last executing test programs: 32m47.061425114s ago: executing program 1 (id=169): r0 = socket$inet6(0xa, 0x1, 0x0) r1 = epoll_create1(0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80042, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000040)={0x120000009}) close_range(r0, 0xffffffffffffffff, 0x0) 32m40.157002137s ago: executing program 1 (id=171): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="18020000000000020000000000000000850000001700000095"], &(0x7f00000005c0)='GPL\x00'}, 0x94) r4 = socket(0x10, 0x803, 0x8) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000005c0)={0x6, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x50) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) r5 = socket$netlink(0x10, 0x3, 0x0) getsockname$packet(r4, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r6, @ANYBLOB="00001000252155b21c0012000c000100626f6e"], 0x3c}}, 0x40000) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000001c0)={r3, r6, 0x25, 0x0, @val=@netkit={@void, @value=r3}}, 0x1c) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=r2, @ANYBLOB="46ff0f00000000001c00128009000100626f6e64000000000c000280050001"], 0x3c}, 0x1, 0x0, 0x0, 0x690}, 0x20048040) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 32m27.944860573s ago: executing program 1 (id=173): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000000000010d21f076000000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) syz_usb_control_io$hid(r0, &(0x7f0000000480)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x5, {[@main=@item_4={0x3, 0x0, 0xa, "8baa2d70"}]}}, 0x0}, 0x0) 32m14.354393046s ago: executing program 1 (id=176): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x40040, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000880)=@newqdisc={0x70, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x44, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5a, 0x0, 0x84d, 0x9, 0x1, 0x800}, {0x8c, 0x1, 0xfffc, 0x7fff, 0x2, 0xb}, 0x5, 0x34, 0x91f}}, @TCA_TBF_PRATE64={0xc, 0x5, 0xc2240edb8ac75ac7}, @TCA_TBF_RATE64={0xc, 0x4, 0xdd31e353c9fd1eb}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x40088c1}, 0x50) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xb}, {0xe, 0xffea}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x9, 0x1}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x2400c061}, 0x4890) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$kcm(r1, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0xdd86, 0x0, 0x3e}, 0x80, &(0x7f0000000280)=[{&(0x7f0000000900)='l', 0x1}], 0x1}, 0x4) 31m45.11382651s ago: executing program 1 (id=179): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)={0x40, r1, 0x601, 0x0, 0x25dfdbff, {}, [@TIPC_NLA_LINK={0x2c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x5, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xa1}]}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x20044885}, 0x0) 31m36.1456644s ago: executing program 1 (id=182): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x800) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev, @in6=@mcast1, 0x0, 0x0, 0xffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x1}, {0x0, 0x1}, 0x0, 0x0, 0x1}, {{@in=@rand_addr=0x64010102, 0x4d5, 0x33}, 0x2, @in6=@loopback, 0x0, 0x0, 0x0, 0xb7, 0x0, 0x8000000}}, 0xe8) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x0) 30m48.218134016s ago: executing program 32 (id=182): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x800) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev, @in6=@mcast1, 0x0, 0x0, 0xffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x1}, {0x0, 0x1}, 0x0, 0x0, 0x1}, {{@in=@rand_addr=0x64010102, 0x4d5, 0x33}, 0x2, @in6=@loopback, 0x0, 0x0, 0x0, 0xb7, 0x0, 0x8000000}}, 0xe8) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x0) 11m59.51486028s ago: executing program 2 (id=388): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="18020000000000020000000000000000850000001700000095"], &(0x7f00000005c0)='GPL\x00'}, 0x94) r4 = socket(0x10, 0x803, 0x8) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000005c0)={0x6, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x50) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) r5 = socket$netlink(0x10, 0x3, 0x0) getsockname$packet(r4, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r6, @ANYBLOB="00001000252155b21c0012000c000100626f6e64"], 0x3c}}, 0x40000) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000001c0)={r3, r6, 0x25, 0x0, @val=@netkit={@void, @value=r3}}, 0x1c) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x690}, 0x20048040) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 11m49.642623459s ago: executing program 2 (id=392): ioctl$KDFONTOP_SET(0xffffffffffffffff, 0x4b72, &(0x7f0000000040)={0x0, 0x0, 0x8, 0x4, 0x200, 0x0}) socket$packet(0x11, 0x3, 0x300) r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x530, 0x1d8, 0xffffffff, 0xffffffff, 0x1d8, 0xffffffff, 0x460, 0xffffffff, 0xffffffff, 0x460, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1d8, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1, [0xff000000, 0xffffffff, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x39a}, 0x100, 0x20}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x590) r1 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x3, 0xc, @dev={0xfe, 0x80, '\x00', 0xd}, 0x9}, 0x1c) sendmmsg$unix(r1, &(0x7f0000007b80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2404c054}}], 0x1, 0x2000c080) sendmsg(r1, &(0x7f00000000c0)={0x0, 0x33, &(0x7f0000000100)=[{&(0x7f0000000000)=',', 0x588}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 11m30.580660404s ago: executing program 2 (id=395): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x5, 0x5, 0x2, 0x7, 0x0, 0x1, 0x10000}, 0x50) close(r0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x9, 0x8, 0x8000, 0x1, 0x0, 0xffffffffffffffff, 0x27d}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r1}, &(0x7f00000002c0), &(0x7f0000000300)}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4000}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xffffffff}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r2, r0}, 0xc) 11m28.640134661s ago: executing program 2 (id=396): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="18020000000000020000000000000000850000001700000095"], &(0x7f00000005c0)='GPL\x00'}, 0x94) r4 = socket(0x10, 0x803, 0x8) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000005c0)={0x6, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x50) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) r5 = socket$netlink(0x10, 0x3, 0x0) getsockname$packet(r4, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r6, @ANYBLOB="00001000252155b21c0012000c000100626f6e64"], 0x3c}}, 0x40000) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000001c0)={r3, r6, 0x25, 0x0, @val=@netkit={@void, @value=r3}}, 0x1c) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=r2, @ANYBLOB], 0x3c}, 0x1, 0x0, 0x0, 0x690}, 0x20048040) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 11m16.740356818s ago: executing program 2 (id=399): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x8840, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b7000000016d0cffbfa30000000000000703000020feffff720af0fff8ffffff71a4f0ff000000003704000000ffffffdd4005000000000034000000016d00007b130000000000001d440100000000007a0a00fe00ffffffdb03000040000000b5000000000000009500000000000000023bc065b70300c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e51815548000000000000000275daf51efd601b6bf01c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7f300c095199fe3ff3128e599b0eaebbdbd732c9cc20eec363e4a8f6456e5ccae25ea21714eca8cf5d803e04d83b46e21557c0afc646cb7790b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845b9f75dd08d123deda8ebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987af1714e72ba7616536fd9aa58f2477184b6a89adaf17b0baf587aef370a2d426a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a277c7a775d55dfc28abbe9b5ea62d84f3a10746443d64364f56e24e6d2105bd901128c7e0ec82770c8206b1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee7d26b34381fcb59b854e9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67051d355d84ce97bb0c6b4a595e487efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599ddd71063be9261eee52216d009df5daf87068a602a018628efc56c752af4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d96c2ea3e2e04cfe031b287539d0540059fe6c7fe7c3abee0712f5f6b4ee5e459493113d8697502c7596566d674e425da5e87e59602a9f6590521d36f38df9ba60248d9a0d61282dfb15eb6841bb64a1b3045024a982f3c48153baae2c4e7bf37548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c3560811ea6c3560a43364d402ccdd9069bd50b994fd6a34ee18022a579dfc0229cc0dc9881610270928eeeb883418f562ae00003ea96d10f172c0374d6eed826407000000000000004a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca5f1380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea52acb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d851680f6f2f9a6a8906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f4ca2195234648e0a1ca50db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7bea19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145eb6dc5f6a9037d2283c42efc54fa84323a3304f41ff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f928ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f80724a5bfc1e8890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f068840a754c02180d61542c2571f983e96735600000554f327a353511ccedde99493c31ac05a7b57f03ca91a01ba2c60ca99e8ebc15ecfd64bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d40460780000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120968308c31db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98c2c73e1661261173f359e93d2c80000000999d09ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebccbaf1ea4a003fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9e0600f86909bc90addb7b9aee813df534aac494e0b32fc7741c7e3f426b9ed20debd883593ff5d691b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a000000000000000000000000000006acc19808d7cf29bc974b0ea92499a419aa095e203c1bafbb9b9a7c2bca3f0a18ee4952f2d325a56390578f12205db653a536f0100e0eda300a43a13bd1b9f3322405d1efd78e578dc6b3fb84f3738a4b6caa84feda91f3edb32231ec75300000000000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a42b46979f99f6a1527f004f1e37a3926937e84fb478199dc1ac486e2ea6020f4beb98b88b5e7885e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d0f086b3f03b20d546fa66a72e38207c9d20035ab63de71a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db1829f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a2744c46570e8f46da1ab990ca053cbfe801000000000000000000000000000000d55d7182af2ea5f8d0ad495e3eb9421963a5a683c3dcb2d300aa3b2cfe946d2348c35f5d67d68ac07c8f84b3679e77c2e629ecec7c12c35d6b6971b8ae13cc00956d2245e761f5a3bfdcdc18ac27db60c0a461ed2b3ecfb16d19037c8c88c91dda1f904fbbc864e95ad43d6dd6d5eadbcea25682ba4b91e14c3fbfdfd1d680e7f13a65dbaa1af102d97681656bf56ff0cf36518f674237ce097d39008cc3257778de878bcd37467386f993be6d20c93a7791e7f2a155ce379b4cda2500108052aeb9bd03ffbda9ff485d6576a492d436d52edcd420e7deaa4343a0add3941ae7c5f58af43866ca64750f43e583ca1ceb3a805e46beef9dca77a4edcbb42aa0caf0bbd6cec72d85540293cb4849b0610800000000000000000000000000000000f9814d5f6c8673c143ff2f901e71b8818665b56f7a03afe3d900007656859db4cb06aaaf9f02cfab5b9e61cc00e8e19429921b8df4c4c53bddea4cc48737842952ff08aeac15685df194ca89da8cf6d29a2be9779181fd5d105af5786094d9130f5826b18b9667b971a994f3fd069629a1052f441e96884fcdc91f4a974242aabfc8adbadc9ca27955b5c90f0bd9a46ed044272383d3768871a9c8cfd7948aea445c55684351002ed4a4af45341de8e5e1f33624bd2ec1591dd00bbe05000000f89a928662e9b9449db34394fc5e946fadaee576e28ac0feab4e3585ed43d206218f524083840a78b723621f3b706bb7f5e42b5376642f8ad4028d4ead407240e7467d1b37afe20690d7672c7e926fded95cf805516ad836eb730619a05af36fb28329d6feb33219cc9164461a8ba3afd5949b9a6046c53663df30a149414089c1ae8f3476236b056c90dda4843a62c591f8d2b1a62d0db8dc826219bd87398b33e13e3a7a1511573cb1a8cdce3a8fea40792297d023ef52de2e75b9dbbfb8712ccc15c69cfb4c6c1bc2ae74621e536b9d3f09a15dada1561a8192d65cc59d7ed5a6bd610000000000000000000000000000000000000000000000b41248c570c4223a471b755ce6956908e2b0e5dbc5e71ff2373d3ed89c2e2eafac81c21ac2436d2ffacffe2fc0d601a50221c88a47b264c5129004f350963b52702c5a360000000000000000000000000000000b4077dc8a1801a8bf833350d302c5439ea3dd0f3b8eb1dc93af1fbf863d33a38a53a02ec1e5b90cb673d6b0cfe7f35b20e438653e0f73ddfc78e3e1d1cc9798af0eb9b61bb4fc72454a57237b68ea614ad898374e952784a18ffb9dc4447acd7ad28a63f88007ad8cba31a6fdd9982c97a913dffe69654d3a00b98c45ead9b9619f946c82f5789379d0d942020652ccfac45e1ef5e93e72b7d5381a3c61fbabc1286285110540075bc7aee3e595f9850b9e96887d53404add0021b198be851d9f797d6d4fe7501997524d28ce7b1d5f8203d9f756efd5676c5d85052030c27e2a99ee39007d9b3c305b1c7d14899b42149d6c437d863651d30426e36ff66bafa93ce3f76c18b8c91ac65b7ab49f03b7c0d0687e1ee0369e88d674f51fe69423000000000000596444d8a7bf983d6f0342b2987e520542c1f725402404f37cda7868234eeefbd472c7b396c182f23e00bf2f85ad1a7b18681784c8fcf0cf5e34baebc594de0d6c9244a834b82a162739619b5f2e3c24378417f71f855b7958fbae631a8aa30b2120a9e23d8711f529b0cd7ce6ee2b0841a4d9e82e6ef54089b64175338ed7effe440c97c663a1000000000033f9ee8bc74fb676198caf54f9a07461c30b4b65890f2b64e68eb2a265f641e68af046fb8751055c6dba7e49068656dbf01c26b3812cec4204084e4c3f5abb86121a3eddd10720d3b66a3a8033aab499cf56b7e5b01d37c1d7b4f5968040cd727efc9a1d69fa550313969508472ec9af3327d1bcae9167e3316f272ba2efdebf91f15b4a2bc27ea303834600d92961d3dcff0e4f55d9e3e7c66e8d3324216c4c77b95c000c5f30d56da969b1ce3a3e1a8ce5a632b3c404e7b455cac15273ce31a57dc723e173d14b65bed120f5396671eb7f8670ddc26ecc7461b1badfc98076c95aa811954827767c023c51e183cf1de0230912617f72169a3f9bda12d14667855757ca543b524491e213929a9d095abb9e57f33ad7e5301e5995e65246bc06f931d983596a4979d403f1b3884123633e9af67a0972612b5874f2a4bb21772c35bf437c31afa5990a8bb584792aea1353f0e2739cea006984449fec118b5e8545c976a7bd829fdc88855c1641593f4f825e72b56be89c5900666a2edf"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffff95, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000040)={0x0, 0xffffffff, 0x1, 0x8, 0xa, "ff00f70002e5020052c4f21c7f000000002000"}) syz_open_dev$loop(&(0x7f0000000040), 0x1080000100008, 0x2a942) r2 = syz_open_pts(r1, 0x141601) write(r2, &(0x7f0000000000)="d5", 0xfffffedf) close_range(r0, 0xffffffffffffffff, 0x0) 11m11.765860983s ago: executing program 2 (id=401): socket$nl_route(0x10, 0x3, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) socket$unix(0x1, 0x5, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$kcm(0x11, 0x3, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000c00)=@newtfilter={0x4c, 0x2c, 0xd3f, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r6, {0xe, 0xffe0}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x9, 0x4}]}}, @TCA_BPF_FLAGS={0x8, 0x8, 0x1}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x307000, 0x0) close(r7) socket$inet6(0xa, 0x400000000001, 0x0) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r3, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r8, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)='\'', 0x1}], 0x1}, 0x4) 10m23.815043811s