last executing test programs: 13.526835875s ago: executing program 3 (id=356): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0xfffffffffffffdc3, &(0x7f00000000c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x1, 0x100007, 0x4, 0x25, 0x1, 0xffffffffffffffff, 0x400000}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240), &(0x7f0000000240)=')', 0x2000cc0, r2}, 0x38) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) 11.693139438s ago: executing program 3 (id=360): socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) rseq(&(0x7f0000000080), 0x20, 0x0, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r0 = shmget(0x1, 0x4000, 0x200, &(0x7f0000ffb000/0x4000)=nil) shmat(r0, &(0x7f0000ff9000/0x1000)=nil, 0x4000) shmctl$IPC_RMID(r0, 0x0) 9.652115901s ago: executing program 4 (id=368): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0xd3283d0368e269b7, 0x8031, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0x10, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000008f00000000000000010000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000054000001b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000c309000040000000bf91000000000000b7020000020000008500000085000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x7, 0x1003, &(0x7f0000003e80)=""/4099, 0x41100, 0xd}, 0x94) 9.470590486s ago: executing program 4 (id=371): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x69577000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bind$rds(0xffffffffffffffff, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) socket$can_j1939(0x1d, 0x2, 0x7) close_range(r3, 0xffffffffffffffff, 0x0) 7.773246453s ago: executing program 3 (id=376): sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={0x0}, 0x1, 0x0, 0x0, 0x64000}, 0x4040) socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="e00000001300100000000000000000007374726565626f673531322d67656e65726963"], 0xe0}}, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) write$cgroup_devices(0xffffffffffffffff, 0x0, 0xa) r2 = socket$vsock_stream(0x28, 0x1, 0x0) r3 = syz_open_dev$vbi(&(0x7f0000000040), 0x0, 0x2) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r3, 0xc0845657, &(0x7f00000007c0)={0x0, @bt={0xa8c, 0x870, 0x1, 0xdf9e32a0640bc3f8, 0xd59f82, 0x19f5, 0xacc, 0xb, 0x0, 0x8, 0x27fd, 0x7fff, 0x440, 0x3, 0xd, 0x22, {0x45, 0x80}, 0xcd, 0x3}}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) getpgid(0xffffffffffffffff) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r5, 0x84, 0x15, 0x0, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000005440)={0x0, 0x0, 0x0, 0x0, &(0x7f0000005380)=[@rights={{0x10}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, r2, r1]}}], 0x70, 0xc000}, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000005, 0x100013, 0xffffffffffffffff, 0x7f571000) ioctl$KDFONTOP_SET(r0, 0x4b72, &(0x7f0000000180)={0x0, 0x1, 0x12, 0x6, 0x200, &(0x7f0000000880)="1ae19337aa151f36ae49bb3f8cb95c5bf840d4f1e55efaaf098d47a70eb36a7309002500000000000f4743f490c585108c1331c7749299a25a705f5096cb268cbc60efd680e1be250700000000000000472471ff550c0010000007f3c7b61abe4162256004ea8ca512b5f379c4eb3257eda08f7e6959090000004d13184d382747e035b4722525e00ade86b4c6d1e157c75d15c1f961ebc0a64d7f2a73f8979fcecacaa64f9b9069ebcc1d5b471edbc4f6c7f1b98ae74e909aa6f25b7f804bb4713019a83353dc519d11c3cc1c22a3b86cf3c645413fcea0ce9ded703699d2bb6a4a663b99b6069da5aaf64785a58847440f064b9e57ee07000000def6f255ca26108f11f02047d47f2d0fec30f7e92482f71496e184214a4e0c5fdc48b0af0c0478940016d8f0990a0e1090fd515380aae83c5eaeed338701574b64200216032811fadcf1e0f49a514df529061e09ce45e3f303a03fe9b4a6bcfa7d04594e4f6d0714a2e14ea127ab37d64a5e0db630cd4f4a2e6c985a542ff20a9b2193f265f93a250200000000000000d23d324205000000000000000a617f22133b6cb5087f4c6057942ad995fa70a1f949b196f2e2a3c175858575713be5ee3f7f4dcecc98123f9ded3afdebe13d79a7f7fcb2469ae0ac503111401612df7ee995f74fb97a63bf62d61f78c062f959119ab50c1f706a930121ebcd53ccb93d158186ed360750ca8e728150d988844b9a3cff46591ccaff3075b86ea6171b046b856168f403b5253a5cc393430a09a4489a0895571e597ac8841416c80c55773f917020751ed51cfd73c1e06fbadd156d56bedcbefc5990d7fed29a002ce34dccd6005e944afa92b22ec9a698469c6edc06caa2cfcd61912607d559b4c28ebea9745bcd4697d75c9601fd333d3cd797963a3c71b7cc5fdc756d732533c2722e03002293e37966611602f297de6ff5408777d7a93c45cee3ee5c56e8a3e94266b295ea7a86812a7ab8896ec5ea1b12643e1844b185734528399e62bceb8700cc6cd491e4a4430d0a3ba329a5a2fa170fd0b1cc4ba8294de988cd35df2cd7344aa8a9f3432b96fb889c02f484f6579ef62866a3c2733d45f176931b2db18dba54991a9553cedb7f585786388d4042dbae1c95b769e3d4e036fd1f8efee60425c5a122fd1b90e98635284abd9f217d9e19cb2a64b354c909cc47d7305114990148a7291cb0fe2d1c773a6664b66ae04aa62c534d072ae54c2ca0d5962cc562507430d8f2c17479a6678b0b3700000000000000000000000000000000000000000000f80000000000001700000000000000000000000000000000000200"}) 6.23363754s ago: executing program 3 (id=379): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io$uac1(r0, &(0x7f0000000140)={0x14, &(0x7f0000000040)={0x0, 0x3, 0x1e, {0x1e, 0x14, "0ec1da1d97fb28b6684368ae5f69f591e84d4896350e2233111c0e65"}}, &(0x7f00000000c0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x43f}}}, &(0x7f0000000440)={0x44, &(0x7f0000000180)={0x40, 0x5, 0xd1, "79731a50412baed39497cd5c21cce7de70e493f33e5c53e66e68bd14102a852b1219feb5bd0c7118f70cbf36794821a2904ab2dea1fb3af5159e272891376c4fb40f063391f1de7e77a71651d861b046aa813d7392148b7ee1991427f81d84abd54bcde2d3a1cb554908d524fdac7518aee966658fb52aa828962ff6431302d319ac6c550a062c44ba22653e2ce5ab9afd209f9d44122763a4e99fdf398cb6b0d20a0350a820960451a71385e5d3762b5a52b5bd62005efe82a0f84b50527a98366b7edcdcf0330db7c9edbd61f44b5b8d"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x7}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0xfd}, &(0x7f00000004c0)=ANY=[@ANYBLOB="0000000000000000ddc7156c9ab23a0327961349aef66b86d0dd33bb2f262e2afe90f6a6fac3c361d664ae1fecd8602e636a9dc25aa0f511defd38c7acb9e4bd77c6d02206e9e1a614bb8e60c98ae0e8e558ff1472ca0ffb28f65848a9803c422d028feb6058a97cbb81f32b6a6497144a1294a4a3de44"], &(0x7f0000000340)={0x20, 0x82, 0x5a, "084c89"}, &(0x7f0000000380)={0x20, 0x83, 0x3, "f93d8b"}, &(0x7f00000003c0)={0x20, 0x84, 0x2, "28de"}, &(0x7f0000000400)={0x20, 0x85, 0x3, "05f9a1"}}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c0000001000010700000000000000000a0000000600010038"], 0x1c}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() syz_open_procfs(0x0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone3(0x0, 0x0) r4 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000200)=0x1, 0x4) r5 = syz_open_dev$cec(&(0x7f0000000000), 0xffffffffffffffff, 0x0) mount(&(0x7f0000000180)=@nullb, &(0x7f0000000240)='./cgroup\x00', &(0x7f0000000040)='vfat\x00', 0x800041, 0x0) ioctl$IOC_PR_PREEMPT(r5, 0x40046109, &(0x7f0000000040)={0xd0, 0x2, 0x5}) connect$inet(r4, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x15}}, 0x10) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) 4.764664509s ago: executing program 4 (id=380): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r1, &(0x7f0000000200)={0x0, 0xfffffffffffffe26, &(0x7f0000000000)={&(0x7f0000000400)={0x2c, r0, 0x1, 0x4, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xa5}]}, 0x2c}}, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000000c00)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc0}, 0x0) 4.406393483s ago: executing program 0 (id=383): syz_emit_ethernet(0x3e, &(0x7f00000000c0)={@local, @dev, @val={@void, {0x8100, 0x0, 0x0, 0x1}}, {@ipv4={0x800, @tcp={{0x6, 0x4, 0x0, 0x0, 0x2c, 0x2, 0x0, 