last executing test programs: 2.641203163s ago: executing program 2 (id=515): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet_mptcp(0x2, 0x1, 0x106) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f00000001c0)='bic', 0x3) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x40000, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0x3, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x6, 0x2, 0x80, 0x0, 0x1, 0x91b1}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000400}, 0x24000000) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB], 0x48) sendto$inet(r1, &(0x7f0000000900)="2e552f5d9fd8b0d9627c49f8f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9135a01c95d4a128ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) recvfrom$inet(r1, &(0x7f0000000080), 0xffffffffffffffa9, 0xc9100120, 0x0, 0x1500) r4 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f00000000c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2f8, 0x130, 0xc8, 0x8, 0x130, 0x5803, 0x250, 0x2e8, 0x2e8, 0x250, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @mcast1, [0xffffff00, 0xffffff00, 0xffffffff, 0xff], [0xffffff7f, 0xfffffefe, 0xffffffff, 0xffffffff], 'xfrm0\x00', 'veth0_to_bridge\x00', {0xff}, {0xff}, 0x84, 0xb7}, 0x0, 0xe0, 0x108, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x1, 0x3, 0x10001, {0x1}}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0xc, 0x100, 0x3}}}, {{@ipv6={@private1={0xfc, 0x1, '\x00', 0x1}, @mcast2, [0xffffff00, 0xff000000, 0xff000000, 0xffffff00], [0xff, 0xffffff00, 0xff, 0xffffffff], 'team0\x00', 'wg2\x00', {}, {}, 0x112, 0x6, 0x4, 0x10}, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x8}}, @inet=@rpfilter={{0x28}, {0x8}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x6, 0x6}, {0x0, 0x8, 0x1}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x358) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x28, 0x7, 0x0, 0xa56e}]}, 0x10) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)=ANY=[], 0x5c}, 0x1, 0x0, 0x0, 0x2002c0c4}, 0x0) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, 0x0, 0x800) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCBRDELBR(r8, 0x89a1, &(0x7f0000000040)='ipvlan1\x00') 2.130591326s ago: executing program 0 (id=521): request_key(0x0, 0x0, &(0x7f0000000340)='\x8e\x00\x9e\xbb\x1e\x1av\xe8M\x00d\xaaI\x00\x00\x00\x00\x00\x00\t<\xe5u\xedA\xa7\aT\xdd\xd1{\xff\xcb\xdb\xb11\xc2s\xcb\xbf\x04\x00\x00\x00<\xfe\xf9\f\xe6E\b\x00\xd7\x85q\xc4\xab\xbd&\x92\x89(\xf3\"\xceJ\x19\x185\xa6- \xe6uK\xe1D\x8f\x9f\x92\xca\x93#\xf5E\xc2\x91Yl\x17\a\x02\t\x17\x7f\xc4\xde\x04\x9b\x89#\xf6&[\xd81\xb3\xdc\x00\x04\x15\x03\x17R\xd24\xeb\xb5\xc2\xff\x1bnF\x8e\xe4\'\x18\xba9.\xd4\xd9\xc6\x98\x8f\xc6D!p\xbeV\xb7x\r@\x1b5\x8br\x11\xdex\x19\x89\xdc\x1el\xcd\x13\xb6\xc2\xdb\x1fr2\x7f?\xfe\x0f\x04\x11\xc3\x8f:uXQ\x0f\v\xfc\xff\x7fL\xfb\xa8]\xd4\xd7\x13?\xe3<#\x1f\x9a\x03C\x8f\xe7\rV1\x99\xaf@Re\x18J\xb6\xee\xeeAnR\n\x8a\xe4\x1a:&\xc7\x15B\x8aG\xa4\a`\xee\xaf\x80T\xddo\xc4D^z\xbf\x1c\x87F?!k\'\xc3\xf9\xa3\xd9\x85\xb1N%\x17\f\xd0#\x05^\xf7\x11\x13\xadKb\x8ck\x10\xd3 >\t\xe0\x16\x80\x82\xb3\xcc\xc7\x05*\x9b\x0eQ\x92\xd7\xbaO\x06\xb2\xdc\xe7/\x1f\x90]IB94(evFMJ\x85\xc4S\xa8\x8b\xbe\xd3\x90\xe9\t\x00\x13\x1e\x9a\x94\x00\x00\x00\x00\x00U\xfbLA\xa6K\xd5\x0eD\xf2Y\xc3,\t4hD\xc4o\xc3\x87$\x9d6\xc8\x93\xa3\x8e:\xfe#\xa0`\xb1k\xacz\xe0\xb3\x95\x17\xdf\xc7\xc2\xedKc\xa3\xbd\xc2\x9f\x86C(/\xe3\xb2\xc6$s^\xd1vU\x9cB)ao\xf1\'', 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000000) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000300)={'syztnl2\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x29, 0x84, 0x4, 0x4038a0b, 0x11, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @mcast2={0xff, 0x5}, 0x20, 0x0, 0x0, 0x4}}) fsopen(0x0, 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, 0x0, 0x2) sendmsg$IPSET_CMD_SAVE(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x40044}, 0x48040) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x10) io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x972, 0x1f480, 0x2, 0x325}) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracefs_dir\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs_dir\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./tracefs_dir/buffer_subbuf_size_kb\x00', 0x1, 0x0) write(r2, &(0x7f00000002c0)='16', 0x2) close(0xffffffffffffffff) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x42, &(0x7f0000000500)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff080045000028fffe000095069078640101", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="8c020008907810050000000000000040005600002d226905531de156c8ecefbaecbc06add46e8a3d97a47e75e224d3858e1494d970d9e00fd3e79c9939f75883aee0a185a4e2b4950e2c1a0b5b052ae7609ba5aecca6e20beb023dcb1c"], 0x0) 2.106184407s ago: executing program 0 (id=522): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x81) r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, 0x0, 0x0) ioctl$sock_bt_hci(0xffffffffffffffff, 0x400448de, &(0x7f00000000c0)) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d00000000"], 0x0, 0x34}, 0x28) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x100}, 0x1c) listen(r1, 0xfffffffc) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x28, r3, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0x40080) 2.033051899s ago: executing program 0 (id=524): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/mapper/control\x00', 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x42, 0x1ff) pwrite64(r1, &(0x7f0000000000)='\x00', 0x1, 0xffffff) r2 = syz_open_dev$loop(&(0x7f0000000200), 0x0, 0x2) ioctl$LOOP_SET_FD(r2, 0x4c00, r1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file1\x00', 0x42, 0x1ff) pwrite64(r3, 0x0, 0x0, 0xffffff) r4 = syz_open_dev$loop(&(0x7f0000000280), 0x1, 0x2) ioctl$LOOP_SET_FD(r4, 0x4c00, r3) ioctl(r0, 0xc138fd03, &(0x7f0000000000)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000006d79706f6f6c00") write(r0, &(0x7f0000000138)="000000000000000000800000000000000000000000000000746869", 0x1b) ioctl(r0, 0xc138fd09, &(0x7f0000000000)="0400000000000000000000006e01000038010000010000000000000000000000000000000000000000000000000000006d79706f6f6c00") ioctl(r0, 0xc138fd06, &(0x7f0000000000)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000006d79706f6f6c00") ioctl(r0, 0xc138fd06, &(0x7f0000000000)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000006d79706f6f6c00") 2.029218389s ago: executing program 3 (id=525): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x8d4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x15, 0xe, &(0x7f0000000400)=ANY=[@ANYBLOB="b7020000380d0000bfa30000000000000703000000feffff720af0fff8ffff1989a4f0ff00000000b7060000080000001e640000000000004504040001000000170400000c000a00b7040000ff0100006a0af2fe00000000850000001a000000b70000003f00000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000f0000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd8000000000000080231c61ccd106cb937b450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e1179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c4608800000000000000005cbb5a2600"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffe49}, 0x42) 1.518761432s ago: executing program 2 (id=527): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, 0x0, 0x0) r3 = accept(r1, 0x0, 0x0) sendmsg$xdp(r3, &(0x7f0000000640)={&(0x7f0000000480)={0x2c, 0x1, 0x0, 0x1e}, 0x10, &(0x7f0000000600)=[{&(0x7f00000004c0)="cc35", 0x2}], 0x1, 0x0, 0x0, 0x4000}, 0x40) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x24008840}, 0x0) connect$unix(r3, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) 1.485013293s ago: executing program 0 (id=528): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = accept(r1, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x24008840}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000740000000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f0000000100)) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet_mptcp(0x2, 0x1, 0x106) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x38, 0x0, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x2}]}]}, 0x38}}, 0x0) 1.030166744s ago: executing program 3 (id=535): r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) write(r0, &(0x7f0000000700)='\x00'/32, 0x20) write(r0, &(0x7f0000000700)='\x00'/32, 0x20) write(r0, &(0x7f0000000700)='\x00'/32, 0x20) write(r0, 0x0, 0x0) write(r0, 0x0, 0x0) write(r0, &(0x7f0000000700)='\x00'/32, 0x20) write(r0, &(0x7f0000000700)='\x00'/32, 0x20) write(r0, &(0x7f0000000700)='\x00'/32, 0x20) write(r0, &(0x7f0000000700)='\x00'/32, 0x20) write(r0, &(0x7f0000000700)='\x00'/25, 0x19) 912.538887ms ago: executing program 3 (id=537): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x10000}}]}}]}, 0x48}}, 0x0) syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = socket$unix(0x1, 0x1, 0x0) r7 = socket$kcm(0x11, 0x3, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r8) socket$tipc(0x1e, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000a80)=@newtfilter={0xb4, 0x2c, 0xd27, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0x4}, {}, {0x8, 0xfff2}}, [@filter_kind_options=@f_matchall={{0xd}, {0x80, 0x2, [@TCA_MATCHALL_ACT={0x7c, 0x2, [@m_tunnel_key={0x78, 0x1, 0x0, 0x0, {{0xf}, {0x48, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0x5, @empty}, @TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @ipv4={'\x00', '\xff\xff', @remote}}, @TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x3, 