last executing test programs: 7.226153422s ago: executing program 1 (id=80): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) 6.966030452s ago: executing program 0 (id=82): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000240)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x802, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000240), 0x4000000044402, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0x10a}) r4 = syz_io_uring_setup(0x416f, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0x200, 0x11a}, 0x0, &(0x7f00000000c0)) io_uring_enter(r4, 0x567, 0x1000a387, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x4c, 0x0, &(0x7f00000004c0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000540)={0x44, 0x0, &(0x7f0000000400)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0xfcff, &(0x7f0000000f00)="9e"}) 6.170146485s ago: executing program 3 (id=84): ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f00000000c0)={'bridge_slave_0\x00', &(0x7f0000000b40)=@ethtool_dump={0x40, 0xff, 0x5}}) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800e00010069703665727370616e000000200002800600180000003f0005001600020000c304001200050017"], 0x54}}, 0x20040080) 6.054315683s ago: executing program 1 (id=86): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) socket(0x10, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r1, 0x0, 0xfffffffffffffffe}, 0x18) prlimit64(0x0, 0x5, &(0x7f0000000140)={0x10, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) fsopen(&(0x7f0000000080)='ext3\x00', 0x0) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), 0xffffffffffffffff) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @dev}, 0x2}}, 0x2e) sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000240)={0x28, r5, 0x1, 0x0, 0xfffffffd, {0x7}, [@L2TP_ATTR_IFNAME={0x14}]}, 0x28}}, 0x0) 6.054110517s ago: executing program 3 (id=87): ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) madvise(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x78) r0 = syz_open_dev$vcsu(&(0x7f0000000080), 0x61a, 0x3) recvfrom(0xffffffffffffffff, 0x0, 0x0, 0x40, 0x0, 0x0) read$FUSE(r0, &(0x7f0000000200)={0x2020}, 0x2020) sched_setattr(0x0, &(0x7f0000002280)={0x38, 0x6, 0xa, 0x3, 0x0, 0xfffffffffffff4d8, 0xcc0, 0x7f, 0x2, 0x811f}, 0x0) finit_module(r0, 0x0, 0x1) 6.029432178s ago: executing program 3 (id=88): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r4 = socket(0x40000000015, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r4, 0x114, 0x8, &(0x7f00000008c0), 0x4) close(r4) mprotect(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0) r5 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) listen(0xffffffffffffffff, 0xd083) ioctl$IOMMU_IOAS_ALLOC(r5, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r5, 0x3ba0, &(0x7f0000000440)={0x48, 0x1, r6, 0x0, 0x97, 0x8000000}) ioctl$IOMMU_IOAS_MAP$PAGES(r5, 0x3b85, &(0x7f0000000500)={0x28, 0x4, r6, 0x0, &(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x6}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r5, 0x3ba0, &(0x7f0000000180)={0x48, 0x2, r6}) r7 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r7, 0x40045532, &(0x7f0000000100)) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0), 0x88602, 0x0) r8 = syz_open_dev$sndpcmp(&(0x7f0000000040), 0x0, 0xa2465) ioctl$SNDRV_PCM_IOCTL_REWIND(r8, 0xc0884123, &(0x7f0000000000)=0x85) ioctl$SNDRV_PCM_IOCTL_DRAIN(r8, 0x4144, 0x0) 5.939181797s ago: executing program 0 (id=89): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4000}}, &(0x7f0000000000)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00', 0x0}) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000180)={r2, 0x1, 0x6, @local}, 0x10) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f0000000580)={r2, 0x1, 0x6, @local}, 0x10) 5.938936368s ago: executing program 4 (id=90): sendmsg$NFC_CMD_SE_IO(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="c8000000", @ANYRES16, @ANYBLOB="01002dbd7000fbdbdf251b00000008000100"], 0xc8}}, 0x40080) io_setup(0x409, &(0x7f0000000600)=0x0) r1 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000002740), 0x101002) io_submit(r0, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f00000000c0)="01", 0x24}]) 5.210151432s ago: executing program 2 (id=91): sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x20064854, 0x0, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600600, 0x200000, 0x3, &(0x7f0000a00000/0x600000)=nil) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1}, 0x1c) 5.204942493s ago: executing program 4 (id=92): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0x0) add_key(&(0x7f0000000140)='encrypted\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r3}, 0x10) r4 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0x103480, 0x0) ioctl$SOUND_MIXER_READ_RECSRC(r4, 0x80044dff, &(0x7f0000000080)) r5 = gettid() bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x28, 0x28, 0x6, [@var={0x4, 0x0, 0x0, 0xe, 0x2}, @func={0x1, 0x0, 0x0, 0x12}, @ptr={0x0, 0x0, 0x0, 0x2, 0x2}]}, {0x0, [0x2e, 0x0, 0x0, 0x61]}}, 0x0, 0x46, 0x0, 0x0, 0x8000000, 0x0, @void, @value}, 0x28) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, 0x0, &(0x7f0000048000), 0x0) 5.039269879s ago: executing program 1 (id=93): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@ipv4_delroute={0x44, 0x19, 0x901, 0x0, 0x0, {0x2, 0x18, 0x0, 0x0, 0x0, 0x2, 0xfd, 0x1}, [@RTA_DST={0x8, 0x1, @dev}, @RTA_GATEWAY={0x8, 0x5, @initdev={0xac, 0x1e, 0x1, 0x0}}, @RTA_ENCAP={0x10, 0x16, 0x0, 0x1, @LWTUNNEL_IP6_ID={0xc, 0x1, 0x4}}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x1}]}, 0x44}}, 0x0) 4.975368606s ago: executing program 3 (id=94): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socket$kcm(0x2, 0x1, 0x84) readv(0xffffffffffffffff, 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0xf) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$TCFLSH(r2, 0x400455c8, 0x20000000009) syz_usb_connect$cdc_ecm(0x0, 0x0, 0x0, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r3, 0xffffffffffffffff, 0x0) 4.266179394s ago: executing program 0 (id=95): syz_open_dev$dri(0x0, 0x1, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) shutdown(0xffffffffffffffff, 0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) gettid() mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB='dyn']) chdir(&(0x7f00000000c0)='./file0\x00') openat(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x40) 4.198397284s ago: executing program 4 (id=96): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0xfffffd89, 0x0, &(0x7f00000005c0)=[@increfs], 0x0, 0x0, 0x0}) 4.104537004s ago: executing program 2 (id=97): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000400)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r3}, 0x10) r4 = add_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000080)="f8", 0x1, 0xfffffffffffffffe) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r4, r5, 0x0) 4.103489255s ago: executing program 1 (id=98): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) getsockname$packet(r2, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@delchain={0x24, 0x28, 0x7d1cdc3e828018e9, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r3, {0xfff1}, {0x0, 0xffff}, {0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x0) 4.0512812s ago: executing program 4 (id=99): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0xffffffffffffff2b, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(r3, 0x7, &(0x7f0000000080)=0x6e) getgroups(0x27, &(0x7f0000002540)) r6 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) r7 = syz_open_dev$vim2m(&(0x7f0000000000), 0x4541b6bf, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r7, 0xc008561c, &(0x7f0000000080)={0xf0f004, 0x4}) connect$bt_rfcomm(r6, &(0x7f0000000040)={0x1f, @none, 0x2}, 0xa) shutdown(r6, 0x1) listen(0xffffffffffffffff, 0x20000005) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c0000", @ANYRES16=r1, @ANYBLOB="050026bd7000a7ea935b17f9c1da00"/25, @ANYRES32=r2, @ANYBLOB], 0x1c}}, 0x20000014) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000040)={0xa, 0x4e22, 0x200ff, @private0={0xfc, 0x0, '\x00', 0x1}, 0x80000001}, 0x1c, 0x0}, 0x4006) r8 = socket(0x10, 0xbd0e6e190d015d52, 0x10) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000000)={0xe0, 0x2, 0x1}, 0x10) sendmsg$kcm(r8, &(0x7f00000016c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="2e0000004a008102e00f80ecdb4cb9020a", 0x4a}, {&(0x7f0000001700)="0c74c75350f4a590e15c61c7942348092734fe1863473bbce6798a60e9", 0x1d}], 0x2, 0x0, 0x0, 0x10}, 0x0) r9 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZEX(r9, 0x560a, &(0x7f0000000100)={0x4, 0x0, 0x4, 0x0, 0x4002}) 2.673615175s ago: executing program 0 (id=100): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = socket(0x10, 0x803, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000740)=@newtfilter={0x3c, 0x2c, 0xd27, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, r6, {0xfff1, 0x4}, {}, {0x5, 0x10}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_IPV4_DST={0x8, 0xc, @multicast1}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x400c021}, 0x40814) 2.673354047s ago: executing program 2 (id=101): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0x5) ioctl$TCFLSH(r0, 0x8926, 0xffffffffffff7ffe) 2.210614049s ago: executing program 4 (id=102): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000001640)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$nfc_llcp(r1, &(0x7f0000000240)={0x27, 0x0, 0x0, 0x4, 0x0, 0x3, "e88509de7f1939e8abff005597c8ef039a5be42200", 0x13}, 0x60) listen(r1, 0x0) accept4$nfc_llcp(r1, 0x0, 0x0, 0x0) syz_clone3(0x0, 0x0) 2.177825133s ago: executing program 1 (id=103): r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000000240)=@abs={0x0, 0x0, 0x4e23}, 0x6e) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r1 = memfd_create(&(0x7f00000000c0)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x9a\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00\x81Ks\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x14\xb1`\x87#X\\W`;\'_4\xc5\xc9\x921<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\x02\x00\x00\x00\x8aeh;F[\xe2\x1c\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\x9a{C|S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ', 0x6) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x8010002}) mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x2000003, 0x97052, r1, 0x0) 2.054708295s ago: executing program 1 (id=104): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) r1 = syz_io_uring_setup(0x88f, &(0x7f0000000340)={0x0, 0xaee4, 0x400, 0x1, 0xbfdffffc}, &(0x7f0000000000)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000100)=@IORING_OP_ACCEPT={0xd, 0x0, 0x3, r0, 0x0, 0x0, 0x0, 0x80000}) io_uring_enter(r1, 0x47f6, 0x0, 0x0, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) 2.053525179s ago: executing program 2 (id=105): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4000}}, &(0x7f0000000000)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f00000001c0)={'batadv_slave_1\x00', 0x0}) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000180)={r2, 0x1, 0x6, @local}, 0x10) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f0000000580)={r2, 0x1, 0x6, @local}, 0x10) 1.995149702s ago: executing program 0 (id=106): r0 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) r4 = io_uring_setup(0x2237, &(0x7f0000000880)={0x0, 0xfffffffc, 0x3018, 0x2}) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r4, 0xe, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000000040)=[{0x0}], &(0x7f0000000080)=[0x400000000000], 0x1}, 0x20) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r4, 0xe, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x1a, &(0x7f00000001c0)={0x3, &(0x7f0000000040)=[{0x40, 0x0, 0x0, 0x401}, {0x20, 0x0, 0x0, 0xfffff038}, {0x6, 0xfc, 0x0, 0x6}]}, 0x10) write$binfmt_aout(r5, &(0x7f0000000000)=ANY=[], 0xfdef) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x0, 0x1) openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x601, 0x84) 1.801104328s ago: executing program 2 (id=107): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000804082, 0x0) r1 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r1, 0x2000) ioctl$BLKGETDISKSEQ(r0, 0x80081280, &(0x7f0000000280)) 1.765216754s ago: executing program 2 (id=108): fsopen(0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) ioctl$TUNSETLINK(r1, 0x4020940d, 0x200000000000) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) r5 = syz_open_dev$loop(&(0x7f0000000100), 0x8, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.empty_time\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r5, 0x4c0a, &(0x7f00000002c0)={r6, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x2000000000001]}}) ioctl$LOOP_SET_STATUS(r5, 0x4c02, &(0x7f0000000000)={0x0, {}, 0x0, {}, 0x9, 0x5, 0x17, 0x8, "038b0ced01d119456adc3b7aa5fda49436ef7fc25f433b0666324210780fd75009efb2033b1d6397f69e31a3b8a6f59f3ad6a6cfc3e99f3ca0cc8e0cda21bfcc", "1adad85867f7c226807b0f528c3e616ddbcdbbb3dc002b7ee11f8d8752ac335b", [0x5]}) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r4, 0x84, 0x10, 0x0, 0x0) r7 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYRES16, @ANYRES32=r1, @ANYRESHEX=r7], 0x6c}, 0x1, 0x0, 0x0, 0x801}, 