last executing test programs: 3.125924794s ago: executing program 1 (id=3094): syz_emit_ethernet(0x5e, &(0x7f0000002e40)={@local, @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "7428dd", 0x28, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_na={0x89, 0x0, 0x0, 0x0, '\x00', @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [{0x0, 0x2, "122b472e41e24b11f34b608816e5"}]}}}}}}, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000000)=@newtaction={0x26c, 0x30, 0x871a15abc695fb3d, 0x0, 0x25dfdbfd, {}, [{0x258, 0x1, [@m_tunnel_key={0x6c, 0x1, 0x0, 0x0, {{0xf}, {0x3c, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x204, 0x7, 0x10000000, 0x200000, 0x6}, 0x2}}, @TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0x5, @empty}, @TCA_TUNNEL_KEY_NO_CSUM={0x5, 0xa, 0x1}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}, @m_skbedit={0x84, 0xc, 0x0, 0x0, {{0xc}, {0x4c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0x3, 0xffe7}}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x7}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0xff}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0xfff1, 0xc}}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x7}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x4}, @TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x8}, @TCA_SKBEDIT_PTYPE={0x6, 0x7, 0x1}, @TCA_SKBEDIT_MARK={0x8, 0x5, 0x70}]}, {0xffffffffffffff25, 0x6, "1abf842170b99b2d385cd0"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x2}}}}, @m_ife={0x164, 0x2, 0x0, 0x0, {{0x8}, {0xac, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x6, 0x7b84, 0xffffffffffffffff, 0x0, 0x4000}, 0x1}}, @TCA_IFE_METALST={0x28, 0x6, [@IFE_META_PRIO={0x8, 0x3, @val=0xa4}, @IFE_META_SKBMARK={0x8, 0x1, @val=0x696}, @IFE_META_PRIO={0x8, 0x3, @val=0x6}, @IFE_META_PRIO={0x4, 0x3, @void}, @IFE_META_SKBMARK={0x4, 0x1, @void}, @IFE_META_SKBMARK={0x4, 0x1, @void}]}, @TCA_IFE_SMAC={0x0, 0x4, @multicast}, @TCA_IFE_TYPE={0x6, 0x5, 0xc9}, @TCA_IFE_DMAC={0xa, 0x3, @random="8e626b6bfbf7"}, @TCA_IFE_PARMS={0x1c, 0x1, {{0xe, 0x100000, 0x4, 0x6, 0x3}}}, @TCA_IFE_SMAC={0xa}, @TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0xd, 0x2, 0x1, 0x4}, 0x1}}]}, {0x92, 0x6, "0745eda98a44af97ae46a19127d038c5123f3cb17331ff9148552ed3e66c1ec3da02b7f8bf5c416577450e40e13f05636db4c6ad1b3b41745844ead184f6931b6094c2079d7cfc0e3261b4596fbfbc0d19da37719c7dae4fc8e453fa633c7fd941086e3a72eaace8b91ccace63675f74944e81a9c807e2e4fbfbfd06a5fa8083ba3da79908908e58145dc1ca9b47"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x7}}}}]}]}, 0x26c}, 0x1, 0x0, 0x0, 0x20048840}, 0x1004) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000680), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PAUSE_GET(r3, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000001940)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01dfffffff9a26000000210000000c00018008000100", @ANYRES32=r2], 0x20}, 0x1, 0x0, 0x0, 0x4000c00}, 0x0) r5 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) openat$cgroup_ro(r5, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000007580), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000007680)={0x0, 0x0, &(0x7f0000007640)={&(0x7f0000000000)=ANY=[@ANYBLOB="46040000", @ANYRES16=r6, @ANYBLOB="ff830500000700ffffff", @ANYRES8=r5], 0x4}}, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000002c0)={'syztnl0\x00', &(0x7f0000000340)={'ip6tnl0\x00', 0x0, 0x2f, 0x2, 0xfc, 0x4, 0x3, @private1, @mcast2, 0x7c8, 0x10, 0x6, 0xbc0b7c6}}) sendmsg$BATADV_CMD_TP_METER(r3, &(0x7f0000000480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x48, r6, 0x600, 0x70bd29, 0x25dfdbfe, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x9}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r7}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x80}, 0x20000004) 3.094260807s ago: executing program 1 (id=3096): r0 = syz_open_dev$usbfs(&(0x7f0000000000), 0x9, 0x2a4041) ioctl$USBDEVFS_FREE_STREAMS(r0, 0x8008551d, &(0x7f0000000040)={0x94a}) r1 = gettid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000010000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r4}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x6, 0x4, 0x6, 0x7ffc1ffc}]}) r5 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) process_vm_readv(r5, &(0x7f0000000540)=[{&(0x7f0000000200)=""/248, 0xf8}, {&(0x7f0000000340)=""/165, 0xa5}, {&(0x7f0000000400)=""/155, 0x9b}, {&(0x7f0000000100)=""/50, 0x32}, {&(0x7f00000004c0)}, {&(0x7f0000000500)=""/15, 0xf}], 0x6, &(0x7f0000002bc0)=[{&(0x7f0000000bc0)=""/4096, 0x1000}, {&(0x7f00000005c0)=""/29, 0x1d}, {&(0x7f0000000600)=""/37, 0x25}, {&(0x7f0000000640)=""/171, 0xab}, {&(0x7f0000000700)=""/70, 0x46}, {&(0x7f0000001bc0)=""/4096, 0x1000}, {&(0x7f0000000780)=""/227, 0xe3}, {&(0x7f0000000880)=""/83, 0x53}, {&(0x7f0000000900)=""/95, 0x5f}, {&(0x7f0000000980)=""/224, 0xe0}], 0xa, 0x0) ioctl$int_in(r2, 0x5452, &(0x7f0000b28000)=0x3) fcntl$setsig(r2, 0xa, 0x12) poll(&(0x7f0000b2c000)=[{r3}], 0x2c, 0xffffffffffbffff8) dup2(r2, r3) fcntl$setown(r2, 0x8, r1) tkill(r1, 0x13) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000180)=@generic={&(0x7f0000000300)='./file0\x00', 0x0, 0x10}, 0x18) 3.004530254s ago: executing program 1 (id=3098): bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x16, 0x16, &(0x7f0000000380)=ANY=[], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, &(0x7f0000000040), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x8, 0x5}, 0x10}, 0x94) 3.003634745s ago: executing program 1 (id=3099): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000800000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000001000000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_inet6_tcp_SIOCOUTQ(r3, 0x5411, &(0x7f0000000200)) sendmsg$TIPC_CMD_GET_NODES(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)={0x1c, r2, 0x1, 0x0, 0x0, {{}, {0x0, 0x6}}}, 0x1c}}, 0x0) (fail_nth: 7) socket$inet6_mptcp(0xa, 0x1, 0x106) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000080000000500000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000086"], 0x0, 0xfffffffe, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000000a80)=ANY=[@ANYBLOB="620af8ffa1dc0021bfa100000000000007010000f8ffffffb702000007000000bd120000000000008500000010000000b70000000000000095000000000000003faf4f2aa3d9b18ed812a2e2c49e8020a6f4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24561f1b2607995daa56f151905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64b751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07372c29184ff7f4a7c0000070000006056feb4cc664c0af9360a1f7a5e6b607130c89f18c0c1088d8b8588d72ec29c48f0af5f2d9f51c4b45e0000000000000401d01aa27ae8b09e00e79ab20b0b8ed8fb7a68af2ad0810000000000006fa03c6468978089b302d7ff6023cdcedb5e0125ebbcebdde510cb2364149215108337719acd97cfa107d40224edc5465ad32b77a74e802a0dc6bf25cca242bc6099ad2300000480006ef6c1ff0900000000000010c63a949e8b7955394ffaff03000000000000ab87b1bfeda7be586602d985430cea080000000000000026abfb0767042361448279b05d96a703a660581eecdbf5bcd3de227a167ca17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9b081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b6c7632d5933a1c1fa5605bd7603f2ba2a790d62d6faec2fed44da4928b30142ba1fde5c5d50b83bae645ffa4997da9c77af4c0cb97fca585ec6bf58351d578be00d952aab9c71764b0a8a7583c90b3433b809bdb9fbd48fc877505ebf6c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223d8d9e86c5ea06d108d8f80a0eb4fa39f6b5c02e6d6d90756ff578f57000000009700cf0b4b8bc229413300000000000000000003000000000000000000000000001000000000559711e6e8fcffffffffffffffb2d02edc3e01dd271c896249ed85b980680b09000000000f0000169cdcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffffd897ef3b7cda42f93d53046da21b40216e14ba2d6af8656b01e17addaedab25b30002abbba7fa725f38400be7c1fb8f72cd317902f19e385be9e48dccf1f9f3282830689da6b53b263339863297771d74732d400003341bf4a00fc9fec2271ff01589646efd1cf870cd7bb2366fde4a594290c405ff870ce5dfd3467decb05cfd9fcb32c8ed1dbd9d30a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78249788f11f761038b75d4fe32b561d46ea3abe0fa7956488bef241875f3b4b6ab7929a57affe760e797724f4fce1093b62d7e8c7123d890decacec55bf404e4e1f74b7eed82571be54c72d978cf906df0042e36acd37d7f9e109f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2acd1fe582786105c70600000000000000b7561301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c542c9062ece84c99a061887a20639b41c8c12ee86c50804042b3eac1f870b136345cf67ca3fb5aac518a75f9e7d7101da841735e186c489b3a06fb99e0347f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f91e358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e669261192899d4562db0e22d564ae09bb6d163118e401e024fd452277c3887d6116c6cc9d8046c216c1f895778cb26e22a2a998de44aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f154772f514216bdf57d2a40d40b51ab67903ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99a3594191e104d417e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1594e32409e2a3bce109b6000000000000a1fec9000000d694210d7560eb92d6a97a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137ab79a404abde7750898b59270bb29b81367ac91bd627e87306703be8672d70d1ab57075228a9f46ed9bd1f00fb8191bbab2dc591dda61f0868afc4294859323e7a45319f18101288a0268893373750d1a8fe64680b0a3fc22dd704e4214d00000000d6c98cd1a9fbe1e7d58c08acaf30065b928a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ce21d69993e9960ff5f76015e6009756237badf4e7965bbe2777e808fcba821a00e8c5c39609ff854356cb490000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466ac96e0d0b3bc19faa5449209b085f3c334b47f067bbab40743b2a428f1da1f68df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c471c784ae7da7eaa69eb7f7f80572fdd11bb1d070080fbc22bf73468788df51710eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331ff5e20fa26b8471d42645288d7226bbd9c9e9e1cc9eb3d541e407cc2dae5e690cd628ab84875f2c50ba830d3f474b079b407000000deff000040430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71b967ce7daac4be290159f6bcd75f0dda9de5532e66ae9e48b0ed1254a81faae79b6af6fbb869604d51de44c4e0973171ad47d6c00ebc7603093f000000fdec30cd6db49a47613808bad959719c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f15d6533f78a1f4e2df4ca23d867693fd42de9b49a1b36d48a44ba6a4530e59bec53e876dc660dd63bed8d31c31c37a373d4efd89f0000377b1b1292a893a516dab183ee65744fb8fc4f9ce2242e0f0059161c5e0000000000000000000057d77480e0345effff6413258d1f6eb190aa28cbb4bafe34124172e436b176c7ed4b132fb805d5edd9d188daf28d89c014c3ecca10ae55704544673e1fa03b84f63e022fe755f4007a4a899eaf52c4f491d8e97c862e29e457060000007ac691faee1e0c8fe056a07474e6e5490a7d3c3402000000b60600d837c6befc63ddf2f594ad7cbc56a1e44d218c956a5392a995f1fae8e9f206efbb33854dc70104ebc1581848f9745cb796da2dfb714a0500000000000000faed94fc39acfb3fd25dfa8116a154cd1226e1bb72b59fed817072a0da60160761fd3dffda0f7c592eabd8ab68334d2a1693cb187539049e331272bf5135044df8161400211b8012b6eb1ed5656e83f65509bb4b323c5bd61bff949d3bade2f6ffda1360c2786e16937ab61d6dcafed319c716357d0885f9c6d1f442954c167dd9b4acd9468ce3674c82bbb2e31389179b025dbe063b7f906217b2cf8410c7023aa3e5cc3ba1000000000000000000000000000000006ae6301a2da44394275c582a6516bb92ea1980a0a659f2f1811c8b281c209647c4241f292b20508b215dde27bb2487a6e2b5e4a8ccfab90c23827ef06cbe364073005f8a6d1456aaeb85ffb7858f24eced67a67ab825e863928ed64c83f62ffdaa997657335b63c6b4163aff094059e626766845fd779c9e6cdbbd64c24936615ee68538e8fddd0d90f3a7579579a142c0f7b318264d5c13c31cf475829528267ead38523cab7e1664e8426ca85e82ccf821c8a02a7e7d954d05b68a9c28f79429b09e2bb3681ae2b831e27c735123361c193d66ed4d71f19b199d371ec6bfada7cd370e3fdd3cd980fa1e145fd3f3e96b1feb53c865e1ad6acf5d16ed652ee0c7f45352222692fbd679212c225d097aa90f7e1fb1f983415f43e75a19ecf7fd21bfa150ef563aa72ba1c43c5f3d9be128ec26b691f31f9cab931631606a81622f120675c962be2d3b5e95f74f0b209e42e6bdd76e6e725295b1d78d928f6f63c41cbde2ba66ad81168070c8c6e18a6e452a31bdc4a60d637545ed4c8a1c649c3ce54ad3e16304d06a234f5f9311ef0f78924b68dbb4712efdb6974667bdb54f16fd2061b9ba93638dd177227e94e4ebd0ec1d437db948062bf41742000000000000000000305f70dd02fa0c61d5fe6d8ff35389246037e18d34c1375ae04f44f0c2543c772c5ccb137be7dc1874c5140200000054d77d4ea5ed144a648257f4a0301067bbcd9b91072659d872f26b796e2b81025edb5f45f785e2c2602b248ecdd80f019ca659be7e8ae953325a27564f33c9d458a60be3dab38baab7eb1a66ab1ffd6308f7fd51beb356fe75eb985b7581bb5584c53984ba9c7340f97e8d3825681c53de5f554e595b00000000000000006a8fa9f05d64c4be42f981f00051a3bc38613067dbd1427e01bfec016e51844cefa8a855bf23ac887b4a88eed6d9443857242f28e31a41d20105fbf3394ff910e734b4d9101265ff729c426e01c1ab13dda8c388b9e6626f19eecb87e39175e85e17000000000000000000009431807e43886903526074e6b40244c938a4c68a38c25ddd7c143b3f14eafe4b28ec66815cf8d1f56aa1424bc9b5d58790298e5b310969e50c222563b54e60854e1bfeef448aca8c5ccbf5546ce4c3cd5a733fec25fb94e1e0f966bcbd28a4d8fe4f556eaa1104a793006619700798354c6ae0040965e3083562bfa20968c04007d21dc02c9fd1f75e1ff40f439bdde4e784012e52049b483f02f81b88f5f57816b3fecec79cfca8d37203e769759d6b6a56b7605ced8ee18475a77ff0963a565fb6021d216c01b1098e40550a1cfd80e9180100000000000000654cd76ca61fe5ad8a31ec558fdbfa706d5e738bceae81fe777c307d5bc72183a4c2d35732e74dd690c57bdfdc1f069f9491bca7a8c59363799be70018c25ece5ad7307dc7a95c51bc25a8bbe2cf5ddf6aa161693782b0e7feb8a768f391b49d4c978c96dbb52f21c122eba9f17c8bed10591958cf06321a248b5f76ceedfe0d080d6aeadc11b237b3326dd04b86ac37c0d131544888db9e128d059761ad9a393e96c3b41c13c5a381bff187a75de560ba6eb3faa5ff8d2bb3c88f8de5efc2fb2200cfda6d07ceae22577064334fbf76a23e62e6059211d995b879f6b7d3f7fcf03652b81e6b7cdeff947ad185d3c6269ca247b429c3b872a8f1ef60407d29a874f4ec31c9effed55543a65a6b4d778cebcd43b7905f3960140bd783540a7353014bda8e9c7a34a5f428fd1f8eb11e837dd9d586487fdebcb1ecd3a003ff0fda4be617fecf1ff0ef2cdfb7fea73ca18874664d60a4b9423f3297bc8eb91b4ee1d73272ab28a7d7ab055a8eb58fe379de85338304e26e3620941b463e9049fd105c74c91cc4d71b0f76e2c2e4825106aa7ce2a3adbbc7a0443ece98c077b358e752b439132a0f27080ece2a94c320b002c77f82662675a7713c7067081cac15994698c41ff4754268ae2676384ff799783f55d7e5a1a092a01b965dc99cb7a9d98440c355927629f2bcf9dc2396eb2f5d25829715b24327642ac48f1201014a95e0e65e12cdf27e19043e3c5d3e798375cead35b9a93190a52cdecaaccc854a1d41ef365303f0e9b4fc969c9dab6df5e8a795b140fcc09e8a7b694d12932917facd8ceaa4e2d0d16bb0b95387fcd5ff136d8abddf94daf442bbff744591931872a36cf921ad69f2127386e8b0f9afee4da8d3fbec809fbb3ca0fded2859cf25d4c6155d396c5b9bd1a928923123f63f4c40688eae69990a9419456247bbaeb7948de84d2ff875414883bb1e503d4bfebc01bc12a53ea06bf38e571157bd642dac25dbee7832c58378374a39483d6721eec96c28911db21c0c006b42afc90000000000000000000000700000000000000000008ce4ea442c1a207108b35511186c5e860278f6463f52f3990ce08b1bfccc3cff4b5ae27b610aa9ba11b47d4f94c439e055cdbb2b12c983885c93ea4ab4ca1e02d831ae162ee104"], &(0x7f0000000100)='GPL\x00'}, 0x41) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='+}[@\x00') sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000007c0)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x1000000, {0x0, 0x0, 0x0, 0x0, {0x9}, {0xf}, {0xe, 0xd}}, [@TCA_RATE={0x6, 0x5, {0x9, 0x1}}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x691, 0x0, 0x0, 0x0, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x8c0}, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='task_newtask\x00', r6}, 0x10) syz_clone(0x400, 0x0, 0x0, 0x0, 0x0, 0x0) 2.981036276s ago: executing program 1 (id=3100): openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x404c044, &(0x7f0000000540)={0x2, 0x4e24, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x3b}}, 0x4000000}, 0x1c) r1 = io_uring_setup(0x4d3f, &(0x7f0000000240)={0x0, 0xca6a, 0x40, 0x1, 0x6}) io_uring_register$IORING_REGISTER_RESTRICTIONS(r1, 0xb, &(0x7f0000000500), 0x66) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="1b00"/13], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000003000010850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00', r3}, 0x10) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x5e, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000010000700000e0000000000000000000a20000000000a03000000000000000000010000000900010073797a30000000003c000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a30000000000800054000000002600000000c0a01080000000000000000010000000900020073797a32000000003400038030000080080003400000000224000b80200001800e000100636f6e6e6c696d69740000000c00028008000140000000000900010073797a30"], 0xe4}}, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007300000095"], &(0x7f0000000040)='GPL\x00', 0x5, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000ac0)={r4, 0xe0, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000740)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x9, &(0x7f0000000780)=[0x0], &(0x7f00000007c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x59, &(0x7f0000000800)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x40, 0x10, &(0x7f0000000840), 0x0, 0x0, 0xaf, 0x8, 0x8, &(0x7f0000000940)}}, 0x10) socket$inet6_udplite(0xa, 0x2, 0x88) 2.314202851s ago: executing program 2 (id=3107): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000180)='sys_enter\x00', r0}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000180)='tmpfs\x00', 0x3200890, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x80001) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, 0x0, 0x262) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000001c0)={0x4, &(0x7f0000000100)=[{0xd0e, 0x4, 0x2d, 0xfffff8af}, {0x1, 0x1, 0xb5, 0x800}, {0xfc00, 0x8, 0xe, 0x3}, {0x8, 0x6, 0x51, 0x5}]}) 2.31381991s ago: executing program 2 (id=3108): socket$nl_generic(0x10, 0x3, 0x10) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(0xffffffffffffffff, 0x40a85321, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) socket$packet(0x11, 0xa, 0x300) socket$packet(0x11, 0xa, 0x300) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r0 = socket$inet6(0xa, 0x800000000000002, 0x0) openat$binfmt_register(0xffffffffffffff9c, 0x0, 0x1, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000001800ff0f00000000001b0000850000006d000000850000002300000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x10) writev(r1, 0x0, 0x0) syz_usb_connect(0x2, 0x2e3, &(0x7f0000000880)={{0x12, 0x1, 0x200, 0x68, 0x3b, 0x2, 0x10, 0x59f, 0x1061, 0x8844, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d1, 0x1, 0xd, 0x2, 0x40, 0xac, [{{0x9, 0x4, 0xe3, 0x44, 0xb, 0xf5, 0x9e, 0xfa, 0x81, [@generic={0x7b, 0x5, "ce767c079e0b8d86e58c5db24fd3c31e8bfc4fb7fda126c4fd938676acd6bcbe9407ea8ddfae4de4c8ffc45ff9ca39749c4e21123749fe823f4e940359498124fc53513378d9f96a22cbc76d93c31fbba433f9a6d6cad6778280e96d874628e0ccc64716cb3078bf121a9f9cccc925deb31015f42e7ab9dd67"}], [{{0x9, 0x5, 0x7, 0x8, 0x8, 0x3f, 0xa3, 0x1, [@generic={0x1c, 0x10, "052a5f7059bd07c243ea58ff04901549837904b4bbebf9cf4898"}, @uac_iso={0x7, 0x25, 0x1, 0x2, 0x3, 0x4}]}}, {{0x9, 0x5, 0x2, 0x0, 0x40, 0xc0, 0x40, 0x8, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0x8, 0x1000}]}}, {{0x9, 0x5, 0x80, 0x0, 0x8, 0x8, 0x7, 0x10, [@generic={0xdb, 0xe, "8d3c6127aa938979078756ba49243d9c9d065e15a6d6d1ffb19d21ba8c69d503fead135557c636f2515818d1d6c6fc4b124179b348d71d4da8a975ae980e67278cde79ff1ee6c1849e85528bee31efd27393d4000d776db7aaa79768544f893ed1820d75b36143d533435af6b954627f45f61aae603ee73e8d3f2d7f4b6f18341bf10bf8418e5a5a2aeaf2be11e4ff9a605da2a1a0c56c333472aab897b785c066e6b63aac7e18d0df54fe17e61efb51433ccb4d7f34218186e262f4d5ef67627a7fcb4c2263ffa41138b2ae5782d2baed96abb314a7c28d0f"}]}}, {{0x9, 0x5, 0xf, 0x8, 0x400, 0x0, 0x2, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x40, 0x6}, @uac_iso={0x7, 0x25, 0x1, 0x81, 0x9, 0x30}]}}, {{0x9, 0x5, 0xc, 0x10, 0x10, 0x0, 0x6, 0x9}}, {{0x9, 0x5, 0x4, 0x1, 0x620, 0x9, 0x6, 0xd2, [@generic={0x96, 0x21, "aebaf95d6536b390a44171138d747e0eead439f6c518abee427aa859a164bb1a09d4f4ff4b0f1cf9627053dc6c07f90ae69991f3a83a020f12eb8c150eb7538f39921b02da6a01aa15623f881525e60c16e5679f8123b4a3efba86532f08e8c3fce1572f64e42ee4f6e94b3ecca794bb2801093520598bd17682d3586118faf699af81d64a02e02f2c185b7e7909668d4d73060b"}, @generic={0x23, 0x22, "f8f705d27aaf42120333bfea3f28e2a14045144feba84b8b069a766dca02430dcb"}]}}, {{0x9, 0x5, 0x80, 0x4, 0x10, 0x4, 0x0, 0xea}}, {{0x9, 0x5, 0xb, 0x0, 0x400, 0x8, 0x9, 0x6, [@uac_iso={0x7, 0x25, 0x1, 0x81, 0x0, 0x80}]}}, {{0x9, 0x5, 0x2, 0xc, 0x40, 0x1, 0x9, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x81, 0x3ff}, @uac_iso={0x7, 0x25, 0x1, 0x80, 0x2, 0x894}]}}, {{0x9, 0x5, 0x1, 0x3, 0x40, 0x7, 0x2, 0x2}}, {{0x9, 0x5, 0xd, 0x10, 0x400, 0x9e}}]}}]}}]}}, &(0x7f0000000c80)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x310, 0x6, 0x7c, 0x2, 0xff, 0x7}, 0x29, &(0x7f0000000300)={0x5, 0xf, 0x29, 0x1, [@ssp_cap={0x24, 0x10, 0xa, 0x10, 0x6, 0x100, 0xf, 0x1, [0x0, 0xc0, 0x30, 0x3fc0, 0xf, 0x3e80]}]}, 0x6, [{0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x445}}, {0x65, &(0x7f0000000380)=@string={0x65, 0x3, "780f9595e951ce7ddbe2ac8d311e52a408770c5facad4278f50076b994e077040d79bb35dd5e293b63b8ece6ebb696e3109ef69c244d3597b9e3352162b5d830d7e3ad72b590a63cf0b065d52d3903ba0bcd48a5656a7eb3762869a07610185e63eb47"}}, {0x4, &(0x7f00000006c0)=@lang_id={0x4, 0x3, 0x81a}}, {0x4, &(0x7f0000000700)=@lang_id={0x4, 0x3, 0xc1a}}, {0x9a, &(0x7f0000000740)=@string={0x9a, 