0x8, 0x4, 0x7fff, 0x7}, 0x1}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}}]}, 0xb4}, 0x1, 0x0, 0x0, 0x8080}, 0x20000000) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r7, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r7, &(0x7f0000000280)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r9, 0x3e}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000000)="27030200000214000e00002fb96dffff1144ee163cddcb000000800000827600000000000000", 0x26}, {&(0x7f00000004c0)="f058050000007f8f", 0x300}], 0x2}, 0x5) 887.043968ms ago: executing program 1 (id=538): socket$nl_generic(0x10, 0x3, 0x10) unshare(0x2040400) fcntl$setpipe(0xffffffffffffffff, 0x407, 0xffffffffffffffff) r0 = mq_open(&(0x7f0000000480)='!sel\x00\x00\x00\x10\x00\x00\x00\x00\xd7\\P\xc1\xde.O\xcb]0y\x00\x00\x00\x00\x00\x00\x00\x00', 0x6e93ebbbcc0884f2, 0x196, &(0x7f0000000440)={0x2000000000002000, 0x1, 0x56, 0x3}) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mq_timedsend(r0, 0x0, 0x0, 0x3, 0x0) mq_timedsend(r0, 0x0, 0x0, 0x9, &(0x7f00000002c0)={0x77359400}) 777.27623ms ago: executing program 1 (id=539): r0 = socket$kcm(0x2b, 0x1, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000280)=0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) link(&(0x7f0000000540)='./file0\x00', &(0x7f0000000580)='./file0\x00') recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x16ba82, 0x10) rseq(0x0, 0x0, 0x0, 0x0) write$cgroup_int(r3, 0x0, 0x0) ioctl$VIDIOC_SUBDEV_G_FMT(r3, 0xc0585604, 0x0) getsockopt$inet_mtu(r3, 0x0, 0xa, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0xc080) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendto$inet(r4, 0x0, 0x0, 0x4004084, 0x0, 0x0) io_submit(r2, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r1, 0x0, 0x0, 0x0, 0x0, 0x0, r3}]) sendmsg$inet(r0, &(0x7f0000000240)={&(0x7f00000000c0)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x43}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x2000c08d) shutdown(r0, 0x1) 602.562075ms ago: executing program 3 (id=540): request_key(0x0, 0x0, &(0x7f0000000340)='\x8e\x00\x9e\xbb\x1e\x1av\xe8M\x00d\xaaI\x00\x00\x00\x00\x00\x00\t<\xe5u\xedA\xa7\aT\xdd\xd1{\xff\xcb\xdb\xb11\xc2s\xcb\xbf\x04\x00\x00\x00<\xfe\xf9\f\xe6E\b\x00\xd7\x85q\xc4\xab\xbd&\x92\x89(\xf3\"\xceJ\x19\x185\xa6- \xe6uK\xe1D\x8f\x9f\x92\xca\x93#\xf5E\xc2\x91Yl\x17\a\x02\t\x17\x7f\xc4\xde\x04\x9b\x89#\xf6&[\xd81\xb3\xdc\x00\x04\x15\x03\x17R\xd24\xeb\xb5\xc2\xff\x1bnF\x8e\xe4\'\x18\xba9.\xd4\xd9\xc6\x98\x8f\xc6D!p\xbeV\xb7x\r@\x1b5\x8br\x11\xdex\x19\x89\xdc\x1el\xcd\x13\xb6\xc2\xdb\x1fr2\x7f?\xfe\x0f\x04\x11\xc3\x8f:uXQ\x0f\v\xfc\xff\x7fL\xfb\xa8]\xd4\xd7\x13?\xe3<#\x1f\x9a\x03C\x8f\xe7\rV1\x99\xaf@Re\x18J\xb6\xee\xeeAnR\n\x8a\xe4\x1a:&\xc7\x15B\x8aG\xa4\a`\xee\xaf\x80T\xddo\xc4D^z\xbf\x1c\x87F?!k\'\xc3\xf9\xa3\xd9\x85\xb1N%\x17\f\xd0#\x05^\xf7\x11\x13\xadKb\x8ck\x10\xd3 >\t\xe0\x16\x80\x82\xb3\xcc\xc7\x05*\x9b\x0eQ\x92\xd7\xbaO\x06\xb2\xdc\xe7/\x1f\x90]IB94(evFMJ\x85\xc4S\xa8\x8b\xbe\xd3\x90\xe9\t\x00\x13\x1e\x9a\x94\x00\x00\x00\x00\x00U\xfbLA\xa6K\xd5\x0eD\xf2Y\xc3,\t4hD\xc4o\xc3\x87$\x9d6\xc8\x93\xa3\x8e:\xfe#\xa0`\xb1k\xacz\xe0\xb3\x95\x17\xdf\xc7\xc2\xedKc\xa3\xbd\xc2\x9f\x86C(/\xe3\xb2\xc6$s^\xd1vU\x9cB)ao\xf1\'', 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000000) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000300)={'syztnl2\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x29, 0x84, 0x4, 0x4038a0b, 0x11, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @mcast2={0xff, 0x5}, 0x20, 0x0, 0x0, 0x4}}) fsopen(0x0, 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, 0x0, 0x2) sendmsg$IPSET_CMD_SAVE(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x40044}, 0x48040) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x10) io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x972, 0x1f480, 0x2, 0x325}) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracefs_dir\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs_dir\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./tracefs_dir/buffer_subbuf_size_kb\x00', 0x1, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs_dir/trace\x00', 0x0, 0x0) close(r2) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x42, &(0x7f0000000500)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff080045000028fffe000095069078640101", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="8c020008907810050000000000000040005600002d226905531de156c8ecefbaecbc06add46e8a3d97a47e75e224d3858e1494d970d9e00fd3e79c9939f75883aee0a185a4e2b4950e2c1a0b5b052ae7609ba5aecca6e20beb023dcb1c"], 0x0) 588.477595ms ago: executing program 3 (id=541): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0) write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0) write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff) symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00') symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00') symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00') symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff) symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00') symlinkat(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/uvc.0/control/class/ss/h\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r2, &(0x7f0000000780)='pcspkr\x00', 0x6) 575.713115ms ago: executing program 2 (id=542): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) sendmsg$kcm(r0, &(0x7f0000001ec0)={0x0, 0x0, &(0x7f0000001980)=[{&(0x7f0000000480)="6648c3a2c3f2134babcb8abed272a599875a35ec814f4526d43e8d170c2bdba8b93faa3c07328540ca936e899d66a25fafe2d8d95fcd0c742015631bdd44979a9d5cbcf23947e2b113c7d72edba265b821a23a3f0dc82e8e56b7c524da44c440f864bfcfcba82727394f52748e09c93ec7a3aae92bd0849dea162d7ddee8e44573f26d065448460218459a0d1f6e09a1272bcdbd2f5665818d074c7d5cfd3fb8d078295e30d12cadb8770f82f6e2835ad3e85815ee76295d1b26ed4ea347cb0e60a9a2db", 0xc4}, {&(0x7f0000000680)="4cca1805d7eeefc7f92017b19a3bfb08b29385810ad86f5674fa2b4f6f6376a5c5f3e0fa32247ea8913d1c77d1e1d407856648947abd7f3ad1dea8eb75c3aa8095d88b5cb2880cc121a6630e3736e78ac794105e1f9e048a8a62dcd11f2efd1e4d3c47955bde1fc716732e73b26ffd6734d5315c0dd5c2f91d3a9223165d5ca8f00a4e06dc7b4a07a9d00ede27f8f0a89dfb04a1fa1eb0ad7aa2f3eb638c28829f357e359e340904bacae14dd60674593d38706c7c94d151a5f262f1f6667559f296d591a3af8e42384bbdbb0f461705e35d8bf5843b3d601d6bf57ef4d5e5ad2c1791f67fc8aeb2a06f88369d2668a012043366ef4eaa03454d917753c36dd74b54c33e13144e356ffe5d4584ea9a25f8b0e5f6496e888d24b61251f87ced0fcf89c16023709190f9ae3939179df1cd5c8a17ba3ff765760d510de820f9080e56d7dad69e44fb46de7cc7d3bbf9609596c3566a4596cd80b38eacb7577d39ffd061a130cc28402cb657200c2785b08a269ab9a3939b97ef3f40d15f44de1db6de4458273e903095e1754f81993fbb77cede58f24ea889abb04cacc645760f657dc79199400d969b8858fe67191ed1ba5594ddbe9655defbed7f977dd6ba6e10742046396e66a4b9a47fb22cdc859294355c3a0a6ff7290fa2f7cdf2129348dad88b23d89c4ed745d0d6a5eb0e118f26d96ce5df5067144ad8f760f2f7cc4bd589e4cc2eab3f09056dd6e794013e4ea4c373f45becc368e532f2461a873116ec5a818db16b434330e0dfb8d5ebfadc7ae3f496e4764fb6ca2caefc1a7be27269e8b64e8bbc89fd08cb7c724a152db1ef48f7844cc524d021cac432a5f9bfdcad5fafc82d58355ec7a1cb3f47f35285eb9356e3ac093c7fb526e2a6906f9e2a757e0694ecc71143292d5bb8a24019e5a21c26d8d2e4bdcb02738a60c54543c051505a3b0a7a5a69aa51135be3fc2d01d6fa8e26b038459820fe642a1e95163d1ff79c29389cb51cf56e1cf349edd322a3e6a57c540f305fc1f336a2c88a382d839f84631785bafed2e0b0d6f5ea033ce6d5dc2d1df64dfb52e8c3c2087836932e5c57a28314596cce14ba4436f96c26880df95148c27d91aef7d0c8defa7797413b9805970b7b05a131efae55609e37fa4ae67711eda8a3609cd65eacaad1a7099175ea15ad2502563ab5e59a40e382846e1b1d3dda668d43555df4c50d8204fd430c369860145a4020270ab68f94e5d55d44a5119ce1c2837db41d38c3e062557555b6071c9acd7863601bbe2e616c870096c0d3e42c87507a3a44d89c49273c7af7fd7717e004a97e3b5e1cbfa5d85614a7c480a147db1d39fdcbb261362cd2389cbef3d979714e781f7052a346a163b9b13fbdd433a55b353f7b37280a8900e73fccbbe440c6413643b83b0846b0fc62f776b1bf0e65ae1e8c761c6bfa69b9ae67766e2b8ce984aae62adb264af1e8c2391538d8f2555a4eac381af1687c9aa95433bfae6636352da9fda4638d0bcd9e75a2748f348aa798ffe2c1e9a97910866dbe145fc4ee743741c26dbd3af8817576543b7dc16fda4d9ba8dd668bb80b693a4ac87de36bfb1a3cf1f5045c27c7703767225bc9f98c33664292e8a5814057ebf61054e011a26335890832a05b45490c392d57d365f9265f7a96a0a0ca553e4e217c5de13453cdec8459054d387034fe43c39be802cf6eb1e058dc9c533805dcd51db5000e7de87844bf05e721c0281b48c82f582e98301fafe0f0cebb1f694e9d07ce175cd2b7ede2bc510eada627c012b178af423acc9709fd7fc89701579d02f00c28b9b6c2797073496dd06347d417aeb4c3ade7e8d404c0f26469e985ec72b2eef4e8c47741f525ee130b634026a843f00e272a6ccf7287dd9110aa52018c272f8d066b586ff4ccc425904fecb48bb4615a16d637f94a3aa4506854d817f96995ea90839492d1a1498d14c605ba820c450e9263cce31aec6c9c9e625f76cf739e606a2a7ce1bca2311fa0cb26cefce4b9f841ae79c1e134dadaa9ecba3321e752592aa0af0cf9bb7a232439715b8cfbe2ea258ab0c1b292dc094a7c7c6b96a3d7f52822f778676fecc171b17cabed72fe78838c3106b008a0673c9615df236563fcd091f84cdddd415c55bcb5292181345668d70cfbc67e05784b279d253729927d59c0752ab3c9a3571faba81c1ea438e746f2b48e2cd2a9763f08ff06c7f127251225075926a80693c7239ac5a946e693501e03f2781e307814f2a20de18d83b7505e6d240b7bce8e8e72a2c8b24b36943b25f8cf8c60c72ddf3eb66322b7414adec1bd62d5718596392b8eee50d25bea45de2fcdadc30ac628bd1b397a31727b43bf0dc9887e7978693cd802eb5fa7290803295ea2a54caa2f2739e4e25ca8a86c78ef3b2f9f6ed25b1f630e6f9fa8c134773b57ea6046332f8e73bb2309df4ee640c6a2b7b7ef03d1bbb4e48ef16cd0825b89390b50156d01c89c73bc4252101be6c1ba0fe3a9fbac86a34f0c7a39c8f6f7", 