0x40000) r8 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYRESHEX=r6, @ANYRES32=0x1, @ANYRESOCT, @ANYRES32=0x0, @ANYRES32=r8, @ANYBLOB="0000000001000000000000000000"], 0x48) syz_emit_ethernet(0x2a, &(0x7f0000000c40)=ANY=[@ANYBLOB="0180c200000050a245d5cde086dd4500001c000000000002907800000000ffffffff1cff49dc958bb45948a35779ee2fb5981200907800000000"], 0x0) 1.074500189s ago: executing program 3 (id=109): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@ipv4_delroute={0x44, 0x19, 0x901, 0x0, 0x0, {0x2, 0x18, 0x0, 0x0, 0x0, 0x2, 0xfd, 0x1}, [@RTA_DST={0x8, 0x1, @dev}, @RTA_GATEWAY={0x8, 0x5, @initdev={0xac, 0x1e, 0x1, 0x0}}, @RTA_ENCAP={0x10, 0x16, 0x0, 0x1, @LWTUNNEL_IP6_ID={0xc, 0x1, 0x4}}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x1}]}, 0x44}}, 0x0) 1.055523221s ago: executing program 0 (id=110): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SCROLLCONSOLE(r0, 0x541c, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="4400000071000100000000000000000007"], 0x44}}, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r2 = socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000002400)='net/wireless\x00') read$FUSE(r6, &(0x7f0000003f80)={0x2020}, 0x2020) sendmsg$nl_generic(r2, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[], 0x24}}, 0x0) move_mount(r1, 0x0, 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) socketpair(0x1d, 0x2, 0x2, &(0x7f0000000000)={0x0, 0x0}) r7 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000280), 0x0) pread64(r7, 0x0, 0x0, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000080)={0x209d}, 0x10) write(0xffffffffffffffff, &(0x7f0000000240)="1800000016005f0214ffffedfffffff80700000011000000", 0x18) r8 = socket(0x10, 0x803, 0x0) r9 = socket(0x10, 0x803, 0x0) getsockname$packet(r8, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000700)=0x14) sendmsg$nl_route(r9, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_tracing={0x1a, 0x5, &(0x7f0000000600)=@framed={{0x18, 0x0, 0x0, 0x0, 0xe717, 0x0, 0x0, 0x0, 0x1}, [@cb_func={0x18, 0x9, 0x4, 0x0, 0x8}]}, &(0x7f0000000400)='GPL\x00', 0x4, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000540)={0x2, 0xf, 0x87e0, 0x3ff}, 0x10, 0x2582c, r6, 0x3, &(0x7f0000000580)=[r6], &(0x7f00000005c0)=[{0x0, 0xfffffffe, 0x9, 0xa}, {0x3, 0x1, 0x10, 0x7}, {0x5, 0x3, 0xb, 0x2}], 0x10, 0x2, @void, @value}, 0x94) 986.3324ms ago: executing program 4 (id=111): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) syz_open_dev$sndctrl(&(0x7f0000000e00), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)={0x28, 0x40, 0xb, 0x0, 0x3, {0x3}, [@typed={0xc, 0x2, 0x0, 0x0, @u64=0x7}, @nested={0x8, 0x1, 0x0, 0x1, [@generic="30b26705"]}]}, 0x28}}, 0x48840) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000000)='source', &(0x7f0000000100)='::,:/', 0x0) r5 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000280)=@ethtool_channels={0x3d, 0x0, 0x0, 0x40000, 0x0, 0x2, 0x1}}) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_cmd={0x2c, 0x6, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}}) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000040)={'veth0_to_team\x00', 0x3fa1dc947ffe4b82}) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={0xffffffffffffffff, 0x0, &(0x7f0000001380)=@udp}, 0x20) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[], 0x0, 0x37, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000004440)=@base={0x9, 0x4, 0x4, 0x7, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r6, 0x2, 0x1, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000004440)=@base={0xd, 0x4, 0x4, 0x7, 0x0, r7, 0x0, '\x00', 0x0, r6, 0x0, 0x1, 0x0, 0x0, @void, @value, @void, @value}, 0x48) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x5452, &(0x7f0000000380)={'gre0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x7, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x9, 0x0, 0x0, 0x0, 0x69, 0x10, 0xae}, [@ldst={0x4, 0x0, 0x6, 0x9}], {0x95, 0x0, 0x74}}, &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000080), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x49) 0s ago: executing program 3 (id=112): syz_emit_ethernet(0xd6, &(0x7f0000000000)={@link_local, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0xa0, 0x3a, 0xff, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @dev, @dev, [{0x2, 0xf, "1d6ace8f8ca9100083faa1f1a6db56fa1ede4bc5398bd6606aaa671ffdd8e79d60cde5302fa555d0f9e0b2fa0d62fffea7fab292bbcd05812814821553a38e86fe6101bf2c4e313e4f930b10cd9a70cebc77f319c1857ad9d50341d17b5e7857a871249feab9b7b485d93f657e39417fb957d1b7fa15"}]}}}}}}, 0x0) socket$unix(0x1, 0x2, 0x0) r0 = socket$inet_sctp(0x2, 0x1, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) read$FUSE(r4, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) r5 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r5, &(0x7f00000001c0)={0x1f, @none, 0x1}, 0xa) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[], 0xfc}, 0x1, 0x0, 0x0, 0x4084}, 0x5044) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000140)={0x0, @in6={{0xa, 0x4e21, 0xe8ed, @private1, 0x80}}, 0x4, 0x8000}, &(0x7f0000000080)=0x90) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TCSETS(r6, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x5, "ff00"}) r7 = syz_open_pts(r6, 0x0) read(r7, &(0x7f0000000180)=""/209, 0x7b) ioctl$TIOCSTI(r7, 0x5412, &(0x7f0000000140)=0x4) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.170' (ED25519) to the list of known hosts. syzkaller login: [ 37.279082][ T6509] cgroup: Unknown subsys name 'net' [ 37.382416][ T6509] cgroup: Unknown subsys name 'cpuset' [ 37.386011][ T6509] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 37.613748][ T6509] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 39.163428][ T6524] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 39.163846][ T6524] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 39.168416][ T6524] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 39.170826][ T6524] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 39.174080][ T6524] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 39.176504][ T6524] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 39.179911][ T6088] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 39.182141][ T6088] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 39.190279][ T6088] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 39.192815][ T6088] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 39.206288][ T6088] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 39.209151][ T6088] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 39.219663][ T52] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 39.222023][ T52] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 39.222969][ T52] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 39.233628][ T6524] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 39.237499][ T52] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 39.238058][ T52] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 39.240808][ T52] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 39.241266][ T52] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 39.245781][ T6525] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 39.246330][ T6525] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 39.246684][ T6525] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 39.248007][ T6525] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 39.248448][ T6525] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 39.539242][ T6519] chnl_net:caif_netlink_parms(): no params data found [ 39.591793][ T6528] chnl_net:caif_netlink_parms(): no params data found [ 39.644933][ T6527] chnl_net:caif_netlink_parms(): no params data found [ 39.656801][ T6520] chnl_net:caif_netlink_parms(): no params data found [ 39.741679][ T6526] chnl_net:caif_netlink_parms(): no params data found [ 39.754143][ T6519] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.754290][ T6519] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.754420][ T6519] bridge_slave_0: entered allmulticast mode [ 39.755325][ T6519] bridge_slave_0: entered promiscuous mode [ 39.757263][ T6519] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.757355][ T6519] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.757464][ T6519] bridge_slave_1: entered allmulticast mode [ 39.758279][ T6519] bridge_slave_1: entered promiscuous mode [ 39.768969][ T6528] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.769094][ T6528] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.769214][ T6528] bridge_slave_0: entered allmulticast mode [ 39.770015][ T6528] bridge_slave_0: entered promiscuous mode [ 39.802391][ T6528] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.802463][ T6528] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.802584][ T6528] bridge_slave_1: entered allmulticast mode [ 39.803417][ T6528] bridge_slave_1: entered promiscuous mode [ 39.851281][ T6527] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.853259][ T6527] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.855559][ T6527] bridge_slave_0: entered allmulticast mode [ 39.858038][ T6527] bridge_slave_0: entered promiscuous mode [ 39.859536][ T6527] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.859585][ T6527] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.859726][ T6527] bridge_slave_1: entered allmulticast mode [ 39.860879][ T6527] bridge_slave_1: entered promiscuous mode [ 39.884418][ T6519] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 39.888812][ T6528] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 39.915728][ T6520] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.915837][ T6520] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.915966][ T6520] bridge_slave_0: entered allmulticast mode [ 39.916845][ T6520] bridge_slave_0: entered promiscuous mode [ 39.918345][ T6520] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.918392][ T6520] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.918514][ T6520] bridge_slave_1: entered allmulticast mode [ 39.919432][ T6520] bridge_slave_1: entered promiscuous mode [ 39.921795][ T6519] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 39.931709][ T6528] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 39.940307][ T6527] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 39.970093][ T6527] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 39.971575][ T6528] team0: Port device team_slave_0 added [ 39.979260][ T6526] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.979357][ T6526] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.979580][ T6526] bridge_slave_0: entered allmulticast mode [ 39.980461][ T6526] bridge_slave_0: entered promiscuous mode [ 39.989858][ T6520] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 39.992806][ T6519] team0: Port device team_slave_0 added [ 39.994298][ T6519] team0: Port device team_slave_1 added [ 40.002736][ T6528] team0: Port device team_slave_1 added [ 40.018942][ T6526] bridge0: port 2(bridge_slave_1) entered blocking state [ 40.019051][ T6526] bridge0: port 2(bridge_slave_1) entered disabled state [ 40.019152][ T6526] bridge_slave_1: entered allmulticast mode [ 40.020031][ T6526] bridge_slave_1: entered promiscuous mode [ 40.028808][ T6520] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 40.044570][ T6527] team0: Port device team_slave_0 added [ 40.059202][ T6519] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 40.059254][ T6519] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 40.059322][ T6519] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 40.060761][ T6519] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 40.060788][ T6519] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 40.060820][ T6519] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 40.061672][ T6528] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 40.061697][ T6528] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 40.061728][ T6528] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 40.085057][ T6527] team0: Port device team_slave_1 added [ 40.098178][ T6526] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 40.102135][ T6526] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 40.114705][ T6520] team0: Port device team_slave_0 added [ 40.116887][ T6528] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 40.116942][ T6528] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 40.117216][ T6528] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 40.152508][ T6526] team0: Port device team_slave_0 added [ 40.155363][ T6520] team0: Port device team_slave_1 added [ 40.167586][ T6519] hsr_slave_0: entered promiscuous mode [ 40.169817][ T6519] hsr_slave_1: entered promiscuous mode [ 40.171787][ T6527] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 40.172394][ T6527] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 40.172436][ T6527] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 40.185089][ T6526] team0: Port device team_slave_1 added [ 40.194683][ T6527] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 40.194741][ T6527] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 40.194780][ T6527] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 40.211027][ T6528] hsr_slave_0: entered promiscuous mode [ 