ago: executing program 33 (id=401): socket$nl_route(0x10, 0x3, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) socket$unix(0x1, 0x5, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$kcm(0x11, 0x3, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000c00)=@newtfilter={0x4c, 0x2c, 0xd3f, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r6, {0xe, 0xffe0}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x9, 0x4}]}}, @TCA_BPF_FLAGS={0x8, 0x8, 0x1}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x307000, 0x0) close(r7) socket$inet6(0xa, 0x400000000001, 0x0) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r3, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r8, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)='\'', 0x1}], 0x1}, 0x4) 3m22.270075699s ago: executing program 3 (id=437): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb01001800000000000000240000002400000007000000000000000200001304000000030000000000000b000000000400000000000008000000000000005f5f"], 0x0, 0x43}, 0x28) 3m10.032595763s ago: executing program 3 (id=439): syz_open_dev$usbfs(0x0, 0x77, 0x41341) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() syz_emit_ethernet(0x3a, &(0x7f0000000100)={@broadcast, @dev, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x3, 0x0, 0x2c, 0x500, 0x0, 0x0, 0x2f, 0x0, @rand_addr, @empty}, {0x0, 0x88be, 0x18, 0x0, @wg=@data={0x4, 0x7, 0x8}}}}}}, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000010c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000100)=ANY=[@ANYRES32=r7, @ANYRES32=r6, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r7}, &(0x7f0000000000), &(0x7f0000000080)=r3}, 0x20) prctl$PR_MCE_KILL(0x35, 0x1, 0x2) sendmsg$inet(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x22fe0}], 0x1}, 0x0) recvfrom(r4, &(0x7f0000004000)=""/4112, 0xfffffffffffffedc, 0x2080, 0x0, 0x0) 2m27.116375454s ago: executing program 3 (id=441): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x181042, 0x15) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x21c0, 0x103) close(0x3) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) 2m10.931988944s ago: executing program 3 (id=442): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0xfffffffd, @local, 0x2}, 0x1c) listen(r0, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000340)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x33}, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0x100}}}}}}}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000100)={@local, @random="cda69ef32ef2", @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0x0, {[@sack_perm={0x4, 0x2}, @fastopen={0x22, 0x2}]}}}}}}}}, 0x0) 2m2.409944047s ago: executing program 3 (id=444): syz_io_uring_setup(0x39d, &(0x7f0000000080)={0x0, 0x20000851, 0x200, 0x4, 0x3a1}, 0x0, &(0x7f00000001c0), &(0x7f0000000200)) r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x24020000) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0) syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) 1m47.367601785s ago: executing program 3 (id=446): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @broadcast}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x0, 0x3, {0x40, 0x8, 0x8}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4040000}, 0x20040084) sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001740)=@newqdisc={0x24, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r5, {0x10}, {}, {0xa, 0x3}}}, 0x24}, 0x1, 0x0, 0x0, 0x40098}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r7, &(0x7f0000000200)="2478546ca4fa3b0bfe4ddf30cc5a", 0xe, 0x4000050, &(0x7f00000001c0)={0x11, 0xf7, r6, 0x1, 0xd8, 0x6, @multicast}, 0x14) 1m10.732348446s ago: executing program 0 (id=447): r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) prlimit64(r0, 0x4, 0x0, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(0xffffffffffffffff, 0x10e, 0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = add_key$keyring(0x0, &(0x7f00000002c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) r4 = add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x3}, 0x0, 0x0, 0x0) keyctl$invalidate(0x15, r4) keyctl$KEYCTL_MOVE(0x1e, 0x0, 0x0, r3, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x40) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="02030609100000000000004c9e0000000200130002000000da16c167d803f1f805000600200000000a00060000000000ff0000000000000000001ffeff0001000003f1dc7f7c6e7c0200010000000000004000020000000005000500000000000a"], 0x80}}, 0x0) sendmmsg(r5, &(0x7f0000000180), 0x400008a, 0x0) sendmsg$key(r5, &(0x7f0000000000)={0x9, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)={0x2, 0x9, 0x0, 0x9, 0x2, 0x0, 0x70bd2b, 0x25dfdbfe}, 0x10}}, 0x0) 56.3919189s ago: executing program 34 (id=446): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @broadcast}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x0, 0x3, {0x40, 0x8, 0x8}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4040000}, 0x20040084) sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001740)=@newqdisc={0x24, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r5, {0x10}, {}, {0xa, 0x3}}}, 0x24}, 0x1, 0x0, 0x0, 0x40098}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r7, &(0x7f0000000200)="2478546ca4fa3b0bfe4ddf30cc5a", 0xe, 0x4000050, &(0x7f00000001c0)={0x11, 0xf7, r6, 0x1, 0xd8, 0x6, @multicast}, 0x14) 51.638211851s ago: executing program 0 (id=449): syz_emit_ethernet(0x3a, &(0x7f00000001c0)={@local, @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x2, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x0, 0x18, 0x0, @wg=@data={0x4, 0x4, 0xffffffff80000000}}}}}}, 0x0) syz_emit_ethernet(0x2c, &(0x7f0000000040)={@broadcast, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1e, 0x0, 0xe000, 0x4, 0x11, 0x0, @empty, @empty}, {0x4, 0x4e60, 0xa, 0x0, @opaque="a7a6"}}}}}, 0x0) 41.575773834s ago: executing program 0 (id=450): syz_io_uring_setup(0x39d, &(0x7f0000000080)={0x0, 0x20000851, 0x200, 0x4, 0x3a1}, 0x0, &(0x7f00000001c0), &(0x7f0000000200)) r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x24020000) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) 25.701092278s ago: executing program 0 (id=451): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="20010000160001002bbf7000fedbdf250a010101000000000000000000000000fe8800000000000000000000000001014e2300004e2400000a"], 0x120}, 0x1, 0x0, 0x0, 0x10}, 0x400c8c0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x40008d0}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a900000000c0a010400000000000000000a0000060900020073797a31000000000900010073797a310000000064000380600000800c00018006000100d65b000050000b80200001800e000100636f6e6e6c696d69740000000c000280080001"], 0xb8}, 0x1, 0x0, 0x0, 0x24000840}, 0x40) 16.051424883s ago: executing program 0 (id=452): r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) prlimit64(r0, 0x4, 0x0, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(0xffffffffffffffff, 0x10e, 0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = add_key$keyring(0x0, &(0x7f00000002c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) r4 = add_key$keyring(&(0x7f0000000440), &(0x7f0000000480)={'syz', 0x3}, 0x0, 0x0, 0x0) keyctl$invalidate(0x15, r4) keyctl$KEYCTL_MOVE(0x1e, 0x0, 0x0, r3, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x40) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="02030609100000000000004c9e0000000200130002000000da16c167d803f1f805000600200000000a00060000000000ff0000000000000000001ffeff0001000003f1dc7f7c6e7c0200010000000000004000020000000005000500000000000a"], 