0x6f8}], 0x2, &(0x7f0000001a40)=ANY=[@ANYBLOB="580000000000000008010000010000805e6f4c18faf27eaf8c9402bf4a574b34107429e3906292e091616665cda1825955d70d9de4063fb4f29e1ae5f663177deac6c63c53445ce6999fe265836aadce31000000000000008800000000000000130100000800000080d3d9551981d4597f494717d9bf6a6011df61fb4c16bba05f53675d156e8741a38ec31237d4acd510b7f9fa9cb6f0de8b0cd1ea75c6deba12f15ee41318cdca52b649491c4c1333304068320ad5a9c0fc3b4db0f139a0bc4e30aea829e00e4608246696da0be15a7053e25b08ac82267dafdb2c000000006800000000000000ff0000000700000071938f2a9f45616f9401303c3884bb1cfdb83270a76444d56e7d8cd8fb6d7c9f93df15e7a60c3fbc151e68f22fd320e16e488a13e089d5446c480d86416e44e539cd843a24748b452d810f1f084d4acebb266a05a50000001800000000000000ff00000007000000e8b4000000000000e0000000000000000600000003000000a2840039e13150ac71da691d3d8a07fc3daad08671d9d88cecc5602a5613551910833a3c9a73cc171c5a64d1b72b551230e74be9716d2e16211d83dbfad9b3fd6576bd64b8e4975f64b2ad1d2ff2b8fc05078c681ac2fcda386399783f5b123ad1eee8308c44344f8aebb1d071e62d5ec8ceee4618bfd99402893ecfa29514758c282bc245e5d7dae8173d8628bc1a86541608e6f7d0cb92ed2c609223c494dac970e74146f32e8f880da46ea9eec9cd81c94b3701540879801773fbaed09d96eff1ad0dc62ccf4bc237ec7b07741700b000000000000000120100000e000000dd9750bbab4387ac6db07fdd1dc1b96f98bfe6c0e300039f0cc76e2d337c9e040b2a5c7c7e91979f025551c269f98be26f12999ae8795bd8bbb9e6bf9410ce7499a1890c6a6b7b1604239f29a6227e06bf99a22b4f0c8e33c7d09d32166f688e7445e10ee575c3c7dd4ad8d3fcb7a477d8b307779803a42ab003d3ca8dc27c3097e3f62f0b4061ee2508fc277f44e532cb798b4a5215c36f94bc01c507000000f0000000000000003a00000001000000a7adb079d1b8f5fed5558b42f468ddea3d9a498788659dfa4f1132feccd1804fb3bed6d65cd764d7a22770ddd78639ad83ff0e1145e5d9d12af081dc1f0935b3d420e1c15043c63108ac9c6b1ece44971a8d1c0d34f3b25811f85d62e56a42e8e9b7155a5c4d4df341557be89662ccab4f01df430f08bd071bdf2cc116fd1c85bebc097fa09edae0e2d979a8e9557aff133e963567aa1005ca9f8431018d184c7bb9290170d3759aa4b806e99693acd9c0fc3ef02363ca960a4bed1ab24b5859d90182f60738bcda1c354f1c4092a9dec5af91a0a2723db39bd66bd1d71a1d0080"], 0x460}, 0x40004) 486.630938ms ago: executing program 1 (id=543): syz_open_dev$sndpcmc(&(0x7f00000000c0), 0x7, 0x96603) r0 = syz_open_dev$vbi(&(0x7f0000000040), 0x2, 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)=ANY=[@ANYRESOCT, @ANYRES8=r0], 0x7c}}, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) openat$vcs(0xffffff9c, &(0x7f0000000180), 0x50040, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$nl_rdma(0x10, 0x3, 0x14) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="24000000200001032abd7000ffd9df2502000000ff000008"], 0x24}, 0x1, 0x0, 0x0, 0x240480d4}, 0x4040) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) openat$dlm_plock(0xffffffffffffff9c, 0x0, 0x41, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x6) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r4, 0x10) r5 = socket$inet6_tcp(0xa, 0x1, 0x6) bind$inet6(r5, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @local, 0xb}, 0x1c) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) syz_emit_ethernet(0x4c, &(0x7f0000000580)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x16, 0x6, 0xff, @local, @local, {[], {{0x4e23, 0x4e22, 0x2, 0x1, 0x0, 0x0, 0x5, 0x18, 0x1000}, {"f96e"}}}}}}}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) mkdirat$cgroup(r6, &(0x7f00000000c0)='syz1\x00', 0x1ff) socket$inet_mptcp(0x2, 0x1, 0x106) 486.376278ms ago: executing program 0 (id=544): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe0}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r0, &(0x7f0000001240)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000000e80)="44900000000056ee66c372f3105eb186dd8062fad2d5b5bfb0ba06f274a8d026bd209da8ffa6a26e3b3f8075704a9d0ef9aff7f1e7db24609f02d34e76992c9df9fe6888c6c9a4825c6223be6ac54536025af1dea54e527c68b0ff250261953f2da79a78104c2d9e7b16ed86b124945aa9ab7581ebd385fb61d442035db81e18c2d2462d0bb25fff9d3b1ce90b597992b2a4d541611ce77f58dce7c9500118229e7cdf4ca7f6adca92c73d97ce54164c1942b2568635bec8e020b41fb2f8000000000000000000000000000000001c8a9f7956583e26f6f0edc415851d0b8305fe66c2b7c114e3712d87744938848f24a13cb604000000000000000000000000000000c7aa50", 0x106}], 0x1}}, {{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000740)="f77d2b5dd5f7d74f0748cf3d2cf218d644566a14103b1c7dd35fd2951bd022f10f2dc7f4ce0d8ac5f4abaca4b97b706153756913b7dd48248b5bfb10460019248bf238743fa2aeb5bef21ce832db670920dc5e911ef2ad63e849901d1001129dbacbfd4924d7545517fd18b5d29978f32a5b5c81755cb89cc0490958ba3211eb99df5cdbbc0f9c941aaa1495893dada02d8188acd26b5afd7476413f322c8f79de769debb56343f3eded2dca93ed6641e50fe595e1e0dbe84ed0f70abb4ed2dfb6648df7dbbd18", 0xc7}], 0x1}}], 0x2, 0x14042082) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 365.703451ms ago: executing program 2 (id=545): r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/test2\x00', 0x42, 0x1ff) write(r0, &(0x7f0000000700)='\x00'/32, 0x20) write(r0, &(0x7f0000000700)='\x00'/32, 0x20) write(r0, &(0x7f0000000700)='\x00'/32, 0x20) write(r0, 0x0, 0x0) write(r0, 0x0, 0x0) write(r0, &(0x7f0000000700)='\x00'/32, 0x20) write(r0, &(0x7f0000000700)='\x00'/32, 0x20) write(r0, &(0x7f0000000700)='\x00'/32, 0x20) write(r0, &(0x7f0000000700)='\x00'/32, 0x20) write(r0, &(0x7f0000000700)='\x00'/25, 0x19) 304.139312ms ago: executing program 1 (id=546): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x20000, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) open(0x0, 0x400001, 0x100) r1 = syz_io_uring_setup(0xefe, &(0x7f0000000080)={0x0, 0x0, 0x1, 0x83, 0x3af}, &(0x7f0000000100)=0x0, &(0x7f0000000440)=0x0, &(0x7f0000000180)) syz_io_uring_modify_offsets$generic(r2, r3, 0x2c, 0x10000) io_uring_enter(r1, 0x2883, 0xf1bd, 0x0, 0x0, 0x0) 219.878034ms ago: executing program 2 (id=547): socket$nl_generic(0x10, 0x3, 0x10) unshare(0x2040400) fcntl$setpipe(0xffffffffffffffff, 0x407, 0xffffffffffffffff) r0 = mq_open(&(0x7f0000000480)='!sel\x00\x00\x00\x10\x00\x00\x00\x00\xd7\\P\xc1\xde.O\xcb]0y\x00\x00\x00\x00\x00\x00\x00\x00', 0x6e93ebbbcc0884f2, 0x196, &(0x7f0000000440)={0x2000000000002000, 0x1, 0x56, 0x3}) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mq_timedsend(r0, 0x0, 0x0, 0x3, 0x0) mq_timedsend(r0, 0x0, 0x0, 0x9, &(0x7f00000002c0)={0x77359400}) 132.726956ms ago: executing program 1 (id=548): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r0, 0xc138fd06, &(0x7f0000000000)="0400000000000000000000003801000000000000000000000000000000000000000000000000000000000000000000006d79706f6f6c00") ioctl(r0, 0xc138fd06, &(0x7f0000000000)="0400000000") 93.455848ms ago: executing program 3 (id=549): request_key(0x0, 0x0, &(0x7f0000000340)='\x8e\x00\x9e\xbb\x1e\x1av\xe8M\x00d\xaaI\x00\x00\x00\x00\x00\x00\t<\xe5u\xedA\xa7\aT\xdd\xd1{\xff\xcb\xdb\xb11\xc2s\xcb\xbf\x04\x00\x00\x00<\xfe\xf9\f\xe6E\b\x00\xd7\x85q\xc4\xab\xbd&\x92\x89(\xf3\"\xceJ\x19\x185\xa6- \xe6uK\xe1D\x8f\x9f\x92\xca\x93#\xf5E\xc2\x91Yl\x17\a\x02\t\x17\x7f\xc4\xde\x04\x9b\x89#\xf6&[\xd81\xb3\xdc\x00\x04\x15\x03\x17R\xd24\xeb\xb5\xc2\xff\x1bnF\x8e\xe4\'\x18\xba9.\xd4\xd9\xc6\x98\x8f\xc6D!p\xbeV\xb7x\r@\x1b5\x8br\x11\xdex\x19\x89\xdc\x1el\xcd\x13\xb6\xc2\xdb\x1fr2\x7f?\xfe\x0f\x04\x11\xc3\x8f:uXQ\x0f\v\xfc\xff\x7fL\xfb\xa8]\xd4\xd7\x13?\xe3<#\x1f\x9a\x03C\x8f\xe7\rV1\x99\xaf@Re\x18J\xb6\xee\xeeAnR\n\x8a\xe4\x1a:&\xc7\x15B\x8aG\xa4\a`\xee\xaf\x80T\xddo\xc4D^z\xbf\x1c\x87F?!k\'\xc3\xf9\xa3\xd9\x85\xb1N%\x17\f\xd0#\x05^\xf7\x11\x13\xadKb\x8ck\x10\xd3 >\t\xe0\x16\x80\x82\xb3\xcc\xc7\x05*\x9b\x0eQ\x92\xd7\xbaO\x06\xb2\xdc\xe7/\x1f\x90]IB94(evFMJ\x85\xc4S\xa8\x8b\xbe\xd3\x90\xe9\t\x00\x13\x1e\x9a\x94\x00\x00\x00\x00\x00U\xfbLA\xa6K\xd5\x0eD\xf2Y\xc3,\t4hD\xc4o\xc3\x87$\x9d6\xc8\x93\xa3\x8e:\xfe#\xa0`\xb1k\xacz\xe0\xb3\x95\x17\xdf\xc7\xc2\xedKc\xa3\xbd\xc2\x9f\x86C(/\xe3\xb2\xc6$s^\xd1vU\x9cB)ao\xf1\'', 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000000) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000300)={'syztnl2\x00', &(0x7f0000000040)={'syztnl2\x00', 0x0, 0x29, 0x84, 0x4, 0x4038a0b, 0x11, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @mcast2={0xff, 0x5}, 0x20, 0x0, 0x0, 0x4}}) fsopen(0x0, 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, 0x0, 0x2) sendmsg$IPSET_CMD_SAVE(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x40044}, 0x48040) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x10) io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x972, 0x1f480, 0x2, 0x325}) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracefs_dir\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracefs_dir\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./tracefs_dir/buffer_subbuf_size_kb\x00', 0x1, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracefs_dir/trace\x00', 0x0, 0x0) close(r2) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x42, &(0x7f0000000500)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff080045000028fffe000095069078640101", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="8c020008907810050000000000000040005600002d226905531de156c8ecefbaecbc06add46e8a3d97a47e75e224d3858e1494d970d9e00fd3e79c9939f75883aee0a185a4e2b4950e2c1a0b5b052ae7609ba5aecca6e20beb023dcb1c"], 0x0) 76.931218ms ago: executing program 0 (id=550): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x200}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = accept(r1, 0x0, 0x0) sendmsg$xdp(r3, 0x0, 0x40) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000004c0)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x24008840}, 0x0) connect$unix(r3, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) 6.80469ms ago: executing program 2 (id=551): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/target/core\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) write(0xffffffffffffffff, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000580), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/usb_gadget/g1/functions\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/tcm.