last executing test programs: 2.526789105s ago: executing program 0 (id=1): syz_emit_ethernet(0x3c, &(0x7f0000000d80)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000181004000001142802f1d2237cf1a602a55f78b46a32a95382023ecb8dc46afb86d42958ee668e133192144fac54a9a4f"], 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) r5 = gettid() fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) tkill(r5, 0xb) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZEX(r6, 0x560a, &(0x7f00000006c0)={0x4, 0x0, 0x0, 0x0, 0x132, 0x3}) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r7, 0x0, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r8 = socket$igmp(0x2, 0x3, 0x2) setsockopt$IPT_SO_SET_REPLACE(r8, 0x0, 0x40, &(0x7f0000000040)=@raw={'raw\x00', 0x8, 0x3, 0x308, 0x0, 0x43, 0xa0, 0x148, 0x98, 0x270, 0x178, 0x178, 0x270, 0x178, 0x49, 0x0, {[{{@ip={@loopback, @local, 0x0, 0x0, 'veth0_to_bond\x00', 'ip6erspan0\x00', {}, {}, 0x0, 0x0, 0x40}, 0x12a, 0xe0, 0x148, 0x0, {0x0, 0x7a010000}, [@common=@unspec=@state={{0x28}, {0xfffffffe}}, @common=@unspec=@helper={{0x48}, {0x0, 'snmp\x00'}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0xfff, 0x0, 0x7, '\x00', 'syz1\x00', {0xd063}}}}, {{@uncond, 0x0, 0xc8, 0x128, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x6}}, @common=@addrtype={{0x30}, {0x4, 0x810, 0x0, 0x1}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv4=@multicast1, [0x0, 0xff000000, 0x0, 0xffffff00], 0x1000, 0x0, 0x4e24, 0x0, 0x0, 0x0, 0x16b}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x368) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x8995, &(0x7f0000000500)={'ip_vti0\x00', 0x0}) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x12, 0x4, 0x20000004, 0x212, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0xfffffffc}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b80)={0x15, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000400000018110000", @ANYRES32=r9, @ANYRESDEC=r5], &(0x7f0000000240)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0xc}, 0x94) 2.022822871s ago: executing program 4 (id=5): r0 = socket$inet_udp(0x2, 0x2, 0x0) syz_emit_vhci(0x0, 0x7) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001c40)={0x8, 0x3, &(0x7f0000001300)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000001200)='syzkaller\x00'}, 0x80) r5 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) process_vm_readv(0x0, &(0x7f00000015c0)=[{&(0x7f00000000c0)=""/190, 0xbe}, {&(0x7f0000000180)=""/112, 0x70}, {0x0}, {&(0x7f0000000340)=""/94, 0x5e}, {&(0x7f00000003c0)=""/176, 0xb0}, {&(0x7f0000000480)=""/80, 0x50}], 0x6, 0xffffffffffffffff, 0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0x80) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000003c0)={r4, r6}, 0x10) r7 = fsopen(&(0x7f0000000080)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) r8 = fsmount(r7, 0x0, 0x8) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000280)={@fallback=r8, 0x0, 0x0, 0xce2c, &(0x7f0000002100)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0}, 0x40) r9 = io_uring_setup(0x3c46, &(0x7f0000000880)={0x0, 0xeb7f, 0x3000, 0x2, 0x26c}) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r9, 0xd, &(0x7f0000000140)={0x7, 0x0, 0x0, 0x0}, 0x20) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r9, 0xe, &(0x7f0000001180)={0x1010, 0x0, &(0x7f0000000100)=[{0x0}], 0x0, 0x1}, 0x20) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) syz_open_dev$video4linux(0x0, 0x0, 0x0) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) getsockopt$inet_int(r0, 0x0, 0x15, 0x0, &(0x7f00000010c0)) openat$vcs(0xffffffffffffff9c, 0x0, 0x523003, 0x0) 1.545303944s ago: executing program 0 (id=6): r0 = socket$inet_udp(0x2, 0x2, 0x0) syz_emit_vhci(0x0, 0x7) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001c40)={0x8, 0x3, &(0x7f0000001300)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000001200)='syzkaller\x00'}, 0x80) r5 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) process_vm_readv(0x0, &(0x7f00000015c0)=[{&(0x7f00000000c0)=""/190, 0xbe}, {&(0x7f0000000180)=""/112, 0x70}, {0x0}, {&(0x7f0000000340)=""/94, 0x5e}, {&(0x7f00000003c0)=""/176, 0xb0}, {&(0x7f0000000480)=""/80, 0x50}], 0x6, 0xffffffffffffffff, 0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0x80) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000003c0)={r4, r6}, 0x10) r7 = fsopen(&(0x7f0000000080)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) r8 = fsmount(r7, 0x0, 0x8) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000280)={@fallback=r8, 0x0, 0x0, 0xce2c, &(0x7f0000002100)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0}, 0x40) r9 = io_uring_setup(0x3c46, &(0x7f0000000880)={0x0, 0xeb7f, 0x3000, 0x2, 0x26c}) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r9, 0xd, &(0x7f0000000140)={0x7, 0x0, 0x0, 0x0}, 0x20) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r9, 