0x3, "9274322b8077d59351706312de1d758ea5e30e42a2a0302ff85f40d5704e3cf695562a52498af3c76729c14eee8ec3226dc5f56a8b2dd63291abb03f60052e154f75bf3c553c84a754df738126329f2176d4405902d43b15925dc65adfd6592c876e2d63cb51d989e4c333cf81f4f7c41ff60003a7ce16e22534620391698bec6023f03ef2bb7d6d44c1d6e100de5351ea8d11a4a88691b5"}}, {0x87, &(0x7f0000000bc0)=@string={0x87, 0x3, "38e7cd3ac2bfd132534fa73fec53e4840e9713a07170a74975be733f7696091d5b3ad907ff984a31372818814dfad9a43a028433d4b844b93cfd1e520f43138d7606e69444290e4023401f6cb838a6d26b2ee6cbe4fd0dd65450421e7037f889a4206cae587063032ef8a3655c444c509803451d7f19b32019c3668474316157b150e2803e"}}]}) sendmmsg$inet6(r0, &(0x7f0000000080)=[{{&(0x7f0000000400)={0xa, 0x4e23, 0x1, @mcast2}, 0x1c, 0x0}}], 0x1, 0x0) 2.291897733s ago: executing program 3 (id=3109): r0 = socket$nl_audit(0x10, 0x3, 0x9) getsockopt$netlink(r0, 0x10e, 0x4, 0x0, &(0x7f0000000000)) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @broadcast}, 0x10) (async) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @broadcast}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b40500000000000079109a00000000000500000000f4ffff9400000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x22e, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b40500000000000079109a00000000000500000000f4ffff9400000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x22e, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600600, 0x200000, 0x3, &(0x7f0000a00000/0x600000)=nil) unshare(0x6a040000) (async) unshare(0x6a040000) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000a999850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f0000000400)='rxrpc_peer\x00', r3, 0x0, 0xfffffffffffffff9}, 0x18) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f0000000400)='rxrpc_peer\x00', r3, 0x0, 0xfffffffffffffff9}, 0x18) r4 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r4, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10}, 0x24) sendmmsg(r4, &(0x7f0000000180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0xe000}, 0x5}], 0x1, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x8000000, 0x9) (async) madvise(&(0x7f0000000000/0x2000)=nil, 0x8000000, 0x9) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) setsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000001c0)={{{@in6=@mcast1, @in6=@remote, 0x4e21, 0x8, 0x4e20, 0x3d7, 0x308dc466b09911c6, 0x80, 0x20, 0x6c, r5, 0xee00}, {0x8001, 0x80000000, 0x81, 0x81, 0x80, 0xfffffffffffffffc, 0x2, 0xfffffffffffffffe}, {0xfffffffffffffffc, 0x7f, 0x376, 0x5}, 0x8, 0x0, 0x0, 0x1, 0x2}, {{@in=@rand_addr=0x64010101, 0x4d6, 0x32}, 0xa, @in6=@remote, 0x0, 0x1, 0x3, 0x8e, 0x400, 0x1071, 0x46}}, 0xe8) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18060000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000003000000b703000000000000850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r5, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x50) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f0000000080)='sys_enter\x00', r6}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x18) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setxattr$security_capability(0x0, &(0x7f0000000280), 0x0, 0x0, 0x0) (async) setxattr$security_capability(0x0, &(0x7f0000000280), 0x0, 0x0, 0x0) 2.143427515s ago: executing program 3 (id=3112): bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000b28000)=0x3) poll(&(0x7f0000b2c000)=[{}], 0x2c, 0xffffffffffbffff8) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="190000000400", @ANYBLOB], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18060000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000003000000b70300000000000085000000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000400850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0x3100, 0x3100, &(0x7f0000000000), 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000080)={0x18, 0x0, {0xfffe, @remote, 'veth0_virt_wifi\x00'}}, 0x1e) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)=@getqdisc={0x28, 0x26, 0x400, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x10, 0x9}, {0xfff4, 0x5}, {0xa, 0x3}}, [{0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x8000) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001100010100"/20, @ANYRES32=r5], 0x20}, 0x1, 0x0, 0x0, 0x80d5}, 0x0) 1.766709075s ago: executing program 2 (id=3119): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1b000000000000000000"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/vmallocinfo\x00', 0x0, 0x0) read$hiddev(r2, &(0x7f00000000c0)=""/4092, 0xffc) 1.720268999s ago: executing program 0 (id=3120): r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)=@newtfilter={0x54, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r2, {0xd, 0xffe0}, {}, {0xa, 0x6}}, [@filter_kind_options=@f_flower={{0xb}, {0x24, 0x2, [@TCA_FLOWER_INDEV={0x14, 0x2, 'veth0_virt_wifi\x00'}, @TCA_FLOWER_KEY_ETH_DST={0xa, 0x4, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x22044078}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1b, 0x10, &(0x7f00000000c0)=ANY=[@ANYRESHEX=r1, @ANYRESHEX=r2], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r2, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x11, 0xc, &(0x7f0000000040)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x8, 0xa0, &(0x7f0000001a80)=""/160, 0x8eb2e000f2c28467, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1e29}, 0x94) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4) r3 = syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa401) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, &(0x7f0000000000)={0x0, 0x0, "ec9fe44d4dbe56a60274fcffffffffffffff14e315eeb406bfdd73835e57efa94b1a0275781c647aa7e3470c6028643b17832b10b386a6f73791011c26a9aa141f406e312295ee620a9a46577b9249b738fe7750bec83bf6ed5b67213fa7d6c0823fd154ed29ede1ff379742c3f0b46caa357d70ee438f901d7645c3f87e4b21482b76f2ad8eaac090272081f98fd2e3e5a63e008104df635e731a5bfcd942f4529517454618de595cd179445b4bdbf698b9986356f0ebf7d25a57774ef474f86a3ad24ae9f0bf94b99e6b87de5f79d383d05bb32701daed400785a49788f08caecc9e0c48a3740bbe6e1c1fd4f6cfdfe756bc00d08e36655c00"}) ioctl$USBDEVFS_CONTROL(r3, 0xc0185500, &(0x7f00000006c0)={0x2, 0xf, 0x4, 0x1, 0x0, 0x5, 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x8}, 0x3b) 1.601931919s ago: executing program 0 (id=3121): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000220000000000000000000000850000006d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000021007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={&(0x7f0000000300)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x2, [@func_proto={0x0, 0x3, 0x0, 0xd, 0x6000000, [{0xd, 0x40000000}, {0xd}, {0xb, 0x1}]}]}}, 0x0, 0x3e, 0x0, 0x9}, 0x28) connect$vsock_stream(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x1}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000100)='kmem_cache_free\x00', r2}, 0x18) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f00000007c0), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r3, 0xc0189374, &(0x7f0000000240)={{0x1, 0x1, 0x1018, 0xffffffffffffffff, {0x29}}, './file0\x00'}) connect$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) r4 = creat(&(0x7f0000000100)='./file0\x00', 0x3) r5 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) ioctl$USBDEVFS_IOCTL(r5, 0xc0105512, 0x0) ioctl$USBDEVFS_IOCTL(r5, 0x80045505, &(0x7f0000000040)=@usbdevfs_driver={0x1, 0x3, &(0x7f00000000c0)="eb77ec06c0e0af95d3be025b910dba5be03a7e6e323742e5686b5dbf7e9374afcb6ea65cc8a3"}) r6 = openat$autofs(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r6, 0xc018937e, &(0x7f0000000200)={{0x1, 0x1, 0x29}, './file0\x00'}) mknod$loop(&(0x7f0000000180)='./file0\x00', 0x6000, 0x0) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) writev(r7, &(0x7f0000000540)=[{&(0x7f00000004c0)="2518", 0x2}], 0x1) ioctl$BTRFS_IOC_BALANCE_CTL(r2, 0x40049421, 0x2) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x2008002, &(0x7f0000000080), 0x1, 0x55f, &(0x7f0000000d00)="$eJzs3c9vHFcdAPDvjH9t0zROoAeogAQoBBRlN960UdVLwwWEqkqIigPikBp7Y5nsZkN2XWoTCfdvAAkkTvAncEDigNQTB24cEELigBDlgFTAAsVIHBbN7Njd2rvNNl7v1t7PR5rMj/dmvu+ts/PevrXnBTC1LkXEdkTMR8RrEbFYHE+KJW52lyzfw50HK7s7D1aS6HRe/WeSp2fHoueczJPFNUsR8fWvRHw7ORy3tbl1Z7ler90v9ivtxr1Ka3Pr6npjea22Vrtbrd5YunHthevPVw+c+Ydzj1vXi41fvPPl9Ze/8etfffLt321/8ftZsc4Wab31GKVu1ef242RmI+Ll4wg2ATPFen7C5eDxpBHxkYj4TP7+X4yZ/H8nAHCadTqL0Vns3R+gNDAFADhh0nwMLEnLEZGmRSeg3B3DezrOpPVmq33ldnPj7mp3rOx8zKW31+u1axcW/vTdPPNcku0v5Wl5er5fPbB/PSIuRMSPFp7I98srzfrqZLo8ADD1nuxt/yPiPwtpWi4PdWqfb/UAgBOjNOkCAABjp/0HgOmj/QeA6TNE+1982b997GUBAMbD538AmD7afwCYPtp/AJgqX3vllWzp7BbPv159fXPjTvP1q6u11p1yY2OlvNK8f6+81myu5c/saTzqevVm897Sc7HxRqVda7Urrc2tW43mxt32rfy53rdqc2OpFQDwfi5cfOuPSURsv/hEvkTPXA7aajjd0hHmAk6WmaOcrIMAJ5rZvmB6DdWE552E3x57WYDJ6Psw71Lfzff6yQcI4veM4EPl8seHH/83xzOcLh9wZP/3xzJJPjARjzf+/9LIywGMn/F/mF6dTnJwzv/5/SQA4FQ6wq/wdX4wqk4IMFGPmsx7JN//AwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwClzNiK+E0lazucCT7N/03I54qmIOB9zye31eu1aRJyLixExt5DtL0260ADAEaV/T4r5vy4vPnv2YOp88t+FfB0R3/vpqz9+Y7ndvr+UHf/X/vGFvenDqu+ed4R5BQGA4f11mEx5+10t1j0f5B/uPFjZW46xjIe886X9yUdXdnce5Es3ZTY6nU4nopT3Jc78O4nZ4pxSRDwTETMjiL/9ZkR8rF/9k3xs5Hwx82lv/ChiPzXW+Ol74qd5WnedvXwfHUFZYNq8ld1/bvZ7/6VxKV/3f/+X8jvU0eX3v1LE3r1vtyf+bBFppk/87D1/adgYz/3mq4cOdha7aW9GPDPbL36yHz8ZEP/ZIeP/+ROf+uFLA9I6P4u4HP3j98aqtBv3Kq3NravrjeW12lrtbrV6Y+nGtReuP1+t5GPUlb2R6sP+8eKVc4PKltX/zID4pb71n98/93ND1v/n/3vtW59+d3fhYPwvfLb/z//pvvG7sjbx80PGXz7zy4HTd2fxVwfU/1E//ytDxn/7b1urQ2YFAMagtbl1Z7ler90/0kb2KXQU1zm0kRVxuMx73cXBeYoMN9/vOn+JfGNEL8uAjawzNkzmueN6VY99Y3a/rzjaK38zu+KYq5OOvBZH2ng4rliTuR8B43OoeQQAAAAAAAAAAAAAAD50xvGnS5OuIwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKfX/wMAAP//8RXBxA==") (fail_nth: 4) r8 = signalfd(r6, &(0x7f0000000000), 0x8) ioctl$sock_SIOCGPGRP(r4, 0x8904, &(0x7f00000000c0)=0x0) ioctl$BLKTRACESETUP(r8, 0xc0481273, &(0x7f0000000140)={'\x00', 0x7, 0xffffffff, 0x3, 0x3, 0x6, r9}) write$UHID_CREATE(r4, &(0x7f0000000800)={0x0, {'syz1\x00', 'syz1\x00', 'syz1\x00', &(0x7f0000000580)=""/228, 0xe4, 0x0, 0x6, 0x8, 0xa, 0x1ff}}, 0x120) 1.389685026s ago: executing program 0 (id=3122): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0xb, &(0x7f0000000080)=@framed={{0x18, 0x3, 0x0, 0x18}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @initr0, @generic={0x65}, @initr0={0x18, 0x0, 0x0, 0x0, 0x20000000}, @exit, @alu={0x4, 0x0, 0x9, 0x3, 0x0, 0x2, 0xfffffffffffffffc}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x45}, 0x94) 1.375348177s ago: executing program 0 (id=3123): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000007b00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) sendmsg$nl_xfrm(r0, &(0x7f0000001680)={0x0, 0x0, 0x0}, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) bpf$MAP_CREATE(0x0, 0x0, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x8}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020700000000000002030207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000100850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="01000000080000000500000007"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300), &(0x7f0000000100), 0x3f, r5}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r5, &(0x7f0000000340), &(0x7f00000004c0)=""/192}, 0x20) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000600000005"], 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a00000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r7}, 0x10) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01080000000000000000020000000900020073797a2a0000000008000440000000000900010073797a3000000000080003400000000a14000000110001"], 0x64}}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f0000000180)={0x0, 0x51, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[], 0x74}}, 0x0) 1.262559357s ago: executing program 2 (id=3124): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0a000000040000000c0000000b"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000006020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000003000000b70300000000ecff850000000400000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_CREATE(0x0, 0x0, 0x48) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000001400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x30, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xffffffff}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x98}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) close_range(r2, 0xffffffffffffffff, 0x0) 1.260649197s ago: executing program 3 (id=3125): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000030000000000000000000400b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b705000008000000850000006900000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$int_in(r1, 0x5421, &(0x7f0000000100)=0x100000001) setsockopt$inet_tcp_int(r1, 0x6, 0x1e, &(0x7f0000000180)=0x1, 0x4) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e20, @dev}, 0x10) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0xff, 0x0, 0x1}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0}, 0x94) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r3 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0xb76e}, 0x100002, 0x0, 0xfffffffc, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0, 0x800, 0x0, 0x0, 0x0, 0x18, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x200a}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r4}, &(0x7f0000000180), &(0x7f00000001c0)=r3}, 0x20) syz_clone3(&(0x7f0000000780)={0x1c3002480, 0x0, 0x0, 0x0, {0x2b}, 0x0, 0x0, 0x0, 0x0}, 0x58) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r5}, 0x10) close(r1) 1.10603296s ago: executing program 2 (id=3127): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="070000000400000008020000d9"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000200000850000001b000000b70000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='kfree\x00', r1}, 0x18) r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_usb_connect$uac1(0x0, 0x71, &(0x7f0000000080)=ANY=[], 0x0) close_range(r2, 0xffffffffffffffff, 0x200000000000000) 1.10143483s ago: executing program 3 (id=3128): bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000140)=@newtaction={0xa0, 0x30, 0x9, 0x0, 0x0, {}, [{0x8c, 0x1, [@m_bpf={0x88, 0x1, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{}, {0x0, 0x0, 0x0, 0xffffffff}, {0x3, 0x4, 0x20, 0x1000000}, {0x0, 0x2}, {0x0, 0x0, 0x0, 0x2}, {}, {0x3}]}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x0, 0x7, 0x4}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa0}}, 0x0) (fail_nth: 7) 702.091292ms ago: executing program 3 (id=3129): socket$nl_generic(0x10, 0x3, 0x10) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(0xffffffffffffffff, 0x40a85321, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) socket$packet(0x11, 0xa, 0x300) socket$packet(0x11, 0xa, 0x300) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r0 = socket$inet6(0xa, 0x800000000000002, 0x0) openat$binfmt_register(0xffffffffffffff9c, 0x0, 0x1, 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000001800ff0f00000000001b0000850000006d000000850000002300000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x10) writev(r1, 0x0, 0x0) syz_usb_connect(0x2, 0x2e3, &(0x7f0000000880)={{0x12, 0x1, 0x200, 0x68, 0x3b, 0x2, 0x10, 0x59f, 0x1061, 0x8844, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d1, 0x1, 0xd, 0x2, 0x40, 0xac, [{{0x9, 0x4, 0xe3, 0x44, 0xb, 0xf5, 0x9e, 0xfa, 0x81, [@generic={0x7b, 0x5, "ce767c079e0b8d86e58c5db24fd3c31e8bfc4fb7fda126c4fd938676acd6bcbe9407ea8ddfae4de4c8ffc45ff9ca39749c4e21123749fe823f4e940359498124fc53513378d9f96a22cbc76d93c31fbba433f9a6d6cad6778280e96d874628e0ccc64716cb3078bf121a9f9cccc925deb31015f42e7ab9dd67"}], [{{0x9, 0x5, 0x7, 0x8, 0x8, 0x3f, 0xa3, 0x1, [@generic={0x1c, 0x10, "052a5f7059bd07c243ea58ff04901549837904b4bbebf9cf4898"}, @uac_iso={0x7, 0x25, 0x1, 0x2, 0x3, 0x4}]}}, {{0x9, 0x5, 0x2, 0x0, 0x40, 0xc0, 0x40, 0x8, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0x8, 0x1000}]}}, {{0x9, 0x5, 0x80, 0x0, 0x8, 0x8, 0x7, 0x10, [@generic={0xdb, 0xe, "8d3c6127aa938979078756ba49243d9c9d065e15a6d6d1ffb19d21ba8c69d503fead135557c636f2515818d1d6c6fc4b124179b348d71d4da8a975ae980e67278cde79ff1ee6c1849e85528bee31efd27393d4000d776db7aaa79768544f893ed1820d75b36143d533435af6b954627f45f61aae603ee73e8d3f2d7f4b6f18341bf10bf8418e5a5a2aeaf2be11e4ff9a605da2a1a0c56c333472aab897b785c066e6b63aac7e18d0df54fe17e61efb51433ccb4d7f34218186e262f4d5ef67627a7fcb4c2263ffa41138b2ae5782d2baed96abb314a7c28d0f"}]}}, {{0x9, 0x5, 0xf, 0x8, 0x400, 0x0, 0x2, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x40, 0x6}, @uac_iso={0x7, 0x25, 0x1, 0x81, 0x9, 0x30}]}}, {{0x9, 0x5, 0xc, 0x10, 0x10, 0x0, 0x6, 0x9}}, {{0x9, 0x5, 0x4, 0x1, 0x620, 0x9, 0x6, 0xd2, [@generic={0x96, 0x21, "aebaf95d6536b390a44171138d747e0eead439f6c518abee427aa859a164bb1a09d4f4ff4b0f1cf9627053dc6c07f90ae69991f3a83a020f12eb8c150eb7538f39921b02da6a01aa15623f881525e60c16e5679f8123b4a3efba86532f08e8c3fce1572f64e42ee4f6e94b3ecca794bb2801093520598bd17682d3586118faf699af81d64a02e02f2c185b7e7909668d4d73060b"}, @generic={0x23, 0x22, "f8f705d27aaf42120333bfea3f28e2a14045144feba84b8b069a766dca02430dcb"}]}}, {{0x9, 0x5, 0x80, 0x4, 0x10, 0x4, 0x0, 0xea}}, {{0x9, 0x5, 0xb, 0x0, 0x400, 0x8, 0x9, 0x6, [@uac_iso={0x7, 0x25, 0x1, 0x81, 0x0, 0x80}]}}, {{0x9, 0x5, 0x2, 0xc, 0x40, 0x1, 0x9, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x81, 0x3ff}, @uac_iso={0x7, 0x25, 0x1, 0x80, 0x2, 0x894}]}}, {{0x9, 0x5, 0x1, 0x3, 0x40, 0x7, 0x2, 0x2}}, {{0x9, 0x5, 0xd, 0x10, 0x400, 0x9e}}]}}]}}]}}, &(0x7f0000000c80)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x310, 0x6, 0x7c, 0x2, 0xff, 0x7}, 0x29, &(0x7f0000000300)={0x5, 0xf, 0x29, 0x1, [@ssp_cap={0x24, 0x10, 0xa, 0x10, 0x6, 0x100, 0xf, 0x1, [0x0, 0xc0, 0x30, 0x3fc0, 0xf, 0x3e80]}]}, 0x6, [{0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x445}}, {0x65, &(0x7f0000000380)=@string={0x65, 0x3, "780f9595e951ce7ddbe2ac8d311e52a408770c5facad4278f50076b994e077040d79bb35dd5e293b63b8ece6ebb696e3109ef69c244d3597b9e3352162b5d830d7e3ad72b590a63cf0b065d52d3903ba0bcd48a5656a7eb3762869a07610185e63eb47"}}, {0x4, &(0x7f00000006c0)=@lang_id={0x4, 0x3, 0x81a}}, {0x4, &(0x7f0000000700)=@lang_id={0x4, 0x3, 0xc1a}}, {0x9a, &(0x7f0000000740)=@string={0x9a, 0x3, "9274322b8077d59351706312de1d758ea5e30e42a2a0302ff85f40d5704e3cf695562a52498af3c76729c14eee8ec3226dc5f56a8b2dd63291abb03f60052e154f75bf3c553c84a754df738126329f2176d4405902d43b15925dc65adfd6592c876e2d63cb51d989e4c333cf81f4f7c41ff60003a7ce16e22534620391698bec6023f03ef2bb7d6d44c1d6e100de5351ea8d11a4a88691b5"}}, {0x87, &(0x7f0000000bc0)=@string={0x87, 0x3, "38e7cd3ac2bfd132534fa73fec53e4840e9713a07170a74975be733f7696091d5b3ad907ff984a31372818814dfad9a43a028433d4b844b93cfd1e520f43138d7606e69444290e4023401f6cb838a6d26b2ee6cbe4fd0dd65450421e7037f889a4206cae587063032ef8a3655c444c509803451d7f19b32019c3668474316157b150e2803e"}}]}) sendmmsg$inet6(r0, &(0x7f0000000080)=[{{&(0x7f0000000400)={0xa, 0x4e23, 0x1, @mcast2}, 0x1c, 0x0}}], 0x1, 0x0) 494.06438ms ago: executing program 0 (id=3130): r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x34120, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10000, 0x0, 0x2, 0x0, 0x88}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="040000000400000004000000"], 0x48) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r1) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="180000000000000000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x5, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000008c0)={r2, 0xe0, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x26, 0x0, &(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x73, 0x0, 0x0, 0x10, &(0x7f0000000640), 0x0, 0x0, 0x88, 0x8, 0x0, 0x0}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x11, 0xc, &(0x7f0000000900)=ANY=[], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mknod$loop(&(0x7f0000000080)='./file0\x00', 0x100000000000600d, 0x0) pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240), 0x21004a, &(0x7f0000000a00)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r5, @ANYBLOB="cbc6cd5f8ff138062e20755080ebaa7f5441e0b90cebbf004d702c86d46001000000000000b6baff5042181dfee6a9dcff0211d503deff943d0eba1432832f003c9efbd43cb357e352ff70269f4817215421ab5e36cdb58051a61cd74efebd992cf5f0cc79f67eb9e0123d9eaa00e2945c202ded2fe33d89", @ANYRESHEX=r6, @ANYBLOB=',noxattr,\x00']) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r4}, 0x10) r7 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0x7, 0x0, &(0x7f0000000540)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001580)={&(0x7f0000000000)='kmem_cache_free\x00', r8}, 0x18) socket$inet(0x10, 0x3, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0xa4, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, 0x0, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_FLAGS={0x8, 0xa, 0x2}, @TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], 0x0, [0x5, 0x4, 0x2, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x8]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x4000000}]}]}]}}]}, 0xa4}}, 0x0) bind$tipc(0xffffffffffffffff, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43}}, 0x10) sendmsg$NFQNL_MSG_CONFIG(r9, &(0x7f0000000700)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000680)={0x2c, 0x2, 0x3, 0x801, 0x0, 0x0, {0x7, 0x0, 0x2}, [@NFQA_CFG_QUEUE_MAXLEN={0x8, 0x3, 