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/configs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/target/usb_gadget/naa.6001405123456789\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000740)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000780)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000007c0)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/lun/lun_0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./config/target/usb_gadget/naa.6001405123456789/tpgt_1/nexus\x00', 0x2, 0x0) write(r0, &(0x7f0000000940)='naa.600140', 0xa) 0s ago: executing program 1 (id=552): socket$igmp(0x2, 0x3, 0x2) socket$inet_udp(0x2, 0x2, 0x0) socket$alg(0x26, 0x5, 0x0) getpgrp(0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x14, 0x3e, 0x229, 0x0, 0x25dfdbfc, {0xa}}, 0x14}}, 0x8000) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.23' (ED25519) to the list of known hosts. [ 72.657819][ T5758] cgroup: Unknown subsys name 'net' [ 72.786942][ T5758] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 74.139418][ T5758] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 75.588528][ T5781] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 75.598066][ T5781] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 75.607306][ T5781] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 75.615440][ T5781] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 75.623212][ T5781] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 75.632372][ T5781] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 75.640389][ T5781] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 75.641844][ T5782] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 75.647856][ T5781] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 75.665133][ T5781] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 75.666320][ T5783] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 75.673710][ T5781] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 75.681010][ T5782] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 75.687440][ T5781] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 75.696348][ T5782] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 75.701487][ T5784] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 75.710068][ T5782] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 75.716656][ T5781] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 75.728563][ T5784] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 75.729961][ T5782] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 75.737470][ T5784] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 75.744780][ T5782] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 75.750693][ T5784] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 75.769700][ T5784] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 76.210428][ T5773] chnl_net:caif_netlink_parms(): no params data found [ 76.256341][ T5770] chnl_net:caif_netlink_parms(): no params data found [ 76.271356][ T5771] chnl_net:caif_netlink_parms(): no params data found [ 76.384643][ T5772] chnl_net:caif_netlink_parms(): no params data found [ 76.463580][ T5773] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.471496][ T5773] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.478925][ T5773] bridge_slave_0: entered allmulticast mode [ 76.486118][ T5773] bridge_slave_0: entered promiscuous mode [ 76.515540][ T5771] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.523008][ T5771] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.530607][ T5771] bridge_slave_0: entered allmulticast mode [ 76.537817][ T5771] bridge_slave_0: entered promiscuous mode [ 76.553646][ T5773] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.561323][ T5773] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.568512][ T5773] bridge_slave_1: entered allmulticast mode [ 76.575968][ T5773] bridge_slave_1: entered promiscuous mode [ 76.587267][ T5771] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.594871][ T5771] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.602068][ T5771] bridge_slave_1: entered allmulticast mode [ 76.608828][ T5771] bridge_slave_1: entered promiscuous mode [ 76.616278][ T5770] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.623507][ T5770] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.630848][ T5770] bridge_slave_0: entered allmulticast mode [ 76.637544][ T5770] bridge_slave_0: entered promiscuous mode [ 76.675647][ T5770] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.682886][ T5770] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.690010][ T5770] bridge_slave_1: entered allmulticast mode [ 76.696967][ T5770] bridge_slave_1: entered promiscuous mode [ 76.741922][ T5771] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 76.762213][ T5773] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 76.786026][ T5771] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 76.805524][ T5770] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 76.817144][ T5773] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 76.828992][ T5772] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.836571][ T5772] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.844056][ T5772] bridge_slave_0: entered allmulticast mode [ 76.851365][ T5772] bridge_slave_0: entered promiscuous mode [ 76.858785][ T5772] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.865988][ T5772] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.873531][ T5772] bridge_slave_1: entered allmulticast mode [ 76.880561][ T5772] bridge_slave_1: entered promiscuous mode [ 76.895428][ T5770] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 76.928244][ T5771] team0: Port device team_slave_0 added [ 76.967242][ T5771] team0: Port device team_slave_1 added [ 76.984432][ T5770] team0: Port device team_slave_0 added [ 76.993493][ T5773] team0: Port device team_slave_0 added [ 77.001563][ T5770] team0: Port device team_slave_1 added [ 77.009402][ T5772] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.027868][ T5773] team0: Port device team_slave_1 added [ 77.055171][ T5772] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.075727][ T5771] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.082940][ T5771] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.108990][ T5771] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.147443][ T5770] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.154619][ T5770] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.181069][ T5770] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.202902][ T5771] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.209884][ T5771] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.238467][ T5771] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.258310][ T5770] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.265431][ T5770] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.293986][ T5770] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.306194][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.313752][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.339935][ T5773] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.352770][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.359733][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.391528][ T5773] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.414840][ T5772] team0: Port device team_slave_0 added [ 77.428080][ T5772] team0: Port device team_slave_1 added [ 77.480802][ T5772] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.487777][ T5772] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.514138][ T5772] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.567801][ T5771] hsr_slave_0: entered promiscuous mode [ 77.574961][ T5771] hsr_slave_1: entered promiscuous mode [ 77.582726][ T5772] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.589739][ T5772] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.616084][ T5772] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.630757][ T5773] hsr_slave_0: entered promiscuous mode [ 77.637481][ T5773] hsr_slave_1: entered promiscuous mode [ 77.643741][ T5773] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 77.651598][ T5773] Cannot create hsr debugfs directory [ 77.661871][ T5770] hsr_slave_0: entered promiscuous mode [ 77.668707][ T5770] hsr_slave_1: entered promiscuous mode [ 77.676738][ T5770] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 77.685009][ T5770] Cannot create hsr debugfs directory [ 77.761249][ T5784] Bluetooth: hci1: command tx timeout [ 77.812265][ T5772] hsr_slave_0: entered promiscuous mode [ 77.819630][ T5772] hsr_slave_1: entered promiscuous mode [ 77.827357][ T5772] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 77.835170][ T5772] Cannot create hsr debugfs directory [ 77.840770][ T5784] Bluetooth: hci2: command tx timeout [ 77.846424][ T5784] Bluetooth: hci3: command tx timeout [ 77.852442][ T5779] Bluetooth: hci0: command tx timeout [ 78.171274][ T5770] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 78.193981][ T5770] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 78.203265][ T5770] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 78.216571][ T5770] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 78.274880][ T5771] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 78.286662][ T5771] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 78.297667][ T5771] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 78.310636][ T5771] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 78.424035][ T5772] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 78.434968][ T5772] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 78.445685][ T5772] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 78.468050][ T5772] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 78.514608][ T5773] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 78.535563][ T5770] 8021q: adding VLAN 0 to HW filter on device bond0 [ 78.546175][ T5773] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 78.556564][ T5773] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 78.566275][ T5773] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 78.615050][ T5770] 8021q: adding VLAN 0 to HW filter on device team0 [ 78.643837][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.651293][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 78.682932][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.690078][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 78.786935][ T5771] 8021q: adding VLAN 0 to HW filter on device bond0 [ 78.828056][ T5772] 8021q: adding VLAN 0 to HW filter on device bond0 [ 78.876624][ T5771] 8021q: adding VLAN 0 to HW filter on device team0 [ 78.912436][ T1087] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.919721][ T1087] bridge0: port 1(bridge_slave_0) entered forwarding state [ 78.958824][ T5772] 8021q: adding VLAN 0 to HW filter on device team0 [ 78.969390][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.976645][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.011609][ T5773] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.028927][ T1144] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.036125][ T1144] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.075982][ T1145] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.083209][ T1145] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.183393][ T5773] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.216412][ T1144] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.223639][ T1144] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.247701][ T5770] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 79.279708][ T1144] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.286943][ T1144] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.470231][ T5770] veth0_vlan: entered promiscuous mode [ 79.515309][ T5770] veth1_vlan: entered promiscuous mode [ 79.624563][ T5770] veth0_macvtap: entered promiscuous mode [ 79.642868][ T5772] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 79.673675][ T5770] veth1_macvtap: entered promiscuous mode [ 79.714492][ T5771] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 79.748214][ T5770] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 79.773670][ T5773] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 79.812053][ T5770] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 79.832311][ T5770] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.841501][ T5784] Bluetooth: hci1: command tx timeout [ 79.850108][ T5770] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.858964][ T5770] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.872059][ T5770] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.895174][ T5772] veth0_vlan: entered promiscuous mode [ 79.914044][ T5771] veth0_vlan: entered promiscuous mode [ 79.921033][ T5784] Bluetooth: hci3: command tx timeout [ 79.921601][ T5087] Bluetooth: hci0: command tx timeout [ 79.926447][ T5784] Bluetooth: hci2: command tx timeout [ 79.946395][ T5771] veth1_vlan: entered promiscuous mode [ 79.953711][ T5772] veth1_vlan: entered promiscuous mode [ 80.077355][ T5772] veth0_macvtap: entered promiscuous mode [ 80.096355][ T5773] veth0_vlan: entered promiscuous mode [ 80.107697][ T5771] veth0_macvtap: entered promiscuous mode [ 80.136818][ T1145] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.153992][ T5773] veth1_vlan: entered promiscuous mode [ 80.163717][ T1145] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.181677][ T5772] veth1_macvtap: entered promiscuous mode [ 80.197911][ T5771] veth1_macvtap: entered promiscuous mode [ 80.257393][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 80.268693][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.281596][ T5772] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.289854][ T1144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.299242][ T1144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.323275][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 80.337552][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.349507][ T5772] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.367358][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 80.377981][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.388642][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 80.400086][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.412899][ T5771] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.435126][ T5772] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.445907][ T5772] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.455206][ T5772] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.464204][ T5772] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.497839][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 80.509351][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.519506][ T5771] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 80.530362][ T5771] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.543101][ T5771] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.567167][ T5773] veth0_macvtap: entered promiscuous mode [ 80.578870][ T5773] veth1_macvtap: entered promiscuous mode [ 80.602172][ T5771] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.623323][ T5771] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.635715][ T5771] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.671942][ T5771] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.519865][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.538106][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.549874][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.560763][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.571046][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.581908][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.601335][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.633292][ T1087] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.643038][ T1087] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.658046][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.672322][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.683100][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.693788][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.704649][ T5773] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.715370][ T5773] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.726982][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.767616][ T1145] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.768609][ T5773] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.775897][ T1145] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.788228][ T5773] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.803274][ T5773] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.812713][ T5773] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.860805][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.868949][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.886562][ T1087] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.897857][ T1087] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.920795][ T5784] Bluetooth: hci1: command tx timeout [ 82.001243][ T5784] Bluetooth: hci2: command tx timeout [ 82.001265][ T5779] Bluetooth: hci0: command tx timeout [ 82.006661][ T5784] Bluetooth: hci3: command tx timeout [ 82.051120][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.061468][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.104597][ T1087] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.113897][ T1087] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.203137][ T5846] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 82.277770][ T5848] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 83.224877][ T5882] process 'syz.1.12' launched './file1' with NULL argv: empty string added [ 84.010231][ T5784] Bluetooth: hci1: command tx timeout [ 84.082519][ T5784] Bluetooth: hci0: command tx timeout [ 84.088429][ T5784] Bluetooth: hci3: command tx timeout [ 84.279882][ T5903] netlink: 8 bytes leftover after parsing attributes in process `syz.0.17'. [ 84.530386][ T28] audit: type=1326 audit(1785936276.503:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5898 