40.211596][ T6528] hsr_slave_1: entered promiscuous mode [ 40.211969][ T6528] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 40.212047][ T6528] Cannot create hsr debugfs directory [ 40.231072][ T6526] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 40.231125][ T6526] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 40.231187][ T6526] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 40.243599][ T6520] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 40.243650][ T6520] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 40.243915][ T6520] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 40.245075][ T6520] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 40.245101][ T6520] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 40.245133][ T6520] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 40.273068][ T6526] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 40.273129][ T6526] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 40.273407][ T6526] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 40.292863][ T6527] hsr_slave_0: entered promiscuous mode [ 40.293402][ T6527] hsr_slave_1: entered promiscuous mode [ 40.293706][ T6527] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 40.293736][ T6527] Cannot create hsr debugfs directory [ 40.396427][ T6526] hsr_slave_0: entered promiscuous mode [ 40.396963][ T6526] hsr_slave_1: entered promiscuous mode [ 40.397795][ T6526] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 40.397827][ T6526] Cannot create hsr debugfs directory [ 40.428076][ T6520] hsr_slave_0: entered promiscuous mode [ 40.430156][ T6520] hsr_slave_1: entered promiscuous mode [ 40.432028][ T6520] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 40.434118][ T6520] Cannot create hsr debugfs directory [ 40.664817][ T6519] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 40.674547][ T6519] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 40.691177][ T6519] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 40.695248][ T6519] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 40.724441][ T6526] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 40.735208][ T6526] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 40.739579][ T6526] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 40.755294][ T6526] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 40.773086][ T6528] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 40.781635][ T6528] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 40.795291][ T6528] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 40.805792][ T6528] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 40.862464][ T6527] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 40.864509][ T6527] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 40.879683][ T6527] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 40.884480][ T6527] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 40.903984][ T6519] 8021q: adding VLAN 0 to HW filter on device bond0 [ 40.919617][ T6520] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 40.925479][ T6520] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 40.935983][ T6520] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 40.945518][ T6519] 8021q: adding VLAN 0 to HW filter on device team0 [ 40.952072][ T6520] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 40.990185][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 40.990340][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.009498][ T6528] 8021q: adding VLAN 0 to HW filter on device bond0 [ 41.021547][ T41] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.021643][ T41] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.024994][ T6526] 8021q: adding VLAN 0 to HW filter on device bond0 [ 41.032865][ T6528] 8021q: adding VLAN 0 to HW filter on device team0 [ 41.049735][ T41] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.049810][ T41] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.062133][ T6526] 8021q: adding VLAN 0 to HW filter on device team0 [ 41.073945][ T2675] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.074026][ T2675] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.075117][ T2675] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.075172][ T2675] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.094308][ T2675] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.094397][ T2675] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.118249][ T6520] 8021q: adding VLAN 0 to HW filter on device bond0 [ 41.143304][ T6519] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 41.159101][ T6527] 8021q: adding VLAN 0 to HW filter on device bond0 [ 41.165326][ T6520] 8021q: adding VLAN 0 to HW filter on device team0 [ 41.185041][ T2675] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.185136][ T2675] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.186362][ T2675] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.186406][ T2675] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.224130][ T6520] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 41.224211][ T6520] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 41.238909][ T6531] Bluetooth: hci2: command tx timeout [ 41.239135][ T6531] Bluetooth: hci1: command tx timeout [ 41.239284][ T6531] Bluetooth: hci0: command tx timeout [ 41.264875][ T6527] 8021q: adding VLAN 0 to HW filter on device team0 [ 41.281180][ T795] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.281275][ T795] bridge0: port 1(bridge_slave_0) entered forwarding state [ 41.299693][ T2675] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.299797][ T2675] bridge0: port 2(bridge_slave_1) entered forwarding state [ 41.318526][ T6525] Bluetooth: hci4: command tx timeout [ 41.318737][ T6525] Bluetooth: hci3: command tx timeout [ 41.384395][ T6526] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 41.441105][ T6519] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 41.476401][ T6519] veth0_vlan: entered promiscuous mode [ 41.490705][ T6519] veth1_vlan: entered promiscuous mode [ 41.526674][ T6519] veth0_macvtap: entered promiscuous mode [ 41.532252][ T6519] veth1_macvtap: entered promiscuous mode [ 41.547051][ T6527] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 41.552070][ T6520] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 41.582910][ T6528] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 41.587801][ T6519] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 41.609865][ T6519] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 41.613807][ T6519] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.616189][ T6519] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.619347][ T6519] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.621644][ T6519] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.671076][ T6527] veth0_vlan: entered promiscuous mode [ 41.703818][ T6527] veth1_vlan: entered promiscuous mode [ 41.711754][ T6526] veth0_vlan: entered promiscuous mode [ 41.725843][ T6520] veth0_vlan: entered promiscuous mode [ 41.745573][ T6526] veth1_vlan: entered promiscuous mode [ 41.747568][ T674] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 41.749725][ T674] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 41.755711][ T6528] veth0_vlan: entered promiscuous mode [ 41.759744][ T6520] veth1_vlan: entered promiscuous mode [ 41.772490][ T6528] veth1_vlan: entered promiscuous mode [ 41.814614][ T6526] veth0_macvtap: entered promiscuous mode [ 41.823344][ T6520] veth0_macvtap: entered promiscuous mode [ 41.830932][ T6520] veth1_macvtap: entered promiscuous mode [ 41.834202][ T6528] veth0_macvtap: entered promiscuous mode [ 41.836289][ T6526] veth1_macvtap: entered promiscuous mode [ 41.840272][ T674] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 41.840327][ T674] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 41.846633][ T6528] veth1_macvtap: entered promiscuous mode [ 41.855883][ T6526] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 41.862451][ T6526] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 41.863977][ T6526] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.864019][ T6526] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.864049][ T6526] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.864079][ T6526] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.878001][ T6527] veth0_macvtap: entered promiscuous mode [ 41.891520][ T6528] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 41.895598][ T6527] veth1_macvtap: entered promiscuous mode [ 41.900040][ T6520] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 41.920932][ T6520] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 41.922507][ T6520] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.922548][ T6520] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.922578][ T6520] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.922608][ T6520] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 41.938987][ T6527] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 41.951992][ T6528] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 41.980066][ T6527] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 41.986912][ T6519] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 42.001524][ T6528] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.001665][ T6528] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.001698][ T6528] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.001728][ T6528] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.014607][ T6527] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.014676][ T6527] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.014707][ T6527] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.014737][ T6527] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 42.054495][ T4430] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 42.056743][ T4430] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 42.146628][ T41] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 42.149243][ T41] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 42.193237][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 42.193291][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 42.244361][ T41] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 42.244421][ T41] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 42.264393][ T819] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 42.264455][ T819] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 42.405697][ T6634] process 'syz.0.1' launched './file2' with NULL argv: empty string added [ 42.900624][ T2675] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 42.900679][ T2675] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 42.947683][ T795] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 42.947725][ T795] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 43.063409][ T819] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 43.063472][ T819] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 43.084479][ T6639] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 43.084863][ T6639] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 43.318063][ T6531] Bluetooth: hci0: command tx timeout [ 43.318412][ T6531] Bluetooth: hci1: command tx timeout [ 43.318838][ T6531] Bluetooth: hci2: command tx timeout [ 43.398795][ T6531] Bluetooth: hci3: command tx timeout [ 43.399089][ T6531] Bluetooth: hci4: command tx timeout [ 43.967231][ T6647] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8'. [ 44.111954][ T6659] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 45.128316][ T6682] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 45.128645][ T6682] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 45.204292][ T6687] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 45.204650][ T6687] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 45.227585][ T24] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 45.377087][ T24] usb 1-1: Using ep0 maxpacket: 8 [ 45.382130][ T24] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04 [ 45.382620][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 45.382647][ T24] usb 1-1: Product: syz [ 45.382669][ T24] usb 1-1: Manufacturer: syz [ 45.382690][ T24] usb 1-1: SerialNumber: syz [ 45.386722][ T24] usb 1-1: config 0 descriptor?? [ 45.398609][ T6531] Bluetooth: hci1: command tx timeout [ 45.398677][ T6531] Bluetooth: hci0: command tx timeout [ 45.399051][ T6525] Bluetooth: hci2: command tx timeout [ 45.474760][ T6690] netlink: 'syz.1.23': attribute type 1 has an invalid length. [ 45.474935][ T6690] netlink: 'syz.1.23': attribute type 2 has an invalid length. [ 45.480292][ T6525] Bluetooth: hci4: command tx timeout [ 45.481838][ T6525] Bluetooth: hci3: command tx timeout [ 45.595862][ T24] usb 1-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 45.716345][ T31] audit: type=1326 audit(45.340:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6691 comm="syz.3.24" exe="/root/syz-executor" sig=31 arch=c00000b7 syscall=98 compat=0 ip=0xffffa275a7a8 code=0x0 [ 45.925460][ T6699] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 45.931138][ T6699] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 47.091554][ T24] dvb_usb_rtl28xxu 