0x1, 0x0, 0x81}, @NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x5}, @NFQA_CFG_CMD={0x8, 0x1, {0x3, 0x0, 0x3}}]}, 0x2c}, 0x1, 0x0, 0x0, 0xc000}, 0x900) r10 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r10, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x0, 0x3, 0x3}, 0x10) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x4, 0x3, 0x3}, 0x10) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000008c0), 0x58, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x20) r11 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SETSEL(r11, 0x5410, &(0x7f0000000100)) ioctl$TIOCSETD(r11, 0x5423, &(0x7f0000000040)=0x6) sendmsg$netlink(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000004c0)=ANY=[@ANYBLOB="140100002800010004000000f8dbdf250301f2800c00180008ac0f00000000001400010000000000000000000000ffffac14142d50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe96a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be0400e90000bdf6161f672c02171c14e131ea355eb78c0aae7f23a9084beb553adeddc9d73c07e4377853d137cf0738cad2d92bdc"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) 376.440159ms ago: executing program 4 (id=3131): r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x34120, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x4000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000008c0)={0x18, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="1802000000000000"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x12}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r2}, 0x10) r3 = socket$packet(0x11, 0x2, 0x300) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) bind$packet(r3, &(0x7f0000000000)={0x11, 0x3, r5, 0x1, 0x82, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x19}}, 0x14) 315.740375ms ago: executing program 0 (id=3132): socket(0x10, 0x3, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3f8, 0x0, 0x32}, 0x9c) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x100202, 0x0, 0xfffffffb}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x13, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r3}, &(0x7f0000000180), &(0x7f00000001c0)=r2}, 0x20) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r4}, 0x10) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2, 0xfffffffc}, 0x1c) sendto$inet6(r1, 0x0, 0x8dff, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x18115, @rand_addr, 0x983a}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0xfee4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 314.982915ms ago: executing program 4 (id=3133): bpf$MAP_CREATE(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00', r0}, 0x10) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r1, &(0x7f0000005d80)=[{{&(0x7f0000000000)={0xa, 0x4e24, 0x0, @remote, 0x9}, 0x1c, 0x0, 0x0, &(0x7f00000020c0)=ANY=[@ANYBLOB="38020000000000002900000036000000004300000000000004013f040100c910ff010000000000000000000000000001c910fc0000000000000000000000000000000001000740000000000e07010101000000010000000200000000000000000000000000000001000000010000002000000000000000ffffffff00000000ffffffffffffff7f06aeb07c1c192077cc9e7c45705803ad5588ca8b194d23f748fe792cfa3d32221f25d73b8ffe64a4ddda6efcfb7483b588194d29c7a04395d8500965a9a1d07879040c44db1d5d6f618d2ab920f0bf168ddc9acc6a51edd1230760d4ae8bf30f5f82a78e8114849ee8e37364560400000035bfa8197ef2ba99103ee5f5aae28ec5c8e2675db11530f5c466d55f2244d479dc653c854406155eada3eaeb90d39149b8d13bab75a9bd1452c8c76284b9ddfbeff41344e64f1771d78a706e1c5a6d63f1c954e24a1e73f75c26e9f09ec9b606cc3470f11c4842db651926bd2263a4a0a8fe80de8b2f9cb176e51819d5f4d10a5d1f0488d5e46953fbfd750f6137fbebe89a8d462158a87f9622355104b4f68d7a6d3ad85c373ea52a25afad37ffb743a5c361158087904b09fcc806d032bac00ee0e0251fc032446e45a3e12417ff4703526ffc45f71567857777927903799e0ba453334186009d22e38099c67b5350c7e82136bba947a18fb61d36fcba1f9efe3d79485d06252702833dc8ee417f40bb9064878fb89dd75a49135e5df148c4ad1e1d5626b44c8112d822f4c9a05e693fd5ae5595627f8684016b37a2bf6d0040030000000000002900000037000000006500000000000000fb1a63687c244e6df3aecb13d6eb957495b669cc032f6d0a11a5e16eed9937b046c9dc1a61dcf9754b767df4735c3f8c37b4d5cd15a99c5a19cc62c921ad4e90d6e3695e85000000a53600d5031b5735acafb556e22279975f958ad437c76573e544506e58455772eb11493af933099a5dc7e9e0c8b907e68e23e59d7b94bc774309e2047132758b60955301f277a9032b0bc47e660b243e9e2126733f13ab99055a0999068ada35a38d105a5efe6c7115774effe28695ecae3944413b7764eefde26ed571d857b2cb2dd1b2a4a84c1fec0799cf90f57f7a6d35e2b60cd425b9372ae4a27f453e5d7da2eacd3b98cdb10cec9152d5829c2511eb0f9600a0cd280f3d08849b6cd43d25e3dcd62f7c7dee6123a2682daf4aa9a856b31e9204c5c2b80b84dbeec05d93a64a550f1ebc326488cd620c6fe1aa266a0ce5b24be03b5037786e037cc85ed61f362e081fb694e12e54fcb9eb0f86d6d91fd159023a073278f84d6ada8f9aa25ec223d268f3291b25392c941740932bd1a82f40a8fc586db23d2f6240ce883e3c1dc1e0d07fc3aa73a9ac82a1538d129c9e66cb6a8100abe95bc4064581e8c01ce65ba3ea751db5d8c0a1173fe62b2fd2d415042a97ade4d274a466b6d997eed6bf5d7a305ead804c36b9e1c314b26676ed83412417610d3cf4d07e5b24cf3de9c790ae93850e0f8bba047b710cf340c78a80cef5f6665a647681ff5f7b6ecce8ab65e26406b6a6e0e72ff8501c545bffc00f034dc3a5b251390ae68bb61d936dc9a24e6f66c72e7911c51c716dfd4304566fb32e6c2745d232f990d0bbe0ddf9dc58398dda292c07b16da766a37c60bd9993b4f21e641036a8afa2ccdb47d7990d5a007faccb2f86664179f2e229723b"], 0x590}}], 0x1, 0x8008801) sendmmsg$inet6(r1, &(0x7f0000019880)=[{{0x0, 0x0, &(0x7f0000019740)=[{&(0x7f0000019940)='i', 0x1}], 0x27}, 0x12}], 0x1, 0x2604082c) 258.148909ms ago: executing program 4 (id=3134): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1b0000000000000000000000008000"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/vmallocinfo\x00', 0x0, 0x0) read$hiddev(r2, &(0x7f00000000c0)=""/4092, 0xffc) 257.741429ms ago: executing program 1 (id=3101): r0 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000007b00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000004c0)='mm_page_free\x00', r1, 0x0, 0x1d6}, 0x18) r2 = gettid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000b28000)=0x3) fcntl$setsig(r3, 0xa, 0x12) poll(&(0x7f0000b2c000)=[{r4}], 0x2c, 0xffffffffffbffff8) socket$inet6(0xa, 0x3, 0x3c) ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0xc0c0583b, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0x1) r5 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="14"], &(0x7f0000000180), 0x1200) open_by_handle_at(0xffffffffffffff9c, &(0x7f00000000c0)=ANY=[], 0x0) dup2(r3, r4) fcntl$setown(r3, 0x8, r2) tkill(r2, 0x13) fcntl$notify(r0, 0x402, 0x8000001f) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x11, 0x3, &(0x7f0000000740)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400}}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000100)='kmem_cache_free\x00', r6}, 0x18) close_range(r0, 0xffffffffffffffff, 0x0) 233.896091ms ago: executing program 2 (id=3135): bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000b28000)=0x3) poll(&(0x7f0000b2c000)=[{}], 0x2c, 0xffffffffffbffff8) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="190000000400", @ANYBLOB], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18060000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000003000000b70300000000000085000000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000400850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0x3100, 0x3100, &(0x7f0000000000), 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000080)={0x18, 0x0, {0xfffe, @remote, 'veth0_virt_wifi\x00'}}, 0x1e) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)=@getqdisc={0x28, 0x26, 0x400, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x10, 0x9}, {0xfff4, 0x5}, {0xa, 0x3}}, [{0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x8000) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001100010100"/20, @ANYRES32=r5], 0x20}, 0x1, 0x0, 0x0, 0x80d5}, 0x0) 185.558445ms ago: executing program 3 (id=3136): socket$nl_route(0x10, 0x3, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000003200)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000500)={0xffffffffffffffff, 0xe0, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780), ""/16, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x0, 0x800d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x77, 0x8, 0xfffffffffffffe1d, 0x0}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000020850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x19, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000020100008500000043"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffa4, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, &(0x7f0000000980), 0x0, 0x2f, 0xe8034000, 0x0, 0x0, &(0x7f0000000000), 0x0, 0x5dc}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000580)={&(0x7f0000000540)='fib6_table_lookup\x00', r2}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000001000000b7040000000000008500000033000000180100002020752500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb70200001f000000b7"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip6gre0\x00', 0x200}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000240), 0x12) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x89f1, &(0x7f0000000080)) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000880)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000100)='kmem_cache_free\x00', r4}, 0x18) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x4e0, 0x0, 0x9403, 0x0, 0x2e0, 0x2c0, 0x410, 0x3d8, 0x3d8, 0x410, 0x3d8, 0x3, 0x0, {[{{@uncond, 0x0, 0x298, 0x2e0, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x1, 0x0, 'syz0\x00'}}, @common=@inet=@recent0={{0xf8}, {0x0, 0xffffffff, 0x1, 0x0, 'syz0\x00'}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@loopback, 'virt_wifi0\x00'}}}, {{@ipv6={@empty, @local, [], [], 'ip6erspan0\x00', 'bridge_slave_1\x00'}, 0x0, 0xd0, 0x130, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@remote}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x540) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x3) ioctl$TIOCSSOFTCAR(r0, 0x541a, &(0x7f0000000100)=0x80000000) socket$nl_route(0x10, 0x3, 0x0) lsm_get_self_attr(0x67, 0x0, &(0x7f0000000080), 0x0) r6 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, r6, {0x1}}, './file0\x00'}) sendmsg$IPVS_CMD_SET_CONFIG(r7, &(0x7f0000000480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000440)={&(0x7f0000000300)=ANY=[@ANYBLOB="d0000000", @ANYRES16=0x0, @ANYBLOB="10002abd7000fddbdf250c00000004000280080004000400000024000380060007004e2400000800010002000000060004000500000005000800c00000001400038008000500ac1414aa06000400d20200003c0003800800010001000000140006002001000000000000000000000000000114000600fe600000002ed189e10b00000000000000000000bb06000400ffff00003c0002800800030004000000080003000200000006000e004e240000080009000300000006000b00020000000800030002000000080006"], 0xd0}, 0x1, 0x0, 0x0, 0x48010}, 0x0) ioctl$sock_ifreq(r6, 0x8990, &(0x7f0000000000)={'bond0\x00', @ifru_names='ip6tnl0\x00'}) r8 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) 79.058794ms ago: executing program 4 (id=3137): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0a000000040000000c0000000b"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000006020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000003000000b70300000000ecff850000000400000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_CREATE(0x0, 0x0, 0x48) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000001400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x30, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xffffffff}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x98}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) close_range(r2, 0xffffffffffffffff, 0x0) 52.970176ms ago: executing program 4 (id=3138): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = socket$inet_sctp(0x2, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) sendmsg$inet_sctp(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f00000001c0)='F', 0x1}, {0x0, 0xe0}], 0x2, &(0x7f00000000c0)=[@sndinfo={0x20, 0x84, 0x2, {0xa, 0x4, 0x28, 0x200000b, r2}}], 0x20, 0x2400e044}, 0x0) 0s ago: executing program 4 (id=3139): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000005"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000200)='mm_vmscan_throttled\x00', r2, 0x0, 0x2}, 0x18) r3 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r3, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x1}, 0x8) sendto$inet6(r3, &(0x7f00000005c0)="f5", 0x1, 0x0, &(0x7f0000000240)={0xa, 0x4e20, 0xfffffffc, @rand_addr=' \x01\x00'}, 0x1c) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r3, 0x84, 0x7c, &(0x7f00000002c0)={0x0, 0x0, 0x4}, 0x8) r4 = socket$kcm(0x2, 0xa, 0x2) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='mountinfo\x00') sendfile(r5, r5, &(0x7f0000000000)=0x2eb4, 0x2000007ff) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000340)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_REGISTER_BEACONS(r5, &(0x7f0000000400)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, r6, 0x400, 0x70bd25, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x66}, @val={0x8, 0x3, r7}, @void}}, ["", "", "", "", "", "", "", "", "", ""]}, 0x24}}, 0x4000) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000080)="2e9b3d0007e03dd65193dfb6c575963f86ddf06712e9001c2f8db0049d90491ceaebfd26d4eef23248000000f858dbb8a19052343f", 0x35}, {&(0x7f0000000300)="051a0031ee6adba06b", 0x9}], 0x2) kernel console output (not intermixed with test programs): 3.2339': attribute type 1 has an invalid length. [ 233.351421][T10420] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 233.360631][T10420] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 233.391870][T10427] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 233.400531][T10427] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 235.142418][T10469] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 235.149022][T10469] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 235.156812][T10469] vhci_hcd vhci_hcd.0: Device attached [ 235.163122][T10473] vhci_hcd: cannot find the pending unlink 6 [ 235.246049][T10473] vhci_hcd: connection closed [ 235.246974][T10018] vhci_hcd: stop threads [ 235.256054][T10018] vhci_hcd: release socket [ 235.260459][T10018] vhci_hcd: disconnect device [ 236.229400][T10482] lo speed is unknown, defaulting to 1000 [ 236.262126][T10482] lo speed is unknown, defaulting to 1000 [ 236.468656][T10485] __nla_validate_parse: 15 callbacks suppressed [ 236.468679][T10485] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2365'. [ 236.489231][T10484] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2365'. [ 236.528327][T10490] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2367'. [ 236.598471][T10498] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 236.611252][T10498] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 236.631722][T10503] netlink: 268 bytes leftover after parsing attributes in process `syz.2.2370'. [ 236.642754][T10490] IPv6: addrconf: prefix option has invalid lifetime [ 236.846564][T10518] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2370'. [ 236.875155][T10518] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2370'. [ 237.075151][T10519] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 237.084738][T10519] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 237.241185][T10523] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2375'. [ 237.337621][T10525] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 237.346241][T10525] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 237.504673][T10532] netlink: 268 bytes leftover after parsing attributes in process `syz.2.2377'. [ 237.697567][T10538] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2377'. [ 237.730670][T10538] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2377'. [ 238.745691][T10559] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 238.752225][T10559] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 238.759758][T10559] vhci_hcd vhci_hcd.0: Device attached [ 238.835488][T10561] vhci_hcd: connection closed [ 238.835590][ T6970] vhci_hcd: stop threads [ 238.844587][ T6970] vhci_hcd: release socket [ 238.849010][ T6970] vhci_hcd: disconnect device [ 238.949371][T10566] lo speed is unknown, defaulting to 1000 [ 238.975435][T10566] lo speed is unknown, defaulting to 1000 [ 240.018295][T10592] netlink: 'syz.2.2395': attribute type 1 has an invalid length. [ 241.254972][T10627] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 241.270709][T10636] netlink: 'syz.3.2407': attribute type 1 has an invalid length. [ 241.283561][T10627] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 241.329314][T10647] netlink: 'syz.1.2410': attribute type 13 has an invalid length. [ 241.348803][T10647] gretap0: refused to change device tx_queue_len [ 241.355397][T10647] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 241.371048][ T6804] lo speed is unknown, defaulting to 1000 [ 241.377026][ T6804] syz0: Port: 1 Link DOWN [ 241.597833][T10670] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 241.607466][T10670] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 242.087360][T10681] netlink: 'syz.3.2419': attribute type 1 has an invalid length. [ 242.155060][T10694] __nla_validate_parse: 13 callbacks suppressed [ 242.155081][T10694] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2422'. [ 242.275284][T10696] siw: device registration error -23 [ 242.840295][T10700] IPv6: addrconf: prefix option has invalid lifetime [ 242.908501][T10698] siw: device registration error -23 [ 242.973961][T10704] netlink: 'syz.1.2423': attribute type 13 has an invalid length. [ 243.192982][T10704] gretap0: refused to change device tx_queue_len [ 243.199467][T10704] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 243.239266][ T29] audit: type=1326 audit(1754002721.215:3093): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10711 comm="syz.2.2427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f5131935b27 code=0x7ffc0000 [ 243.262768][ T29] audit: type=1326 audit(1754002721.215:3094): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10711 comm="syz.2.2427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f51318dad69 code=0x7ffc0000 [ 243.286179][ T29] audit: type=1326 audit(1754002721.215:3095): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10711 comm="syz.2.2427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f5131935b27 code=0x7ffc0000 [ 243.309712][ T29] audit: type=1326 audit(1754002721.215:3096): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10711 comm="syz.2.2427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f51318dad69 code=0x7ffc0000 [ 243.333237][ T29] audit: type=1326 audit(1754002721.215:3097): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10711 comm="syz.2.2427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f5131935b27 code=0x7ffc0000 [ 243.356777][ T29] audit: type=1326 audit(1754002721.215:3098): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10711 comm="syz.2.2427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f51318dad69 code=0x7ffc0000 [ 243.380305][ T29] audit: type=1326 audit(1754002721.215:3099): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10711 comm="syz.2.2427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f5131935b27 code=0x7ffc0000 [ 243.403719][ T29] audit: type=1326 audit(1754002721.215:3100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10711 comm="syz.2.2427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f51318dad69 code=0x7ffc0000 [ 243.427205][ T29] audit: type=1326 audit(1754002721.215:3101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10711 comm="syz.2.2427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f5131935b27 code=0x7ffc0000 [ 243.450608][ T29] audit: type=1326 audit(1754002721.215:3102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10711 comm="syz.2.2427" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f51318dad69 code=0x7ffc0000 [ 243.476074][T10712] FAULT_INJECTION: forcing a failure. [ 243.476074][T10712] name failslab, interval 1, probability 0, space 0, times 0 [ 243.488821][T10712] CPU: 1 UID: 0 PID: 10712 Comm: syz.2.2427 Not tainted 6.16.0-syzkaller-08685-g260f6f4fda93 #0 PREEMPT(voluntary) [ 243.488854][T10712] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 243.488910][T10712] Call Trace: [ 243.488918][T10712] [ 243.488927][T10712] __dump_stack+0x1d/0x30 [ 243.488989][T10712] dump_stack_lvl+0xe8/0x140 [ 243.489008][T10712] dump_stack+0x15/0x1b [ 243.489023][T10712] should_fail_ex+0x265/0x280 [ 243.489056][T10712] ? get_mountpoint+0x17e/0x370 [ 243.489077][T10712] should_failslab+0x8c/0xb0 [ 243.489171][T10712] __kmalloc_cache_noprof+0x4c/0x320 [ 243.489203][T10712] get_mountpoint+0x17e/0x370 [ 243.489224][T10712] attach_recursive_mnt+0xfc/0x14e0 [ 243.489274][T10712] ? propagation_would_overmount+0x44/0x110 [ 243.489310][T10712] do_move_mount+0x523/0x560 [ 243.489343][T10712] vfs_move_mount+0x64/0x490 [ 243.489375][T10712] __se_sys_move_mount+0x3cd/0x450 [ 243.489447][T10712] __x64_sys_move_mount+0x67/0x80 [ 243.489504][T10712] x64_sys_call+0xcfe/0x2ff0 [ 243.489588][T10712] do_syscall_64+0xd2/0x200 [ 243.489734][T10712] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 243.489762][T10712] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 243.489793][T10712] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 243.489869][T10712] RIP: 0033:0x7f513193eb69 [ 243.489886][T10712] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 243.489905][T10712] RSP: 002b:00007f512ff9f038 EFLAGS: 00000246 ORIG_RAX: 00000000000001ad [ 243.489927][T10712] RAX: ffffffffffffffda RBX: 00007f5131b65fa0 RCX: 00007f513193eb69 [ 243.489938][T10712] RDX: ffffffffffffff9c RSI: 0000200000000140 RDI: 0000000000000003 [ 243.489950][T10712] RBP: 00007f512ff9f090 R08: 0000000000000262 R09: 0000000000000000 [ 243.489961][T10712] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 243.489972][T10712] R13: 0000000000000000 R14: 00007f5131b65fa0 R15: 00007ffc6761c0c8 [ 243.489992][T10712] [ 243.490445][T10715] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2428'. [ 243.635951][T10728] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 243.698335][T10736] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2435'. [ 243.699608][T10728] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 243.779285][T10744] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 243.787799][T10744] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 244.261848][T10756] netlink: 268 bytes leftover after parsing attributes in process `syz.3.2440'. [ 244.400858][T10765] netlink: 'syz.0.2444': attribute type 13 has an invalid length. [ 244.440569][T10765] gretap0: refused to change device tx_queue_len [ 244.447017][T10765] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 245.326786][T10756] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2440'. [ 245.336182][T10756] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2440'. [ 245.346933][T10769] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2445'. [ 245.385993][T10771] FAULT_INJECTION: forcing a failure. [ 245.385993][T10771] name failslab, interval 1, probability 0, space 0, times 0 [ 245.398653][T10771] CPU: 0 UID: 0 PID: 10771 Comm: syz.0.2446 Not tainted 6.16.0-syzkaller-08685-g260f6f4fda93 #0 PREEMPT(voluntary) [ 245.398690][T10771] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 245.398704][T10771] Call Trace: [ 245.398729][T10771] [ 245.398738][T10771] __dump_stack+0x1d/0x30 [ 245.398758][T10771] dump_stack_lvl+0xe8/0x140 [ 245.398775][T10771] dump_stack+0x15/0x1b [ 245.398789][T10771] should_fail_ex+0x265/0x280 [ 245.398817][T10771] should_failslab+0x8c/0xb0 [ 245.398863][T10771] kmem_cache_alloc_noprof+0x50/0x310 [ 245.398951][T10771] ? security_file_alloc+0x32/0x100 [ 245.398979][T10771] security_file_alloc+0x32/0x100 [ 245.399010][T10771] init_file+0x5c/0x1d0 [ 245.399037][T10771] alloc_empty_file+0x8b/0x200 [ 245.399118][T10771] path_openat+0x68/0x2170 [ 245.399206][T10771] ? _parse_integer_limit+0x170/0x190 [ 245.399236][T10771] ? _parse_integer+0x27/0x40 [ 245.399262][T10771] ? kstrtoull+0x111/0x140 [ 245.399325][T10771] ? kstrtouint+0x76/0xc0 [ 245.399404][T10771] do_filp_open+0x109/0x230 [ 245.399592][T10771] do_sys_openat2+0xa6/0x110 [ 245.399655][T10771] __x64_sys_creat+0x65/0x90 [ 245.399688][T10771] x64_sys_call+0x2d94/0x2ff0 [ 245.399709][T10771] do_syscall_64+0xd2/0x200 [ 245.399784][T10771] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 245.399810][T10771] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 245.399852][T10771] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 245.399873][T10771] RIP: 0033:0x7f335f26eb69 [ 245.399888][T10771] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 245.399908][T10771] RSP: 002b:00007f335d8cf038 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 [ 245.399952][T10771] RAX: ffffffffffffffda RBX: 00007f335f495fa0 RCX: 00007f335f26eb69 [ 245.399966][T10771] RDX: 0000000000000000 RSI: 0000000000000130 RDI: 0000200000000000 [ 245.399981][T10771] RBP: 00007f335d8cf090 R08: 0000000000000000 R09: 0000000000000000 [ 245.399994][T10771] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 245.400006][T10771] R13: 0000000000000000 R14: 00007f335f495fa0 R15: 00007fff6dcb41d8 [ 245.400024][T10771] [ 245.670902][T10780] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 245.679692][T10780] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 245.754200][T10795] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2453'. [ 245.798674][T10805] netlink: 'syz.1.2457': attribute type 13 has an invalid length. [ 245.806703][T10805] gretap0: refused to change device tx_queue_len [ 245.813076][T10805] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 245.893144][T10812] netlink: 268 bytes leftover after parsing attributes in process `syz.0.2459'. [ 246.097058][T10815] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2459'. [ 246.971462][T10823] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 246.978037][T10823] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 246.985712][T10823] vhci_hcd vhci_hcd.0: Device attached [ 246.996307][T10827] vhci_hcd: connection closed [ 246.996472][T10017] vhci_hcd: stop threads [ 247.005477][T10017] vhci_hcd: release socket [ 247.009884][T10017] vhci_hcd: disconnect device [ 247.073224][T10838] siw: device registration error -23 [ 247.291821][T10845] __nla_validate_parse: 3 callbacks suppressed [ 247.291837][T10845] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2470'. [ 247.502444][T10849] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2470'. [ 247.531129][T10849] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2470'. [ 247.574206][T10851] netlink: 268 bytes leftover after parsing attributes in process `syz.3.2471'. [ 248.158054][T10854] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2471'. [ 248.167483][T10854] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2471'. [ 248.507659][T10858] netlink: 'syz.4.2474': attribute type 13 has an invalid length. [ 248.528109][T10864] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 248.536932][T10864] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 248.546643][T10858] gretap0: refused to change device tx_queue_len [ 248.553094][T10858] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 248.672343][T10874] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 248.681143][T10874] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 249.200621][T10881] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2480'. [ 249.222657][T10888] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2482'. [ 249.257490][T10892] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2484'. [ 249.460697][T10896] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2484'. [ 249.870659][T10900] siw: device registration error -23 [ 250.786287][T10907] siw: device registration error -23 [ 251.032214][T10917] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 251.041725][T10917] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 251.210118][T10926] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 251.218717][T10928] netlink: 'syz.0.2492': attribute type 1 has an invalid length. [ 251.231157][T10926] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 251.775065][T10950] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(5) [ 251.781661][T10950] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 251.789221][T10950] vhci_hcd vhci_hcd.0: Device attached [ 251.795795][T10951] vhci_hcd: cannot find the pending unlink 6 [ 251.807660][T10951] vhci_hcd: connection closed [ 251.807782][T10017] vhci_hcd: stop threads [ 251.816817][T10017] vhci_hcd: release socket [ 251.821287][T10017] vhci_hcd: disconnect device [ 252.388553][T10969] __nla_validate_parse: 5 callbacks suppressed [ 252.388569][T10969] netlink: 268 bytes leftover after parsing attributes in process `syz.0.2504'. [ 252.676234][T10972] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2504'. [ 252.685795][T10972] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2504'. [ 253.122760][T10974] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2505'. [ 253.149575][T10976] netlink: 348 bytes leftover after parsing attributes in process `syz.2.2516'. [ 253.184472][T10979] openvswitch: netlink: Message has 6 unknown bytes. [ 253.286146][T10978] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2506'. [ 253.358380][T10985] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2516'. [ 253.401169][T10985] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2516'. [ 254.245271][T11001] netlink: 268 bytes leftover after parsing attributes in process `syz.2.2515'. [ 254.364671][T11004] netlink: 348 bytes leftover after parsing attributes in process `syz.1.2517'. [ 255.385934][T11013] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 255.392564][T11013] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 255.400143][T11013] vhci_hcd vhci_hcd.0: Device attached [ 255.408116][T11017] vhci_hcd: cannot find the pending unlink 6 [ 255.414681][T11017] vhci_hcd: connection closed [ 255.414896][T10018] vhci_hcd: stop threads [ 255.423936][T10018] vhci_hcd: release socket [ 255.428342][T10018] vhci_hcd: disconnect device [ 257.027383][T11043] IPv6: addrconf: prefix option has invalid lifetime [ 257.431044][T11059] siw: device registration error -23 [ 257.505639][T11063] __nla_validate_parse: 10 callbacks suppressed [ 257.505655][T11063] netlink: 348 bytes leftover after parsing attributes in process `syz.0.2532'. [ 257.904623][T11074] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2532'. [ 257.914860][T11074] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2532'. [ 258.570643][T11090] netlink: 268 bytes leftover after parsing attributes in process `syz.2.2541'. [ 258.666321][T11094] netlink: 'syz.3.2543': attribute type 1 has an invalid length. [ 258.686425][T11097] netlink: 268 bytes leftover after parsing attributes in process `syz.3.2544'. [ 258.780288][T11099] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2541'. [ 258.806695][T11099] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2541'. [ 258.911248][T11100] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2544'. [ 258.969241][T11100] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2544'. [ 259.163495][T11104] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2546'. [ 259.816921][T11114] siw: device registration error -23 [ 259.954689][T11104] IPv6: addrconf: prefix option has invalid lifetime [ 260.035673][T11118] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 260.060778][T11118] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 260.236089][T11125] netlink: 'syz.1.2554': attribute type 1 has an invalid length. [ 260.399795][T11136] netlink: 'syz.3.2558': attribute type 1 has an invalid length. [ 260.492009][T11140] IPv6: addrconf: prefix option has invalid lifetime [ 260.499008][T11143] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5) [ 260.505678][T11143] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 260.513190][T11143] vhci_hcd vhci_hcd.0: Device attached [ 260.561326][T11144] vhci_hcd: connection closed [ 260.561632][T10014] vhci_hcd: stop threads [ 260.570598][T10014] vhci_hcd: release socket [ 260.575062][T10014] vhci_hcd: disconnect device [ 260.728082][T11158] netlink: 'syz.0.2566': attribute type 1 has an invalid length. [ 260.935028][T11170] netlink: 'syz.0.2571': attribute type 1 has an invalid length. [ 261.477702][T11187] netlink: 'syz.4.2578': attribute type 1 has an invalid length. [ 261.910197][T11218] netlink: 'syz.0.2591': attribute type 1 has an invalid length. [ 263.191096][T11249] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 263.200251][T11249] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 263.213872][T11256] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(5) [ 263.220480][T11256] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 263.227981][T11256] vhci_hcd vhci_hcd.0: Device attached [ 263.234409][T11257] vhci_hcd: cannot find the pending unlink 6 [ 263.246196][T11257] vhci_hcd: connection closed [ 263.246332][T10014] vhci_hcd: stop threads [ 263.255365][T10014] vhci_hcd: release socket [ 263.259764][T10014] vhci_hcd: disconnect device [ 263.469188][T11260] netlink: 'syz.3.2604': attribute type 1 has an invalid length. [ 263.716869][T11272] netlink: 'syz.1.2609': attribute type 13 has an invalid length. [ 263.725221][T11272] gretap0: refused to change device tx_queue_len [ 263.731760][T11272] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 263.735150][T11274] __nla_validate_parse: 19 callbacks suppressed [ 263.735166][T11274] netlink: 268 bytes leftover after parsing attributes in process `syz.4.2610'. [ 263.791181][T11278] FAULT_INJECTION: forcing a failure. [ 263.791181][T11278] name failslab, interval 1, probability 0, space 0, times 0 [ 263.803940][T11278] CPU: 1 UID: 0 PID: 11278 Comm: syz.2.2612 Not tainted 6.16.0-syzkaller-08685-g260f6f4fda93 #0 PREEMPT(voluntary) [ 263.803968][T11278] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 263.803979][T11278] Call Trace: [ 263.803986][T11278] [ 263.803993][T11278] __dump_stack+0x1d/0x30 [ 263.804090][T11278] dump_stack_lvl+0xe8/0x140 [ 263.804111][T11278] dump_stack+0x15/0x1b [ 263.804129][T11278] should_fail_ex+0x265/0x280 [ 263.804218][T11278] ? tcf_proto_create+0x44/0x1a0 [ 263.804283][T11278] should_failslab+0x8c/0xb0 [ 263.804312][T11278] __kmalloc_cache_noprof+0x4c/0x320 [ 263.804349][T11278] tcf_proto_create+0x44/0x1a0 [ 263.804379][T11278] tc_new_tfilter+0x95c/0x10a0 [ 263.804455][T11278] ? __rcu_read_unlock+0x4f/0x70 [ 263.804490][T11278] ? ns_capable+0x7d/0xb0 [ 263.804544][T11278] ? __pfx_tc_new_tfilter+0x10/0x10 [ 263.804571][T11278] rtnetlink_rcv_msg+0x5fe/0x6d0 [ 263.804605][T11278] netlink_rcv_skb+0x120/0x220 [ 263.804631][T11278] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 263.804703][T11278] rtnetlink_rcv+0x1c/0x30 [ 263.804733][T11278] netlink_unicast+0x5c0/0x690 [ 263.804765][T11278] netlink_sendmsg+0x58b/0x6b0 [ 263.804805][T11278] ? __pfx_netlink_sendmsg+0x10/0x10 [ 263.804875][T11278] __sock_sendmsg+0x145/0x180 [ 263.804905][T11278] ____sys_sendmsg+0x31e/0x4e0 [ 263.804935][T11278] ___sys_sendmsg+0x17b/0x1d0 [ 263.804975][T11278] __x64_sys_sendmsg+0xd4/0x160 [ 263.805027][T11278] x64_sys_call+0x191e/0x2ff0 [ 263.805048][T11278] do_syscall_64+0xd2/0x200 [ 263.805082][T11278] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 263.805108][T11278] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 263.805194][T11278] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 263.805218][T11278] RIP: 0033:0x7f513193eb69 [ 263.805235][T11278] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 263.805252][T11278] RSP: 002b:00007f512ff9f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 263.805269][T11278] RAX: ffffffffffffffda RBX: 00007f5131b65fa0 RCX: 00007f513193eb69 [ 263.805317][T11278] RDX: 0000000020000000 RSI: 0000200000001040 RDI: 0000000000000004 [ 263.805329][T11278] RBP: 00007f512ff9f090 R08: 0000000000000000 R09: 0000000000000000 [ 263.805340][T11278] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 263.805352][T11278] R13: 0000000000000000 R14: 00007f5131b65fa0 R15: 00007ffc6761c0c8 [ 263.805368][T11278] [ 264.064043][T11280] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2610'. [ 264.081908][T11280] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2610'. [ 264.224543][T11289] netlink: 268 bytes leftover after parsing attributes in process `syz.0.2614'. [ 264.438815][T11293] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2614'. [ 264.448765][T11293] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2614'. [ 264.537150][T11298] netlink: 'syz.1.2616': attribute type 1 has an invalid length. [ 264.885391][T11302] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 264.894402][T11302] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 264.998999][T11314] netlink: 'syz.2.2622': attribute type 13 has an invalid length. [ 265.007072][T11314] gretap0: refused to change device tx_queue_len [ 265.013494][T11314] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 265.168100][T11324] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 265.177050][T11324] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 265.497581][T11336] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 265.504123][T11336] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 265.511709][T11336] vhci_hcd vhci_hcd.0: Device attached [ 265.519325][T11337] vhci_hcd: connection closed [ 265.519443][ T31] vhci_hcd: stop threads [ 265.528439][ T31] vhci_hcd: release socket [ 265.532848][ T31] vhci_hcd: disconnect device [ 265.774782][T11343] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2634'. [ 265.829476][T11343] IPv6: addrconf: prefix option has invalid lifetime [ 265.911328][T11347] netlink: 'syz.4.2635': attribute type 13 has an invalid length. [ 265.919458][T11347] gretap0: refused to change device tx_queue_len [ 265.925869][T11347] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 265.963434][T11352] netlink: 268 bytes leftover after parsing attributes in process `syz.4.2637'. [ 266.059523][T11358] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 266.068167][T11358] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 266.073849][T11357] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 266.084372][T11357] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 266.153694][T11368] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2637'. [ 266.163575][T11368] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2637'. [ 266.548550][T11378] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 266.557040][T11378] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 267.279845][ T29] kauditd_printk_skb: 72 callbacks suppressed [ 267.279860][ T29] audit: type=1400 audit(1754002745.265:3175): avc: denied { ioctl } for pid=11396 comm="syz.4.2650" path="socket:[30353]" dev="sockfs" ino=30353 ioctlcmd=0x7213 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 267.372767][T11407] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 267.381449][T11407] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 267.497645][T11412] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 267.506685][T11412] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 268.080322][T11426] netlink: 'syz.4.2659': attribute type 13 has an invalid length. [ 268.098943][T11426] gretap0: refused to change device tx_queue_len [ 268.105325][T11426] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 268.994146][T11458] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 269.002580][T11458] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 269.031494][T11463] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 269.040075][T11463] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 269.119825][T11475] netlink: 'syz.1.2675': attribute type 13 has an invalid length. [ 269.127940][T11475] gretap0: refused to change device tx_queue_len [ 269.134377][T11475] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 269.172531][T11479] __nla_validate_parse: 7 callbacks suppressed [ 269.172544][T11479] netlink: 268 bytes leftover after parsing attributes in process `syz.1.2677'. [ 269.368393][T11481] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2677'. [ 269.402910][T11481] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2677'. [ 269.826340][T11492] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2681'. [ 269.830571][ T29] audit: type=1400 audit(1754002747.805:3176): avc: denied { create } for pid=11491 comm="syz.4.2681" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=netlink_generic_socket permissive=1 [ 269.856675][ T29] audit: type=1400 audit(1754002747.805:3177): avc: denied { write } for pid=11491 comm="syz.4.2681" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=netlink_generic_socket permissive=1 [ 269.877738][ T29] audit: type=1400 audit(1754002747.805:3178): avc: denied { read } for pid=11491 comm="syz.4.2681" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=netlink_generic_socket permissive=1 [ 269.898684][ T29] audit: type=1400 audit(1754002747.805:3179): avc: denied { create } for pid=11491 comm="syz.4.2681" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=netlink_audit_socket permissive=1 [ 269.919696][ T29] audit: type=1400 audit(1754002747.815:3180): avc: denied { create } for pid=11491 comm="syz.4.2681" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=netlink_netfilter_socket permissive=1 [ 269.941046][ T29] audit: type=1400 audit(1754002747.815:3181): avc: denied { write } for pid=11491 comm="syz.4.2681" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=netlink_netfilter_socket permissive=1 [ 269.978757][T11494] block device autoloading is deprecated and will be removed. [ 269.993616][T11492] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=11492 comm=syz.4.2681 [ 270.011672][T11492] netlink: 'syz.4.2681': attribute type 2 has an invalid length. [ 270.019460][T11492] netlink: 'syz.4.2681': attribute type 1 has an invalid length. [ 270.027279][T11492] netlink: 'syz.4.2681': attribute type 1 has an invalid length. [ 270.035087][T11492] netlink: 