comm="syz.0.17" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f56e6b9e019 code=0x0 [ 85.455785][ T5933] syzkaller0: entered promiscuous mode [ 85.481173][ T5941] netlink: 12 bytes leftover after parsing attributes in process `syz.1.25'. [ 85.490719][ T5933] syzkaller0: entered allmulticast mode [ 86.061151][ T5954] netlink: 4 bytes leftover after parsing attributes in process `syz.1.28'. [ 87.063892][ T789] cfg80211: failed to load regulatory.db [ 87.710850][ T5779] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 87.719462][ T5779] Bluetooth: hci2: Injecting HCI hardware error event [ 87.755638][ T5779] Bluetooth: hci2: hardware error 0x00 [ 88.295806][ T5974] jffs2: notice: (5974) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 90.408930][ T5779] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 92.557428][ T6001] Zero length message leads to an empty skb [ 92.603793][ T6001] netlink: 'syz.0.38': attribute type 10 has an invalid length. [ 92.789876][ T6001] 8021q: adding VLAN 0 to HW filter on device bond0 [ 92.812291][ T6001] team0: Port device bond0 added [ 92.906658][ T6009] netlink: 12 bytes leftover after parsing attributes in process `syz.2.40'. [ 94.040291][ T28] audit: type=1800 audit(1785936286.013:3): pid=6027 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.47" name="idProduct" dev="configfs" ino=8402 res=0 errno=0 [ 94.141068][ T28] audit: type=1800 audit(1785936286.123:4): pid=6027 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.47" name="process_ump" dev="configfs" ino=8412 res=0 errno=0 [ 94.190356][ T28] audit: type=1800 audit(1785936286.143:5): pid=6027 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.47" name="ep_name" dev="configfs" ino=8413 res=0 errno=0 [ 94.245316][ T6016] syz.1.41 (6016) used greatest stack depth: 20632 bytes left [ 94.254505][ T28] audit: type=1800 audit(1785936286.203:6): pid=6027 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.47" name="direction" dev="configfs" ino=8418 res=0 errno=0 [ 94.309157][ T28] audit: type=1800 audit(1785936286.203:7): pid=6027 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.47" name="name" dev="configfs" ino=8421 res=0 errno=0 [ 94.394940][ T6031] TC_ACT_REPEAT abuse ? [ 94.455988][ T6034] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input5 [ 95.040526][ T0] NOHZ tick-stop error: local softirq work is pending, handler #1c2!!! [ 96.880154][ C0] sched: RT throttling activated [ 97.103792][ T6047] syz.3.53[6047]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 97.695246][ T6052] warning: `syz.2.56' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 98.251533][ T6067] MTD: Couldn't look up './dev/mtdblock0': -2 [ 99.518081][ T6090] netlink: 12 bytes leftover after parsing attributes in process `syz.0.54'. [ 99.527249][ T6090] netlink: 20 bytes leftover after parsing attributes in process `syz.0.54'. [ 100.408789][ T6088] Bluetooth: hci0: Opcode 0x0c20 failed: -4 [ 100.853981][ T5775] lpc_ich 0000:00:00.0: I/O space for ACPI uninitialized [ 100.886955][ T5775] lpc_ich 0000:00:00.0: No MFD cells added [ 100.906912][ T5775] lpc_ich 0000:00:05.0: I/O space for ACPI uninitialized [ 100.936607][ T5775] lpc_ich 0000:00:05.0: No MFD cells added [ 100.938109][ T28] audit: type=1800 audit(1785936292.913:8): pid=6114 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.77" name="ipv4_address" dev="configfs" ino=8563 res=0 errno=0 [ 101.014669][ T28] audit: type=1800 audit(1785936292.943:9): pid=6114 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.77" name="ipv4_port" dev="configfs" ino=8564 res=0 errno=0 [ 101.168898][ T28] audit: type=1800 audit(1785936292.953:10): pid=6114 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.77" name="num" dev="configfs" ino=8565 res=0 errno=0 [ 101.260941][ T28] audit: type=1800 audit(1785936292.953:11): pid=6114 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.77" name="local" dev="configfs" ino=8566 res=0 errno=0 [ 101.362969][ T28] audit: type=1800 audit(1785936292.993:12): pid=6114 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.77" name="block_bytes" dev="configfs" ino=7744 res=0 errno=0 [ 101.439203][ T28] audit: type=1800 audit(1785936292.993:13): pid=6114 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.77" name="blocks" dev="configfs" ino=7745 res=0 errno=0 [ 101.490418][ T28] audit: type=1800 audit(1785936292.993:14): pid=6114 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.77" name="start_block" dev="configfs" ino=7746 res=0 errno=0 [ 101.512132][ T28] audit: type=1800 audit(1785936292.993:15): pid=6114 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.77" name="dev" dev="configfs" ino=7747 res=0 errno=0 [ 101.532187][ T5779] Bluetooth: hci0: command 0x0c20 tx timeout [ 101.701765][ T5779] Bluetooth: Unexpected continuation frame (len 4) [ 102.740448][ T6159] device-mapper: ioctl: ioctl interface mismatch: kernel(4.48.0), user(4.50.0), cmd(9) [ 102.811260][ T6160] syzkaller0: entered promiscuous mode [ 102.819760][ T6160] syzkaller0: entered allmulticast mode [ 103.347943][ T28] audit: type=1800 audit(1785936295.323:16): pid=6189 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.99" name="local" dev="configfs" ino=8685 res=0 errno=0 [ 105.279919][ T0] NOHZ tick-stop error: local softirq work is pending, handler #142!!! [ 105.775260][ T6201] syzkaller0: entered promiscuous mode [ 105.794326][ T6201] syzkaller0: entered allmulticast mode [ 108.040892][ T6276] netlink: 12 bytes leftover after parsing attributes in process `syz.1.134'. [ 108.828264][ T6310] netlink: 12 bytes leftover after parsing attributes in process `syz.1.146'. [ 108.934052][ T6313] netlink: 12 bytes leftover after parsing attributes in process `syz.3.143'. [ 108.943071][ T6313] netlink: 20 bytes leftover after parsing attributes in process `syz.3.143'. [ 109.878209][ T6329] io-wq is not configured for unbound workers [ 109.905305][ T6327] batman_adv: batadv0: Adding interface: dummy0 [ 109.928091][ T6321] can: request_module (can-proto-0) failed. [ 109.935335][ T6327] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 109.973725][ T6327] batman_adv: batadv0: Interface activated: dummy0 [ 110.006799][ T6321] batadv0: mtu less than device minimum [ 110.031034][ T6321] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 110.043847][ T6321] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 110.056259][ T6321] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 110.068788][ T6321] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 110.081231][ T6321] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 110.093695][ T6321] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 110.106095][ T6321] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 110.118600][ T6321] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 110.131157][ T6321] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 110.664609][ T6355] netlink: 12 bytes leftover after parsing attributes in process `syz.2.160'. [ 110.673637][ T6355] netlink: 20 bytes leftover after parsing attributes in process `syz.2.160'. [ 112.959508][ T0] NOHZ tick-stop error: local softirq work is pending, handler #142!!! [ 113.929100][ T6398] kAFS: Can only specify source 'none' with -o dyn [ 114.354027][ T6404] netlink: 12 bytes leftover after parsing attributes in process `syz.1.176'. [ 114.363043][ T6404] netlink: 20 bytes leftover after parsing attributes in process `syz.1.176'. [ 114.459190][ T6406] netlink: 12 bytes leftover after parsing attributes in process `syz.0.179'. [ 116.200917][ T6438] batadv_slave_1: entered promiscuous mode [ 116.217897][ T6436] batadv_slave_1: left promiscuous mode [ 116.294308][ T6439] netlink: 12 bytes leftover after parsing attributes in process `syz.0.192'. [ 116.303369][ T6439] netlink: 20 bytes leftover after parsing attributes in process `syz.0.192'. [ 117.401469][ T28] audit: type=1326 audit(1785936309.384:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6457 comm="syz.1.202" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f71d659e019 code=0x7ffc0000 [ 117.452998][ T28] audit: type=1326 audit(1785936309.414:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6457 comm="syz.1.202" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f71d659e019 code=0x7ffc0000 [ 117.568072][ T28] audit: type=1326 audit(1785936309.414:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6457 comm="syz.1.202" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f71d659e019 code=0x7ffc0000 [ 117.677259][ T28] audit: type=1326 audit(1785936309.414:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6457 comm="syz.1.202" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f71d659e019 code=0x7ffc0000 [ 117.702026][ T28] audit: type=1326 audit(1785936309.414:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6457 comm="syz.1.202" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=186 compat=0 ip=0x7f71d659e019 code=0x7ffc0000 [ 117.726087][ T28] audit: type=1326 audit(1785936309.414:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6457 comm="syz.1.202" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f71d659e019 code=0x7ffc0000 [ 117.750163][ T28] audit: type=1326 audit(1785936309.414:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6457 comm="syz.1.202" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f71d659e019 code=0x7ffc0000 [ 117.814707][ T6464] netlink: 12 bytes leftover