0x80}}, 0x0) sendmmsg(r5, &(0x7f0000000180), 0x400008a, 0x0) sendmsg$key(r5, &(0x7f0000000000)={0x9, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)={0x2, 0x9, 0x0, 0x9, 0x2, 0x0, 0x70bd2b, 0x25dfdbfe}, 0x10}}, 0x0) 0s ago: executing program 0 (id=453): madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = syz_io_uring_setup(0x33ef, &(0x7f0000000300)={0x0, 0x7c87, 0x10, 0xfffffffe, 0x252}, &(0x7f0000000380), &(0x7f00000002c0), &(0x7f0000000200)) io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/114, 0x72}], 0x1) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:62092' (ED25519) to the list of known hosts. syzkaller login: [ 509.158935][ T3194] cgroup: Unknown subsys name 'net' [ 509.970247][ T3194] cgroup: Unknown subsys name 'cpuset' [ 510.082956][ T3194] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 595.030931][ T3194] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 790.152320][ T3203] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 790.402236][ T3203] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 791.901649][ T3202] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 792.080392][ T3202] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 803.333076][ T3203] hsr_slave_0: entered promiscuous mode [ 803.387005][ T3203] hsr_slave_1: entered promiscuous mode [ 805.592383][ T3202] hsr_slave_0: entered promiscuous mode [ 805.647451][ T3202] hsr_slave_1: entered promiscuous mode [ 805.701258][ T3202] debugfs: 'hsr0' already exists in 'hsr' [ 805.706511][ T3202] Cannot create hsr debugfs directory [ 815.892376][ T3203] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 816.451097][ T3203] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 816.713195][ T3203] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 817.303191][ T3203] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 820.357860][ T3202] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 820.608589][ T3202] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 820.877857][ T3202] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 821.718142][ T3202] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 841.620803][ T3203] 8021q: adding VLAN 0 to HW filter on device bond0 [ 841.878847][ T3202] 8021q: adding VLAN 0 to HW filter on device bond0 [ 897.114596][ T3202] veth0_vlan: entered promiscuous mode [ 898.186817][ T3202] veth1_vlan: entered promiscuous mode [ 901.470122][ T3202] veth0_macvtap: entered promiscuous mode [ 901.956667][ T3202] veth1_macvtap: entered promiscuous mode [ 905.016980][ T30] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 905.023224][ T30] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 905.195380][ T55] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 905.199366][ T55] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 906.427443][ T3203] veth0_vlan: entered promiscuous mode [ 909.043151][ T3203] veth1_vlan: entered promiscuous mode [ 911.775174][ T3202] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 912.349567][ T3203] veth0_macvtap: entered promiscuous mode [ 912.831373][ T3203] veth1_macvtap: entered promiscuous mode [ 916.689878][ T3402] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 916.797149][ T3402] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 916.799257][ T3402] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 916.801870][ T3402] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 949.718974][ T3849] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 970.618630][ T3865] syzkaller0: entered promiscuous mode [ 970.620261][ T3865] syzkaller0: entered allmulticast mode [ 981.376848][ T3882] syzkaller1: entered promiscuous mode [ 981.379127][ T3882] syzkaller1: entered allmulticast mode [ 1006.682302][ T3905] netlink: 24 bytes leftover after parsing attributes in process `syz.1.20'. [ 1006.810238][ T3905] Zero length message leads to an empty skb [ 1010.581509][ T3909] syzkaller0: entered promiscuous mode [ 1010.607868][ T3909] syzkaller0: entered allmulticast mode [ 1049.011283][ T4006] xt_hashlimit: size too large, truncated to 1048576 [ 1080.276777][ T4031] netlink: 12 bytes leftover after parsing attributes in process `syz.0.31'. [ 1080.280010][ T4031] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 1080.387638][ T4031] netlink: 96 bytes leftover after parsing attributes in process `syz.0.31'. [ 1098.546071][ T4047] netlink: 28 bytes leftover after parsing attributes in process `syz.1.39'. [ 1110.519160][ T4053] syz.0.42 uses obsolete (PF_INET,SOCK_PACKET) [ 1137.244852][ T4077] syzkaller0: entered promiscuous mode [ 1137.246341][ T4077] syzkaller0: entered allmulticast mode [ 1157.123360][ T4100] netlink: 24 bytes leftover after parsing attributes in process `syz.0.55'. [ 1160.093235][ T4100] netlink: 4 bytes leftover after parsing attributes in process `syz.0.55'. [ 1166.217276][ T4125] syzkaller1: entered promiscuous mode [ 1166.220244][ T4125] syzkaller1: entered allmulticast mode [ 1180.279637][ T4139] syzkaller0: entered promiscuous mode [ 1180.280896][ T4139] syzkaller0: entered allmulticast mode [ 1189.422919][ T4156] netlink: 24 bytes leftover after parsing attributes in process `syz.0.65'. [ 1205.532950][ T4181] syzkaller0: entered promiscuous mode [ 1205.569397][ T4181] syzkaller0: entered allmulticast mode [ 1211.560020][ T4188] syzkaller0: entered promiscuous mode [ 1211.562218][ T4188] syzkaller0: entered allmulticast mode [ 1219.615065][ T4205] netlink: 24 bytes leftover after parsing attributes in process `syz.0.72'. [ 1226.039833][ T4224] syzkaller0: entered promiscuous mode [ 1226.041175][ T4224] syzkaller0: entered allmulticast mode [ 1237.126216][ T4243] netlink: 24 bytes leftover after parsing attributes in process `syz.0.78'. [ 1243.930662][ T4263] syzkaller0: entered promiscuous mode [ 1243.932018][ T4263] syzkaller0: entered allmulticast mode [ 1244.611344][ T4267] netlink: 24 bytes leftover after parsing attributes in process `syz.1.81'. [ 1245.856437][ T4278] netlink: 4 bytes leftover after parsing attributes in process `syz.1.81'. [ 1282.170677][ T4331] syzkaller0: entered promiscuous mode [ 1282.172000][ T4331] syzkaller0: entered allmulticast mode [ 1292.757394][ T4342] syzkaller0: entered promiscuous mode [ 1292.759661][ T4342] syzkaller0: entered allmulticast mode [ 1299.652182][ T4355] syzkaller0: entered promiscuous mode [ 1299.653461][ T4355] syzkaller0: entered allmulticast mode [ 1317.849999][ T4378] syzkaller0: entered promiscuous mode [ 1317.851764][ T4378] syzkaller0: entered allmulticast mode [ 1337.461365][ T4398] syzkaller0: entered promiscuous mode [ 1337.462804][ T4398] syzkaller0: entered allmulticast mode [ 1339.869319][ T4404] netlink: 6 bytes leftover after parsing attributes in process `syz.0.112'. [ 1339.888958][ T4404] netlink: 6 bytes leftover after parsing attributes in process `syz.0.112'. [ 1351.200816][ T4418] syzkaller0: entered promiscuous mode [ 1351.202140][ T4418] syzkaller0: entered allmulticast mode [ 1360.246472][ T4434] netlink: 24 bytes leftover after parsing attributes in process `syz.1.121'. [ 1360.345991][ T4434] netlink: 4 bytes leftover after parsing attributes in process `syz.1.121'. [ 1380.867405][ T4454] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 1390.967895][ T4459] syzkaller0: entered promiscuous mode [ 1390.975393][ T4459] syzkaller0: entered allmulticast mode [ 1400.406211][ T4468] syzkaller0: entered promiscuous mode [ 1400.408347][ T4468] syzkaller0: entered allmulticast mode [ 1405.130246][ T4476] netlink: 4 bytes leftover after parsing attributes in process `syz.1.133'. [ 1413.360679][ T4488] syzkaller0: entered promiscuous mode [ 1413.362162][ T4488] syzkaller0: entered allmulticast mode [ 1415.051352][ T4492] netlink: 6 bytes leftover after parsing attributes in process `syz.1.137'. [ 1428.891576][ T4508] netlink: 6 bytes leftover after parsing attributes in process `syz.0.142'. [ 1435.071234][ T4512] syzkaller0: entered promiscuous mode [ 1435.072603][ T4512] syzkaller0: entered allmulticast mode [ 1447.246181][ T4521] netlink: 6 bytes leftover after parsing attributes in process `syz.0.147'. [ 1453.246994][ T4299] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 1453.516035][ T4299] usb 1-1: Using ep0 maxpacket: 32 [ 1453.801717][ T4299] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1453.813134][ T4299] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1453.822726][ T4299] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 1453.832649][ T4299] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1454.042699][ T4299] usb 1-1: config 0 descriptor?? [ 1459.597212][ T3762] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 1460.106277][ T3762] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1460.109067][ T3762] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1460.111670][ T3762] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1460.204761][ T3762] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1460.640740][ T3762] usb 2-1: config 0 descriptor?? [ 1460.747626][ T4299] usbhid 1-1:0.0: can't add hid device: -32 [ 1460.788961][ T4299] usbhid 1-1:0.0: probe with driver usbhid failed with error -32 [ 1467.290106][ T3762] usb 1-1: USB disconnect, device number 2 [ 1473.906153][ T3743] usb 2-1: USB disconnect, device number 2 [ 1475.609819][ T4558] syzkaller0: entered promiscuous mode [ 1475.611805][ T4558] syzkaller0: entered allmulticast mode [ 1478.019013][ T4568] netlink: 12 bytes leftover after parsing attributes in process `syz.1.152'. [ 1486.441773][ T4571] bond1: entered promiscuous mode [ 1486.467240][ T4571] bond1: entered allmulticast mode [ 1492.181764][ T4611] binder: 4610:4611 ioctl c0306201 200000000080 returned -14 [ 1492.601000][ T4611] binder: 4610:4611 ioctl c0306201 2000000003c0 returned -14 [ 1497.986410][ T3743] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 1498.305226][ T3743] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1498.306992][ T3743] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 1498.309044][ T3743] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1498.310379][ T3743] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1498.563035][ T3743] usb 2-1: config 0 descriptor?? [ 1499.097488][ T3743] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 1505.405139][ T4624] syzkaller0: entered promiscuous mode [ 1505.406503][ T4624] syzkaller0: entered allmulticast mode [ 1515.351427][ T9] usb 2-1: USB disconnect, device number 3 [ 1532.166653][ T3743] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 1532.680028][ T4649] mmap: syz.0.163 (4649): VmData 28938240 exceed data ulimit 0. Update limits or use boot option ignore_rlimit_data. [ 1532.881960][ T3743] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1532.901155][ T3743] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 21 [ 1532.920585][ T3743] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1532.932508][ T3743] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1533.400876][ T3743] usb 2-1: config 0 descriptor?? [ 1533.940962][ T3743] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 1547.634346][ T9] usb 2-1: USB disconnect, device number 4 [ 1549.079187][ T4675] netlink: 4 bytes leftover after parsing attributes in process `syz.0.166'. [ 1553.220651][ T4679] netlink: 'syz.0.168': attribute type 1 has an invalid length. [ 1561.978973][ T4689] netlink: 12 bytes leftover after parsing attributes in process `syz.1.171'. [ 1567.177788][ T4692] bond2: entered promiscuous mode [ 1567.179936][ T4692] bond2: entered allmulticast mode [ 1573.019060][ T4543] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 1573.398089][ T4543] usb 2-1: Using ep0 maxpacket: 16 [ 1573.678379][ T4543] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1573.680568][ T4543] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1573.682304][ T4543] usb 2-1: New USB device found, idVendor=1fd2, idProduct=6007, bcdDevice= 0.00 [ 1573.696212][ T4543] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1574.092888][ T4543] usb 2-1: config 0 descriptor?? [ 1576.193410][ T4543] hid-multitouch 0003:1FD2:6007.0001: unbalanced collection at end of report description [ 1576.309119][ T4543] hid-multitouch 0003:1FD2:6007.0001: probe with driver hid-multitouch failed with error -22 [ 1576.636128][ T4543] usb 2-1: USB disconnect, device number 5 [ 1587.416641][ T4759] netlink: 16 bytes leftover after parsing attributes in process `syz.0.177'. [ 1589.028026][ T4755] syzkaller0: entered promiscuous mode [ 1589.029550][ T4755] syzkaller0: entered allmulticast mode [ 1591.793147][ T4762] bond1: entered promiscuous mode [ 1591.802388][ T4762] bond1: entered allmulticast mode [ 1618.008278][ T4806] netlink: 4 bytes leftover after parsing attributes in process `syz.0.180'. [ 1625.599739][ T4812] process 'syz.0.181' launched './file1' with NULL argv: empty string added [ 1651.756432][ T3762] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 1652.018875][ T3762] usb 1-1: Using ep0 maxpacket: 32 [ 1652.190214][ T3762] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1652.195689][ T3762] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1652.198361][ T3762] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2d51, bcdDevice= 0.00 [ 1652.200079][ T3762] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1652.550592][ T3762] usb 1-1: config 0 descriptor?? [ 1655.903236][ T3762] koneplus 0003:1E7D:2D51.0002: hidraw0: USB HID v0.00 Device [HID 1e7d:2d51] on usb-dummy_hcd.0-1/input0 [ 1656.049241][ T3762] koneplus 0003:1E7D:2D51.0002: couldn't init struct koneplus_device [ 1656.052490][ T3762] koneplus 0003:1E7D:2D51.0002: couldn't install mouse [ 1656.433591][ T3762] koneplus 0003:1E7D:2D51.0002: probe with driver koneplus failed with error -71 [ 1656.947356][ T3762] usb 1-1: USB disconnect, device number 3 [ 1705.938250][ T4875] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1707.801512][ T4875] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1708.992303][ T4875] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1709.731699][ T4875] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1725.054814][ T4875] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1725.202941][ T4875] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1725.267334][ T4875] bond0 (unregistering): Released all slaves [ 1725.493461][ T4875] bond1 (unregistering): Released all slaves [ 1726.001044][ T4875] bond2 (unregistering): Released all slaves [ 1728.471482][ T4875] hsr_slave_0: left promiscuous mode [ 1728.539158][ T4875] hsr_slave_1: left promiscuous mode [ 1729.069903][ T4875] veth1_macvtap: left promiscuous mode [ 1729.096227][ T4875] veth0_macvtap: left promiscuous mode [ 1729.102329][ T4875] veth1_vlan: left promiscuous mode [ 1729.128980][ T4875] veth0_vlan: left promiscuous mode [ 1783.485010][ T5099] syzkaller0: entered promiscuous mode [ 1783.486267][ T5099] syzkaller0: entered allmulticast mode [ 1787.846824][ T4931] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1788.126594][ T4931] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1814.288984][ T4931] hsr_slave_0: entered promiscuous mode [ 1814.415192][ T4931] hsr_slave_1: entered promiscuous mode [ 1814.506461][ T4931] debugfs: 'hsr0' already exists in 'hsr' [ 1814.508633][ T4931] Cannot create hsr debugfs directory [ 1816.222622][ T5202] syzkaller0: entered promiscuous mode [ 1816.235337][ T5202] syzkaller0: entered allmulticast mode [ 1831.183056][ T4931] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1831.523376][ T4931] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1832.106407][ T4931] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1832.380755][ T4931] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1855.040400][ T4931] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1872.076220][ T5350] netlink: 24 bytes leftover after parsing attributes in process `syz.0.206'. [ 1874.378441][ T5357] netlink: 4 bytes leftover after parsing attributes in process `syz.0.206'. [ 1875.879071][ T5363] netlink: 4 bytes leftover after parsing attributes in process `syz.0.206'. [ 1921.060797][ T5411] netlink: 24 bytes leftover after parsing attributes in process `syz.0.210'. [ 1925.181183][ T5428] netlink: 4 bytes leftover after parsing attributes in process `syz.0.210'. [ 1934.900645][ T5435] netlink: 24 bytes leftover after parsing attributes in process `syz.0.211'. [ 1943.180249][ T4931] veth0_vlan: entered promiscuous mode [ 1943.625283][ T4931] veth1_vlan: entered promiscuous mode [ 1946.177440][ T4931] veth0_macvtap: entered promiscuous mode [ 1946.373028][ T4931] veth1_macvtap: entered promiscuous mode [ 1950.139559][ T4882] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1950.141542][ T4882] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1950.143471][ T4882] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1950.189240][ T4882] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1952.667985][ T5450] netlink: 24 bytes leftover after parsing attributes in process `syz.0.214'. [ 1952.699986][ T5450] netlink: 4 bytes leftover after parsing attributes in process `syz.0.214'. [ 1957.539532][ T5454] netlink: 4 bytes leftover after parsing attributes in process `syz.2.185'. [ 1961.276731][ T5457] binder: 5455:5457 ioctl c0306201 200000000080 returned -14 [ 1961.417760][ T5457] binder: 5455:5457 ioctl c0306201 2000000003c0 returned -14 [ 1967.219670][ T5466] netlink: 24 bytes leftover after parsing attributes in process `syz.2.219'. [ 1967.662702][ T5466] netlink: 4 bytes leftover after parsing attributes in process `syz.2.219'. [ 1978.347532][ T5476] netlink: 152 bytes leftover after parsing attributes in process `syz.0.224'. [ 1983.497490][ T5480] netlink: 24 bytes leftover after parsing attributes in process `syz.0.225'. [ 1983.580258][ T5480] netlink: 4 bytes leftover after parsing attributes in process `syz.0.225'. [ 1993.830047][ T5491] netlink: 152 bytes leftover after parsing attributes in process `syz.0.229'. [ 1998.940612][ T5495] netlink: 24 bytes leftover after parsing attributes in process `syz.0.231'. [ 1999.121559][ T5495] netlink: 4 bytes leftover after parsing attributes in process `syz.0.231'. [ 2001.725931][ T5497] netlink: 4 bytes leftover after parsing attributes in process `syz.2.232'. [ 2007.430408][ T5505] netlink: 152 bytes leftover after parsing attributes in process `syz.0.235'. [ 2008.117363][ T5507] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2008.253706][ T5507] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2011.207345][ T5511] netlink: 24 bytes leftover after parsing attributes in process `syz.0.237'. [ 2011.303109][ T5511] netlink: 4 bytes leftover after parsing attributes in process `syz.0.237'. [ 2023.862454][ T5521] netlink: 24 bytes leftover after parsing attributes in process `syz.2.242'. [ 2024.027722][ T5521] netlink: 4 bytes leftover after parsing attributes in process `syz.2.242'. [ 2067.379499][ T4904] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 2067.599394][ T4904] usb 1-1: Using ep0 maxpacket: 16 [ 2067.838578][ T4904] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2067.841243][ T4904] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2067.843350][ T4904] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 2067.871881][ T4904] usb 1-1: New USB device found, idVendor=05ac, idProduct=8241, bcdDevice= 0.00 [ 2067.880327][ T4904] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2068.268325][ T4904] usb 1-1: config 0 descriptor?? [ 2070.148213][ T4904] input: HID 05ac:8241 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:05AC:8241.0003/input/input0 [ 2071.120023][ T4904] appleir 0003:05AC:8241.0003: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 05ac:8241] on usb-dummy_hcd.0-1/input0 [ 2071.767084][ T4904] usb 1-1: reset high-speed USB device number 4 using dummy_hcd [ 2073.277865][ T4895] usb 1-1: USB disconnect, device number 4 [ 2085.141905][ T5595] xt_hashlimit: size too large, truncated to 1048576 [ 2086.398222][ T5596] xt_hashlimit: size too large, truncated to 1048576 [ 2127.071604][ T5642] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2127.247020][ T5642] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2128.907470][ T24] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 2129.316470][ T24] usb 1-1: Using ep0 maxpacket: 32 [ 2129.466817][ T24] usb 1-1: config 0 interface 0 altsetting 129 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2129.469442][ T24] usb 1-1: config 0 interface 0 altsetting 129 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 2129.471901][ T24] usb 1-1: config 0 interface 0 has no altsetting 0 [ 2129.488499][ T24] usb 1-1: New USB device found, idVendor=056a, idProduct=00c6, bcdDevice= 0.00 [ 2129.490854][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2129.780632][ T24] usb 1-1: config 0 descriptor?? [ 2131.421679][ T24] wacom 0003:056A:00C6.0004: unknown main item tag 0x0 [ 2131.442183][ T24] wacom 0003:056A:00C6.0004: unknown main item tag 0x0 [ 2131.456532][ T24] wacom 0003:056A:00C6.0004: unknown main item tag 0x0 [ 2131.458816][ T24] wacom 0003:056A:00C6.0004: unknown main item tag 0x0 [ 2131.485497][ T24] wacom 0003:056A:00C6.0004: unknown main item tag 0x0 [ 2131.487887][ T24] wacom 0003:056A:00C6.0004: unknown main item tag 0x0 [ 2131.489686][ T24] wacom 0003:056A:00C6.0004: unknown main item tag 0x0 [ 2131.491474][ T24] wacom 0003:056A:00C6.0004: unknown main item tag 0x0 [ 2131.493280][ T24] wacom 0003:056A:00C6.0004: unknown main item tag 0x0 [ 2131.536844][ T24] wacom 0003:056A:00C6.0004: unknown main item tag 0x0 [ 2131.760027][ T24] usb 1-1: USB disconnect, device number 5 [ 2147.501099][ T5449] usb 1-1: new full-speed USB device number 6 using dummy_hcd [ 2147.926758][ T5449] usb 1-1: config 1 has an invalid descriptor of length 200, skipping remainder of the config [ 2147.929440][ T5449] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 2148.240824][ T5449] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 2148.243214][ T5449] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2148.260505][ T5449] usb 1-1: Product: syz [ 2148.262110][ T5449] usb 1-1: Manufacturer: syz [ 2148.298400][ T5449] usb 1-1: SerialNumber: syz [ 2162.362316][ T5449] usb 1-1: USB disconnect, device number 6 [ 2180.692309][ T5721] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2180.757073][ T5721] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2203.415679][ T5738] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2203.472699][ T5738] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2203.990206][ T5741] netlink: 12 bytes leftover after parsing attributes in process `syz.0.292'. [ 2205.976124][ T5754] bond2: entered promiscuous mode [ 2206.017387][ T5754] bond2: entered allmulticast mode [ 2213.746464][ T5778] xt_hashlimit: size too large, truncated to 1048576 [ 2244.319966][ T5792] netlink: 12 bytes leftover after parsing attributes in process `syz.0.297'. [ 2256.817551][ T5793] bond3: entered promiscuous mode [ 2256.819026][ T5793] bond3: entered allmulticast mode [ 2267.791822][ T5831] netlink: 20 bytes leftover after parsing attributes in process `syz.0.299'. [ 2269.689860][ T5833] netlink: 152 bytes leftover after parsing attributes in process `syz.2.300'. [ 2281.628509][ T5845] xt_hashlimit: size too large, truncated to 1048576 [ 2307.995393][ T5859] netlink: 152 bytes leftover after parsing attributes in process `syz.2.306'. [ 2318.656512][ T5870] xt_hashlimit: size too large, truncated to 1048576 [ 2325.679618][ T5874] veth1_to_hsr: entered promiscuous mode [ 2325.956353][ T5874] netlink: 4 bytes leftover after parsing attributes in process `syz.0.310'. [ 2331.231230][ T5873] veth1_to_hsr: left promiscuous mode [ 2332.851529][ T5884] netlink: 152 bytes leftover after parsing attributes in process `syz.2.311'. [ 2343.321465][ T5893] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 2344.910695][ T5895] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2344.967822][ T5895] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2354.866992][ T5900] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2354.908100][ T5900] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2356.082120][ T5903] xt_hashlimit: size too large, truncated to 1048576 [ 2405.442671][ T5921] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2405.532869][ T5921] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2410.140176][ T31] audit: type=1326 audit(2408.770:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5918 comm="syz.0.320" exe="/syz-executor" sig=9 arch=c00000f3 syscall=98 compat=0 ip=0x7fffaed33992 code=0x0 [ 2417.512282][ T5927] capability: warning: `syz.2.322' uses deprecated v2 capabilities in a way that may be insecure [ 2429.204348][ T5931] xt_hashlimit: size too large, truncated to 1048576 [ 2438.007891][ T5935] netlink: 24 bytes leftover after parsing attributes in process `syz.0.325'. [ 2441.667450][ T5951] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2441.707084][ T5951] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2480.269488][ T5969] netlink: 24 bytes leftover after parsing attributes in process `syz.0.331'. [ 2562.368585][ T6012] xt_hashlimit: size too large, truncated to 1048576 [ 2582.096152][ T6021] netlink: 24 bytes leftover after parsing attributes in process `syz.2.343'. [ 2590.572400][ T6038] netlink: 4 bytes leftover after parsing attributes in process `syz.2.343'. [ 2659.201549][ T6100] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2659.391114][ T6100] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2754.587603][ T6210] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2754.636811][ T6210] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2760.571209][ T6216] netlink: 12 bytes leftover after parsing attributes in process `syz.0.382'. [ 2761.855962][ T6223] netlink: 28 bytes leftover after parsing attributes in process `syz.0.382'. [ 2793.785769][ T6273] binder: 6272:6273 ioctl 4018620d 0 returned -22 [ 2793.982720][ T6273] binder: 6272:6273 ioctl c0306201 200000000080 returned -14 [ 2795.913000][ T6273] binder: 6272:6273 ioctl c0306201 2000000003c0 returned -14 [ 2800.799030][ T6277] fuse: Bad value for 'fd' [ 2801.751791][ T6278] netlink: 12 bytes leftover after parsing attributes in process `syz.2.388'. [ 2803.238704][ T6297] netlink: 28 bytes leftover after parsing attributes in process `syz.2.388'. [ 2812.110455][ T6321] xt_hashlimit: size too large, truncated to 1048576 [ 2833.823351][ T6333] netlink: 12 bytes leftover after parsing attributes in process `syz.2.396'. [ 2835.178195][ T6350] netlink: 28 bytes leftover after parsing attributes in process `syz.2.396'. [ 2853.027044][ T6384] syzkaller0: entered promiscuous mode [ 2853.028491][ T6384] syzkaller0: entered allmulticast mode [ 2886.519360][ T6398] netlink: 12 bytes leftover after parsing attributes in process `syz.0.403'. [ 2888.581069][ T6400] netlink: 28 bytes leftover after parsing attributes in process `syz.0.403'. [ 2897.178724][ T6398] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 2932.162698][ T6422] netlink: 12 bytes leftover after parsing attributes in process `syz.0.408'. [ 2933.831932][ T6435] netlink: 28 bytes leftover after parsing attributes in process `syz.0.408'. [ 2960.670390][ T4887] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2963.017727][ T4887] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2964.612466][ T4887] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2966.497406][ T4887] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2989.657088][ T6589] fuse: Bad value for 'fd' [ 2990.473167][ T4887] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2990.810903][ T4887] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2990.952792][ T4887] bond0 (unregistering): Released all slaves [ 2991.687057][ T4887] bond1 (unregistering): Released all slaves [ 2992.839472][ T4887] bond2 (unregistering): Released all slaves [ 2995.301861][ T4887] hsr_slave_0: left promiscuous mode [ 2995.346353][ T4887] hsr_slave_1: left promiscuous mode [ 2995.736720][ T4887] veth1_macvtap: left promiscuous mode [ 2995.739273][ T4887] veth0_macvtap: left promiscuous mode [ 2995.742802][ T4887] veth1_vlan: left promiscuous mode [ 2995.767605][ T4887] veth0_vlan: left promiscuous mode [ 3028.297905][ T6408] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 3028.700930][ T6408] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 3073.701115][ T6408] hsr_slave_0: entered promiscuous mode [ 3073.876803][ T6408] hsr_slave_1: entered promiscuous mode [ 3074.016835][ T6408] debugfs: 'hsr0' already exists in 'hsr' [ 3074.028602][ T6408] Cannot create hsr debugfs directory [ 3093.310987][ T6408] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 3094.571132][ T6408] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 3095.125358][ T6408] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 3095.657660][ T6408] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 3109.661110][ T6800] netlink: 164 bytes leftover after parsing attributes in process `syz.0.421'. [ 3130.642859][ T6408] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3220.398595][ T6868] raw_sendmsg: syz.0.430 forgot to set AF_INET. Fix it! [ 3250.811246][ T6408] veth0_vlan: entered promiscuous mode [ 3253.098235][ T6408] veth1_vlan: entered promiscuous mode [ 3258.169714][ T6408] veth0_macvtap: entered promiscuous mode [ 3259.700579][ T6408] veth1_macvtap: entered promiscuous mode [ 3262.822003][ T6890] netlink: 8 bytes leftover after parsing attributes in process `syz.0.432'. [ 3265.675455][ T6164] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 3266.143077][ T6164] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 3266.228838][ T6164] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 3266.231465][ T6164] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 3312.496034][ T6918] ip6_tunnel: non-ECT from fc00:0000:0000:0000:0000:0000:0000:0001 with DS=0xaa [ 3448.140670][ T6959] syzkaller0: entered promiscuous mode [ 3448.142798][ T6959] syzkaller0: entered allmulticast mode [ 3498.097499][ T6986] netlink: 6 bytes leftover after parsing attributes in process `syz.0.451'. [ 3498.352199][ T4875] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3500.702657][ T4875] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3503.081625][ T4875] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3504.127127][ T4875] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3522.633034][ C0] ------------[ cut here ]------------ [ 3522.633478][ C0] kernel BUG at [] mm/page_table_check.c:118! [ 3522.634669][ C0] Kernel BUG [#1] [ 3522.634903][ C0] Modules linked in: [ 3522.635747][ C0] CPU: 0 UID: 0 PID: 7008 Comm: syz.0.453 Not tainted syzkaller #0 PREEMPT [ 3522.636390][ C0] Hardware name: riscv-virtio,qemu (DT) [ 3522.636801][ C0] epc : page_table_check_set+0xa74/0xd30 [ 3522.638337][ C0] ra : page_table_check_set+0xa74/0xd30 [ 3522.638700][ C0] epc : ffffffff80c4d300 ra : ffffffff80c4d300 sp : ffff8f8004126cc0 [ 3522.638923][ C0] gp : ffffffff8a22a0c0 tp : ffffaf8015694f80 t0 : fffff5ef07c3e200 [ 3522.639145][ C0] t1 : fffff5ef02806409 t2 : ffffffff80a13dae s0 : ffff8f8004126d40 [ 3522.639412][ C0] s1 : 0000000000000001 a0 : 0000000000000001 a1 : 0000000000000000 [ 3522.639610][ C0] a2 : 0000000000080000 a3 : ffffffff80c4d300 a4 : ffff8f800496fca0 [ 3522.639831][ C0] a5 : 0000000000086ca0 a6 : 0000000000000003 a7 : ffffaf801403204b [ 3522.640120][ C0] s2 : 00000000000c0a00 s3 : 0000000000000000 s4 : ffffaf8014032000 [ 3522.640374][ C0] s5 : 0000000000000200 s6 : 0000000000000001 s7 : dfffffff00000000 [ 3522.640744][ C0] s8 : 0000000000007fff s9 : ffffffff88a44e80 s10: 0000000000000000 [ 3522.641118][ C0] s11: ffffffff8a347d80 t3 : 0000000000000001 t4 : fffff5ef02806409 [ 3522.641488][ C0] t5 : fffff5ef0280640a t6 : 0000000000000002 ssp : 0000000000000000 [ 3522.641759][ C0] status: 0000000200000120 badaddr: ffffffff80c4d300 cause: 0000000000000003 [ 3522.642023][ C0] [] page_table_check_set+0xa74/0xd30 [ 3522.642371][ C0] [] __page_table_check_ptes_set+0x264/0x47c [ 3522.642676][ C0] [] split_huge_pmd_locked+0x2b08/0x3268 [ 3522.643246][ C0] [] __split_huge_pmd+0x2ba/0x3e4 [ 3522.643732][ C0] [] copy_huge_pmd+0x28cc/0x2f24 [ 3522.644380][ C0] [] copy_page_range+0xd5a/0x705c [ 3522.644865][ C0] [] dup_mmap+0xd18/0x2168 [ 3522.645182][ C0] [] copy_process+0x6f9c/0x7638 [ 3522.645471][ C0] [] kernel_clone+0x120/0xf54 [ 3522.645785][ C0] [] __do_sys_clone+0xfe/0x140 [ 3522.646062][ C0] [] __riscv_sys_clone+0xa0/0x110 [ 3522.646363][ C0] [] syscall_handler+0x92/0x114 [ 3522.646705][ C0] [] do_trap_ecall_u+0x402/0x680 [ 3522.647112][ C0] [] handle_exception+0x15e/0x16a [ 3522.648097][ C0] Code: e097 ff8c 80e7 11c0 81e3 e004 e097 ff8c 80e7 5f00 (9002) e097 [ 3522.649266][ C0] ---[ end trace 0000000000000000 ]--- [ 3522.650482][ C0] Kernel panic - not syncing: Fatal exception in interrupt [ 3522.651158][ C0] SMP: stopping secondary CPUs VM DIAGNOSIS: 08:07:31 Registers: info registers vcpu 0 CPU#0 V = 0 pc ffffffff81f72434 mhartid 0000000000000000 mstatus 0000000a000001a0 hstatus 0000000200000000 vsstatus 0000000a00000000 mip 0000000000000222 mie 000000000000022a mideleg 0000000000001666 hideleg 0000000000000444 medeleg 0000000000f4b509 hedeleg 000000000000b10d mtvec 00000000800004f8 stvec ffffffff86459ff4 vstvec 0000000000000000 mepc ffffffff80090f72 sepc ffffffff80c4d300 vsepc 0000000000000000 mcause 0000000000000009 scause 0000000000000003 vscause 0000000000000000 mtval 0000000000000000 stval ffffffff80c4d300 htval 0000000000000000 mtval2 0000000000000000 mscratch 0000000080049000 sscratch 0000000000000000 satp 905a5000000b752d x0/zero 0000000000000000 x1/ra ffffffff81f72404 x2/sp ffff8f8004126490 x3/gp ffffffff8a22a0c0 x4/tp ffffaf8015694f80 x5/t0 552030203a555043 x6/t1 ffffffff8a33cac0 x7/t2 49552030203a5550 x8/s0 ffff8f80041264d0 x9/s1 0000000000000000 x10/a0 ffffffff915efcc8 x11/a1 000000000000001f x12/a2 0000000000000000 x13/a3 ffffffff81f72404 x14/a4 1ffffffff22bdf99 x15/a5 ffff8f800006b000 x16/a6 0000000000ff0100 x17/a7 0000000000000003 x18/s2 ffffffff915efc80 x19/s3 0000000000000061 x20/s4 0000000000000000 x21/s5 0000000000000000 x22/s6 0000000000000000 x23/s7 0000000000000004 x24/s8 0000000000000001 x25/s9 1ffff1f000824ca4 x26/s10 ffffffff915efcd8 x27/s11 0000000000000061 x28/t3 ffffffff81f85160 x29/t4 fffff1ef00824c84 x30/t5 fffff1ef00824c85 x31/t6 ffffffff913fc0b7 fcsr 0000000000000000 f0/ft0 0000000000000000 f1/ft1 0000000000000000 f2/ft2 0000000000000000 f3/ft3 0000000000000000 f4/ft4 0000000000000000 f5/ft5 0000000000000000 f6/ft6 0000000000000000 f7/ft7 0000000000000000 f8/fs0 0000000000000000 f9/fs1 0000000000000000 f10/fa0 0000000000000000 f11/fa1 0000000000000000 f12/fa2 0000000000000000 f13/fa3 0000000000000000 f14/fa4 0000000000000000 f15/fa5 0000000000000000 f16/fa6 0000000000000000 f17/fa7 0000000000000000 f18/fs2 0000000000000000 f19/fs3 0000000000000000 f20/fs4 0000000000000000 f21/fs5 0000000000000000 f22/fs6 0000000000000000 f23/fs7 0000000000000000 f24/fs8 0000000000000000 f25/fs9 0000000000000000 f26/fs10 0000000000000000 f27/fs11 0000000000000000 f28/ft8 0000000000000000 f29/ft9 0000000000000000 f30/ft10 0000000000000000 f31/ft11 0000000000000000 info registers vcpu 1 CPU#1 V = 0 pc ffffffff800875b6 mhartid 0000000000000001 mstatus 0000000a000001a0 hstatus 0000000200000000 vsstatus 0000000a00000000 mip 0000000000000020 mie 000000000000022a mideleg 0000000000001666 hideleg 0000000000000444 medeleg 0000000000f4b509 hedeleg 000000000000b10d mtvec 00000000800004f8 stvec ffffffff86459ff4 vstvec 0000000000000000 mepc ffffffff8051b8e8 sepc ffffffff86455e9a vsepc 0000000000000000 mcause 8000000000000003 scause 8000000000000001 vscause 0000000000000000 mtval 0000000000000000 stval 0000000000000000 htval 0000000000000000 mtval2 0000000000000000 mscratch 0000000080047000 sscratch 0000000000000000 satp 90132000000aecb1 x0/zero 0000000000000000 x1/ra ffffffff800875b2 x2/sp ffff8f8000017e10 x3/gp ffffffff8a22a0c0 x4/tp ffffaf801a6d0000 x5/t0 ffff8f8000010000 x6/t1 fffffffef1467930 x7/t2 ffffffff91601828 x8/s0 ffff8f8000017e40 x9/s1 ffffffff86a0cae8 x10/a0 0000000000000001 x11/a1 0000000000000004 x12/a2 0000000000000001 x13/a3 ffffffff800875b2 x14/a4 0000000000000000 x15/a5 ffffaf801a6d0000 x16/a6 fffffffef1467931 x17/a7 0000000000000003 x18/s2 0000000000000001 x19/s3 ffffffff86863000 x20/s4 ffffffff800872fc x21/s5 ffffaf8011d19000 x22/s6 0000000000000000 x23/s7 0000000000000001 x24/s8 0000000000000007 x25/s9 ffffffff91601828 x26/s10 ffffffff86a6e1c0 x27/s11 0000000000000004 x28/t3 ffffffff87fb2860 x29/t4 fffffffef1467930 x30/t5 fffffffef1467931 x31/t6 ffffffff88184280 fcsr 0000000000000000 f0/ft0 0000000000000000 f1/ft1 0000000000000000 f2/ft2 0000000000000000 f3/ft3 0000000000000000 f4/ft4 0000000000000000 f5/ft5 0000000000000000 f6/ft6 0000000000000000 f7/ft7 0000000000000000 f8/fs0 0000000000000000 f9/fs1 0000000000000000 f10/fa0 0000000000000000 f11/fa1 0000000000000000 f12/fa2 0000000000000000 f13/fa3 0000000000000000 f14/fa4 0000000000000000 f15/fa5 0000000000000000 f16/fa6 0000000000000000 f17/fa7 0000000000000000 f18/fs2 0000000000000000 f19/fs3 0000000000000000 f20/fs4 0000000000000000 f21/fs5 0000000000000000 f22/fs6 0000000000000000 f23/fs7 0000000000000000 f24/fs8 0000000000000000 f25/fs9 0000000000000000 f26/fs10 0000000000000000 f27/fs11 0000000000000000 f28/ft8 0000000000000000 f29/ft9 0000000000000000 f30/ft10 0000000000000000 f31/ft11 0000000000000000