'syz.4.2681': attribute type 1 has an invalid length. [ 270.042795][T11492] netlink: 'syz.4.2681': attribute type 1 has an invalid length. [ 270.239409][T11495] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=11495 comm=syz.4.2681 [ 270.333725][T11503] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2683'. [ 270.370851][T11503] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2683'. [ 270.395981][ T29] audit: type=1400 audit(1754002747.985:3182): avc: denied { write } for pid=11491 comm="syz.4.2681" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=netlink_audit_socket permissive=1 [ 270.416980][ T29] audit: type=1400 audit(1754002747.995:3183): avc: denied { read } for pid=11491 comm="syz.4.2681" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=netlink_audit_socket permissive=1 [ 270.909822][T11508] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 270.992007][T11520] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 270.998540][T11520] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 271.006044][T11520] vhci_hcd vhci_hcd.0: Device attached [ 271.013730][T11508] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 271.021728][T11519] netlink: 268 bytes leftover after parsing attributes in process `syz.0.2689'. [ 271.056265][T11521] vhci_hcd: cannot find the pending unlink 6 [ 271.101813][T11529] netlink: 268 bytes leftover after parsing attributes in process `syz.1.2692'. [ 271.165053][T11521] vhci_hcd: connection closed [ 271.165189][T10014] vhci_hcd: stop threads [ 271.174159][T10014] vhci_hcd: release socket [ 271.178573][T10014] vhci_hcd: disconnect device [ 271.223483][T10653] vhci_hcd: vhci_device speed not set [ 272.049760][T11530] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2689'. [ 272.059708][T11530] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2689'. [ 272.117025][T11535] netlink: 'syz.2.2693': attribute type 13 has an invalid length. [ 272.125362][T11535] gretap0: refused to change device tx_queue_len [ 272.131700][T11535] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 272.159889][T11537] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(5) [ 272.166471][T11537] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 272.174056][T11537] vhci_hcd vhci_hcd.0: Device attached [ 272.198756][T11538] vhci_hcd: connection closed [ 272.199206][ T31] vhci_hcd: stop threads [ 272.208240][ T31] vhci_hcd: release socket [ 272.212639][ T31] vhci_hcd: disconnect device [ 272.493499][T11554] siw: device registration error -23 [ 272.839815][T11571] netlink: 'syz.2.2705': attribute type 13 has an invalid length. [ 272.849285][T11571] gretap0: refused to change device tx_queue_len [ 272.855690][T11571] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 272.963410][T11579] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 272.972064][T11579] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 273.141936][T11587] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 273.150624][T11587] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 273.159922][T11589] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(5) [ 273.166449][T11589] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 273.174108][T11589] vhci_hcd vhci_hcd.0: Device attached [ 273.185585][T11591] vhci_hcd: cannot find the pending unlink 6 [ 273.247441][T11591] vhci_hcd: connection closed [ 273.247704][ T6970] vhci_hcd: stop threads [ 273.256763][ T6970] vhci_hcd: release socket [ 273.261245][ T6970] vhci_hcd: disconnect device [ 273.749600][T11603] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(4) [ 273.756200][T11603] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 273.763781][T11603] vhci_hcd vhci_hcd.0: Device attached [ 273.800302][T11604] vhci_hcd: connection closed [ 273.800494][ T31] vhci_hcd: stop threads [ 273.809564][ T31] vhci_hcd: release socket [ 273.814017][ T31] vhci_hcd: disconnect device [ 273.829294][T11609] netlink: 'syz.4.2717': attribute type 13 has an invalid length. [ 273.842266][T11609] gretap0: refused to change device tx_queue_len [ 273.848749][T11609] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 274.134367][T11629] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 274.143084][T11629] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 274.189978][T11640] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 274.198590][T11640] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 274.359848][T11646] netlink: 'syz.2.2731': attribute type 13 has an invalid length. [ 274.368050][T11646] gretap0: refused to change device tx_queue_len [ 274.374422][T11646] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 274.403945][ T29] audit: type=1400 audit(1754002752.395:3184): avc: denied { lock } for pid=11647 comm="syz.2.2732" path="socket:[32807]" dev="sockfs" ino=32807 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 274.601694][T11654] __nla_validate_parse: 5 callbacks suppressed [ 274.601767][T11654] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2734'. [ 274.832143][T11663] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 274.843118][T11665] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2739'. [ 274.852208][T11663] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 274.912771][T11665] IPv6: addrconf: prefix option has invalid lifetime [ 274.937524][T11667] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(4) [ 274.944062][T11667] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 274.951699][T11667] vhci_hcd vhci_hcd.0: Device attached [ 275.005721][T11683] netlink: 268 bytes leftover after parsing attributes in process `syz.2.2745'. [ 275.035788][T11685] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2746'. [ 275.045992][T11671] vhci_hcd: connection closed [ 275.046199][ T31] vhci_hcd: stop threads [ 275.055230][ T31] vhci_hcd: release socket [ 275.059668][ T31] vhci_hcd: disconnect device [ 275.097222][T11688] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 275.108205][T11688] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 275.130054][T11692] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 275.138630][T11692] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 275.221147][T11696] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2745'. [ 275.248573][T11696] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2745'. [ 275.672493][T11707] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 275.681061][T11707] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 275.684985][ T29] audit: type=1400 audit(1754002753.675:3185): avc: denied { create } for pid=11709 comm="syz.1.2755" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 275.716992][ T29] audit: type=1400 audit(1754002753.705:3186): avc: denied { ioctl } for pid=11709 comm="syz.1.2755" path="socket:[32901]" dev="sockfs" ino=32901 ioctlcmd=0x7007 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 275.736555][T11707] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 275.753263][T11707] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 275.773375][ T29] audit: type=1400 audit(1754002753.735:3187): avc: denied { bind } for pid=11709 comm="syz.1.2755" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_connector_socket permissive=1 [ 275.952175][T11716] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2757'. [ 275.962871][T11716] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2560 sclass=netlink_route_socket pid=11716 comm=syz.1.2757 [ 275.975674][T11716] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2569 sclass=netlink_route_socket pid=11716 comm=syz.1.2757 [ 275.978036][T11718] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2758'. [ 275.988595][T11716] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2572 sclass=netlink_route_socket pid=11716 comm=syz.1.2757 [ 276.016320][T11720] mmap: syz.2.2759 (11720) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 276.045147][T11724] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(4) [ 276.051718][T11724] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 276.059458][T11724] vhci_hcd vhci_hcd.0: Device attached [ 276.066640][T11725] vhci_hcd: connection closed [ 276.066696][ T6970] vhci_hcd: stop threads [ 276.075745][ T6970] vhci_hcd: release socket [ 276.080157][ T6970] vhci_hcd: disconnect device [ 276.095677][T11728] FAULT_INJECTION: forcing a failure. [ 276.095677][T11728] name failslab, interval 1, probability 0, space 0, times 0 [ 276.108348][T11728] CPU: 0 UID: 0 PID: 11728 Comm: syz.1.2762 Not tainted 6.16.0-syzkaller-08685-g260f6f4fda93 #0 PREEMPT(voluntary) [ 276.108439][T11728] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 276.108452][T11728] Call Trace: [ 276.108458][T11728] [ 276.108465][T11728] __dump_stack+0x1d/0x30 [ 276.108487][T11728] dump_stack_lvl+0xe8/0x140 [ 276.108566][T11728] dump_stack+0x15/0x1b [ 276.108575][T11728] should_fail_ex+0x265/0x280 [ 276.108594][T11728] should_failslab+0x8c/0xb0 [ 276.108609][T11728] kmem_cache_alloc_noprof+0x50/0x310 [ 276.108638][T11728] ? dup_fd+0x3a/0x540 [ 276.108649][T11728] dup_fd+0x3a/0x540 [ 276.108723][T11728] copy_files+0x98/0xf0 [ 276.108738][T11728] copy_process+0xc5b/0x2000 [ 276.108756][T11728] kernel_clone+0x16c/0x5c0 [ 276.108773][T11728] __se_sys_clone3+0x1c2/0x200 [ 276.108864][T11728] __x64_sys_clone3+0x31/0x40 [ 276.108947][T11728] x64_sys_call+0x1fc9/0x2ff0 [ 276.109008][T11728] do_syscall_64+0xd2/0x200 [ 276.109073][T11728] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 276.109087][T11728] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 276.109164][T11728] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 276.109177][T11728] RIP: 0033:0x7f5e8412eb69 [ 276.109187][T11728] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 276.109208][T11728] RSP: 002b:00007f5e82796f08 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 [ 276.109220][T11728] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007f5e8412eb69 [ 276.109268][T11728] RDX: 00007f5e82796f20 RSI: 0000000000000058 RDI: 00007f5e82796f20 [ 276.109275][T11728] RBP: 00007f5e82797090 R08: 0000000000000000 R09: 0000000000000058 [ 276.109304][T11728] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 276.109311][T11728] R13: 0000000000000000 R14: 00007f5e84355fa0 R15: 00007ffd3f979a48 [ 276.109322][T11728] [ 276.384236][T11732] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 276.392795][T11732] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 276.410845][T11738] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 276.419503][T11738] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 276.431513][T11744] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 276.440800][T11744] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 276.471645][T11748] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 276.480179][T11748] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 276.578921][T11753] netlink: 268 bytes leftover after parsing attributes in process `syz.2.2768'. [ 276.759600][T11755] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2768'. [ 277.488394][T11783] netlink: 'syz.2.2779': attribute type 13 has an invalid length. [ 277.503019][T11783] gretap0: refused to change device tx_queue_len [ 277.509453][T11783] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 277.631751][T11788] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(4) [ 277.638284][T11788] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 277.645951][T11788] vhci_hcd vhci_hcd.0: Device attached [ 277.661389][T11789] vhci_hcd: connection closed [ 277.661769][ T31] vhci_hcd: stop threads [ 277.670734][ T31] vhci_hcd: release socket [ 277.675242][ T31] vhci_hcd: disconnect device [ 278.334758][T11796] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 278.363525][T11796] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 278.610408][T11825] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 278.619051][T11825] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 279.221150][T11841] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3) [ 279.227733][T11841] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 279.235258][T11841] vhci_hcd vhci_hcd.0: Device attached [ 279.243199][T11843] vhci_hcd: connection closed [ 279.243526][ T52] vhci_hcd: stop threads [ 279.252535][ T52] vhci_hcd: release socket [ 279.257089][ T52] vhci_hcd: disconnect device [ 279.342730][T11853] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 279.351290][T11853] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 280.612618][T11906] __nla_validate_parse: 12 callbacks suppressed [ 280.612637][T11906] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2821'. [ 280.645454][T11908] netlink: 'syz.4.2822': attribute type 13 has an invalid length. [ 280.660337][T11908] gretap0: refused to change device tx_queue_len [ 280.666876][T11908] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 280.701071][T11915] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 280.709905][T11915] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 280.737788][T11916] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2825'. [ 280.747362][T11916] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=11916 comm=syz.2.2825 [ 280.760508][T11916] netlink: 'syz.2.2825': attribute type 2 has an invalid length. [ 280.768295][T11916] netlink: 'syz.2.2825': attribute type 1 has an invalid length. [ 280.776070][T11916] netlink: 'syz.2.2825': attribute type 1 has an invalid length. [ 280.783836][T11916] netlink: 'syz.2.2825': attribute type 1 has an invalid length. [ 280.791532][T11916] netlink: 'syz.2.2825': attribute type 1 has an invalid length. [ 280.801641][T11916] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=11916 comm=syz.2.2825 [ 280.856583][T11925] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(3) [ 280.863101][T11925] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 280.871303][T11925] vhci_hcd vhci_hcd.0: Device attached [ 280.878426][T11926] vhci_hcd: connection closed [ 280.878530][T10014] vhci_hcd: stop threads [ 280.887592][T10014] vhci_hcd: release socket [ 280.892068][T10014] vhci_hcd: disconnect device [ 281.231474][T11929] netlink: 'syz.4.2828': attribute type 10 has an invalid length. [ 281.243142][T11929] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 281.251488][T11929] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 281.264462][T11930] netlink: 'syz.4.2828': attribute type 10 has an invalid length. [ 281.300247][T11936] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 281.308762][T11936] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 281.415478][ T29] audit: type=1326 audit(1754002759.405:3188): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11946 comm="syz.0.2835" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f335f26eb69 code=0x7ffc0000 [ 281.440829][T11947] FAULT_INJECTION: forcing a failure. [ 281.440829][T11947] name failslab, interval 1, probability 0, space 0, times 0 [ 281.453532][T11947] CPU: 1 UID: 0 PID: 11947 Comm: syz.0.2835 Not tainted 6.16.0-syzkaller-08685-g260f6f4fda93 #0 PREEMPT(voluntary) [ 281.453593][T11947] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 281.453608][T11947] Call Trace: [ 281.453614][T11947] [ 281.453621][T11947] __dump_stack+0x1d/0x30 [ 281.453641][T11947] dump_stack_lvl+0xe8/0x140 [ 281.453724][T11947] dump_stack+0x15/0x1b [ 281.453742][T11947] should_fail_ex+0x265/0x280 [ 281.453844][T11947] should_failslab+0x8c/0xb0 [ 281.453870][T11947] kmem_cache_alloc_node_noprof+0x57/0x320 [ 281.453952][T11947] ? __alloc_skb+0x101/0x320 [ 281.453971][T11947] __alloc_skb+0x101/0x320 [ 281.453988][T11947] ? audit_log_start+0x365/0x6c0 [ 281.454068][T11947] audit_log_start+0x380/0x6c0 [ 281.454096][T11947] audit_seccomp+0x48/0x100 [ 281.454161][T11947] ? __seccomp_filter+0x68c/0x10d0 [ 281.454180][T11947] __seccomp_filter+0x69d/0x10d0 [ 281.454200][T11947] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 281.454222][T11947] ? percpu_array_map_lookup_percpu_elem+0xae/0xd0 [ 281.454329][T11947] ? __rcu_read_unlock+0x4f/0x70 [ 281.454352][T11947] ? bpf_trace_run2+0x124/0x1c0 [ 281.454376][T11947] __secure_computing+0x82/0x150 [ 281.454395][T11947] syscall_trace_enter+0xcf/0x1e0 [ 281.454428][T11947] do_syscall_64+0xac/0x200 [ 281.454454][T11947] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 281.454474][T11947] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 281.454611][T11947] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 281.454630][T11947] RIP: 0033:0x7f335f26d57c [ 281.454643][T11947] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 281.454659][T11947] RSP: 002b:00007f335d8cf030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 281.454676][T11947] RAX: ffffffffffffffda RBX: 00007f335f495fa0 RCX: 00007f335f26d57c [ 281.454687][T11947] RDX: 000000000000000f RSI: 00007f335d8cf0a0 RDI: 0000000000000007 [ 281.454727][T11947] RBP: 00007f335d8cf090 R08: 0000000000000000 R09: 0000000000000000 [ 281.454738][T11947] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 281.454749][T11947] R13: 0000000000000000 R14: 00007f335f495fa0 R15: 00007fff6dcb41d8 [ 281.454764][T11947] [ 281.454910][T11947] audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=64 [ 281.469961][ T29] audit: type=1326 audit(1754002759.425:3189): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11946 comm="syz.0.2835" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f335f26eb69 code=0x7ffc0000 [ 281.477535][T11947] audit: out of memory in audit_log_start [ 281.480856][ T29] audit: type=1326 audit(1754002759.425:3190): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11946 comm="syz.0.2835" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f335f26eb69 code=0x7ffc0000 [ 281.540942][T11957] netlink: 268 bytes leftover after parsing attributes in process `syz.3.2838'. [ 281.545471][ T29] audit: type=1326 audit(1754002759.425:3191): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11946 comm="syz.0.2835" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f335f26eb69 code=0x7ffc0000 [ 281.551436][T11958] netlink: 'syz.1.2837': attribute type 13 has an invalid length. [ 281.557601][ T29] audit: type=1326 audit(1754002759.425:3192): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11946 comm="syz.0.2835" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f335f26eb69 code=0x7ffc0000 [ 281.578736][T11958] gretap0: refused to change device tx_queue_len [ 281.581899][ T29] audit: type=1326 audit(1754002759.425:3193): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11946 comm="syz.0.2835" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f335f26eb69 code=0x7ffc0000 [ 281.581953][ T29] audit: type=1326 audit(1754002759.425:3194): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11946 comm="syz.0.2835" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f335f26eb69 code=0x7ffc0000 [ 281.588083][T11958] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 281.593796][ T29] audit: type=1326 audit(1754002759.425:3195): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11946 comm="syz.0.2835" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f335f26eb69 code=0x7ffc0000 [ 281.692801][T11962] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 281.772187][T11967] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2838'. [ 281.885890][T11962] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 281.928040][T11970] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2840'. [ 281.944935][T11961] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=11961 comm=syz.2.2840 [ 281.967378][T11961] netlink: 'syz.2.2840': attribute type 2 has an invalid length. [ 281.976974][T11961] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=11961 comm=syz.2.2840 [ 282.044539][T11986] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(3) [ 282.051047][T11986] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 282.058710][T11986] vhci_hcd vhci_hcd.0: Device attached [ 282.066016][T11988] vhci_hcd: connection closed [ 282.066184][ T6970] vhci_hcd: stop threads [ 282.075412][ T6970] vhci_hcd: release socket [ 282.079853][ T6970] vhci_hcd: disconnect device [ 282.841492][T12008] netlink: 268 bytes leftover after parsing attributes in process `syz.3.2852'. [ 282.967639][T12010] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 282.977293][T12013] gretap0: refused to change device tx_queue_len [ 282.983645][T12013] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 283.000128][T12010] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 283.010162][T12008] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2852'. [ 283.033758][T12008] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2852'. [ 283.076849][T12015] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 283.086123][T12015] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 284.013992][T12053] netlink: 268 bytes leftover after parsing attributes in process `syz.3.2866'. [ 284.214957][T12053] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2866'. [ 284.300392][T12060] gretap0: refused to change device tx_queue_len [ 