1-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 47.400784][ T24] usb 1-1: USB disconnect, device number 2 [ 47.477682][ T52] Bluetooth: hci2: command tx timeout [ 47.477727][ T6531] Bluetooth: hci1: command tx timeout [ 47.477801][ T6525] Bluetooth: hci0: command tx timeout [ 47.557777][ T6531] Bluetooth: hci4: command tx timeout [ 47.557871][ T6525] Bluetooth: hci3: command tx timeout [ 55.488562][ T6716] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 55.505374][ T6725] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 55.505479][ T6725] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 55.534063][ T6725] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 55.534148][ T6725] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 55.615874][ T6741] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 55.619923][ T6741] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 55.633158][ T6739] warning: `syz.4.42' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 55.874563][ T6602] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 56.049702][ T6602] usb 1-1: Using ep0 maxpacket: 16 [ 56.576946][ T6602] usb 1-1: config 5 has an invalid interface number: 168 but max is 0 [ 56.579432][ T6602] usb 1-1: config 5 has no interface number 0 [ 56.581414][ T6602] usb 1-1: config 5 interface 168 altsetting 7 has an endpoint descriptor with address 0xEB, changing to 0x8B [ 56.585432][ T6602] usb 1-1: config 5 interface 168 altsetting 7 bulk endpoint 0x8B has invalid maxpacket 1024 [ 56.588398][ T6602] usb 1-1: config 5 interface 168 altsetting 7 bulk endpoint 0x4 has invalid maxpacket 1023 [ 56.597114][ T6602] usb 1-1: config 5 interface 168 has no altsetting 0 [ 56.601911][ T6602] usb 1-1: New USB device found, idVendor=04cc, idProduct=2533, bcdDevice=fc.58 [ 56.601965][ T6602] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 56.602005][ T6602] usb 1-1: Product: syz [ 56.602033][ T6602] usb 1-1: Manufacturer: syz [ 56.602061][ T6602] usb 1-1: SerialNumber: syz [ 56.613207][ T6737] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 56.613346][ T6737] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 56.885736][ C0] usb 1-1: NFC: Urb failure (status -71) [ 56.886421][ C0] usb 1-1: NFC: Urb failure (status -71) [ 56.896449][ T6602] usb 1-1: NFC: Unable to get FW version [ 56.897436][ T6602] pn533_usb 1-1:5.168: probe with driver pn533_usb failed with error -71 [ 56.926677][ T6602] usb 1-1: USB disconnect, device number 3 [ 57.200545][ T6775] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 57.206507][ T6775] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 57.807109][ T6530] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 58.698374][ T6530] usb 1-1: config 0 has an invalid interface number: 29 but max is 0 [ 58.698441][ T6530] usb 1-1: config 0 has no interface number 0 [ 58.698487][ T6530] usb 1-1: config 0 interface 29 has no altsetting 0 [ 58.700007][ T6530] usb 1-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 58.700043][ T6530] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 58.700068][ T6530] usb 1-1: Product: syz [ 58.700089][ T6530] usb 1-1: Manufacturer: syz [ 58.700110][ T6530] usb 1-1: SerialNumber: syz [ 58.704125][ T6530] usb 1-1: config 0 descriptor?? [ 58.987124][ T6799] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 58.987914][ T6799] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 59.498397][ T6805] netlink: 'syz.4.63': attribute type 10 has an invalid length. [ 60.860443][ T6815] netlink: 60 bytes leftover after parsing attributes in process `syz.0.66'. [ 61.642260][ T6819] Bluetooth: MGMT ver 1.23 [ 64.839272][ T2410] ieee802154 phy0 wpan0: encryption failed: -22 [ 64.839394][ T2410] ieee802154 phy1 wpan1: encryption failed: -22 [ 69.605777][ T6530] peak_usb 1-1:0.29 can0: unable to request usb[type=0 value=1] err=-71 [ 69.614847][ T6530] peak_usb 1-1:0.29: unable to read PCAN-USB X6 firmware info (err -71) [ 69.615738][ T6805] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.618154][ T6805] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 69.657949][ T6809] batman_adv: batadv0: Adding interface: dummy0 [ 69.658017][ T6809] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.658100][ T6809] batman_adv: batadv0: Interface activated: dummy0 [ 69.696114][ T6810] batadv0: mtu less than device minimum [ 69.699154][ T6810] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 69.702106][ T6810] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 69.704987][ T6810] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 69.707892][ T6810] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 69.710768][ T6810] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 69.713654][ T6810] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 69.716516][ T6810] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 69.719403][ T6810] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 69.722276][ T6810] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 69.758389][ T6530] peak_usb 1-1:0.29: probe with driver peak_usb failed with error -71 [ 69.764312][ T6530] usb 1-1: USB disconnect, device number 4 [ 69.959886][ T26] cfg80211: failed to load regulatory.db [ 70.480841][ T6840] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 71.459277][ T6846] batadv_slave_1: entered promiscuous mode [ 71.463837][ T6845] batadv_slave_1: left promiscuous mode [ 71.780844][ T6853] binder: 6843:6853 BC_CLEAR_DEATH_NOTIFICATION invalid ref 5 [ 72.399535][ T6861] veth0_vlan: entered allmulticast mode [ 72.597500][ T6862] veth0_vlan: left promiscuous mode [ 72.604305][ T6862] veth0_vlan: entered promiscuous mode [ 73.083707][ T6874] netlink: 182 bytes leftover after parsing attributes in process `syz.2.83'. [ 73.126865][ T6868] binder: 6867:6868 tried to acquire reference to desc 0, got 1 instead [ 73.145962][ T6868] binder: 6867:6868 got reply transaction with bad transaction stack, transaction 7 has target 6867:0 [ 73.146114][ T6868] binder: 6867:6868 transaction reply to 0:0 failed 8/29201/-71, code 0 size 0-0 line 3068 [ 73.147236][ T26] binder: release 6867:6868 transaction 7 out, still active [ 73.229665][ T6602] binder: send failed reply for transaction 7, target dead [ 73.451942][ T6884] batadv_slave_1: entered promiscuous mode [ 73.912342][ T6893] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 73.991841][ T6889] batadv_slave_1: left promiscuous mode [ 75.087664][ T6907] binder: 6906:6907 unknown command 0 [ 75.089338][ T6907] binder: 6906:6907 ioctl c0306201 20000340 returned -22 [ 75.153276][ T12] Bluetooth: hci5: Frame reassembly failed (-84) [ 75.233007][ T6910] netlink: 24 bytes leftover after parsing attributes in process `syz.1.98'. [ 77.029180][ T6925] mkiss: ax0: crc mode is auto. [ 77.157215][ T52] Bluetooth: hci5: command 0xfc11 tx timeout [ 77.159175][ T6525] Bluetooth: hci5: Entering manufacturer mode failed (-110) [ 77.254382][ T6942] batadv_slave_1: entered promiscuous mode [ 77.254808][ T6942] batadv_slave_1: left promiscuous mode [ 79.255754][ T6525] Bluetooth: hci4: command 0x0405 tx timeout [ 79.697585][ T6961] [ 79.698269][ T6961] ====================================================== [ 79.700164][ T6961] WARNING: possible circular locking dependency detected [ 79.702105][ T6961] 6.16.0-rc1-syzkaller-g39dfc971e42d #0 Not tainted [ 79.703887][ T6961] ------------------------------------------------------ [ 79.705839][ T6961] syz.2.108/6961 is trying to acquire lock: [ 79.707410][ T6961] ffff800092bd96e8 (uevent_sock_mutex){+.