after parsing attributes in process `syz.0.203'. [ 117.823930][ T6464] netlink: 20 bytes leftover after parsing attributes in process `syz.0.203'. [ 117.842019][ T28] audit: type=1326 audit(1785936309.414:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6457 comm="syz.1.202" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f71d659e019 code=0x7ffc0000 [ 118.025142][ T5779] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 118.053161][ T5779] Bluetooth: hci1: Injecting HCI hardware error event [ 118.068946][ T5779] Bluetooth: hci1: hardware error 0x00 [ 118.319276][ T28] audit: type=1326 audit(1785936309.414:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6457 comm="syz.1.202" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f71d659e019 code=0x7ffc0000 [ 118.389150][ T28] audit: type=1326 audit(1785936309.414:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6457 comm="syz.1.202" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=128 compat=0 ip=0x7f71d659e019 code=0x7ffc0000 [ 119.782720][ T6485] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input6 [ 120.239497][ T5779] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 122.385423][ T5779] Bluetooth: hci3: link tx timeout [ 122.392261][ T5779] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 123.176008][ T5784] Bluetooth: hci3: link tx timeout [ 123.189027][ T5784] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 123.664393][ T6556] jffs2: notice: (6556) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 124.479385][ T5784] Bluetooth: hci3: command 0x0406 tx timeout [ 124.505515][ T6558] Bluetooth: hci0: Opcode 0x0c20 failed: -4 [ 124.737246][ T6580] netlink: 'syz.2.247': attribute type 10 has an invalid length. [ 124.781178][ T6580] 8021q: adding VLAN 0 to HW filter on device bond0 [ 124.814996][ T6580] team0: Port device bond0 added [ 125.249485][ T6598] jffs2: notice: (6598) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 125.314401][ T6601] netlink: 12 bytes leftover after parsing attributes in process `syz.1.256'. [ 125.769715][ T5779] Bluetooth: hci0: command 0x0c20 tx timeout [ 125.858938][ T6592] Bluetooth: hci0: Opcode 0x0c20 failed: -110 [ 126.648920][ T6626] netlink: 12 bytes leftover after parsing attributes in process `syz.1.266'. [ 126.720263][ T6631] netlink: 4 bytes leftover after parsing attributes in process `syz.2.269'. [ 127.463709][ T6661] netlink: 12 bytes leftover after parsing attributes in process `syz.1.279'. [ 127.868577][ T5779] Bluetooth: hci0: command 0x0c20 tx timeout [ 128.515537][ T6681] netlink: 20 bytes leftover after parsing attributes in process `syz.1.287'. [ 129.623413][ T6702] netlink: 4 bytes leftover after parsing attributes in process `syz.0.295'. [ 130.885339][ T6725] kAFS: No cell specified [ 131.322018][ T6751] netlink: 4 bytes leftover after parsing attributes in process `syz.1.315'. [ 133.438346][ T0] NOHZ tick-stop error: local softirq work is pending, handler #142!!! [ 134.324934][ T1294] ieee802154 phy0 wpan0: encryption failed: -22 [ 134.332687][ T1294] ieee802154 phy1 wpan1: encryption failed: -22 [ 135.351136][ T6820] trusted_key: encrypted_key: insufficient parameters specified [ 135.480823][ T6824] netlink: 'syz.1.350': attribute type 10 has an invalid length. [ 135.514129][ T6824] bridge0: port 2(bridge_slave_1) entered disabled state [ 135.547380][ T6824] bridge_slave_1: left allmulticast mode [ 135.553231][ T6824] bridge_slave_1: left promiscuous mode [ 135.559501][ T6824] bridge0: port 2(bridge_slave_1) entered disabled state [ 135.576840][ T6824] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 135.703535][ T6836] fuse: Bad value for 'fd' [ 138.593994][ T6858] fuse: Bad value for 'fd' [ 139.358405][ T6869] netlink: 12 bytes leftover after parsing attributes in process `syz.3.367'. [ 142.902550][ T6881] trusted_key: encrypted_key: insufficient parameters specified [ 143.276371][ T6889] jffs2: notice: (6889) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 143.359409][ T6896] syz_tun: entered allmulticast mode [ 144.080296][ T6883] syz_tun: left allmulticast mode [ 144.682512][ T6908] netlink: 12 bytes leftover after parsing attributes in process `syz.2.378'. [ 146.237636][ T0] NOHZ tick-stop error: local softirq work is pending, handler #142!!! [ 146.647437][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 146.955429][ T28] kauditd_printk_skb: 18 callbacks suppressed [ 146.955442][ T28] audit: type=1326 audit(156.160:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6927 comm="syz.1.371" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f71d659e019 code=0x7ffc0000 [ 147.016906][ T28] audit: type=1326 audit(156.200:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6927 comm="syz.1.371" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f71d659e019 code=0x7ffc0000 [ 147.059408][ T28] audit: type=1326 audit(156.200:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6927 comm="syz.1.371" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f71d659e019 code=0x7ffc0000 [ 147.090178][ T28] audit: type=1326 audit(156.200:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6927 comm="syz.1.371" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f71d659e019 code=0x7ffc0000 [ 147.155843][ T28] audit: type=1326 audit(156.200:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6927 comm="syz.1.371" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=440 compat=0 ip=0x7f71d659e019 code=0x7ffc0000 [ 148.049315][ T28] audit: type=1326 audit(156.200:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6927 comm="syz.1.371" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f71d659e019 code=0x7ffc0000 [ 148.097752][ T28] audit: type=1326 audit(156.210:51): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6927 comm="syz.1.371" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f71d659e019 code=0x7ffc0000 [ 148.147515][ T28] audit: type=1326 audit(156.210:52): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6927 comm="syz.1.371" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f71d659e019 code=0x7ffc0000 [ 149.122424][ T6945] netlink: 12 bytes leftover after parsing attributes in process `syz.2.392'. [ 153.087563][ T6986] netlink: 4 bytes leftover after parsing attributes in process `syz.1.402'. [ 153.616232][ T7013] netlink: 4 bytes leftover after parsing attributes in process `syz.3.412'. [ 154.327081][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 157.412162][ T28] audit: type=1800 audit(166.620:53): pid=7083 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.435" name="bDeviceClass" dev="configfs" ino=11371 res=0 errno=0 [ 158.803319][ T28] audit: type=1800 audit(168.010:54): pid=7089 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.437" name="zoned" dev="configfs" ino=11245 res=0 errno=0 [ 159.036962][ T0] NOHZ tick-stop error: local softirq work is pending, handler #142!!! [ 159.393384][ T28] audit: type=1800 audit(168.560:55): pid=7089 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.437" name="zone_nr_conv" dev="configfs" ino=11246 res=0 errno=0 [ 160.704464][ T7132] netlink: 8 bytes leftover after parsing attributes in process `syz.0.451'. [ 160.713939][ T7132] netlink: 43 bytes leftover after parsing attributes in process `syz.0.451'. [ 160.762656][ T7133] mmap: syz.0.451 (7133) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 161.341584][ T7135] jffs2: notice: (7135) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 161.848660][ T7157] trusted_key: encrypted_key: insufficient parameters specified [ 163.250634][ T7183] jffs2: notice: (7183) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 163.683767][ T7193] trusted_key: encrypted_key: insufficient parameters specified [ 164.076920][ T28] audit: type=1800 audit(173.221:56): pid=7194 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.471" name="ipv4_address" dev="configfs" ino=12382 res=0 errno=0 [ 164.215488][ T28] audit: type=1800 audit(173.361:57): pid=7194 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.471" name="ipv4_port" dev="configfs" ino=12383 res=0 errno=0 [ 164.275802][ T28] audit: type=1800 audit(173.441:58): pid=7194 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.471" name="num" dev="configfs" ino=12384 res=0 errno=0 [ 165.581099][ T28] audit: type=1800 audit(174.791:59): pid=7215 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.479" name="zoned" dev="configfs" ino=12440 res=0 errno=0 [ 165.627630][ T28] audit: type=1800 audit(174.821:60): pid=7215 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.479" name="zone_nr_conv" dev="configfs" ino=12443 res=0 errno=0 [ 165.880413][ T7224] trusted_key: encrypted_key: insufficient parameters specified [ 166.569689][ T28] audit: type=1800 audit(174.821:61): pid=7215 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.479" name="power" dev="configfs" ino=12444 res=0 errno=0 [ 166.847784][ T7215] null_blk: disk nullb1 created [ 167.809785][ T7241] ptrace attach of "ci2-linux-6-6-kasan/syz-executor exec"[5772] was attempted by "ci2-linux-6-6-kasan/syz-executor exec"[7241] [ 167.852982][ T7241] netlink: 260 bytes leftover after parsing attributes in process `syz.3.485'. [ 167.864050][ T7241] netlink: 104 bytes leftover after parsing attributes in process `syz.3.485'. [ 167.873369][ T7241] netlink: 8 bytes leftover after parsing attributes in process `syz.3.485'. [ 168.742111][ T7250] syz_tun: entered allmulticast