284.306895][T12060] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 284.383682][T12063] lo speed is unknown, defaulting to 1000 [ 284.418023][T12063] lo speed is unknown, defaulting to 1000 [ 284.515699][T10014] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 284.525635][T10014] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 284.545557][T12081] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=12081 comm=syz.2.2875 [ 284.558176][T12075] lo speed is unknown, defaulting to 1000 [ 284.699338][T12075] lo speed is unknown, defaulting to 1000 [ 284.724727][T10014] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 284.734643][T10014] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 284.832974][T10014] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 284.842933][T10014] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 285.650561][T12095] __nla_validate_parse: 9 callbacks suppressed [ 285.656808][T12095] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2879'. [ 285.686614][T12095] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2879'. [ 285.707995][T12071] lo speed is unknown, defaulting to 1000 [ 285.775180][T10014] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 285.785030][T10014] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 285.833557][T12071] lo speed is unknown, defaulting to 1000 [ 286.037460][T10014] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 286.069354][T10014] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 286.079806][T10014] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 286.089247][T10014] bond0 (unregistering): Released all slaves [ 286.099144][T10014] bond1 (unregistering): Released all slaves [ 286.109554][T10014] bond2 (unregistering): Released all slaves [ 286.118868][T10014] bond3 (unregistering): Released all slaves [ 286.128450][T10014] bond4 (unregistering): Released all slaves [ 286.137528][T10014] bond5 (unregistering): Released all slaves [ 286.148127][T10014] bond6 (unregistering): Released all slaves [ 286.157010][T10014] bond7 (unregistering): Released all slaves [ 286.170845][T12071] chnl_net:caif_netlink_parms(): no params data found [ 286.207882][T12071] bridge0: port 1(bridge_slave_0) entered blocking state [ 286.215115][T12071] bridge0: port 1(bridge_slave_0) entered disabled state [ 286.222515][T12071] bridge_slave_0: entered allmulticast mode [ 286.230258][T12071] bridge_slave_0: entered promiscuous mode [ 286.237545][T12071] bridge0: port 2(bridge_slave_1) entered blocking state [ 286.244691][T12071] bridge0: port 2(bridge_slave_1) entered disabled state [ 286.252286][T12071] bridge_slave_1: entered allmulticast mode [ 286.259509][T12071] bridge_slave_1: entered promiscuous mode [ 286.281629][T12071] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 286.292911][T10014] hsr_slave_0: left promiscuous mode [ 286.300614][T10014] hsr_slave_1: left promiscuous mode [ 286.310987][T10014] veth1_macvtap: left promiscuous mode [ 286.316706][T10014] veth0_macvtap: left promiscuous mode [ 286.322455][T10014] veth1_vlan: left promiscuous mode [ 286.327854][T10014] veth0_vlan: left promiscuous mode [ 286.415152][T12071] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 286.441456][T12071] team0: Port device team_slave_0 added [ 286.455156][T12071] team0: Port device team_slave_1 added [ 286.473447][T12071] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 286.480391][T12071] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 286.506324][T12071] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 286.518066][T12071] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 286.525028][T12071] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 286.550923][T12071] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 286.579294][T12071] hsr_slave_0: entered promiscuous mode [ 286.585324][T12071] hsr_slave_1: entered promiscuous mode [ 286.591204][T12071] debugfs: 'hsr0' already exists in 'hsr' [ 286.597049][T12071] Cannot create hsr debugfs directory [ 286.645454][T12120] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2884'. [ 286.701202][T12126] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2887'. [ 286.722449][T12129] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=12129 comm=syz.2.2888 [ 286.746762][T12129] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=12129 comm=syz.2.2888 [ 286.764481][T12133] netlink: 268 bytes leftover after parsing attributes in process `syz.4.2889'. [ 286.845794][T12135] netlink: 268 bytes leftover after parsing attributes in process `syz.2.2890'. [ 286.897584][T12138] netlink: 268 bytes leftover after parsing attributes in process `syz.1.2891'. [ 287.013107][T12139] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2889'. [ 287.045985][T12139] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2889'. [ 287.057126][T12140] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2890'. [ 289.258795][T12162] siw: device registration error -23 [ 289.368503][ T29] kauditd_printk_skb: 34 callbacks suppressed [ 289.368516][ T29] audit: type=1400 audit(1754002767.355:3230): avc: denied { map_create } for pid=12164 comm="syz.2.2900" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 289.420702][T12168] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=12168 comm=syz.3.2901 [ 289.425149][ T29] audit: type=1400 audit(1754002767.385:3231): avc: denied { map_read map_write } for pid=12164 comm="syz.2.2900" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 289.453281][ T29] audit: type=1400 audit(1754002767.385:3232): avc: denied { recv } for pid=12166 comm="kworker/u8:15" saddr=10.128.0.163 src=30036 daddr=10.128.1.29 dest=54980 netif=eth0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=peer permissive=1 [ 289.478968][ T29] audit: type=1400 audit(1754002767.385:3233): avc: denied { prog_load } for pid=12164 comm="syz.2.2900" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 289.491326][T12168] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=12168 comm=syz.3.2901 [ 289.498110][ T29] audit: type=1400 audit(1754002767.385:3234): avc: denied { bpf } for pid=12164 comm="syz.2.2900" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 289.498139][ T29] audit: type=1400 audit(1754002767.385:3235): avc: denied { perfmon } for pid=12164 comm="syz.2.2900" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 289.498162][ T29] audit: type=1400 audit(1754002767.385:3236): avc: denied { prog_run } for pid=12164 comm="syz.2.2900" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 289.571263][ T29] audit: type=1400 audit(1754002767.395:3237): avc: denied { create } for pid=12164 comm="syz.2.2900" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 289.590904][ T29] audit: type=1400 audit(1754002767.395:3238): avc: denied { connect } for pid=12164 comm="syz.2.2900" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 289.610513][ T29] audit: type=1400 audit(1754002767.395:3239): avc: denied { write } for pid=12164 comm="syz.2.2900" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 290.054420][T12188] IPv6: addrconf: prefix option has invalid lifetime [ 290.278067][T12071] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 290.292770][T12071] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 290.305199][T12071] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 290.315451][T12071] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 290.380234][T12071] 8021q: adding VLAN 0 to HW filter on device bond0 [ 290.393617][T12071] 8021q: adding VLAN 0 to HW filter on device team0 [ 290.404870][T10014] bridge0: port 1(bridge_slave_0) entered blocking state [ 290.412106][T10014] bridge0: port 1(bridge_slave_0) entered forwarding state [ 290.430952][ T52] bridge0: port 2(bridge_slave_1) entered blocking state [ 290.438108][ T52] bridge0: port 2(bridge_slave_1) entered forwarding state [ 290.580903][T12217] IPv6: addrconf: prefix option has invalid lifetime [ 290.635049][T12227] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(4) [ 290.641607][T12227] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 290.649225][T12227] vhci_hcd vhci_hcd.0: Device attached [ 290.655912][T12232] __nla_validate_parse: 17 callbacks suppressed [ 290.655984][T12232] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2920'. [ 290.671692][T12232] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=12232 comm=syz.4.2920 [ 290.684688][T12232] validate_nla: 6 callbacks suppressed [ 290.684702][T12232] netlink: 'syz.4.2920': attribute type 2 has an invalid length. [ 290.697917][T12232] netlink: 'syz.4.2920': attribute type 1 has an invalid length. [ 290.702975][T12071] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 290.705747][T12232] netlink: 'syz.4.2920': attribute type 1 has an invalid length. [ 290.720269][T12232] netlink: 'syz.4.2920': attribute type 1 has an invalid length. [ 290.727319][T12230] vhci_hcd: connection closed [ 290.728013][T12232] netlink: 'syz.4.2920': attribute type 1 has an invalid length. [ 290.728300][ T52] vhci_hcd: stop threads [ 290.737173][T12232] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=12232 comm=syz.4.2920 [ 290.740471][ T52] vhci_hcd: release socket [ 290.761504][ T52] vhci_hcd: disconnect device [ 290.820780][T12071] veth0_vlan: entered promiscuous mode [ 290.829850][T12071] veth1_vlan: entered promiscuous mode [ 290.862502][T12071] veth0_macvtap: entered promiscuous mode [ 290.882505][T12071] veth1_macvtap: entered promiscuous mode [ 290.896103][T12244] netlink: 'syz.4.2922': attribute type 13 has an invalid length. [ 290.908971][T12244] gretap0: refused to change device tx_queue_len [ 290.915382][T12244] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 290.934370][T12071] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 290.946258][T12071] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 290.957739][T10010] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 290.966983][T10010] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 291.003186][T10010] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 291.025294][T12246] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 291.041159][T10010] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 291.052577][T12246] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 291.389500][T12263] lo speed is unknown, defaulting to 1000 [ 291.463187][T12263] lo speed is unknown, defaulting to 1000 [ 291.649037][T12266] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2929'. [ 291.793025][T12272] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2930'. [ 291.850801][T12276] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2931'. [ 291.882577][T12276] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=12276 comm=syz.4.2931 [ 291.935658][T12285] netlink: 'syz.4.2931': attribute type 2 has an invalid length. [ 291.943615][T12285] netlink: 'syz.4.2931': attribute type 1 has an invalid length. [ 291.951377][T12285] netlink: 'syz.4.2931': attribute type 1 has an invalid length. [ 291.959179][T12285] netlink: 'syz.4.2931': attribute type 1 has an invalid length. [ 291.977843][T12267] lo speed is unknown, defaulting to 1000 [ 292.004669][T12276] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=12276 comm=syz.4.2931 [ 292.038696][T10010] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 292.044164][T12291] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 292.059177][T12291] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 292.068535][T12267] lo speed is unknown, defaulting to 1000 [ 292.112766][T10010] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 292.115901][T12293] FAULT_INJECTION: forcing a failure. [ 292.115901][T12293] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 292.136203][T12293] CPU: 0 UID: 0 PID: 12293 Comm: syz.3.2937 Not tainted 6.16.0-syzkaller-08685-g260f6f4fda93 #0 PREEMPT(voluntary) [ 292.136238][T12293] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 292.136250][T12293] Call Trace: [ 292.136257][T12293] [ 292.136264][T12293] __dump_stack+0x1d/0x30 [ 292.136285][T12293] dump_stack_lvl+0xe8/0x140 [ 292.136302][T12293] dump_stack+0x15/0x1b [ 292.136317][T12293] should_fail_ex+0x265/0x280 [ 292.136416][T12293] should_fail+0xb/0x20 [ 292.136445][T12293] should_fail_usercopy+0x1a/0x20 [ 292.136475][T12293] _copy_to_user+0x20/0xa0 [ 292.136496][T12293] simple_read_from_buffer+0xb5/0x130 [ 292.136530][T12293] proc_fail_nth_read+0x10e/0x150 [ 292.136556][T12293] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 292.136579][T12293] vfs_read+0x19d/0x6f0 [ 292.136629][T12293] ? __rcu_read_unlock+0x4f/0x70 [ 292.136653][T12293] ? __fget_files+0x184/0x1c0 [ 292.136674][T12293] ? kfree+0xd9/0x320 [ 292.136702][T12293] ksys_read+0xda/0x1a0 [ 292.136725][T12293] __x64_sys_read+0x40/0x50 [ 292.136825][T12293] x64_sys_call+0x27bc/0x2ff0 [ 292.136846][T12293] do_syscall_64+0xd2/0x200 [ 292.136954][T12293] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 292.136976][T12293] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 292.137002][T12293] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 292.137035][T12293] RIP: 0033:0x7f8fe893d57c [ 292.137051][T12293] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 292.137074][T12293] RSP: 002b:00007f8fe6fa7030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 292.137148][T12293] RAX: ffffffffffffffda RBX: 00007f8fe8b65fa0 RCX: 00007f8fe893d57c [ 292.137160][T12293] RDX: 000000000000000f RSI: 00007f8fe6fa70a0 RDI: 0000000000000003 [ 292.137241][T12293] RBP: 00007f8fe6fa7090 R08: 0000000000000000 R09: 0000000000000000 [ 292.137253][T12293] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 292.137264][T12293] R13: 0000000000000000 R14: 00007f8fe8b65fa0 R15: 00007ffd721a2608 [ 292.137280][T12293] [ 292.351901][T12296] netlink: 268 bytes leftover after parsing attributes in process `syz.4.2938'. [ 292.470860][T10010] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 292.491984][T12299] lo speed is unknown, defaulting to 1000 [ 292.561008][T12301] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2938'. [ 292.589381][T12301] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2938'. [ 292.947965][T12303] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 292.967260][T10010] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 292.992624][T12303] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 292.995236][T12299] lo speed is unknown, defaulting to 1000 [ 293.037014][T12267] chnl_net:caif_netlink_parms(): no params data found [ 293.119964][T12315] FAULT_INJECTION: forcing a failure. [ 293.119964][T12315] name failslab, interval 1, probability 0, space 0, times 0 [ 293.132630][T12315] CPU: 1 UID: 0 PID: 12315 Comm: syz.1.2943 Not tainted 6.16.0-syzkaller-08685-g260f6f4fda93 #0 PREEMPT(voluntary) [ 293.132664][T12315] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 293.132679][T12315] Call Trace: [ 293.132685][T12315] [ 293.132693][T12315] __dump_stack+0x1d/0x30 [ 293.132717][T12315] dump_stack_lvl+0xe8/0x140 [ 293.132747][T12315] dump_stack+0x15/0x1b [ 293.132766][T12315] should_fail_ex+0x265/0x280 [ 293.132797][T12315] should_failslab+0x8c/0xb0 [ 293.132821][T12315] kmem_cache_alloc_noprof+0x50/0x310 [ 293.132863][T12315] ? getname_flags+0x80/0x3b0 [ 293.132964][T12315] getname_flags+0x80/0x3b0 [ 293.132987][T12315] user_path_at+0x28/0x130 [ 293.133019][T12315] __se_sys_mount+0x25b/0x2e0 [ 293.133040][T12315] ? fput+0x8f/0xc0 [ 293.133071][T12315] __x64_sys_mount+0x67/0x80 [ 293.133108][T12315] x64_sys_call+0x2b4d/0x2ff0 [ 293.133128][T12315] do_syscall_64+0xd2/0x200 [ 293.133208][T12315] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 293.133236][T12315] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 293.133332][T12315] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 293.133354][T12315] RIP: 0033:0x7f5e8412eb69 [ 293.133370][T12315] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 293.133387][T12315] RSP: 002b:00007f5e82797038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 293.133407][T12315] RAX: ffffffffffffffda RBX: 00007f5e84355fa0 RCX: 00007f5e8412eb69 [ 293.133419][T12315] RDX: 0000200000000300 RSI: 00002000000002c0 RDI: 0000000000000000 [ 293.133443][T12315] RBP: 00007f5e82797090 R08: 00002000000001c0 R09: 0000000000000000 [ 293.133498][T12315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 293.133512][T12315] R13: 0000000000000000 R14: 00007f5e84355fa0 R15: 00007ffd3f979a48 [ 293.133532][T12315] [ 293.367013][T12317] cgroup: noprefix used incorrectly [ 293.383680][T12322] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 293.392147][T12322] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 293.406040][T10010] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 293.416252][T10010] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 293.425541][T10010] bond0 (unregistering): Released all slaves [ 293.433539][T10010] bond1 (unregistering): Released all slaves [ 293.441654][T10010] bond2 (unregistering): Released all slaves [ 293.449791][T10010] bond3 (unregistering): Released all slaves [ 293.457720][T10010] bond4 (unregistering): Released all slaves [ 293.465416][T10010] bond5 (unregistering): Released all slaves [ 293.472915][T12267] bridge0: port 1(bridge_slave_0) entered blocking state [ 293.480073][T12267] bridge0: port 1(bridge_slave_0) entered disabled state [ 293.487394][T12267] bridge_slave_0: entered allmulticast mode [ 293.493708][T12267] bridge_slave_0: entered promiscuous mode [ 293.500983][T12267] bridge0: port 2(bridge_slave_1) entered blocking state [ 293.508125][T12267] bridge0: port 2(bridge_slave_1) entered disabled state [ 293.515647][T12267] bridge_slave_1: entered allmulticast mode [ 293.522159][T12267] bridge_slave_1: entered promiscuous mode [ 293.546809][T12267] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 293.560123][T12267] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 293.588099][T10010] hsr_slave_0: left promiscuous mode [ 293.593936][T10010] hsr_slave_1: left promiscuous mode [ 293.595697][T12331] netlink: 268 bytes leftover after parsing attributes in process `syz.1.2950'. [ 293.599704][T10010] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 293.615808][T10010] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 293.623983][T10010] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 293.631376][T10010] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 293.640810][T10010] veth1_macvtap: left promiscuous mode [ 293.646478][T10010] veth0_macvtap: left promiscuous mode [ 293.723484][T10014] smc: removing ib device syz! [ 293.753545][T12267] team0: Port device team_slave_0 added [ 293.810877][T12338] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2950'. [ 293.836177][T12338] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2950'. [ 294.119531][T12334] gretap0: refused to change device tx_queue_len [ 294.125991][T12334] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 294.168669][T12267] team0: Port device team_slave_1 added [ 294.226214][T12267] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 294.233258][T12267] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 294.259364][T12267] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 294.342254][T12267] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 294.349333][T12267] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 294.375401][T12267] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 294.531839][T12360] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(4) [ 294.538421][T12360] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 294.545985][T12360] vhci_hcd vhci_hcd.0: Device attached [ 294.555957][T12361] vhci_hcd: connection closed [ 294.556137][ T52] vhci_hcd: stop threads [ 294.565143][ T52] vhci_hcd: release socket [ 294.569631][ T52] vhci_hcd: disconnect device [ 294.605796][T12267] hsr_slave_0: entered promiscuous mode [ 294.620108][T12267] hsr_slave_1: entered promiscuous mode [ 294.633731][T12267] debugfs: 'hsr0' already exists in 'hsr' [ 294.639474][T12267] Cannot create hsr debugfs directory [ 294.677575][ T29] kauditd_printk_skb: 185 callbacks suppressed [ 294.677590][ T29] audit: type=1400 audit(1754002772.665:3425): avc: denied { create } for pid=12365 comm="syz.3.2961" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 294.718865][ T29] audit: type=1400 audit(1754002772.695:3426): avc: denied { bind } for pid=12365 comm="syz.3.2961" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 294.738242][ T29] audit: type=1400 audit(1754002772.695:3427): avc: denied { write } for pid=12365 comm="syz.3.2961" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 294.765682][ T29] audit: type=1400 audit(1754002772.755:3428): avc: denied { ioctl } for pid=12365 comm="syz.3.2961" path="socket:[34506]" dev="sockfs" ino=34506 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 294.797521][ T29] audit: type=1400 audit(1754002772.785:3429): avc: denied { bind } for pid=12365 comm="syz.3.2961" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 294.816899][ T29] audit: type=1400 audit(1754002772.785:3430): avc: denied { create } for pid=12365 