0x1, 0x6, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local, {[@generic={0x7, 0x2}]}}, {{0x0, 0x4e21, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x10}}}}}}, 0x0) 4.305915522s ago: executing program 0 (id=384): mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0xffffffff, 0x7, &(0x7f0000006680)) r0 = memfd_create(&(0x7f00000002c0)='\x00\x0e\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x00\x00\x01\xb5\xf5\xe8\x18h\xb4\xa71\xa8\x85s\xaf\x8a\xe5\xca\xd6\xe3\x00\x9f\xd7\xbe4Z\xaa\xca\'\xfc>\x98\xaa\x8e\xe1\xfc\xbc\xed\x9b\xa2\x9ei\xd5\x02\xf6rY\xc4\xecB5\x00\x00\x04\x00\xdd\x9d\x9e_\x00\xa1\x01\x00\x00\x00B\x98S\xdf\"\xa4\xc2<\xfa\x9f\xac|\xa0\xc5\x9d\xec\xa3\xe9c`j\xbf\x19\xc5\xc7c\xaer\x10\\\xff\x7f\xff\xff\xe8X\x1c\x05E%\xb0\x85\xd0\x1e\xa7\xc9w\xa3D\xad<\xcc\x90`\xa8<1\xa1\x04\x0f\a\r\xe4H\x95\a\x80{\x1eJW\x8b\x93\x05\xa2\x85\x95\xdf\x87\xf6+\x0e\xff\xff\b\x00\x00\x00\x00\x00\xff\xd6h\x8b\xc5\xb9\xb1:\xca\xaa\x99e\xf4\x15\xb1\xe1l\x8c-\f\n\xf9\xc1\x95\x1f\xe5\xa4\xa0\x00\xbc\xc8\x9cm$:\xd3\x7f\x807c\x13\x84\x87\x00\x91A:P\xb8M\x061\x8fPDn\n\xd0\xa3\xdcd\x05\x17q\xa4\x82 7\xb5|d\x01\x86\xaf\xce+\xc3\xd4=\xbb\xe3\x8c%CGB\x17+(\xa0\x9a\x8b\xd2E\xd69\xdc\xd5\x80', 0x6) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x7, 0x13, r0, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1000003, 0x12, r0, 0x0) syz_clone(0x80001000, 0x0, 0x0, &(0x7f0000000000), 0x0, 0x0) write$P9_RFSYNC(0xffffffffffffffff, &(0x7f0000000040)={0x7, 0x33, 0x2}, 0x7) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x5, &(0x7f0000000240)=0x9, 0x8, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40000000010800034000000014480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c0003801800008008000340000000020c0004400000000000000c7f14000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x240048d0}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40004000010800034000000014480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c0003801800008008000340000000020c0027"], 0xb4}}, 0x8044) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x2c, 0xd, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) syz_clone(0x111, 0x0, 0x0, 0x0, 0x0, 0x0) 4.190194743s ago: executing program 2 (id=385): bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={0xffffffffffffffff, 0x1f, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[], &(0x7f0000000140)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r0, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0xfffffffe, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8481f0000005e140604000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) 4.00473225s ago: executing program 1 (id=386): socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) rseq(&(0x7f0000000080), 0x20, 0x0, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r0 = shmget(0x1, 0x4000, 0x200, &(0x7f0000ffb000/0x4000)=nil) shmat(r0, &(0x7f0000ff9000/0x1000)=nil, 0x4000) shmctl$IPC_RMID(r0, 0x0) 3.995250924s ago: executing program 2 (id=387): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) 3.885724296s ago: executing program 1 (id=388): socket(0x10, 0x80002, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) r3 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) ioctl$USBDEVFS_CONTROL(r3, 0xc0105500, &(0x7f0000000000)={0x80, 0x6, 0x300, 0xec, 0x0, 0x0, 0x0}) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x2, 0x400, 0x3, 0x253, 0x0, r2}, &(0x7f0000000480)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4704, 0x10, 0x1000000, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xacd, 0x20000, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x81f70, 0x2, 0x1, 0x1aa, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x1000, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0xffffffffffffff0f, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000100081", 0x7}], 0x1}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) read$msr(0xffffffffffffffff, &(0x7f0000001a40)=""/102392, 0x18ff8) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0), 0x100}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) 3.80050981s ago: executing program 4 (id=389): socket(0x10, 0x80002, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socket$rds(0x15, 0x5, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup(r0) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) ioctl$USBDEVFS_CONTROL(r2, 0xc0105500, &(0x7f0000000000)={0x80, 0x6, 0x300, 0xec, 0x0, 0x0, 0x0}) syz_ublk_setup_queues(r1, 0x0, &(0x7f0000000180)={0x0, 0x2, 0x400, 0x3, 0x253, 0x0, r1}, &(0x7f0000000480)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4704, 0x10, 0x1000000, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xacd, 0x20000, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x81f70, 0x2, 0x1, 0x1aa, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x1000, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r3, &(0x7f0000001a40)=""/102392, 0x18ff8) 3.74452468s ago: executing program 1 (id=390): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) connect$inet(r0, 0x0, 0x0) 3.593497432s ago: executing program 2 (id=391): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = memfd_create(&(0x7f0000000080)=',\xea\x00', 0x4) ftruncate(r3, 0x7000000) r4 = dup(r3) preadv2(r4, 0x0, 0x0, 0x2000, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a48000000060a010400000000000000000a0000040900010073797a31000000000900020073797a32000000001c000480180001800d00010073796e70726f78790000000004000280"], 0x70}, 0x1, 0x0, 0x0, 0x4000851}, 0x24044010) close(0xffffffffffffffff) mount$overlay(0x0, 0x0, 0x0, 0x40, 0x0) 2.27989575s ago: executing program 0 (id=392): fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000100)={0x0, 0x2, 0x3, 0x20000000000000}) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000180)={0x2, 0x0, 0x20000000000002, 0x59}) symlinkat(&(0x7f0000000080)='./file0\x00', 0xffffffffffffffff, 0x0) r0 = fsopen(&(0x7f0000000200)='xfs\x00', 0x1) socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_dev$vim2m(0x0, 0x246, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1, 0x0, 0x6}) ioctl$vim2m_VIDIOC_STREAMOFF(r1, 0x40045612, &(0x7f0000002100)=0x2) ioctl$vim2m_VIDIOC_DQBUF(r1, 0xc0585611, &(0x7f0000000180)=@mmap={0x40000401, 0x2, 0x4, 0x804d04, 0x5, {0x77359400}, {0x3, 0x0, 0xf, 0x6, 0x3, 0x1, "a91b72d9"}, 0x3, 0x1, {}, 0x101}) timer_create(0x0, &(0x7f00000003c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) socket$kcm(0x10, 0x2, 0x10) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040)={0x8604}, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) getsockname$packet(r4, 0x0, &(0x7f00000000c0)) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r4, 0x89f0, &(0x7f0000000500)={'syztnl0\x00', &(0x7f0000000400)={'sit0\x00', 0x0, 0x80, 0x8, 0x10001, 0x4, {{0x12, 0x4, 0x3, 0x0, 0x48, 0x65, 0x2, 0xf8, 0x2f, 0x0, @dev={0xac, 0x14, 0x14, 0x19}, @empty, {[@timestamp={0x44, 0x4, 0xc4, 0x0, 0x1}, @lsrr={0x83, 0x3, 0xf}, @lsrr={0x83, 0x13, 0xa4, [@multicast2, @remote, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x2d}]}, @cipso={0x86, 0x17, 0x1, [{0x7, 0x11, "02534120502638c5859001bcc097f0"}]}]}}}}}) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000180), 0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) sendmsg$nl_route(r3, 0x0, 0x20004980) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='fd', &(0x7f00000000c0), 0x0) close(0x3) 1.845787209s ago: executing program 2 (id=393): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0xd3283d0368e269b7, 