5-1: device descriptor read/8, error -71 [ 87.703512][ T5939] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 88.241747][ T25] usb usb5-port1: unable to enumerate USB device [ 88.249215][ T51] uclogic 0003:256C:006D.0001: failed retrieving string descriptor #100: -71 [ 88.258753][ T51] uclogic 0003:256C:006D.0001: failed retrieving pen parameters: -71 [ 88.267126][ T51] uclogic 0003:256C:006D.0001: failed probing pen v1 parameters: -71 [ 88.275773][ T51] uclogic 0003:256C:006D.0001: failed probing parameters: -71 [ 88.284580][ T51] uclogic 0003:256C:006D.0001: probe with driver uclogic failed with error -71 [ 88.374433][ T51] usb 4-1: USB disconnect, device number 2 [ 88.834447][ T29] audit: type=1326 audit(1736742686.074:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5947 comm="syz.2.13" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fbb6c385d29 code=0x0 [ 88.991618][ T29] audit: type=1326 audit(1736742686.214:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5953 comm="syz.3.16" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fb6af985d29 code=0x0 [ 90.037804][ T5988] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 90.104472][ T5988] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 90.164378][ T5988] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 91.299014][ T5892] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 91.507044][ T5892] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 91.551505][ T5892] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 91.638079][ T5892] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 91.691497][ T5892] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 91.757207][ T5892] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 91.776052][ T6003] syz.1.22 (6003): drop_caches: 2 [ 91.797428][ T5892] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 91.839244][ T5892] usb 1-1: config 0 descriptor?? [ 91.869540][ T6006] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 92.246183][ T8] cfg80211: failed to load regulatory.db [ 92.283383][ T6021] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 92.306955][ T6023] netlink: 666 bytes leftover after parsing attributes in process `syz.2.25'. [ 92.327309][ T5892] plantronics 0003:047F:FFFF.0002: unknown main item tag 0xd [ 92.368441][ T5892] plantronics 0003:047F:FFFF.0002: No inputs registered, leaving [ 92.418279][ T5892] plantronics 0003:047F:FFFF.0002: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 92.660772][ T6028] RDS: rds_bind could not find a transport for ::ffff:10.1.1.0, load rds_tcp or rds_rdma? [ 93.102349][ T5888] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 93.290309][ T5888] usb 3-1: Using ep0 maxpacket: 32 [ 93.298778][ T5888] usb 3-1: config 0 has an invalid interface number: 115 but max is 0 [ 93.307606][ T5888] usb 3-1: config 0 has no interface number 0 [ 93.314170][ T5888] usb 3-1: config 0 interface 115 has no altsetting 0 [ 93.327377][ T5888] usb 3-1: New USB device found, idVendor=03f0, idProduct=3239, bcdDevice=c1.64 [ 93.343941][ T5888] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.352856][ T5888] usb 3-1: Product: syz [ 93.357358][ T5888] usb 3-1: Manufacturer: syz [ 93.362017][ T5888] usb 3-1: SerialNumber: syz [ 93.369917][ T5888] usb 3-1: config 0 descriptor?? [ 93.383535][ T5888] pl2303 3-1:0.115: required interrupt-in endpoint missing [ 93.718490][ T5888] usb 1-1: USB disconnect, device number 3 [ 93.829479][ T51] usb 3-1: USB disconnect, device number 2 [ 93.964465][ T6045] capability: warning: `syz.2.29' uses deprecated v2 capabilities in a way that may be insecure [ 94.332637][ T51] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 94.357869][ T6048] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 94.509493][ T6048] batadv_slave_1: entered promiscuous mode [ 94.540178][ T6045] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 94.568596][ T6045] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 94.604033][ T6045] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 94.721415][ T51] usb 3-1: unable to get BOS descriptor or descriptor too short [ 94.754431][ T51] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 94.787180][ T51] usb 3-1: can't read configurations, error -71 [ 95.543166][ T6094] Zero length message leads to an empty skb [ 95.647243][ T5892] usb 5-1: new full-speed USB device number 6 using dummy_hcd [ 95.828262][ T5892] usb 5-1: not running at top speed; connect to a high speed hub [ 95.850583][ T5892] usb 5-1: config 5 has an invalid interface number: 148 but max is 0 [ 95.889836][ T5892] usb 5-1: config 5 has no interface number 0 [ 95.909958][ T5892] usb 5-1: config 5 interface 148 altsetting 1 endpoint 0xC has an invalid bInterval 250, changing to 4 [ 95.940315][ T6101] netlink: 216 bytes leftover after parsing attributes in process `syz.2.37'. [ 95.969560][ T5892] usb 5-1: config 5 interface 148 altsetting 1 endpoint 0xD has invalid wMaxPacketSize 0 [ 96.021714][ T5892] usb 5-1: config 5 interface 148 has no altsetting 0 [ 96.103206][ T5892] usb 5-1: New USB device found, idVendor=05ac, idProduct=d181, bcdDevice=b4.a2 [ 96.131463][ T5892] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 96.142413][ T973] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 96.204769][ T5892] usb 5-1: Product: syz [ 96.251038][ T5892] usb 5-1: Manufacturer: syz [ 96.313910][ T5892] usb 5-1: SerialNumber: syz [ 96.332413][ T973] usb 4-1: Using ep0 maxpacket: 8 [ 96.363972][ T973] usb 4-1: unable to get BOS descriptor or descriptor too short [ 96.424723][ T973] usb 4-1: config index 0 descriptor too short (expected 44018, got 36) [ 96.498969][ T973] usb 4-1: config 208 has too many interfaces: 223, using maximum allowed: 32 [ 96.581496][ T973] usb 4-1: config 208 has an invalid descriptor of length 0, skipping remainder of the config [ 96.594221][ T6084] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 96.680634][ T6084] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 96.706407][ T973] usb 4-1: config 208 has 0 interfaces, different from the descriptor's value: 223 [ 96.842723][ T973] usb 4-1: New USB device found, idVendor=05ac, idProduct=1240, bcdDevice= 0.3c [ 96.843187][ T6119] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 96.860407][ T973] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 96.860444][ T973] usb 4-1: Product: syz [ 96.860462][ T973] usb 4-1: Manufacturer: syz [ 96.860515][ T973] usb 4-1: SerialNumber: syz [ 96.920796][ T6119] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 97.031053][ T5892] ipheth 5-1:5.148: Unable to find endpoints [ 97.090745][ T5892] usb 5-1: USB disconnect, device number 6 [ 97.242430][ T5891] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 97.397902][ T5891] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 97.442508][ T5891] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 97.451753][ T5891] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 97.506362][ T5891] usb 1-1: config 0 descriptor?? [ 97.605646][ T3619] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 97.796435][ T3619] usb 3-1: Using ep0 maxpacket: 8 [ 97.820654][ T3619] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 13 [ 97.853089][ T3619] usb 3-1: New USB device found, idVendor=046d, idProduct=08ae, bcdDevice=11.58 [ 97.866516][ T3619] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 97.902310][ T3619] usb 3-1: Product: syz [ 97.925614][ T3619] usb 3-1: Manufacturer: syz [ 97.932847][ T5891] keytouch 0003:0926:3333.0003: fixing up Keytouch IEC report descriptor [ 97.953257][ T3619] usb 3-1: SerialNumber: syz [ 97.971094][ T5891] input: HID 0926:3333 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0926:3333.0003/input/input6 [ 97.973589][ T3619] usb 3-1: config 0 descriptor?? [ 98.018026][ T3619] gspca_main: gspca_zc3xx-2.14.0 probing 046d:08ae [ 98.261246][ T5891] keytouch 0003:0926:3333.0003: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.0-1/input0 [ 98.349384][ T6087] usb usb1: usbfs: process 6087 (syz.0.35) did not claim interface 0 before use [ 98.378155][ T5891] usb 1-1: USB disconnect, device number 4 [ 98.541444][ T6153] FAULT_INJECTION: forcing a failure. [ 98.541444][ T6153] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 98.571721][ T6153] CPU: 1 UID: 0 PID: 6153 Comm: syz.4.46 Not tainted 6.13.0-rc6-syzkaller-00290-gbe548645527a #0 [ 98.582327][ T6153] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 98.592452][ T6153] Call Trace: [ 98.595783][ T6153] [ 98.598730][ T6153] dump_stack_lvl+0x241/0x360 [ 98.603460][ T6153] ? __pfx_dump_stack_lvl+0x10/0x10 [ 98.608713][ T6153] ? __pfx__printk+0x10/0x10 [ 98.613344][ T6153] ? __pfx_lock_release+0x10/0x10 [ 98.618441][ T6153] should_fail_ex+0x3b0/0x4e0 [ 98.623206][ T6153] fpu__restore_sig+0x1c0/0x1270 [ 98.628206][ T6153] ? __pfx_fpu__restore_sig+0x10/0x10 [ 98.633629][ T6153] ? __might_fault+0xc6/0x120 [ 98.638361][ T6153] restore_sigcontext+0x675/0x7d0 [ 98.643447][ T6153] ? __pfx___might_resched+0x10/0x10 [ 98.648838][ T6153] ? __pfx_restore_sigcontext+0x10/0x10 [ 98.654459][ T6153] ? __fget_files+0x2a/0x410 [ 98.659099][ T6153] __do_sys_rt_sigreturn+0x1b9/0x280 [ 98.664452][ T6153] ? __pfx___do_sys_rt_sigreturn+0x10/0x10 [ 98.670327][ T6153] ? do_syscall_64+0x100/0x230 [ 98.675181][ T6153] ? do_syscall_64+0xb6/0x230 [ 98.680051][ T6153] do_syscall_64+0xf3/0x230 [ 98.684673][ T6153] ? clear_bhb_loop+0x35/0x90 [ 98.689386][ T6153] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 98.695362][ T6153] RIP: 0003:0x7f312b89f940 [ 98.699827][ T6153] Code: 00 00 00 00 00 00 00 00 00 00 27 fa 89 2b 31 7f 00 00 a0 c8 53 2b 31 7f 00 00 01 80 ad fb 00 00 00 00 10 01 00 00 00 00 00 00 <00> 0f 3d 00 00 00 00 00 90 59 36 2c 31 7f 00 00 90 59 36 2c 31 7f [ 98.719502][ T6153] RSP: 0003:00007f312b775fac EFLAGS: 000502c2 [ 98.725625][ T6153] RAX: 00007f312b775fa8 RBX: 000000001db43952 RCX: 00007f312b775fa0 [ 98.733638][ T6153] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 98.741644][ T6153] RBP: 0000000000000062 R08: 00007f312b775fa0 R09: 0000000000000000 [ 98.749657][ T6153] R10: 0000000300001100 R11: 00007f312b6fcc20 R12: 0000000000000062 [ 98.757663][ T6153] R13: 000000001db877ca R14: 0000000000000033 R15: 0000000000000000 [ 98.765704][ T6153] [ 98.802383][ T3619] gspca_zc3xx: reg_w_i err -71 [ 99.001161][ T6135] syz.2.45 