+.}-{4:4}, at: kobject_uevent_net_broadcast+0x24c/0x548 [ 79.710269][ T6961] [ 79.710269][ T6961] but task is already holding lock: [ 79.712284][ T6961] ffff0000ca08e228 (&q->q_usage_counter(io)#25){++++}-{0:0}, at: loop_set_status+0x1d4/0x9e0 [ 79.715148][ T6961] [ 79.715148][ T6961] which lock already depends on the new lock. [ 79.715148][ T6961] [ 79.718101][ T6961] [ 79.718101][ T6961] the existing dependency chain (in reverse order) is: [ 79.720600][ T6961] [ 79.720600][ T6961] -> #2 (&q->q_usage_counter(io)#25){++++}-{0:0}: [ 79.723120][ T6961] blk_alloc_queue+0x48c/0x54c [ 79.724541][ T6961] __blk_mq_alloc_disk+0x12c/0x310 [ 79.726033][ T6961] loop_add+0x32c/0x88c [ 79.727361][ T6961] loop_init+0x168/0x1a0 [ 79.728679][ T6961] do_one_initcall+0x250/0x990 [ 79.730193][ T6961] do_initcall_level+0x154/0x214 [ 79.731746][ T6961] do_initcalls+0x84/0xf4 [ 79.733134][ T6961] do_basic_setup+0x8c/0xa0 [ 79.734544][ T6961] kernel_init_freeable+0x2dc/0x444 [ 79.736102][ T6961] kernel_init+0x24/0x1dc [ 79.737465][ T6961] ret_from_fork+0x10/0x20 [ 79.738809][ T6961] [ 79.738809][ T6961] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 79.740878][ T6961] fs_reclaim_acquire+0x8c/0x118 [ 79.742437][ T6961] kmem_cache_alloc_node_noprof+0x60/0x3f4 [ 79.744184][ T6961] __alloc_skb+0x144/0x2ec [ 79.745545][ T6961] alloc_uevent_skb+0x78/0x1e0 [ 79.747061][ T6961] kobject_uevent_net_broadcast+0x2d4/0x548 [ 79.748927][ T6961] kobject_uevent_env+0x528/0x884 [ 79.750530][ T6961] kobject_synth_uevent+0x82c/0xa74 [ 79.752128][ T6961] bus_uevent_store+0x114/0x16c [ 79.753649][ T6961] bus_attr_store+0x80/0xa4 [ 79.755112][ T6961] sysfs_kf_write+0x1a8/0x23c [ 79.756616][ T6961] kernfs_fop_write_iter+0x314/0x488 [ 79.758211][ T6961] vfs_write+0x62c/0x97c [ 79.759555][ T6961] ksys_write+0x120/0x210 [ 79.760969][ T6961] __arm64_sys_write+0x7c/0x90 [ 79.762458][ T6961] invoke_syscall+0x98/0x2b8 [ 79.763871][ T6961] el0_svc_common+0x130/0x23c [ 79.765334][ T6961] do_el0_svc+0x48/0x58 [ 79.766651][ T6961] el0_svc+0x58/0x17c [ 79.767893][ T6961] el0t_64_sync_handler+0x78/0x108 [ 79.769447][ T6961] el0t_64_sync+0x198/0x19c [ 79.770809][ T6961] [ 79.770809][ T6961] -> #0 (uevent_sock_mutex){+.+.}-{4:4}: [ 79.773102][ T6961] __lock_acquire+0x1774/0x30a4 [ 79.774635][ T6961] lock_acquire+0x14c/0x2e0 [ 79.776001][ T6961] __mutex_lock_common+0x1d0/0x2190 [ 79.777568][ T6961] mutex_lock_nested+0x2c/0x38 [ 79.779029][ T6961] kobject_uevent_net_broadcast+0x24c/0x548 [ 79.780888][ T6961] kobject_uevent_env+0x528/0x884 [ 79.782491][ T6961] kobject_uevent+0x2c/0x3c [ 79.783944][ T6961] loop_set_status+0x43c/0x9e0 [ 79.785481][ T6961] lo_ioctl+0x7f0/0x1b8c [ 79.786793][ T6961] blkdev_ioctl+0x610/0xac0 [ 79.788235][ T6961] __arm64_sys_ioctl+0x14c/0x1c4 [ 79.789819][ T6961] invoke_syscall+0x98/0x2b8 [ 79.791268][ T6961] el0_svc_common+0x130/0x23c [ 79.792695][ T6961] do_el0_svc+0x48/0x58 [ 79.793975][ T6961] el0_svc+0x58/0x17c [ 79.795209][ T6961] el0t_64_sync_handler+0x78/0x108 [ 79.796841][ T6961] el0t_64_sync+0x198/0x19c [ 79.798292][ T6961] [ 79.798292][ T6961] other info that might help us debug this: [ 79.798292][ T6961] [ 79.801196][ T6961] Chain exists of: [ 79.801196][ T6961] uevent_sock_mutex --> fs_reclaim --> &q->q_usage_counter(io)#25 [ 79.801196][ T6961] [ 79.805194][ T6961] Possible unsafe locking scenario: [ 79.805194][ T6961] [ 79.807269][ T6961] CPU0 CPU1 [ 79.808795][ T6961] ---- ---- [ 79.810254][ T6961] lock(&q->q_usage_counter(io)#25); [ 79.811810][ T6961] lock(fs_reclaim); [ 79.813711][ T6961] lock(&q->q_usage_counter(io)#25); [ 79.815942][ T6961] lock(uevent_sock_mutex); [ 79.817252][ T6961] [ 79.817252][ T6961] *** DEADLOCK *** [ 79.817252][ T6961] [ 79.819529][ T6961] 3 locks held by syz.2.108/6961: [ 79.820936][ T6961] #0: ffff0000ca23d400 (&lo->lo_mutex){+.+.}-{4:4}, at: loop_set_status+0x40/0x9e0 [ 79.823723][ T6961] #1: ffff0000ca08e228 (&q->q_usage_counter(io)#25){++++}-{0:0}, at: loop_set_status+0x1d4/0x9e0 [ 79.826657][ T6961] #2: ffff0000ca08e260 (&q->q_usage_counter(queue)#20){+.+.}-{0:0}, at: loop_set_status+0x1d4/0x9e0 [ 79.829762][ T6961] [ 79.829762][ T6961] stack backtrace: [ 79.831370][ T6961] CPU: 0 UID: 0 PID: 6961 Comm: syz.2.108 Not tainted 6.16.0-rc1-syzkaller-g39dfc971e42d #0 PREEMPT [ 79.834342][ T6961] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 79.837180][ T6961] Call trace: [ 79.838142][ T6961] show_stack+0x2c/0x3c (C) [ 79.839487][ T6961] __dump_stack+0x30/0x40 [ 79.840739][ T6961] dump_stack_lvl+0xd8/0x12c [ 79.842037][ T6961] dump_stack+0x1c/0x28 [ 79.843182][ T6961] print_circular_bug+0x324/0x32c [ 79.844616][ T6961] check_noncircular+0x154/0x174 [ 79.845995][ T6961] __lock_acquire+0x1774/0x30a4 [ 79.847350][ T6961] lock_acquire+0x14c/0x2e0 [ 79.848677][ T6961] __mutex_lock_common+0x1d0/0x2190 [ 79.850154][ T6961] mutex_lock_nested+0x2c/0x38 [ 79.851495][ T6961] kobject_uevent_net_broadcast+0x24c/0x548 [ 79.853213][ T6961] kobject_uevent_env+0x528/0x884 [ 79.854644][ T6961] kobject_uevent+0x2c/0x3c [ 79.855908][ T6961] loop_set_status+0x43c/0x9e0 [ 79.857280][ T6961] lo_ioctl+0x7f0/0x1b8c [ 79.858454][ T6961] blkdev_ioctl+0x610/0xac0 [ 79.859736][ T6961] __arm64_sys_ioctl+0x14c/0x1c4 [ 79.861203][ T6961] invoke_syscall+0x98/0x2b8 [ 79.862549][ T6961] el0_svc_common+0x130/0x23c [ 79.863923][ T6961] do_el0_svc+0x48/0x58 [ 79.865103][ T6961] el0_svc+0x58/0x17c [ 79.866257][ T6961] el0t_64_sync_handler+0x78/0x108 [ 79.867618][ T6961] el0t_64_sync+0x198/0x19c [ 80.217203][ T6967] net_ratelimit: 10 callbacks suppressed [ 80.217260][ T6967] netlink: get zone limit has 4 unknown bytes [ 80.647266][ T6967] veth0_to_team: entered promiscuous mode [ 80.647320][ T6967] veth0_to_team: entered allmulticast mode