0x8031, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0x10, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000008f00000000000000010000001811", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000054000001b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000c309000040000000bf91000000000000b7020000020000008500000085000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x7, 0x1003, &(0x7f0000003e80)=""/4099, 0x41100, 0xd}, 0x94) 1.532130645s ago: executing program 2 (id=394): openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x1ff) socket$inet_tcp(0x2, 0x1, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x1b7d, &(0x7f0000000040)={0x0, 0x7a22, 0xc000, 0x7, 0x337}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) sendmsg(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)='9', 0x1}], 0x1, 0x0, 0x0, 0x2c}, 0x4000845) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 1.356152223s ago: executing program 4 (id=395): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40000000010800034000000014480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c0003801800008008000340000000020c0004400000000000000c7f140000001100"], 0xb4}, 0x1, 0x0, 0x0, 0x240048d0}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40004000010800034000000014480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c0003801800008008000340000000020c0027"], 0xb4}}, 0x8044) 1.338072767s ago: executing program 1 (id=396): sendmsg$inet(0xffffffffffffffff, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001080)=[{&(0x7f0000000040)="a72d11a15c048c0a7d63aebc5cea1f815108f6091475aeec600831aa9d3944e60bc2ad06a619c560aa0118b28f68f1eb14549d633b4b23f179fb680716faa43414787559be90843c35ab30acad8a6740140e00721abc2eb362f7bde53b3c992d3e28ccc20ec84fdc569947047f6c09a647ee8c0a747b951e66c068ccf1af93ee9e6f9528ff79e2f989383b05a690a6bec4634b867c9446c1c644b3010e8a3514c6328323b4bbdd602b8f0dace6aea70902c4ddd2a2f2810f1348b0d0df3c1e6a5938fcfdc87e7580c6be0c6a06eca62d6f787dd16add086a21391c4c707d8b61929d1252681b84c245e0efafe2e6e73ad86a3cf59235ab0eacbb414af92ec3cdac420a064a98e8cc18bdf63f8997f96436e0fe6f06fdbf47fff353b01a861babd4a38d126bfe3e29049e6cc883e6efae6e70ef9ed124b1b09887a58c991e223b6420dca5ae238027e91b17b1707dc5c0d5f59f0ca95614f1ea1d263c1ee54dfe31ae35eb3c8e3b931dff7920c57fbba89adf2e392c1ad719b90c7ade0d38ff9792934ef1fb12f51d8e2fad12486d5883d5b1a46696fad128c6805cfb25bc6487e1e407d6b266971b09d0d864a7a550284e24b6cdc9f4ae1081a638175dffef002c76ac5558d23e41edbe68f4b4950a13aa000326dae5a857603dc5a40d6c6618a98c7b6e1eebd325ea2c14601a25658965f40864fd015d9b2fff83ee5ed3212ebd9fa429f0140f633556ac07c0c08e67a1848c9942ecc47dd4ffede9a429e9e0472be7cdbcd117e621ddf745c00a814ffff0224634472577dc0b35a9c153409f1a2bddc193b20b4d244d9cbbd59816c46000c596865f58b4e640ed4a9ab6086cede697fb113560925498da83273e67", 0x26f}], 0x1}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0x4}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) r1 = socket$kcm(0xa, 0x922000000003, 0x11) sendmsg$kcm(r1, &(0x7f00000002c0)={&(0x7f00000007c0)=@l2tp6={0xa, 0x0, 0x2940000, @mcast1, 0x9}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000780)="f400090006", 0x5}], 0x1}, 0x0) 1.12980502s ago: executing program 0 (id=397): openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000001b40)={0x4, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000f0ff000000000020000000850000002700000085000000d0"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ffffffc}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x1, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2}, [@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0x7f}]}, 0x0, 0x5}, 0x94) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0), 0x48) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r0, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) 939.025291ms ago: executing program 3 (id=398): socket$nl_generic(0x10, 0x3, 0x10) rseq(&(0x7f0000000080), 0x20, 0x0, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r0 = shmget(0x1, 0x4000, 0x200, &(0x7f0000ffb000/0x4000)=nil) shmat(r0, &(0x7f0000ff9000/0x1000)=nil, 0x4000) shmctl$IPC_RMID(r0, 0x0) 724.062127ms ago: executing program 2 (id=399): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r1, &(0x7f0000000200)={0x0, 0xfffffffffffffe26, &(0x7f0000000000)={&(0x7f0000000400)={0x2c, r0, 0x1, 0x4, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xa5}]}, 0x2c}}, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000000c00)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc0}, 0x0) 619.098019ms ago: executing program 0 (id=400): socket(0x10, 0x80002, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) r3 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) ioctl$USBDEVFS_CONTROL(r3, 0xc0105500, &(0x7f0000000000)={0x80, 0x6, 0x300, 0xec, 0x0, 0x0, 0x0}) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x2, 0x400, 0x3, 0x253, 0x0, r2}, &(0x7f0000000480)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4704, 0x10, 0x1000000, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xacd, 0x20000, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x81f70, 0x2, 0x1, 0x1aa, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x1000, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0xffffffffffffff0f, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000100081", 0x7}], 0x1}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) read$msr(0xffffffffffffffff, &(0x7f0000001a40)=""/102392, 0x18ff8) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0), 0x100}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) 575.790182ms ago: executing program 1 (id=401): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6(0xa, 0x3, 0x8000000003c) getsockopt$inet6_int(r0, 0x29, 0x7, 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) socket(0x2, 0x80805, 0x0) socket(0x400000000010, 0x3, 0x0) socket$nl_sock_diag(0x10, 0x3, 0x4) r1 = open(&(0x7f0000000280)='.\x00', 0x760801, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c00000003080102000000074441980000000000050003"], 0x1c}, 0x1, 0x0, 0x0, 0x50}, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000180), 0xfea7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) r3 = openat$cgroup_ro(r1, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB="46040000", @ANYRES16=r5, @ANYBLOB="ff830500000700ffffff", @ANYRES8=r1], 0x4}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendfile(r4, r3, 0x0, 0x100000002) 512.520722ms ago: executing program 3 (id=402): socket$inet6_udp(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000280)=@abs={0x0, 0x0, 0x804e22}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x163042) ioctl$USBDEVFS_CLAIM_PORT(r3, 0x80045518, 0x0) 479.502969ms ago: executing program 4 (id=403): syz_clone(0x842a4011, 0x0, 0x0, 0x0, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x2, &(0x7f0000000000)=[{0x20, 0x0, 0x0, 0x20}, {0x6, 0xfd, 0x0, 0x7ffffcb9}]}) 191.844761ms ago: executing program 1 (id=404): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0xd3283d0368e269b7, 0x8031, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0x10, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000008f00000000000000010000001811", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000054000001b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000c309000040000000bf91000000000000b7020000020000008500000085000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x7, 0x1003, &(0x7f0000003e80)=""/4099, 0x41100, 0xd}, 0x94) 0s ago: executing program 0 (id=405): socket(0x10, 