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 99.402999][ T3619] gspca_zc3xx: Unknown sensor - set to TAS5130C [ 99.409513][ T3619] gspca_zc3xx 3-1:0.0: probe with driver gspca_zc3xx failed with error -71 [ 99.444018][ T3619] usb 3-1: USB disconnect, device number 5 [ 99.880299][ T973] apple-mfi-fastcharge 4-1: USB disconnect, device number 3 [ 100.045514][ T6139] netlink: 96 bytes leftover after parsing attributes in process `syz.1.44'. [ 101.272386][ T973] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 101.422509][ T973] usb 3-1: device descriptor read/64, error -71 [ 101.452478][ T5891] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 101.613387][ T5891] usb 1-1: Using ep0 maxpacket: 16 [ 101.638395][ T5891] usb 1-1: config 0 has an invalid descriptor of length 255, skipping remainder of the config [ 101.672399][ T973] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 101.686026][ T5891] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 101.722789][ T5891] usb 1-1: New USB device found, idVendor=8e2d, idProduct=4e08, bcdDevice=df.dc [ 101.736279][ T5891] usb 1-1: New USB device strings: Mfr=70, Product=2, SerialNumber=3 [ 101.745283][ T5891] usb 1-1: Product: syz [ 101.749681][ T5891] usb 1-1: Manufacturer: syz [ 101.754819][ T5891] usb 1-1: SerialNumber: syz [ 101.775470][ T5891] usb 1-1: config 0 descriptor?? [ 101.832602][ T973] usb 3-1: device descriptor read/64, error -71 [ 101.844799][ T6221] binder_alloc: 6220: binder_alloc_buf size 4096 failed, no address space [ 101.854185][ T6221] binder_alloc: allocated: 8 (num: 1 largest: 8), free: 4088 (num: 1 largest: 4088) [ 101.946501][ T973] usb usb3-port1: attempt power cycle [ 102.050197][ T6229] netlink: 12 bytes leftover after parsing attributes in process `E$:'. [ 102.070935][ T6228] netlink: 76 bytes leftover after parsing attributes in process `E$:'. [ 102.179246][ T5885] usb 1-1: USB disconnect, device number 5 [ 102.303642][ T973] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 102.352722][ T973] usb 3-1: device descriptor read/8, error -71 [ 102.602317][ T973] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 102.634481][ T973] usb 3-1: device descriptor read/8, error -71 [ 102.652287][ T3619] usb 4-1: new low-speed USB device number 4 using dummy_hcd [ 102.752704][ T973] usb usb3-port1: unable to enumerate USB device [ 102.836404][ T3619] usb 4-1: Invalid ep0 maxpacket: 64 [ 102.912855][ T6250] ------------[ cut here ]------------ [ 102.918649][ T6250] WARNING: CPU: 1 PID: 6250 at kernel/signal.c:2050 posixtimer_send_sigqueue+0xa08/0xce0 [ 102.928511][ T6250] Modules linked in: [ 102.932442][ T6250] CPU: 1 UID: 0 PID: 6250 Comm: syz.0.67 Not tainted 6.13.0-rc6-syzkaller-00290-gbe548645527a #0 [ 102.942970][ T6250] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 102.953055][ T6250] RIP: 0010:posixtimer_send_sigqueue+0xa08/0xce0 [ 102.959402][ T6250] Code: 00 0f 85 f4 02 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc e8 23 1e 3b 00 4c 8b 64 24 08 e9 28 ff ff ff 90 <0f> 0b 90 48 b8 00 00 00 00 00 fc ff df 80 3c 03 00 74 08 4c 89 f7 [ 102.979019][ T6250] RSP: 0018:ffffc9000b5f7b00 EFLAGS: 00010086 [ 102.985098][ T6250] RAX: dffffc0000000000 RBX: 1ffff11006856c3f RCX: ffff8880324b9e00 [ 102.993102][ T6250] RDX: 0000000000000000 RSI: 0000000000002000 RDI: 0000000000000000 [ 103.001085][ T6250] RBP: ffffc9000b5f7bf0 R08: ffffffff81647110 R09: 1ffffffff2854b12 [ 103.009064][ T6250] R10: dffffc0000000000 R11: fffffbfff2854b13 R12: ffff8880342b61e0 [ 103.017044][ T6250] R13: 1ffff11006856c4c R14: ffff8880342b61f8 R15: ffff8880342b62a0 [ 103.025026][ T6250] FS: 000055557754f500(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 [ 103.033964][ T6250] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 103.040550][ T6250] CR2: 00007f38d45f6d58 CR3: 0000000034850000 CR4: 00000000003526f0 [ 103.048532][ T6250] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 103.056511][ T6250] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 103.064490][ T6250] Call Trace: [ 103.067777][ T6250] [ 103.070713][ T6250] ? __warn+0x165/0x4d0 [ 103.074880][ T6250] ? posixtimer_send_sigqueue+0xa08/0xce0 [ 103.080626][ T6250] ? report_bug+0x2b3/0x500 [ 103.085169][ T6250] ? posixtimer_send_sigqueue+0xa08/0xce0 [ 103.090909][ T6250] ? handle_bug+0x60/0x90 [ 103.095243][ T6250] ? exc_invalid_op+0x1a/0x50 [ 103.099925][ T6250] ? asm_exc_invalid_op+0x1a/0x20 [ 103.104969][ T6250] ? prepare_signal+0x6c0/0xc90 [ 103.109834][ T6250] ? posixtimer_send_sigqueue+0xa08/0xce0 [ 103.115569][ T6250] ? posixtimer_send_sigqueue+0xd3/0xce0 [ 103.121221][ T6250] ? lockdep_hardirqs_on+0x99/0x150 [ 103.126437][ T6250] ? __pfx_posixtimer_send_sigqueue+0x10/0x10 [ 103.132527][ T6250] posix_cpu_timers_work+0x9dd/0x1490 [ 103.137928][ T6250] ? __pfx_posix_cpu_timers_work+0x10/0x10 [ 103.143775][ T6250] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 103.149163][ T6250] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 103.155159][ T6250] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 103.161499][ T6250] ? _raw_spin_lock_irq+0xdf/0x120 [ 103.166627][ T6250] ? _raw_spin_unlock_irq+0x23/0x50 [ 103.171839][ T6250] ? lockdep_hardirqs_on+0x99/0x150 [ 103.177056][ T6250] task_work_run+0x24f/0x310 [ 103.181672][ T6250] ? __pfx_task_work_run+0x10/0x10 [ 103.186803][ T6250] ? syscall_exit_to_user_mode+0xa3/0x340 [ 103.192540][ T6250] syscall_exit_to_user_mode+0x13f/0x340 [ 103.198218][ T6250] do_syscall_64+0x100/0x230 [ 103.202826][ T6250] ? clear_bhb_loop+0x35/0x90 [ 103.207513][ T6250] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.213421][ T6250] RIP: 0033:0x7f38d67ba589 [ 103.217847][ T6250] Code: 1b 08 00 48 8d 3d fc 1b 08 00 e8 12 29 f6 ff 66 90 b8 ea ff ff ff 48 85 ff 74 2c 48 85 d2 74 27 49 89 c8 b8 b3 01 00 00 0f 05 <48> 85 c0 7c 18 74 01 c3 31 ed 48 83 e4 f0 4c 89 c7 ff d2 48 89 c7 [ 103.237462][ T6250] RSP: 002b:00007f38d6a9f8f8 EFLAGS: 00000206 ORIG_RAX: 00000000000001b3 [ 103.245888][ T6250] RAX: 0000000000000033 RBX: 00007f38d673c9a0 RCX: 00007f38d67ba589 [ 103.253867][ T6250] RDX: 00007f38d673c9a0 RSI: 0000000000000058 RDI: 00007f38d6a9f940 [ 103.261848][ T6250] RBP: 00007f38d45f66c0 R08: 00007f38d45f66c0 R09: 00007f38d6a9fa27 [ 103.269828][ T6250] R10: 0000000000000008 R11: 0000000000000206 R12: ffffffffffffffa8 [ 103.277812][ T6250] R13: 000000000000000b R14: 00007f38d6a9f940 R15: 00007f38d6a9fa28 [ 103.285814][ T6250] [ 103.288851][ T6250] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 103.296136][ T6250] CPU: 1 UID: 0 PID: 6250 Comm: syz.0.67 Not tainted 6.13.0-rc6-syzkaller-00290-gbe548645527a #0 [ 103.306643][ T6250] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 103.316711][ T6250] Call Trace: [ 103.319996][ T6250] [ 103.322952][ T6250] dump_stack_lvl+0x241/0x360 [ 103.327653][ T6250] ? __pfx_dump_stack_lvl+0x10/0x10 [ 103.332889][ T6250] ? __pfx__printk+0x10/0x10 [ 103.337490][ T6250] ? _printk+0xd5/0x120 [ 103.341665][ T6250] ? __init_begin+0x41000/0x41000 [ 103.346704][ T6250] ? vscnprintf+0x5d/0x90 [ 103.351054][ T6250] panic+0x349/0x880 [ 103.354969][ T6250] ? __warn+0x174/0x4d0 [ 103.359147][ T6250] ? __pfx_panic+0x10/0x10 [ 103.363591][ T6250] __warn+0x344/0x4d0 [ 103.367583][ T6250] ? posixtimer_send_sigqueue+0xa08/0xce0 [ 103.373343][ T6250] report_bug+0x2b3/0x500 [ 103.377689][ T6250] ? posixtimer_send_sigqueue+0xa08/0xce0 [ 103.383427][ T6250] handle_bug+0x60/0x90 [ 103.387590][ T6250] exc_invalid_op+0x1a/0x50 [ 103.392119][ T6250] asm_exc_invalid_op+0x1a/0x20 [ 103.397080][ T6250] RIP: 0010:posixtimer_send_sigqueue+0xa08/0xce0 [ 103.403446][ T6250] Code: 00 0f 85 f4 02 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc e8 23 1e 3b 00 4c 8b 64 24 08 e9 28 ff ff ff 90 <0f> 0b 90 48 b8 00 00 00 00 00 fc ff df 80 3c 03 00 74 08 4c 89 f7 [ 103.423063][ T6250] RSP: 0018:ffffc9000b5f7b00 EFLAGS: 00010086 [ 103.429163][ T6250] RAX: dffffc0000000000 RBX: 1ffff11006856c3f RCX: ffff8880324b9e00 [ 103.437147][ T6250] RDX: 0000000000000000 RSI: 0000000000002000 RDI: 0000000000000000 [ 103.445147][ T6250] RBP: ffffc9000b5f7bf0 R08: ffffffff81647110 R09: 1ffffffff2854b12 [ 103.453149][ T6250] R10: dffffc0000000000 R11: fffffbfff2854b13 R12: ffff8880342b61e0 [ 103.461134][ T6250] R13: 1ffff11006856c4c R14: ffff8880342b61f8 R15: ffff8880342b62a0 [ 103.469121][ T6250] ? prepare_signal+0x6c0/0xc90 [ 103.473998][ T6250] ? posixtimer_send_sigqueue+0xd3/0xce0 [ 103.479650][ T6250] ? lockdep_hardirqs_on+0x99/0x150 [ 103.484866][ T6250] ? __pfx_posixtimer_send_sigqueue+0x10/0x10 [ 103.490954][ T6250] posix_cpu_timers_work+0x9dd/0x1490 [ 103.496349][ T6250] ? __pfx_posix_cpu_timers_work+0x10/0x10 [ 103.502192][ T6250] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 103.507593][ T6250] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 103.513592][ T6250] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 103.519932][ T6250] ? _raw_spin_lock_irq+0xdf/0x120 [ 103.525060][ T6250] ? _raw_spin_unlock_irq+0x23/0x50 [ 103.530266][ T6250] ? lockdep_hardirqs_on+0x99/0x150 [ 103.535494][ T6250] task_work_run+0x24f/0x310 [ 103.540111][ T6250] ? __pfx_task_work_run+0x10/0x10 [ 103.545239][ T6250] ? syscall_exit_to_user_mode+0xa3/0x340 [ 103.550975][ T6250] syscall_exit_to_user_mode+0x13f/0x340 [ 103.556635][ T6250] do_syscall_64+0x100/0x230 [ 103.561268][ T6250] ? clear_bhb_loop+0x35/0x90 [ 103.565953][ T6250] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.571884][ T6250] RIP: 0033:0x7f38d67ba589 [ 103.576310][ T6250] Code: 1b 08 00 48 8d 3d fc 1b 08 00 e8 12 29 f6 ff 66 90 b8 ea ff ff ff 48 85 ff 74 2c 48 85 d2 74 27 49 89 c8 b8 b3 01 00 00 0f 05 <48> 85 c0 7c 18 74 01 c3 31 ed 48 83 e4 f0 4c 89 c7 ff d2 48 89 c7 [ 103.595949][ T6250] RSP: 002b:00007f38d6a9f8f8 EFLAGS: 00000206 ORIG_RAX: 00000000000001b3 [ 103.604390][ T6250] RAX: 0000000000000033 RBX: 00007f38d673c9a0 RCX: 00007f38d67ba589 [ 103.612416][ T6250] RDX: 00007f38d673c9a0 RSI: 0000000000000058 RDI: 00007f38d6a9f940 [ 103.620435][ T6250] RBP: 00007f38d45f66c0 R08: 00007f38d45f66c0 R09: 00007f38d6a9fa27 [ 103.628421][ T6250] R10: 0000000000000008 R11: 0000000000000206 R12: ffffffffffffffa8 [ 103.636404][ T6250] R13: 000000000000000b R14: 00007f38d6a9f940 R15: 00007f38d6a9fa28 [ 103.644396][ T6250] [ 104.797096][ T6250] Shutting down cpus with NMI [ 104.802241][ T6250] Kernel Offset: disabled [ 104.806682][ T6250] Rebooting in 86400 seconds..