mode [ 169.355733][ T7243] syz_tun: left allmulticast mode [ 170.261929][ T28] audit: type=1800 audit(179.461:62): pid=7258 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.493" name="zoned" dev="configfs" ino=11686 res=0 errno=0 [ 170.293940][ T28] audit: type=1800 audit(179.461:63): pid=7258 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.493" name="size" dev="configfs" ino=11687 res=0 errno=0 [ 170.366020][ T7266] netlink: 20 bytes leftover after parsing attributes in process `syz.3.494'. [ 170.407716][ T28] audit: type=1800 audit(179.461:64): pid=7258 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.493" name="power" dev="configfs" ino=11688 res=0 errno=0 [ 170.681613][ T7280] netlink: 4 bytes leftover after parsing attributes in process `syz.2.495'. [ 171.359613][ T7284] jffs2: notice: (7284) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 172.018959][ T7290] syz_tun: entered allmulticast mode [ 172.207260][ T7286] syz_tun: left allmulticast mode [ 172.557880][ T7303] netlink: 20 bytes leftover after parsing attributes in process `syz.2.504'. [ 174.485604][ T7335] netlink: 'syz.3.516': attribute type 2 has an invalid length. [ 174.494867][ T7335] netlink: 'syz.3.516': attribute type 4 has an invalid length. [ 175.212913][ T7363] device-mapper: ioctl: Invalid ioctl structure: name mypool, dev f800 [ 175.263925][ T7358] device-mapper: table: 248:0: thi: unknown target type [ 175.276302][ T7358] device-mapper: ioctl: error adding target to table [ 176.094086][ T28] audit: type=1800 audit(185.301:65): pid=7400 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.536" name="enable" dev="configfs" ino=11962 res=0 errno=0 [ 176.567247][ T7424] netlink: 8 bytes leftover after parsing attributes in process `syz.1.543'. [ 176.591867][ T7424] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 176.604661][ T7424] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 176.799492][ T7420] Config c/1 of g1 needs at least one function. [ 176.813256][ T7420] udc pcspkr: failed to start g1: -22 [ 176.822290][ T7420] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 176.870228][ T7420] UDC core: g1: couldn't find an available UDC or it's busy [ 176.979126][ T7436] device-mapper: ioctl: Invalid ioctl structure: name mypool, dev f800 [ 177.068279][ T7442] [ 177.070657][ T7442] ====================================================== [ 177.077787][ T7442] WARNING: possible circular locking dependency detected [ 177.084835][ T7442] syzkaller #0 Not tainted [ 177.089275][ T7442] ------------------------------------------------------ [ 177.096297][ T7442] syz.2.551/7442 is trying to acquire lock: [ 177.102192][ T7442] ffff888020010670 (&sb->s_type->i_mutex_key#21){++++}-{3:3}, at: configfs_depend_item_unlocked+0x157/0x430 [ 177.113713][ T7442] [ 177.113713][ T7442] but task is already holding lock: [ 177.121167][ T7442] ffff88802d7db120 (&opts->dep_lock){+.+.}-{3:3}, at: usbg_make_tpg+0x148/0x580 [ 177.130239][ T7442] [ 177.130239][ T7442] which lock already depends on the new lock. [ 177.130239][ T7442] [ 177.140661][ T7442] [ 177.140661][ T7442] the existing dependency chain (in reverse order) is: [ 177.149671][ T7442] [ 177.149671][ T7442] -> #2 (&opts->dep_lock){+.+.}-{3:3}: [ 177.157401][ T7442] __mutex_lock+0x135/0xc80 [ 177.162428][ T7442] tcm_set_name+0x2a/0x90 [ 177.167275][ T7442] function_make+0x199/0x350 [ 177.172380][ T7442] configfs_mkdir+0x515/0x9e0 [ 177.177591][ T7442] vfs_mkdir+0x2a5/0x470 [ 177.182343][ T7442] do_mkdirat+0x1dc/0x450 [ 177.187181][ T7442] __x64_sys_mkdirat+0x89/0xa0 [ 177.192479][ T7442] do_syscall_64+0x55/0xb0 [ 177.197601][ T7442] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 177.204015][ T7442] [ 177.204015][ T7442] -> #1 (gadget_subsys.su_mutex){+.+.}-{3:3}: [ 177.212276][ T7442] __mutex_lock+0x135/0xc80 [ 177.217312][ T7442] configfs_rmdir+0x63c/0x980 [ 177.222502][ T7442] vfs_rmdir+0x352/0x4b0 [ 177.227343][ T7442] do_rmdir+0x29f/0x590 [ 177.232359][ T7442] __x64_sys_rmdir+0x49/0x50 [ 177.237464][ T7442] do_syscall_64+0x55/0xb0 [ 177.242395][ T7442] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 177.248813][ T7442] [ 177.248813][ T7442] -> #0 (&sb->s_type->i_mutex_key#21){++++}-{3:3}: [ 177.257586][ T7442] __lock_acquire+0x37ef/0x7d80 [ 177.262955][ T7442] lock_acquire+0x19e/0x420 [ 177.267969][ T7442] down_write+0x97/0x200 [ 177.272729][ T7442] configfs_depend_item_unlocked+0x157/0x430 [ 177.279232][ T7442] usbg_make_tpg+0x1f7/0x580 [ 177.284339][ T7442] target_fabric_make_tpg+0xa4/0x6d0 [ 177.290775][ T7442] configfs_mkdir+0x515/0x9e0 [ 177.295964][ T7442] vfs_mkdir+0x2a5/0x470 [ 177.300737][ T7442] do_mkdirat+0x1dc/0x450 [ 177.305574][ T7442] __x64_sys_mkdirat+0x89/0xa0 [ 177.310845][ T7442] do_syscall_64+0x55/0xb0 [ 177.315772][ T7442] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 177.322176][ T7442] [ 177.322176][ T7442] other info that might help us debug this: [ 177.322176][ T7442] [ 177.332498][ T7442] Chain exists of: [ 177.332498][ T7442] &sb->s_type->i_mutex_key#21 --> gadget_subsys.su_mutex --> &opts->dep_lock [ 177.332498][ T7442] [ 177.347215][ T7442] Possible unsafe locking scenario: [ 177.347215][ T7442] [ 177.354657][ T7442] CPU0 CPU1 [ 177.360011][ T7442] ---- ---- [ 177.365362][ T7442] lock(&opts->dep_lock); [ 177.369767][ T7442] lock(gadget_subsys.su_mutex); [ 177.377303][ T7442] lock(&opts->dep_lock); [ 177.384231][ T7442] lock(&sb->s_type->i_mutex_key#21); [ 177.389698][ T7442] [ 177.389698][ T7442] *** DEADLOCK *** [ 177.389698][ T7442] [ 177.397832][ T7442] 5 locks held by syz.2.551/7442: [ 177.402874][ T7442] #0: ffff888018716418 (sb_writers#15){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 177.412470][ T7442] #1: ffff88807b273400 (&sb->s_type->i_mutex_key#7/1){+.+.}-{3:3}, at: filename_create+0x20f/0x450 [ 177.423266][ T7442] #2: ffffffff8db2b830 (&subsys->su_mutex){+.+.}-{3:3}, at: configfs_mkdir+0x4b9/0x9e0 [ 177.433091][ T7442] #3: ffffffff8de58f08 (tpg_instances_lock){+.+.}-{3:3}, at: usbg_make_tpg+0xf8/0x580 [ 177.442749][ T7442] #4: ffff88802d7db120 (&opts->dep_lock){+.+.}-{3:3}, at: usbg_make_tpg+0x148/0x580 [ 177.452227][ T7442] [ 177.452227][ T7442] stack backtrace: [ 177.458118][ T7442] CPU: 1 PID: 7442 Comm: syz.2.551 Not tainted syzkaller #0 [ 177.465390][ T7442] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 177.475459][ T7442] Call Trace: [ 177.478735][ T7442] [ 177.481752][ T7442] dump_stack_lvl+0x18c/0x250 [ 177.486444][ T7442] ? load_image+0x420/0x420 [ 177.490951][ T7442] ? show_regs_print_info+0x20/0x20 [ 177.496145][ T7442] ? print_circular_bug+0x12b/0x1a0 [ 177.501348][ T7442] check_noncircular+0x2fc/0x400 [ 177.506280][ T7442] ? look_up_lock_class+0x75/0x140 [ 177.511386][ T7442] ? print_deadlock_bug+0x5d0/0x5d0 [ 177.516602][ T7442] ? lockdep_lock+0xf5/0x230 [ 177.521182][ T7442] ? __lock_acquire+0x357f/0x7d80 [ 177.526205][ T7442] ? _find_first_zero_bit+0xd6/0x100 [ 177.531493][ T7442] __lock_acquire+0x37ef/0x7d80 [ 177.536356][ T7442] ? is_bpf_text_address+0x28f/0x2a0 [ 177.541633][ T7442] ? verify_lock_unused+0x140/0x140 [ 177.546834][ T7442] lock_acquire+0x19e/0x420 [ 177.551334][ T7442] ? configfs_depend_item_unlocked+0x157/0x430 [ 177.557567][ T7442] ? trace_raw_output_contention_end+0xd0/0xd0 [ 177.563709][ T7442] ? __might_sleep+0xe0/0xe0 [ 177.568293][ T7442] ? rcu_is_watching+0x15/0xb0 [ 177.573053][ T7442] ? read_lock_is_recursive+0x20/0x20 [ 177.578423][ T7442] ? trace_contention_end+0x39/0xe0 [ 177.583613][ T7442] ? __mutex_lock+0x30d/0xc80 [ 177.588372][ T7442] ? do_syscall_64+0x55/0xb0 [ 177.593217][ T7442] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 177.599280][ T7442] down_write+0x97/0x200 [ 177.603519][ T7442] ? configfs_depend_item_unlocked+0x157/0x430 [ 177.610463][ T7442] ? down_read_killable+0x340/0x340 [ 177.615673][ T7442] configfs_depend_item_unlocked+0x157/0x430 [ 177.621651][ T7442] usbg_make_tpg+0x1f7/0x580 [ 177.626276][ T7442] ? usbg_drop_tport+0x20/0x20 [ 177.631151][ T7442] ? vscnprintf+0x80/0x80 [ 177.635542][ T7442] target_fabric_make_tpg+0xa4/0x6d0 [ 177.640871][ T7442] ? target_fabric_release_wwn+0xb0/0xb0 [ 177.646505][ T7442] configfs_mkdir+0x515/0x9e0 [ 177.651181][ T7442] vfs_mkdir+0x2a5/0x470 [ 177.655684][ T7442] do_mkdirat+0x1dc/0x450 [ 177.660021][ T7442] ? vfs_mkdir+0x470/0x470 [ 177.664433][ T7442] __x64_sys_mkdirat+0x89/0xa0 [ 177.669274][ T7442] do_syscall_64+0x55/0xb0 [ 177.673687][ T7442] ? clear_bhb_loop+0x40/0x90 [ 177.678358][ T7442] ? clear_bhb_loop+0x40/0x90 [ 177.683030][ T7442] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 177.688927][ T7442] RIP: 0033:0x7fa3f1d9e019 [ 177.693337][ T7442] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 177.712946][ T7442] RSP: 002b:00007fa3f2c26028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 177.721355][ T7442] RAX: ffffffffffffffda RBX: 00007fa3f2025fa0 RCX: 00007fa3f1d9e019 [ 177.729319][ T7442] RDX: 00000000000001ff RSI: 0000200000000740 RDI: ffffffffffffff9c [ 177.737285][ T7442] RBP: 00007fa3f1e3500c R08: 0000000000000000 R09: 0000000000000000 [ 177.745248][ T7442] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 177.753213][ T7442] R13: 00007fa3f2026038 R14: 00007fa3f2025fa0 R15: 00007ffff4dede68 [ 177.761390][ T7442] [ 177.790060][ T28] audit: type=1800 audit(187.001:66): pid=7442 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.551" name="nexus" dev="configfs" ino=12089 res=0 errno=0