0x80002, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socket$rds(0x15, 0x5, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup(r0) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) ioctl$USBDEVFS_CONTROL(r2, 0xc0105500, &(0x7f0000000000)={0x80, 0x6, 0x300, 0xec, 0x0, 0x0, 0x0}) syz_ublk_setup_queues(r1, 0x0, &(0x7f0000000180)={0x0, 0x2, 0x400, 0x3, 0x253, 0x0, r1}, &(0x7f0000000480)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4704, 0x10, 0x1000000, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xacd, 0x20000, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x81f70, 0x2, 0x1, 0x1aa, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1, 0x1000, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r3, &(0x7f0000001a40)=""/102392, 0x18ff8) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.170' (ED25519) to the list of known hosts. [ 82.728948][ T5580] cgroup: Unknown subsys name 'net' [ 82.972939][ T5580] cgroup: Unknown subsys name 'cpuset' [ 83.025787][ T5580] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 84.963451][ T5580] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 87.003729][ T204] cfg80211: failed to load regulatory.db [ 87.740676][ T5602] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 87.786226][ T5603] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 87.802314][ T5604] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 87.811296][ T5604] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 87.814015][ T5604] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 87.814062][ T5610] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 87.820492][ T5604] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 87.823409][ T5610] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 87.831583][ T5610] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 87.836839][ T5610] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 87.838732][ T5604] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 87.839860][ T5610] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 87.840598][ T5610] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 87.842635][ T5610] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 87.845015][ T5610] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 87.849928][ T5610] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 87.851407][ T5610] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 87.855372][ T4909] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 87.859432][ T4909] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 87.860516][ T4909] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 87.861378][ T4909] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 87.861547][ T4909] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 87.863945][ T5604] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 87.995111][ T4909] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 88.009924][ T60] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 89.976994][ T60] Bluetooth: hci3: command tx timeout [ 90.055584][ T5600] Bluetooth: hci2: command tx timeout [ 90.056063][ T60] Bluetooth: hci0: command tx timeout [ 90.056576][ T5602] Bluetooth: hci4: command tx timeout [ 90.058408][ T5600] Bluetooth: hci1: command tx timeout [ 90.568485][ T5594] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.569597][ T5594] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.569908][ T5594] bridge_slave_0: entered allmulticast mode [ 90.574952][ T5594] bridge_slave_0: entered promiscuous mode [ 90.644076][ T5594] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.644373][ T5594] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.644716][ T5594] bridge_slave_1: entered allmulticast mode [ 90.649841][ T5594] bridge_slave_1: entered promiscuous mode [ 90.825934][ T5594] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.886027][ T5594] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.920123][ T5595] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.920324][ T5595] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.920502][ T5595] bridge_slave_0: entered allmulticast mode [ 90.924275][ T5595] bridge_slave_0: entered promiscuous mode [ 90.953194][ T5593] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.953533][ T5593] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.953824][ T5593] bridge_slave_0: entered allmulticast mode [ 90.956814][ T5593] bridge_slave_0: entered promiscuous mode [ 91.015314][ T5595] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.015557][ T5595] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.015925][ T5595] bridge_slave_1: entered allmulticast mode [ 91.017979][ T5595] bridge_slave_1: entered promiscuous mode [ 91.019153][ T5593] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.019354][ T5593] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.019505][ T5593] bridge_slave_1: entered allmulticast mode [ 91.021520][ T5593] bridge_slave_1: entered promiscuous mode [ 91.047243][ T5596] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.047542][ T5596] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.047778][ T5596] bridge_slave_0: entered allmulticast mode [ 91.054545][ T5596] bridge_slave_0: entered promiscuous mode [ 91.060529][ T5597] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.060883][ T5597] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.061125][ T5597] bridge_slave_0: entered allmulticast mode [ 91.068626][ T5597] bridge_slave_0: entered promiscuous mode [ 91.129768][ T5594] team0: Port device team_slave_0 added [ 91.131463][ T5596] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.131761][ T5596] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.132003][ T5596] bridge_slave_1: entered allmulticast mode [ 91.136078][ T5596] bridge_slave_1: entered promiscuous mode [ 91.142754][ T5597] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.143069][ T5597] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.143306][ T5597] bridge_slave_1: entered allmulticast mode [ 91.148618][ T5597] bridge_slave_1: entered promiscuous mode [ 91.207935][ T5594] team0: Port device team_slave_1 added [ 91.253924][ T5595] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.267082][ T5593] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.340630][ T5595] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.358812][ T5593] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.396055][ T5596] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.401081][ T5597] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.440969][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.440981][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.440996][ T5594] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.450158][ T5596] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.455989][ T5597] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.511164][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.511176][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.511191][ T5594] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.563256][ T5595] team0: Port device team_slave_0 added [ 91.572546][ T5593] team0: Port device team_slave_0 added [ 91.623850][ T5595] team0: Port device team_slave_1 added [ 91.628335][ T5593] team0: Port device team_slave_1 added [ 91.642904][ T5596] team0: Port device team_slave_0 added [ 91.652085][ T5597] team0: Port device team_slave_0 added [ 91.691681][ T5596] team0: Port device team_slave_1 added [ 91.694499][ T5597] team0: Port device team_slave_1 added [ 91.782523][ T5595] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.782535][ T5595] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.782550][ T5595] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.784932][ T5593] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.784945][ T5593] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.784968][ T5593] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.879220][ T5595] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.879237][ T5595] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.879265][ T5595] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.881192][ T5593] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.881201][ T5593] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.881218][ T5593] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.908419][ T5594] hsr_slave_0: entered promiscuous mode [ 91.910756][ T5594] hsr_slave_1: entered promiscuous mode [ 91.916254][ T5596] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.916267][ T5596] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.916291][ T5596] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.921295][ T5597] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.921309][ T5597] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 91.921332][ T5597] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 92.055280][ T60] Bluetooth: hci3: command tx timeout [ 92.135449][ T5600] Bluetooth: hci0: command tx timeout [ 92.135485][ T5602] Bluetooth: hci4: command tx timeout [ 92.135489][ T5600] Bluetooth: hci2: command tx timeout [ 92.135646][ T60] Bluetooth: hci1: command tx timeout [ 92.409727][ T5596] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 92.409740][ T5596] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.409757][ T5596] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.411536][ T5597] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 92.411546][ T5597] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 92.411561][ T5597] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.647478][ T5595] hsr_slave_0: entered promiscuous mode [ 92.648841][ T5595] hsr_slave_1: entered promiscuous mode [ 92.650028][ T5595] debugfs: 'hsr0' already exists in 'hsr' [ 92.650105][ T5595] Cannot create hsr debugfs directory [ 92.660226][ T5593] hsr_slave_0: entered promiscuous mode [ 92.662315][ T5593] hsr_slave_1: entered promiscuous mode [ 92.664996][ T5593] debugfs: 'hsr0' already exists in 'hsr' [ 92.665019][ T5593] Cannot create hsr debugfs directory [ 92.743129][ T5596] hsr_slave_0: entered promiscuous mode [ 92.744526][ T5596] hsr_slave_1: entered promiscuous mode [ 92.746868][ T5596] debugfs: 'hsr0' already exists in 'hsr' [ 92.746893][ T5596] Cannot create hsr debugfs directory [ 92.760674][ T5597] hsr_slave_0: entered promiscuous mode [ 92.762802][ T5597] hsr_slave_1: entered promiscuous mode [ 92.764579][ T5597] debugfs: 'hsr0' already exists in 'hsr' [ 92.764601][ T5597] Cannot create hsr debugfs directory [ 93.817236][ T5594] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 93.858864][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 93.864925][ T5594] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 93.909005][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 93.914203][ T5594] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 93.952994][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 93.975002][ T5594] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 94.009264][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 94.133751][ T5595] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 94.136189][ T60] Bluetooth: hci3: command tx timeout [ 94.171615][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 94.188208][ T5595] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 94.215622][ T5602] Bluetooth: hci1: command tx timeout [ 94.215655][ T5602] Bluetooth: hci2: command tx timeout [ 94.215673][ T5602] Bluetooth: hci4: command tx timeout [ 94.215855][ T60] Bluetooth: hci0: command tx timeout [ 94.238431][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 94.254868][ T5595] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 94.301439][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 94.342864][ T5595] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 94.379370][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 94.544759][ T5596] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 94.580610][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 94.594762][ T5596] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 94.640883][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 94.672602][ T5596] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 94.708286][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 94.726056][ T5596] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 94.763608][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 94.918687][ T5597] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 94.952956][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 94.968148][ T5597] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 95.011414][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 95.023607][ T5597] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 95.051124][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 95.090672][ T5597] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 95.113699][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 95.251440][ T5593] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 95.281460][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 95.296546][ T5594] 8021q: adding VLAN 0 to HW filter on device bond0 [ 95.314079][ T5593] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 95.340175][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 95.349036][ T5593] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 95.382583][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 95.394845][ T5593] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 95.432056][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 95.552779][ T5594] 8021q: adding VLAN 0 to HW filter on device team0 [ 95.568562][ T5595] 8021q: adding VLAN 0 to HW filter on device bond0 [ 95.648444][ T176] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.648740][ T176] bridge0: port 1(bridge_slave_0) entered forwarding state [ 95.706341][ T148] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.706505][ T148] bridge0: port 2(bridge_slave_1) entered forwarding state [ 95.752018][ T5595] 8021q: adding VLAN 0 to HW filter on device team0 [ 95.811251][ T148] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.811724][ T148] bridge0: port 1(bridge_slave_0) entered forwarding state [ 95.893685][ T5596] 8021q: adding VLAN 0 to HW filter on device bond0 [ 95.914052][ T148] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.914195][ T148] bridge0: port 2(bridge_slave_1) entered forwarding state [ 96.037959][ T5596] 8021q: adding VLAN 0 to HW filter on device team0 [ 96.069208][ T5597] 8021q: adding VLAN 0 to HW filter on device bond0 [ 96.113713][ T148] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.113888][ T148] bridge0: port 1(bridge_slave_0) entered forwarding state [ 96.173684][ T160] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.179442][ T160] bridge0: port 2(bridge_slave_1) entered forwarding state [ 96.215384][ T60] Bluetooth: hci3: command tx timeout [ 96.287854][ T5597] 8021q: adding