comm="syz.3.2961" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 294.838315][ T29] audit: type=1400 audit(1754002772.785:3431): avc: denied { map } for pid=12365 comm="syz.3.2961" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=34507 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 294.862699][ T29] audit: type=1400 audit(1754002772.785:3432): avc: denied { read write } for pid=12365 comm="syz.3.2961" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=34507 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 294.887661][ T29] audit: type=1400 audit(1754002772.785:3433): avc: denied { read } for pid=12363 comm="syz.4.2960" name="loop-control" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 294.911938][ T29] audit: type=1400 audit(1754002772.785:3434): avc: denied { open } for pid=12363 comm="syz.4.2960" path="/dev/loop-control" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:loop_control_device_t tclass=chr_file permissive=1 [ 294.980766][T12381] lo speed is unknown, defaulting to 1000 [ 294.998466][T12381] lo speed is unknown, defaulting to 1000 [ 295.032818][T12386] lo speed is unknown, defaulting to 1000 [ 295.039691][T12386] lo speed is unknown, defaulting to 1000 [ 295.087406][T12391] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 295.096102][T12391] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 295.175226][T12397] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=62 sclass=netlink_tcpdiag_socket pid=12397 comm=syz.0.2968 [ 295.252795][T12267] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 295.272185][T12404] wireguard0: entered promiscuous mode [ 295.277738][T12404] wireguard0: entered allmulticast mode [ 295.297889][T12267] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 295.311216][T12267] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 295.320562][T12267] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 295.364842][T12267] 8021q: adding VLAN 0 to HW filter on device bond0 [ 295.377124][T12267] 8021q: adding VLAN 0 to HW filter on device team0 [ 295.386933][T10014] bridge0: port 1(bridge_slave_0) entered blocking state [ 295.394120][T10014] bridge0: port 1(bridge_slave_0) entered forwarding state [ 295.418137][T10018] bridge0: port 2(bridge_slave_1) entered blocking state [ 295.425246][T10018] bridge0: port 2(bridge_slave_1) entered forwarding state [ 295.444952][T12267] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 295.455421][T12267] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 295.525431][T12267] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 295.602769][T12267] veth0_vlan: entered promiscuous mode [ 295.618157][T12267] veth1_vlan: entered promiscuous mode [ 295.645328][T12267] veth0_macvtap: entered promiscuous mode [ 295.654781][T12267] veth1_macvtap: entered promiscuous mode [ 295.666449][T12267] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 295.677970][T12267] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 295.689704][ T31] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 295.698841][ T31] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 295.711796][ T31] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 295.729333][ T31] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 295.798701][T12435] __nla_validate_parse: 5 callbacks suppressed [ 295.798746][T12435] netlink: 268 bytes leftover after parsing attributes in process `syz.2.2927'. [ 295.865609][T12438] netlink: 268 bytes leftover after parsing attributes in process `syz.4.2976'. [ 296.029986][T12441] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2927'. [ 296.039355][T12441] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2927'. [ 296.777118][T12440] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2976'. [ 296.848975][T12440] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2976'. [ 296.882638][T12456] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 296.892896][T12456] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 296.904391][ T31] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 296.925524][T12442] lo speed is unknown, defaulting to 1000 [ 296.931974][T12442] lo speed is unknown, defaulting to 1000 [ 296.957246][ T31] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 297.097689][ T31] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 297.139093][T12442] chnl_net:caif_netlink_parms(): no params data found [ 297.163283][ T31] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 297.209874][T12442] bridge0: port 1(bridge_slave_0) entered blocking state [ 297.217003][T12442] bridge0: port 1(bridge_slave_0) entered disabled state [ 297.224166][T12442] bridge_slave_0: entered allmulticast mode [ 297.230934][T12442] bridge_slave_0: entered promiscuous mode [ 297.238067][T12442] bridge0: port 2(bridge_slave_1) entered blocking state [ 297.245155][T12442] bridge0: port 2(bridge_slave_1) entered disabled state [ 297.252724][T12442] bridge_slave_1: entered allmulticast mode [ 297.259359][T12442] bridge_slave_1: entered promiscuous mode [ 297.286317][T12442] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 297.297274][T12477] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2984'. [ 297.307069][T12442] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 297.349714][ T31] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 297.360263][ T31] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 297.370528][ T31] bond0 (unregistering): Released all slaves [ 297.380186][ T31] bond1 (unregistering): Released all slaves [ 297.389133][ T31] bond2 (unregistering): Released all slaves [ 297.397838][ T31] bond3 (unregistering): Released all slaves [ 297.406819][ T31] bond4 (unregistering): Released all slaves [ 297.416661][ T31] bond5 (unregistering): Released all slaves [ 297.425435][ T31] bond6 (unregistering): Released all slaves [ 297.434248][ T31] bond7 (unregistering): Released all slaves [ 297.443021][ T31] bond8 (unregistering): Released all slaves [ 297.456282][ T31] bond9 (unregistering): Released all slaves [ 297.480935][T12442] team0: Port device team_slave_0 added [ 297.487988][T12442] team0: Port device team_slave_1 added [ 297.506244][T12442] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 297.513320][T12442] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 297.539292][T12442] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 297.550946][T12442] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 297.557960][T12442] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 297.583971][T12442] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 297.611547][ T31] hsr_slave_0: left promiscuous mode [ 297.617469][ T31] hsr_slave_1: left promiscuous mode [ 297.625330][ T31] veth1_macvtap: left promiscuous mode [ 297.630896][ T31] veth0_macvtap: left promiscuous mode [ 297.697494][T12442] hsr_slave_0: entered promiscuous mode [ 297.705165][T12442] hsr_slave_1: entered promiscuous mode [ 297.711077][T12442] debugfs: 'hsr0' already exists in 'hsr' [ 297.716873][T12442] Cannot create hsr debugfs directory [ 297.722442][T10651] lo speed is unknown, defaulting to 1000 [ 297.728245][T10651] infiniband syz2: ib_query_port failed (-19) [ 298.036400][T12490] macvtap0: refused to change device tx_queue_len [ 298.084747][T12493] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2990'. [ 298.096205][T12493] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=12493 comm=syz.4.2990 [ 298.124875][T12442] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 298.131975][T12493] validate_nla: 2 callbacks suppressed [ 298.131990][T12493] netlink: 'syz.4.2990': attribute type 2 has an invalid length. [ 298.145450][T12493] netlink: 'syz.4.2990': attribute type 1 has an invalid length. [ 298.153178][T12493] netlink: 'syz.4.2990': attribute type 1 has an invalid length. [ 298.160989][T12493] netlink: 'syz.4.2990': attribute type 1 has an invalid length. [ 298.168895][T12493] netlink: 'syz.4.2990': attribute type 1 has an invalid length. [ 298.179770][T12442] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 298.188400][T12493] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=12493 comm=syz.4.2990 [ 298.202758][T12442] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 298.212261][T12442] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 298.284442][T12442] 8021q: adding VLAN 0 to HW filter on device bond0 [ 298.358221][T12442] 8021q: adding VLAN 0 to HW filter on device team0 [ 298.375580][T12504] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2992'. [ 298.396097][T10018] bridge0: port 1(bridge_slave_0) entered blocking state [ 298.403249][T10018] bridge0: port 1(bridge_slave_0) entered forwarding state [ 298.413497][T10018] bridge0: port 2(bridge_slave_1) entered blocking state [ 298.420612][T10018] bridge0: port 2(bridge_slave_1) entered forwarding state [ 298.451509][T12506] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2993'. [ 298.478260][T12506] lo speed is unknown, defaulting to 1000 [ 298.562556][T12442] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 298.583033][T12517] lo speed is unknown, defaulting to 1000 [ 298.650261][T12523] team0 (unregistering): Port device team_slave_0 removed [ 298.678949][T12523] team0 (unregistering): Port device team_slave_1 removed [ 298.711419][T12526] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=12526 comm=syz.2.2998 [ 298.726211][T12526] netlink: 'syz.2.2998': attribute type 2 has an invalid length. [ 298.733988][T12526] netlink: 'syz.2.2998': attribute type 1 has an invalid length. [ 298.741759][T12526] netlink: 'syz.2.2998': attribute type 1 has an invalid length. [ 298.749564][T12526] netlink: 'syz.2.2998': attribute type 1 has an invalid length. [ 298.757329][T12526] netlink: 'syz.2.2998': attribute type 1 has an invalid length. [ 298.770110][T12526] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=12526 comm=syz.2.2998 [ 298.840589][T12442] veth0_vlan: entered promiscuous mode [ 298.852858][T12442] veth1_vlan: entered promiscuous mode [ 298.921773][T12442] veth0_macvtap: entered promiscuous mode [ 298.929078][T12442] veth1_macvtap: entered promiscuous mode [ 298.939690][T12442] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 298.962579][T12539] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=12539 comm=syz.1.3001 [ 298.977355][T12442] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 298.994176][T12539] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=12539 comm=syz.1.3001 [ 299.125920][T10017] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 299.149919][T10017] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 299.237425][T10017] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 299.312261][T10017] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 299.552763][T12561] lo speed is unknown, defaulting to 1000 [ 299.593481][T12560] gretap0: refused to change device tx_queue_len [ 299.599857][T12560] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 299.652397][T12567] FAULT_INJECTION: forcing a failure. [ 299.652397][T12567] name failslab, interval 1, probability 0, space 0, times 0 [ 299.665230][T12567] CPU: 0 UID: 0 PID: 12567 Comm: syz.1.3010 Not tainted 6.16.0-syzkaller-08685-g260f6f4fda93 #0 PREEMPT(voluntary) [ 299.665263][T12567] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 299.665276][T12567] Call Trace: [ 299.665284][T12567] [ 299.665320][T12567] __dump_stack+0x1d/0x30 [ 299.665340][T12567] dump_stack_lvl+0xe8/0x140 [ 299.665357][T12567] dump_stack+0x15/0x1b [ 299.665372][T12567] should_fail_ex+0x265/0x280 [ 299.665403][T12567] ? alloc_fdtable+0x8c/0x1d0 [ 299.665425][T12567] should_failslab+0x8c/0xb0 [ 299.665508][T12567] __kmalloc_cache_noprof+0x4c/0x320 [ 299.665616][T12567] alloc_fdtable+0x8c/0x1d0 [ 299.665638][T12567] dup_fd+0x4c7/0x540 [ 299.665662][T12567] copy_files+0x98/0xf0 [ 299.665708][T12567] copy_process+0xc5b/0x2000 [ 299.665738][T12567] kernel_clone+0x16c/0x5c0 [ 299.665771][T12567] __x64_sys_clone+0xe6/0x120 [ 299.665807][T12567] x64_sys_call+0x119c/0x2ff0 [ 299.665836][T12567] do_syscall_64+0xd2/0x200 [ 299.665869][T12567] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 299.665960][T12567] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 299.665987][T12567] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 299.666007][T12567] RIP: 0033:0x7f5e8412eb69 [ 299.666022][T12567] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 299.666104][T12567] RSP: 002b:00007f5e82796fe8 EFLAGS: 00000202 ORIG_RAX: 0000000000000038 [ 299.666125][T12567] RAX: ffffffffffffffda RBX: 00007f5e84355fa0 RCX: 00007f5e8412eb69 [ 299.666139][T12567] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000410e6080 [ 299.666150][T12567] RBP: 00007f5e82797090 R08: 0000200000000680 R09: 0000200000000680 [ 299.666162][T12567] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000001 [ 299.666173][T12567] R13: 0000000000000000 R14: 00007f5e84355fa0 R15: 00007ffd3f979a48 [ 299.666191][T12567] [ 299.963120][ T29] kauditd_printk_skb: 112 callbacks suppressed [ 299.963151][ T29] audit: type=1326 audit(1754002777.945:3547): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12569 comm="syz.3.3011" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1d0bf4eb69 code=0x7ffc0000 [ 300.007322][T12573] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=12573 comm=syz.2.3013 [ 300.023846][T12573] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=12573 comm=syz.2.3013 [ 300.037005][ T29] audit: type=1326 audit(1754002777.945:3548): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12569 comm="syz.3.3011" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f1d0bf4eb69 code=0x7ffc0000 [ 300.060558][ T29] audit: type=1326 audit(1754002777.945:3549): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12569 comm="syz.3.3011" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1d0bf4eb69 code=0x7ffc0000 [ 300.084417][ T29] audit: type=1326 audit(1754002777.945:3550): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12569 comm="syz.3.3011" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f1d0bf4eb69 code=0x7ffc0000 [ 300.107963][ T29] audit: type=1326 audit(1754002777.955:3551): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12569 comm="syz.3.3011" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1d0bf4eb69 code=0x7ffc0000 [ 300.131565][ T29] audit: type=1326 audit(1754002777.955:3552): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12569 comm="syz.3.3011" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f1d0bf4eb69 code=0x7ffc0000 [ 300.155296][ T29] audit: type=1326 audit(1754002777.955:3553): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12569 comm="syz.3.3011" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1d0bf4eb69 code=0x7ffc0000 [ 300.178818][ T29] audit: type=1326 audit(1754002777.955:3554): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12569 comm="syz.3.3011" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f1d0bf4eb69 code=0x7ffc0000 [ 300.202466][ T29] audit: type=1326 audit(1754002777.955:3555): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12569 comm="syz.3.3011" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1d0bf4eb69 code=0x7ffc0000 [ 300.226008][ T29] audit: type=1326 audit(1754002777.955:3556): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12569 comm="syz.3.3011" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f1d0bf4eb69 code=0x7ffc0000 [ 300.297328][T12583] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 300.306855][T12583] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 300.352659][T12588] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 300.361976][T12588] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 300.850937][T12599] __nla_validate_parse: 17 callbacks suppressed [ 300.851018][T12599] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3023'. [ 300.895708][T12600] siw: device registration error -23 [ 301.065242][T12609] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3023'. [ 301.074388][T12609] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3023'. [ 301.093988][T12611] netlink: 268 bytes leftover after parsing attributes in process `syz.1.3026'. [ 301.326020][T12618] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3026'. [ 301.360729][T12618] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3026'. [ 301.634006][T12629] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3030'. [ 301.698711][T12631] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3031'. [ 301.720259][T12631] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=12631 comm=syz.0.3031 [ 301.733094][T12629] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3030'. [ 301.752816][T12631] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=12631 comm=syz.0.3031 [ 301.763454][T12629] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3030'. [ 301.810266][T12636] gretap0: refused to change device tx_queue_len [ 301.816762][T12636] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 301.883751][T12642] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 301.892267][T12642] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 302.813003][T12657] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 302.821574][T12657] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 303.098647][T12662] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 303.107975][T12662] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 303.199011][T12668] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=12668 comm=syz.2.3044 [ 303.239040][T12670] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=12670 comm=syz.2.3045 [ 303.255865][T12670] validate_nla: 18 callbacks suppressed [ 303.255881][T12670] netlink: 'syz.2.3045': attribute type 2 has an invalid length. [ 303.269545][T12670] netlink: 'syz.2.3045': attribute type 1 has an invalid length. [ 303.273167][T12672] netlink: 'syz.4.3046': attribute type 13 has an invalid length. [ 303.277313][T12670] netlink: 'syz.2.3045': attribute type 1 has an invalid length. [ 303.277330][T12670] netlink: 'syz.2.3045': attribute type 1 has an invalid length. [ 303.277380][T12670] netlink: 'syz.2.3045': attribute type 1 has an invalid length. [ 303.285891][T12670] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pid=12670 comm=syz.2.3045 [ 303.293382][T12672] gretap0: refused to change device tx_queue_len [ 303.327371][T12672] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 303.743312][T12686] lo speed is unknown, defaulting to 1000 [ 303.845613][T12693] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 303.900064][T12693] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 304.118149][T12711] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 304.127295][T12711] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 304.272670][T12718] netlink: 'syz.1.3059': attribute type 13 has an invalid length. [ 304.301009][T12718] gretap0: refused to change device tx_queue_len [ 304.307410][T12718] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 304.379870][T12723] FAULT_INJECTION: forcing a failure. [ 304.379870][T12723] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 304.393497][T12723] CPU: 0 UID: 0 PID: 12723 Comm: syz.4.3060 Not tainted 6.16.0-syzkaller-08685-g260f6f4fda93 #0 PREEMPT(voluntary) [ 304.393597][T12723] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 304.393608][T12723] Call Trace: [ 304.393613][T12723] [ 304.393621][T12723] __dump_stack+0x1d/0x30 [ 304.393642][T12723] dump_stack_lvl+0xe8/0x140 [ 304.393705][T12723] dump_stack+0x15/0x1b [ 304.393724][T12723] should_fail_ex+0x265/0x280 [ 304.393752][T12723] should_fail+0xb/0x20 [ 304.393776][T12723] should_fail_usercopy+0x1a/0x20 [ 304.393836][T12723] _copy_from_user+0x1c/0xb0 [ 304.393934][T12723] ___sys_recvmsg+0xaa/0x370 [ 304.393971][T12723] do_recvmmsg+0x1ef/0x540 [ 304.393998][T12723] ? fput+0x8f/0xc0 [ 304.394027][T12723] __x64_sys_recvmmsg+0xe5/0x170 [ 304.394080][T12723] x64_sys_call+0x27a6/0x2ff0 [ 304.394100][T12723] do_syscall_64+0xd2/0x200 [ 304.394127][T12723] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 304.394191][T12723] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 304.394258][T12723] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 304.394422][T12723] RIP: 0033:0x7fec2907eb69 [ 304.394436][T12723] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 304.394453][T12723] RSP: 002b:00007fec276be038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 304.394472][T12723] RAX: ffffffffffffffda RBX: 00007fec292a6080 RCX: 00007fec2907eb69 [ 304.394498][T12723] RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000003 [ 304.394513][T12723] RBP: 00007fec276be090 R08: 0000000000000000 R09: 0000000000000000 [ 304.394525][T12723] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000001 [ 304.394536][T12723] R13: 0000000000000001 R14: 00007fec292a6080 R15: 00007fff4754f4d8 [ 304.394553][T12723] [ 304.592041][T12726] tipc: Started in network mode [ 304.597033][T12726] tipc: Node identity aaaaaaaaaaaa, cluster identity 4711 [ 304.604188][T12726] tipc: Enabled bearer , priority 10 [ 304.708990][T12729] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(4) [ 304.715525][T12729] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 304.723071][T12729] vhci_hcd vhci_hcd.0: Device attached [ 304.732392][T12730] vhci_hcd: connection closed [ 304.732573][T10018] vhci_hcd: stop threads [ 304.741770][T10018] vhci_hcd: release socket [ 304.746405][T10018] vhci_hcd: disconnect device [ 304.794096][T12733] tipc: Enabling of bearer rejected, failed to enable media [ 305.135480][T12741] siw: device registration error -23 [ 305.839953][T10654] tipc: Node number set to 43690 [ 306.139779][ T29] kauditd_printk_skb: 225 callbacks suppressed [ 306.139796][ T29] audit: type=1326 audit(1754002784.125:3782): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12753 comm="syz.3.3072" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1d0bf4eb69 code=0x7ffc0000 [ 306.169621][ T29] audit: type=1326 audit(1754002784.125:3783): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12753 comm="syz.3.3072" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f1d0bf4eb69 code=0x7ffc0000 [ 306.193281][ T29] audit: type=1326 audit(1754002784.125:3784): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12753 comm="syz.3.3072" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1d0bf4eb69 code=0x7ffc0000 [ 306.216893][ T29] audit: type=1326 audit(1754002784.125:3785): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12753 comm="syz.3.3072" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1d0bf4eb69 code=0x7ffc0000 [ 306.240383][ T29] audit: type=1326 audit(1754002784.125:3786): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12753 comm="syz.3.3072" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f1d0bf4eb69 code=0x7ffc0000 [ 306.263899][ T29] audit: type=1326 audit(1754002784.125:3787): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12753 comm="syz.3.3072" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1d0bf4eb69 code=0x7ffc0000 [ 306.287442][ T29] audit: type=1326 audit(1754002784.125:3788): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12753 comm="syz.3.3072" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1d0bf4eb69 code=0x7ffc0000 [ 306.311013][ T29] audit: type=1326 audit(1754002784.125:3789): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12753 comm="syz.3.3072" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f1d0bf4eb69 code=0x7ffc0000 [ 306.334641][ T29] audit: type=1326 audit(1754002784.125:3790): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12753 comm="syz.3.3072" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1d0bf4eb69 code=0x7ffc0000 [ 306.358157][ T29] audit: type=1326 audit(1754002784.125:3791): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=12753 comm="syz.3.3072" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f1d0bf4eb69 code=0x7ffc0000 [ 306.369056][T12760] lo speed is unknown, defaulting to 1000 [ 306.428834][T12764] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 306.437516][T12764] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 306.438142][T12754] siw: device registration error -23 [ 306.486894][T12770] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=12770 comm=syz.1.3075 [ 306.564921][T12776] __nla_validate_parse: 42 callbacks suppressed [ 306.564933][T12776] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3078'. [ 306.580420][T12776] FAULT_INJECTION: forcing a failure. [ 306.580420][T12776] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 306.593542][T12776] CPU: 1 UID: 0 PID: 12776 Comm: syz.1.3078 Not tainted 6.16.0-syzkaller-08685-g260f6f4fda93 #0 PREEMPT(voluntary) [ 306.593629][T12776] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 306.593641][T12776] Call Trace: [ 306.593670][T12776] [ 306.593679][T12776] __dump_stack+0x1d/0x30 [ 306.593702][T12776] dump_stack_lvl+0xe8/0x140 [ 306.593742][T12776] dump_stack+0x15/0x1b [ 306.593757][T12776] should_fail_ex+0x265/0x280 [ 306.593790][T12776] should_fail+0xb/0x20 [ 306.593887][T12776] should_fail_usercopy+0x1a/0x20 [ 306.593979][T12776] _copy_from_user+0x1c/0xb0 [ 306.594078][T12776] __sys_sendto+0x19e/0x330 [ 306.594106][T12776] __x64_sys_sendto+0x76/0x90 [ 306.594128][T12776] x64_sys_call+0x2d05/0x2ff0 [ 306.594152][T12776] do_syscall_64+0xd2/0x200 [ 306.594193][T12776] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 306.594217][T12776] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 306.594359][T12776] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 306.594406][T12776] RIP: 0033:0x7f5e8412eb69 [ 306.594420][T12776] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 306.594436][T12776] RSP: 002b:00007f5e82797038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 306.594454][T12776] RAX: ffffffffffffffda RBX: 00007f5e84355fa0 RCX: 00007f5e8412eb69 [ 306.594467][T12776] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005 [ 306.594482][T12776] RBP: 00007f5e82797090 R08: 00002000000000c0 R09: 000000000000001c [ 306.594516][T12776] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 306.594531][T12776] R13: 0000000000000000 R14: 00007f5e84355fa0 R15: 00007ffd3f979a48 [ 306.594551][T12776] [ 306.858834][T12779] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3079'. [ 306.875336][T12779] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3079'. [ 306.907865][T12781] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3080'. [ 306.918351][T12781] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=16 sclass=netlink_audit_socket pid=12781 comm=syz.0.3080 [ 306.961960][T12783] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(4) [ 306.968493][T12783] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 306.976078][T12783] vhci_hcd vhci_hcd.0: Device attached [ 306.985059][T12784] vhci_hcd: connection closed [ 306.985397][T10018] vhci_hcd: stop threads [ 306.994404][T10018] vhci_hcd: release socket [ 306.998818][T10018] vhci_hcd: disconnect device [ 307.180195][T12797] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3086'. [ 307.201741][T12797] lo speed is unknown, defaulting to 1000 [ 307.339816][T12806] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=0 sclass=netlink_tcpdiag_socket pid=12806 comm=syz.3.3089 [ 307.360105][T12806] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3089'. [ 307.410566][T12811] netlink: '+}[@': attribute type 13 has an invalid length. [ 307.468408][T12811] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 307.484092][ T3607] lo speed is unknown, defaulting to 1000 [ 307.489816][ T3607] syz0: Port: 1 Link ACTIVE [ 307.552387][T12826] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 307.560904][T12826] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 307.699242][T10017] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 307.745113][T10017] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 307.763199][T12845] lo speed is unknown, defaulting to 1000 [ 307.787592][T10017] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 307.822280][T12845] chnl_net:caif_netlink_parms(): no params data found [ 307.843199][T10017] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 307.868042][T12845] bridge0: port 1(bridge_slave_0) entered blocking state [ 307.875178][T12845] bridge0: port 1(bridge_slave_0) entered disabled state [ 307.882385][T12845] bridge_slave_0: entered allmulticast mode [ 307.888721][T12845] bridge_slave_0: entered promiscuous mode [ 307.895689][T12845] bridge0: port 2(bridge_slave_1) entered blocking state [ 307.902826][T12845] bridge0: port 2(bridge_slave_1) entered disabled state [ 307.910273][T12845] bridge_slave_1: entered allmulticast mode [ 307.916868][T12845] bridge_slave_1: entered promiscuous mode [ 307.934092][T12845] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 307.944626][T12845] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 307.964932][T12845] team0: Port device team_slave_0 added [ 307.971458][T12845] team0: Port device team_slave_1 added [ 307.986605][T12845] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 307.993633][T12845] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 308.019673][T12845] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 308.031026][T12845] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 308.038109][T12845] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 308.064019][T12845] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 308.091240][T12845] hsr_slave_0: entered promiscuous mode [ 308.097602][T12845] hsr_slave_1: entered promiscuous mode [ 308.104968][T12845] debugfs: 'hsr0' already exists in 'hsr' [ 308.110944][T12845] Cannot create hsr debugfs directory [ 308.150305][T12869] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(4) [ 308.156840][T12869] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 308.164476][T12869] vhci_hcd vhci_hcd.0: Device attached [ 308.176388][T12875] vhci_hcd: connection closed [ 308.176537][ T31] vhci_hcd: stop threads [ 308.185579][ T31] vhci_hcd: release socket [ 308.189990][ T31] vhci_hcd: disconnect device [ 308.331931][T12881] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 308.344856][T12881] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 308.424110][T12884] lo speed is unknown, defaulting to 1000 [ 308.431393][T12887] lo speed is unknown, defaulting to 1000 [ 308.474092][T12889] lo speed is unknown, defaulting to 1000 [ 308.515720][T12895] usb usb1: usbfs: interface 0 claimed by hub while 'syz.4.3113' sets config #1 [ 308.549872][T12896] team0 (unregistering): Port device team_slave_0 removed [ 308.558959][T12896] team0 (unregistering): Port device team_slave_1 removed [ 308.665738][T10017] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 308.675735][T10017] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 308.688578][T10017] bond0 (unregistering): Released all slaves [ 308.698159][T10017] bond1 (unregistering): Released all slaves [ 308.707224][T10017] bond2 (unregistering): Released all slaves [ 308.717235][T10017] bond3 (unregistering): Released all slaves [ 308.725418][T10017] bond4 (unregistering): Released all slaves [ 308.733858][T10017] bond5 (unregistering): Released all slaves [ 308.750690][T12905] lo speed is unknown, defaulting to 1000 [ 308.779590][T10017] hsr_slave_0: left promiscuous mode [ 308.785280][T10017] hsr_slave_1: left promiscuous mode [ 308.790961][T10017] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 308.798444][T10017] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 308.806929][T10017] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 308.814815][T10017] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 308.826776][T10017] veth1_macvtap: left promiscuous mode [ 308.832297][T10017] veth0_macvtap: left promiscuous mode [ 308.837878][T10017] veth1_vlan: left promiscuous mode [ 308.843190][T10017] veth0_vlan: left promiscuous mode [ 308.881143][T12911] usb usb1: usbfs: interface 0 claimed by hub while 'syz.0.3118' sets config #1 [ 308.968366][ T3409] lo speed is unknown, defaulting to 1000 [ 308.974151][ T3409] infiniband syz0: ib_query_port failed (-19) [ 308.995657][T12917] usb usb1: usbfs: interface 0 claimed by hub while 'syz.0.3121' sets config #1 [ 309.005154][T12917] FAULT_INJECTION: forcing a failure. [ 309.005154][T12917] name failslab, interval 1, probability 0, space 0, times 0 [ 309.017880][T12917] CPU: 0 UID: 0 PID: 12917 Comm: syz.0.3121 Not tainted 6.16.0-syzkaller-08685-g260f6f4fda93 #0 PREEMPT(voluntary) [ 309.017907][T12917] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 309.017918][T12917] Call Trace: [ 309.017924][T12917] [ 309.017932][T12917] __dump_stack+0x1d/0x30 [ 309.017949][T12917] dump_stack_lvl+0xe8/0x140 [ 309.018037][T12917] dump_stack+0x15/0x1b [ 309.018056][T12917] should_fail_ex+0x265/0x280 [ 309.018090][T12917] should_failslab+0x8c/0xb0 [ 309.018120][T12917] kmem_cache_alloc_noprof+0x50/0x310 [ 309.018214][T12917] ? security_inode_alloc+0x37/0x100 [ 309.018239][T12917] security_inode_alloc+0x37/0x100 [ 309.018264][T12917] inode_init_always_gfp+0x4b7/0x500 [ 309.018314][T12917] ? __pfx_shmem_alloc_inode+0x10/0x10 [ 309.018335][T12917] alloc_inode+0x58/0x170 [ 309.018356][T12917] new_inode+0x1d/0xe0 [ 309.018380][T12917] shmem_get_inode+0x244/0x750 [ 309.018406][T12917] __shmem_file_setup+0x113/0x210 [ 309.018511][T12917] shmem_file_setup+0x3b/0x50 [ 309.018544][T12917] __se_sys_memfd_create+0x2c3/0x590 [ 309.018567][T12917] __x64_sys_memfd_create+0x31/0x40 [ 309.018589][T12917] x64_sys_call+0x2abe/0x2ff0 [ 309.018617][T12917] do_syscall_64+0xd2/0x200 [ 309.018650][T12917] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 309.018680][T12917] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 309.018709][T12917] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 309.018732][T12917] RIP: 0033:0x7fc15e3ceb69 [ 309.018814][T12917] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 309.018834][T12917] RSP: 002b:00007fc15ca36e18 EFLAGS: 00000202 ORIG_RAX: 000000000000013f [ 309.018856][T12917] RAX: ffffffffffffffda RBX: 000000000000055f RCX: 00007fc15e3ceb69 [ 309.018870][T12917] RDX: 00007fc15ca36ef0 RSI: 0000000000000000 RDI: 00007fc15e452784 [ 309.018885][T12917] RBP: 0000200000000d00 R08: 00007fc15ca36bb7 R09: 00007fc15ca36e40 [ 309.018897][T12917] R10: 000000000000000a R11: 0000000000000202 R12: 0000200000000040 [ 309.018909][T12917] R13: 00007fc15ca36ef0 R14: 00007fc15ca36eb0 R15: 0000200000000080 [ 309.018926][T12917] [ 309.414989][T12929] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(4) [ 309.421560][T12929] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 309.429122][T12929] vhci_hcd vhci_hcd.0: Device attached [ 309.489897][T12934] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3123'. [ 309.517838][T12934] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3123'. [ 309.547484][T12930] vhci_hcd: connection closed [ 309.550708][T12936] FAULT_INJECTION: forcing a failure. [ 309.550708][T12936] name failslab, interval 1, probability 0, space 0, times 0 [ 309.568140][T12936] CPU: 1 UID: 0 PID: 12936 Comm: syz.3.3128 Not tainted 6.16.0-syzkaller-08685-g260f6f4fda93 #0 PREEMPT(voluntary) [ 309.568203][T12936] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 309.568271][T12936] Call Trace: [ 309.568278][T12936] [ 309.568285][T12936] __dump_stack+0x1d/0x30 [ 309.568308][T12936] dump_stack_lvl+0xe8/0x140 [ 309.568328][T12936] dump_stack+0x15/0x1b [ 309.568342][T12936] should_fail_ex+0x265/0x280 [ 309.568437][T12936] should_failslab+0x8c/0xb0 [ 309.568467][T12936] kmem_cache_alloc_noprof+0x50/0x310 [ 309.568496][T12936] ? radix_tree_node_alloc+0x8a/0x1f0 [ 309.568524][T12936] radix_tree_node_alloc+0x8a/0x1f0 [ 309.568559][T12936] idr_get_free+0x1fa/0x550 [ 309.568585][T12936] idr_alloc_u32+0xca/0x180 [ 309.568620][T12936] tcf_idr_check_alloc+0x193/0x240 [ 309.568758][T12936] tcf_bpf_init+0x1a8/0x610 [ 309.568798][T12936] tcf_action_init_1+0x36a/0x4a0 [ 309.568871][T12936] tcf_action_init+0x267/0x6d0 [ 309.568925][T12936] tc_ctl_action+0x291/0x830 [ 309.569051][T12936] ? __pfx_tc_ctl_action+0x10/0x10 [ 309.569143][T12936] rtnetlink_rcv_msg+0x657/0x6d0 [ 309.569175][T12936] netlink_rcv_skb+0x120/0x220 [ 309.569200][T12936] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 309.569240][T12936] rtnetlink_rcv+0x1c/0x30 [ 309.569333][T12936] netlink_unicast+0x5c0/0x690 [ 309.569355][T12936] netlink_sendmsg+0x58b/0x6b0 [ 309.569422][T12936] ? __pfx_netlink_sendmsg+0x10/0x10 [ 309.569447][T12936] __sock_sendmsg+0x145/0x180 [ 309.569482][T12936] ____sys_sendmsg+0x31e/0x4e0 [ 309.569573][T12936] ___sys_sendmsg+0x17b/0x1d0 [ 309.569605][T12936] __x64_sys_sendmsg+0xd4/0x160 [ 309.569705][T12936] x64_sys_call+0x191e/0x2ff0 [ 309.569726][T12936] do_syscall_64+0xd2/0x200 [ 309.569763][T12936] ? arch_exit_to_user_mode_prepare+0x27/0x60 [ 309.569791][T12936] ? irqentry_exit_to_user_mode+0x7e/0xa0 [ 309.569891][T12936] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 309.569989][T12936] RIP: 0033:0x7f1d0bf4eb69 [ 309.570007][T12936] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 309.570028][T12936] RSP: 002b:00007f1d0a5af038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 309.570093][T12936] RAX: ffffffffffffffda RBX: 00007f1d0c175fa0 RCX: 00007f1d0bf4eb69 [ 309.570106][T12936] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003 [ 309.570120][T12936] RBP: 00007f1d0a5af090 R08: 0000000000000000 R09: 0000000000000000 [ 309.570134][T12936] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 309.570148][T12936] R13: 0000000000000000 R14: 00007f1d0c175fa0 R15: 00007ffdab7b27c8 [ 309.570173][T12936] [ 309.837507][ T31] vhci_hcd: stop threads [ 309.841783][ T31] vhci_hcd: release socket [ 309.846216][ T31] vhci_hcd: disconnect device [ 309.849443][T12845] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 309.861255][T12938] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 309.869973][T12938] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 309.879894][T12845] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 309.889240][T12845] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 309.898001][T12845] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 309.906538][T12943] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 309.914984][T12943] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 309.935159][T12845] 8021q: adding VLAN 0 to HW filter on device bond0 [ 309.946523][T12845] 8021q: adding VLAN 0 to HW filter on device team0 [ 309.956376][T10010] bridge0: port 1(bridge_slave_0) entered blocking state [ 309.963504][T10010] bridge0: port 1(bridge_slave_0) entered forwarding state [ 309.981913][T12845] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 309.992342][T12845] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 310.015187][ T3432] bridge0: port 2(bridge_slave_1) entered blocking state [ 310.022287][ T3432] bridge0: port 2(bridge_slave_1) entered forwarding state [ 310.055606][T12845] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 310.149823][T12960] 9pnet_fd: Insufficient options for proto=fd [ 310.158329][T12960] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=770 sclass=netlink_route_socket pid=12960 comm=syz.0.3130 [ 310.163197][T12845] veth0_vlan: entered promiscuous mode [ 310.187484][T12960] netlink: 'syz.0.3130': attribute type 1 has an invalid length. [ 310.188724][T12845] veth1_vlan: entered promiscuous mode [ 310.195278][T12960] netlink: 224 bytes leftover after parsing attributes in process `syz.0.3130'. [ 310.212352][T12845] veth0_macvtap: entered promiscuous mode [ 310.225792][T12845] veth1_macvtap: entered promiscuous mode [ 310.235898][T12845] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 310.244567][T12845] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 310.262359][ T52] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 310.276146][ T52] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 310.285427][ T52] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 310.297523][ T52] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 310.515204][T12984] team0 (unregistering): Port device team_slave_0 removed [ 310.534425][T12984] team0 (unregistering): Port device team_slave_1 removed [ 310.562024][T12983] 8021q: adding VLAN 0 to HW filter on device bond0 [ 310.582797][T12983] bond0: (slave ip6tnl0): The slave device specified does not support setting the MAC address [ 310.595365][T12983] bond0: (slave ip6tnl0): Error -95 calling set_mac_address [ 310.612470][T12996] ================================================================== [ 310.620581][T12996] BUG: KCSAN: data-race in memcpy_and_pad / release_task [ 310.627626][T12996] [ 310.629938][T12996] write to 0xffff88810ab5b648 of 8 bytes by task 3301 on cpu 1: [ 310.637572][T12996] release_task+0x6f9/0xb60 [ 310.642067][T12996] wait_consider_task+0x114a/0x1660 [ 310.647256][T12996] __do_wait+0xfa/0x510 [ 310.651395][T12996] do_wait+0xb7/0x260 [ 310.655365][T12996] kernel_wait4+0x16b/0x1e0 [ 310.659871][T12996] __x64_sys_wait4+0x91/0x120 [ 310.664530][T12996] x64_sys_call+0x2a66/0x2ff0 [ 310.669184][T12996] do_syscall_64+0xd2/0x200 [ 310.673675][T12996] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 310.679575][T12996] [ 310.681885][T12996] read to 0xffff88810ab5b180 of 3264 bytes by task 12996 on cpu 0: [ 310.689762][T12996] memcpy_and_pad+0x48/0x80 [ 310.694267][T12996] arch_dup_task_struct+0x2c/0x40 [ 310.699282][T12996] dup_task_struct+0x83/0x6a0 [ 310.703951][T12996] copy_process+0x399/0x2000 [ 310.708531][T12996] kernel_clone+0x16c/0x5c0 [ 310.713025][T12996] __x64_sys_clone+0xe6/0x120 [ 310.717694][T12996] x64_sys_call+0x119c/0x2ff0 [ 310.722357][T12996] do_syscall_64+0xd2/0x200 [ 310.726859][T12996] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 310.732737][T12996] [ 310.735042][T12996] Reported by Kernel Concurrency Sanitizer on: [ 310.741174][T12996] CPU: 0 UID: 0 PID: 12996 Comm: dhcpcd-run-hook Not tainted 6.16.0-syzkaller-08685-g260f6f4fda93 #0 PREEMPT(voluntary) [ 310.753746][T12996] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 310.763789][T12996] ==================================================================