VLAN 0 to HW filter on device team0 [ 96.295370][ T5603] Bluetooth: hci4: command tx timeout [ 96.295406][ T5603] Bluetooth: hci2: command tx timeout [ 96.295427][ T5603] Bluetooth: hci1: command tx timeout [ 96.296110][ T60] Bluetooth: hci0: command tx timeout [ 96.361940][ T5593] 8021q: adding VLAN 0 to HW filter on device bond0 [ 96.395800][ T158] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.396093][ T158] bridge0: port 1(bridge_slave_0) entered forwarding state [ 96.484827][ T176] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.484989][ T176] bridge0: port 2(bridge_slave_1) entered forwarding state [ 96.594656][ T5593] 8021q: adding VLAN 0 to HW filter on device team0 [ 96.709426][ T3285] bridge0: port 1(bridge_slave_0) entered blocking state [ 96.709615][ T3285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 96.822663][ T176] bridge0: port 2(bridge_slave_1) entered blocking state [ 96.822851][ T176] bridge0: port 2(bridge_slave_1) entered forwarding state [ 97.553140][ T5594] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 97.993991][ T5595] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 98.270607][ T5594] veth0_vlan: entered promiscuous mode [ 98.408186][ T5596] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 98.453343][ T5594] veth1_vlan: entered promiscuous mode [ 98.577470][ T5597] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 98.601290][ T5595] veth0_vlan: entered promiscuous mode [ 98.717938][ T5595] veth1_vlan: entered promiscuous mode [ 98.852070][ T5594] veth0_macvtap: entered promiscuous mode [ 98.927721][ T5594] veth1_macvtap: entered promiscuous mode [ 98.959801][ T5596] veth0_vlan: entered promiscuous mode [ 98.989441][ T5593] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 99.055456][ T5596] veth1_vlan: entered promiscuous mode [ 99.084270][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 99.138290][ T5595] veth0_macvtap: entered promiscuous mode [ 99.154190][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 99.190391][ T5595] veth1_macvtap: entered promiscuous mode [ 99.230505][ T3285] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.252067][ T3285] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.269373][ T3285] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.291025][ T3285] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.420952][ T5595] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 99.510493][ T5596] veth0_macvtap: entered promiscuous mode [ 99.562063][ T5595] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 99.700260][ T5593] veth0_vlan: entered promiscuous mode [ 99.706366][ T5596] veth1_macvtap: entered promiscuous mode [ 99.780110][ T158] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.824819][ T158] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.857629][ T158] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.867255][ T158] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 99.868575][ T5597] veth0_vlan: entered promiscuous mode [ 99.897641][ T176] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.897665][ T176] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.910079][ T5593] veth1_vlan: entered promiscuous mode [ 100.060539][ T5596] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 100.197535][ T5597] veth1_vlan: entered promiscuous mode [ 100.268474][ T5596] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 100.417290][ T1198] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.417313][ T1198] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.469432][ T90] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.524538][ T90] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.550238][ T90] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.572017][ T90] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 100.733601][ T176] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 100.733624][ T176] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 100.780787][ T5593] veth0_macvtap: entered promiscuous mode [ 100.957546][ T5593] veth1_macvtap: entered promiscuous mode [ 101.131211][ T5597] veth0_macvtap: entered promiscuous mode [ 101.147921][ T3309] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.147942][ T3309] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.294958][ T5597] veth1_macvtap: entered promiscuous mode [ 101.456642][ T5593] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 101.483231][ T3309] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.483253][ T3309] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.529095][ T5593] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 101.603595][ T5597] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 101.700158][ T157] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.791024][ T157] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.944674][ T157] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 101.980186][ T5597] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 102.022913][ T157] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.034195][ T157] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.034218][ T157] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.152598][ T3309] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.136199][ T3309] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.416765][ T176] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.593501][ T5805] sg_write: data in/out 200668/136 bytes for SCSI command 0x0-- guessing data in; [ 103.593501][ T5805] program syz.1.10 not setting count and/or reply_len properly [ 103.639654][ T5802] bond1: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 103.773511][ T5802] bond1 (unregistering): Released all slaves [ 103.922835][ T5813] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 104.051069][ T13] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 104.976853][ T5822] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4'. [ 106.609072][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.609094][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.954091][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.954113][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 107.452231][ T5849] netlink: 'syz.1.25': attribute type 10 has an invalid length. [ 107.504612][ T90] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 107.504635][ T90] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.273833][ T90] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.273857][ T90] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.812732][ T5731] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 111.090102][ T5731] usb 3-1: Using ep0 maxpacket: 8 [ 111.138946][ T5731] usb 3-1: config 0 has an invalid interface number: 52 but max is 0 [ 111.138979][ T5731] usb 3-1: config 0 has an invalid descriptor of length 102, skipping remainder of the config [ 111.139000][ T5731] usb 3-1: config 0 has no interface number 0 [ 111.139053][ T5731] usb 3-1: config 0 interface 52 altsetting 1 endpoint 0x8A has an invalid bInterval 102, changing to 10 [ 111.139082][ T5731] usb 3-1: config 0 interface 52 altsetting 1 endpoint 0x8A has invalid maxpacket 24624, setting to 1024 [ 111.139108][ T5731] usb 3-1: config 0 interface 52 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 111.139136][ T5731] usb 3-1: config 0 interface 52 has no altsetting 0 [ 111.145372][ T5731] usb 3-1: New USB device found, idVendor=06cb, idProduct=0003, bcdDevice=e8.00 [ 111.145405][ T5731] usb 3-1: New USB device strings: Mfr=22, Product=0, SerialNumber=0 [ 111.145427][ T5731] usb 3-1: Manufacturer: syz [ 112.224729][ T5894] Zero length message leads to an empty skb [ 112.290981][ T5731] usb 3-1: config 0 descriptor?? [ 112.357794][ T5731] usb 3-1: can't set config #0, error -71 [ 112.390045][ T5731] usb 3-1: USB disconnect, device number 2 [ 113.248138][ T60] Bluetooth: hci2: Received unexpected HCI Event 0x00 [ 114.054852][ T5910] capability: warning: `syz.1.41' uses 32-bit capabilities (legacy support in use) [ 114.293590][ T5905] mmap: syz.1.41 (5905) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 115.180034][ T5924] cgroup2: Unknown parameter 'rlimit' [ 119.040839][ T5703] IPVS: starting estimator thread 0... [ 119.135013][ T5971] IPVS: using max 7 ests per chain, 16800 per kthread [ 119.910383][ T5975] syz.0.65 (5975) used greatest stack depth: 19424 bytes left [ 126.796679][ T6062] No control pipe specified [ 127.623499][ T6080] netlink: 20 bytes leftover after parsing attributes in process `syz.3.107'. [ 127.764657][ T6080] bridge1: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 127.852445][ T6080] bridge1: entered promiscuous mode [ 129.273273][ T6098] netlink: 'syz.2.114': attribute type 10 has an invalid length. [ 129.428785][ T6103] 9p: Bad value for 'wfdno' [ 129.583666][ T6098] bond0: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 130.056039][ T6118] syz.2.124 (6118) used greatest stack depth: 19336 bytes left [ 131.350611][ T6136] 9p: Bad value for 'wfdno' [ 132.154067][ T6148] netlink: 'syz.4.134': attribute type 10 has an invalid length. [ 133.047492][ T1342] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.049394][ T1342] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.103251][ T6162] netlink: 12 bytes leftover after parsing attributes in process `syz.1.140'. [ 133.329136][ T6167] netlink: 4 bytes leftover after parsing attributes in process `syz.3.137'. [ 133.329160][ T6167] netlink: 348 bytes leftover after parsing attributes in process `syz.3.137'. [ 133.329180][ T6167] netlink: 4 bytes leftover after parsing attributes in process `syz.3.137'. [ 133.329194][ T6167] netlink: 348 bytes leftover after parsing attributes in process `syz.3.137'. [ 133.329313][ T6167] netlink: 4 bytes leftover after parsing attributes in process `syz.3.137'. [ 133.408747][ T6172] 9p: Bad value for 'wfdno' [ 136.595597][ T6205] netlink: 12 bytes leftover after parsing attributes in process `syz.3.154'. [ 136.860323][ C1] Illegal XDP return value 16128 on prog (id 26) dev veth0_to_bond, expect packet loss! [ 141.903654][ T6263] autofs: Bad value for 'fd' [ 144.033278][ T6289] autofs: Unknown parameter '0x0000000000000000' [ 144.226912][ T6291] netlink: 4 bytes leftover after parsing attributes in process `syz.0.175'. [ 144.226936][ T6291] netlink: 348 bytes leftover after parsing attributes in process `syz.0.175'. [ 144.226955][ T6291] netlink: 4 bytes leftover after parsing attributes in process `syz.0.175'. [ 144.226968][ T6291] netlink: 348 bytes leftover after parsing attributes in process `syz.0.175'. [ 144.227049][ T6291] netlink: 4 bytes leftover after parsing attributes in process `syz.0.175'. [ 144.440741][ T6301] capability: warning: `syz.1.189' uses deprecated v2 capabilities in a way that may be insecure [ 146.254156][ T6325] autofs: Unknown parameter '0x0000000000000000' [ 146.526874][ T6329] netlink: 12 bytes leftover after parsing attributes in process `syz.0.202'. [ 146.526902][ T6329] netlink: 12 bytes leftover after parsing attributes in process `syz.0.202'. [ 147.283558][ T6347] netlink: 'syz.1.207': attribute type 10 has an invalid length. [ 147.322713][ T6347] bond0: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 147.478650][ T6356] autofs: Unknown parameter '0x0000000000000000' [ 148.352942][ T6382] autofs: Unknown parameter '0x0000000000000000' [ 148.604507][ T6385] netlink: 'syz.1.223': attribute type 10 has an invalid length. [ 149.847352][ T6413] autofs: Unknown parameter '0x0000000000000000' [ 150.263581][ T6423] netlink: 'syz.0.238': attribute type 10 has an invalid length. [ 150.641694][ T6423] bond0: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 151.293951][ T6445] autofs: Unknown parameter '0x0000000000000000' [ 153.234023][ T5731] IPVS: starting estimator thread 0... [ 153.281274][ T6470] netlink: 'syz.3.259': attribute type 10 has an invalid length. [ 153.321134][ T6471] IPVS: using max 7 ests per chain, 16800 per kthread [ 153.445955][ T6470] bond0: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 156.459206][ T6523] process 'syz.0.278' launched './file2' with NULL argv: empty string added [ 161.862569][ T6580] autofs: Unknown parameter 'fd0x0000000000000000' [ 166.444995][ T6640] wg1: entered promiscuous mode [ 166.445123][ T6640] wg1: entered allmulticast mode [ 167.775092][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 167.795096][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 168.054480][ T6652] netlink: 'syz.4.326': attribute type 10 has an invalid length. [ 168.082420][ T6652] bond0: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 172.945338][ T6694] netlink: 'syz.0.340': attribute type 10 has an invalid length. [ 173.812306][ T6703] netlink: 12 bytes leftover after parsing attributes in process `syz.3.344'. [ 174.778626][ T5695] Flush: task=udevd[5695] dev=loop6 state=2 [ 174.924295][ T5695] Teardown: task=udevd[5695] dev=loop6 state=2 [ 177.965095][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 177.985103][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 177.995092][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 178.005085][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 178.015087][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 178.025087][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 178.035091][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 178.045096][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 179.145743][ T6739] netlink: 'syz.0.358': attribute type 10 has an invalid length. [ 179.578986][ T6742] netlink: 12 bytes leftover after parsing attributes in process `syz.2.359'. [ 183.206086][ T6776] netlink: 'syz.0.372': attribute type 10 has an invalid length. [ 185.349968][ C1] wlan0: beacon TX faster than countdown (channel/color switch) completion [ 186.665579][ T5730] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 186.826798][ T5730] usb 4-1: Using ep0 maxpacket: 32 [ 186.830494][ T5730] usb 4-1: config 0 has an invalid interface number: 132 but max is 0 [ 186.830523][ T5730] usb 4-1: config 0 has no interface number 0 [ 186.830571][ T5730] usb 4-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 186.868117][ T5730] usb 4-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 186.868149][ T5730] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 186.868169][ T5730] usb 4-1: Product: syz [ 186.868182][ T5730] usb 4-1: Manufacturer: syz [ 186.868196][ T5730] usb 4-1: SerialNumber: syz [ 186.945990][ T5730] usb 4-1: config 0 descriptor?? [ 186.996885][ T6813] netlink: 12 bytes leftover after parsing attributes in process `syz.1.373'. [ 187.104151][ T5730] em28xx 4-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 187.104191][ T5730] em28xx 4-1:0.132: Video interface 132 found: [ 187.149341][ T6819] netlink: 'syz.2.385': attribute type 10 has an invalid length. [ 187.397172][ T5730] em28xx 4-1:0.132: unknown em28xx chip ID (0) [ 188.254244][ T6838] ======================================================= [ 188.254244][ T6838] WARNING: The mand mount option has been deprecated and [ 188.254244][ T6838] and is ignored by this kernel. Remove the mand [ 188.254244][ T6838] option from the mount to silence this warning. [ 188.254244][ T6838] ======================================================= [ 188.784113][ T6838] FAT-fs (nullb0): bogus number of reserved sectors [ 188.784165][ T6838] FAT-fs (nullb0): Can't find a valid FAT filesystem [ 190.052386][ T5730] em28xx 4-1:0.132: reading from i2c device at 0xa0 failed: couldn't get the received message from the bridge (error=-5) [ 190.052425][ T5730] em28xx 4-1:0.132: board has no eeprom [ 190.105566][ T5730] em28xx 4-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 190.105597][ T5730] em28xx 4-1:0.132: analog set to bulk mode. [ 190.149639][ T32] em28xx 4-1:0.132: Registering V4L2 extension [ 190.222351][ T5730] usb 4-1: USB disconnect, device number 2 [ 190.374389][ T5730] em28xx 4-1:0.132: Disconnecting em28xx [ 190.818316][ T32] em28xx 4-1:0.132: Config register raw data: 0xffffffed [ 190.818341][ T32] em28xx 4-1:0.132: AC97 chip type couldn't be determined [ 190.818352][ T32] em28xx 4-1:0.132: No AC97 audio processor [ 191.704592][ T32] usb 4-1: Decoder not found [ 191.704615][ T32] em28xx 4-1:0.132: failed to create media graph [ 191.704700][ T32] em28xx 4-1:0.132: V4L2 device video103 deregistered [ 191.879114][ T32] INFO: trying to register non-static key. [ 191.879130][ T32] The code is fine but needs lockdep annotation, or maybe [ 191.879140][ T32] you didn't initialize this object before use? [ 191.879147][ T32] turning off the locking correctness validator. [ 191.879163][ T32] CPU: 1 UID: 0 PID: 32 Comm: kworker/1:0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 191.879190][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 191.879204][ T32] Workqueue: events request_module_async [ 191.879243][ T32] Call Trace: [ 191.879250][ T32] [ 191.879259][ T32] dump_stack_lvl+0xe8/0x150 [ 191.879292][ T32] assign_lock_key+0x133/0x150 [ 191.879320][ T32] register_lock_class+0xcc/0x2e0 [ 191.879350][ T32] __lock_acquire+0xaf/0x2e40 [ 191.879374][ T32] ? ret_from_fork_asm+0x1a/0x30 [ 191.879396][ T32] ? stack_trace_save+0xa9/0x100 [ 191.879417][ T32] ? __pfx_stack_trace_save+0x10/0x10 [ 191.879441][ T32] lock_acquire+0x115/0x350 [ 191.879464][ T32] ? __wake_up_common_lock+0x2f/0x1f0 [ 191.879490][ T32] rt_spin_lock+0x83/0x400 [ 191.879514][ T32] ? __wake_up_common_lock+0x2f/0x1f0 [ 191.879534][ T32] ? __pfx_rt_spin_lock+0x10/0x10 [ 191.879562][ T32] __wake_up_common_lock+0x2f/0x1f0 [ 191.879585][ T32] __vb2_queue_cancel+0x2de/0xdc0 [ 191.879612][ T32] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 191.879643][ T32] ? lockdep_hardirqs_on+0x7a/0x110 [ 191.879672][ T32] ? __vb2_cleanup_fileio+0x134/0x1f0 [ 191.879702][ T32] vb2_core_queue_release+0x2f/0x150 [ 191.879733][ T32] vb2_video_unregister_device+0x15b/0x200 [ 191.879764][ T32] em28xx_v4l2_init+0x1c60/0x3140 [ 191.879804][ T32] em28xx_init_extension+0x120/0x1d0 [ 191.879834][ T32] ? process_one_work+0x7fd/0x1480 [ 191.879858][ T32] process_one_work+0xaaf/0x1480 [ 191.879892][ T32] ? __pfx_process_one_work+0x10/0x10 [ 191.879915][ T32] ? do_raw_spin_lock+0x12b/0x2f0 [ 191.879944][ T32] ? assign_work+0x3cf/0x5d0 [ 191.879970][ T32] worker_thread+0xb05/0x10d0 [ 191.880006][ T32] kthread+0x388/0x470 [ 191.880037][ T32] ? __pfx_worker_thread+0x10/0x10 [ 191.880062][ T32] ? __pfx_kthread+0x10/0x10 [ 191.880093][ T32] ret_from_fork+0x514/0xb70 [ 191.880126][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 191.880158][ T32] ? __switch_to+0xc89/0x1420 [ 191.880186][ T32] ? __pfx_kthread+0x10/0x10 [ 191.880217][ T32] ret_from_fork_asm+0x1a/0x30 [ 191.880244][ T32] [ 191.881949][ T32] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI [ 191.881971][ T32] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 191.881990][ T32] CPU: 1 UID: 0 PID: 32 Comm: kworker/1:0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 191.882013][ T32] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 191.882025][ T32] Workqueue: events request_module_async [ 191.882059][ T32] RIP: 0010:__wake_up_common_lock+0xd6/0x1f0 [ 191.882082][ T32] Code: 0f 84 d4 00 00 00 44 8b 7c 24 04 eb 13 48 ba 00 00 00 00 00 fc ff df 4c 39 ed 0f 84 ba 00 00 00 49 89 ee 48 89 e8 48 c1 e8 03 <80> 3c 10 00 74 12 4c 89 f7 e8 1c ce 93 00 48 ba 00 00 00 00 00 fc [ 191.882099][ T32] RSP: 0018:ffffc90000a6f908 EFLAGS: 00010246 [ 191.882117][ T32] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 191.882130][ T32] RDX: dffffc0000000000 RSI: ffffffff8bca9460 RDI: 00000000ffffffff [ 191.882145][ T32] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 191.882157][ T32] R10: dffffc0000000000 R11: fffffbfff1f5f0b0 R12: ffff888026321b14 [ 191.882172][ T32] R13: ffff888026321c28 R14: 0000000000000000 R15: 0000000000000000 [ 191.882186][ T32] FS: 0000000000000000(0000) GS:ffff888125d3c000(0000) knlGS:0000000000000000 [ 191.882203][ T32] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 191.882217][ T32] CR2: 000000110c436197 CR3: 0000000039f8e000 CR4: 00000000003526f0 [ 191.882237][ T32] Call Trace: [ 191.882244][ T32] [ 191.882256][ T32] __vb2_queue_cancel+0x2de/0xdc0 [ 191.882283][ T32] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 191.882313][ T32] ? lockdep_hardirqs_on+0x7a/0x110 [ 191.882343][ T32] ? __vb2_cleanup_fileio+0x134/0x1f0 [ 191.882373][ T32] vb2_core_queue_release+0x2f/0x150 [ 191.882404][ T32] vb2_video_unregister_device+0x15b/0x200 [ 191.882433][ T32] em28xx_v4l2_init+0x1c60/0x3140 [ 191.882473][ T32] em28xx_init_extension+0x120/0x1d0 [ 191.882502][ T32] ? process_one_work+0x7fd/0x1480 [ 191.882526][ T32] process_one_work+0xaaf/0x1480 [ 191.882559][ T32] ? __pfx_process_one_work+0x10/0x10 [ 191.882582][ T32] ? do_raw_spin_lock+0x12b/0x2f0 [ 191.882605][ T32] ? assign_work+0x3cf/0x5d0 [ 191.882630][ T32] worker_thread+0xb05/0x10d0 [ 191.882667][ T32] kthread+0x388/0x470 [ 191.882697][ T32] ? __pfx_worker_thread+0x10/0x10 [ 191.882722][ T32] ? __pfx_kthread+0x10/0x10 [ 191.882754][ T32] ret_from_fork+0x514/0xb70 [ 191.882786][ T32] ? __pfx_ret_from_fork+0x10/0x10 [ 191.882818][ T32] ? __switch_to+0xc89/0x1420 [ 191.882846][ T32] ? __pfx_kthread+0x10/0x10 [ 191.882878][ T32] ret_from_fork_asm+0x1a/0x30 [ 191.882905][ T32] [ 191.882912][ T32] Modules linked in: [ 191.882935][ T32] ---[ end trace 0000000000000000 ]--- [ 191.882946][ T32] RIP: 0010:__wake_up_common_lock+0xd6/0x1f0 [ 191.882967][ T32] Code: 0f 84 d4 00 00 00 44 8b 7c 24 04 eb 13 48 ba 00 00 00 00 00 fc ff df 4c 39 ed 0f 84 ba 00 00 00 49 89 ee 48 89 e8 48 c1 e8 03 <80> 3c 10 00 74 12 4c 89 f7 e8 1c ce 93 00 48 ba 00 00 00 00 00 fc [ 191.882984][ T32] RSP: 0018:ffffc90000a6f908 EFLAGS: 00010246 [ 191.883002][ T32] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 191.883014][ T32] RDX: dffffc0000000000 RSI: ffffffff8bca9460 RDI: 00000000ffffffff [ 191.883030][ T32] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 191.883042][ T32] R10: dffffc0000000000 R11: fffffbfff1f5f0b0 R12: ffff888026321b14 [ 191.883058][ T32] R13: ffff888026321c28 R14: 0000000000000000 R15: 0000000000000000 [ 191.883071][ T32] FS: 0000000000000000(0000) GS:ffff888125d3c000(0000) knlGS:0000000000000000 [ 191.883089][ T32] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 191.883104][ T32] CR2: 000000110c436197 CR3: 0000000039f8e000 CR4: 00000000003526f0 [ 191.883126][ T32] Kernel panic - not syncing: Fatal exception [ 191.883281][ T32] Kernel Offset: disabled