0xe, &(0x7f0000001180)={0x1010, 0x0, &(0x7f0000000100), 0x0}, 0x20) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) syz_open_dev$video4linux(0x0, 0x0, 0x0) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) getsockopt$inet_int(r0, 0x0, 0x15, 0x0, &(0x7f00000010c0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x523003, 0x0) 4.55804ms ago: executing program 1 (id=2): r0 = socket$inet_udp(0x2, 0x2, 0x0) syz_emit_vhci(0x0, 0x7) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000040)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001c40)={0x8, 0x3, &(0x7f0000001300)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000001200)='syzkaller\x00'}, 0x80) semop(0x0, 0xffffffffffffffff, 0x53) r5 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) process_vm_readv(0x0, &(0x7f00000015c0)=[{&(0x7f00000000c0)=""/190, 0xbe}, {&(0x7f0000000180)=""/112, 0x70}, {0x0}, {&(0x7f0000000340)=""/94, 0x5e}, {&(0x7f00000003c0)=""/176, 0xb0}, {&(0x7f0000000480)=""/80, 0x50}], 0x6, 0xffffffffffffffff, 0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0x80) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000003c0)={r4, r6}, 0x10) r7 = fsopen(&(0x7f0000000080)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) r8 = fsmount(r7, 0x0, 0x8) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000280)={@fallback=r7, 0x11, 0x0, 0xce2c, &(0x7f0000002100)=[0x0], 0x1, 0x0, 0x0, 0x0, 0x0}, 0x40) r9 = io_uring_setup(0x3c46, &(0x7f0000000880)={0x0, 0xeb7b, 0x3000, 0x82, 0x2d2}) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r8, 0xd, &(0x7f0000000140)={0x7, 0x0, 0x0, 0x0, 0x10}, 0x20) io_uring_register$IORING_REGISTER_FILES_UPDATE2(r9, 0xe, &(0x7f0000001180)={0x1010, 0x0, &(0x7f0000000100)=[{0x0}], 0x0, 0x1}, 0x20) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) syz_open_dev$video4linux(0x0, 0x0, 0x0) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x4) getsockopt$inet_int(r0, 0x0, 0x15, 0x0, &(0x7f00000010c0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x523003, 0x0) 3.62363ms ago: executing program 4 (id=7): socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x103a42, 0x32) r3 = inotify_init1(0x0) inotify_add_watch(r3, &(0x7f0000000000)='./file1\x00', 0x40000104) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2060, 0x0) fsetxattr$trusted_overlay_redirect(r4, &(0x7f0000000040), 0x0, 0x0, 0x0) fremovexattr(r4, &(0x7f00000000c0)=@known='trusted.overlay.redirect\x00') socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r5, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f00000000c0)=[{0x28, 0x7, 0x0, 0xa56e}, {0x6, 0x0, 0x0, 0xa1a}]}, 0x10) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r6, &(0x7f0000000180)={0x2, 0x4e22, @local}, 0x10) 3.273027ms ago: executing program 3 (id=4): r0 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r0, &(0x7f0000000040)={0xa, 0x7, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8, 0x1}, 0x20) r1 = socket$l2tp6(0xa, 0x2, 0x73) r2 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f0000000000)={'filter\x00', 0x7, 0x4, 0x3e0, 0x110, 0x110, 0x0, 0x2f8, 0x2f8, 0x2f8, 0x4, 0x0, {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac, @mac=@remote, @loopback, @local, 0x1, 0xffffffff}}}, {{@arp={@multicast2, @private=0xa010100, 0xff, 0xffffff00, 0xc, 0x4, {@mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, {[0xff, 0xff, 0xff, 0xff, 0x0, 0xbe9240b8a223bba0]}}, {@mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x24}, {[0xff, 0x0, 0xff, 0xff, 0xff]}}, 0x2, 0x6, 0x23b0, 0x9dd7, 0x80, 0x9, 'veth1_vlan\x00', 'ip_vti0\x00', {0xff}, {0xff}, 0x0, 0x12}, 0xc0, 0x100}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "716ebd2e1aa0cc683e62f312359594df00da56317f76121697127951fdba"}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE0={0x28}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x430) bind$l2tp6(r1, &(0x7f0000000040)={0xa, 0x7, 0x0, @dev={0xfe, 0x80, '\x00', 0xb}, 0x8, 0x400000}, 0x20) r3 = socket$inet(0x2, 0x2, 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x281c2, 0x0) fcntl$setlease(r4, 0x400, 0x1) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x10000, 0x120) openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x89) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/locks\x00', 0x0, 0x0) pread64(r2, &(0x7f0000000500)=""/136, 0xb0, 0x5) setsockopt$inet6_int(r0, 0x29, 0x42, &(0x7f0000000180)=0x2, 0x4) sendmsg$inet(r3, &(0x7f0000000080)={&(0x7f0000000000)={0x2, 0x4a23, @multicast2}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000100)='\b\x00', 0x2}, {&(0x7f00000004c0)="96bc1480bb58", 0x6}], 0x2, &(0x7f0000000200)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x200}}], 0x18}, 0x40090) r6 = socket$kcm(0x23, 0x5, 0x0) listen(r6, 0x800) r7 = socket$kcm(0x10, 0x2, 0x0) r8 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r8, &(0x7f00000005c0), 0x10) recvmmsg(r8, &(0x7f00000069c0)=[{{0x0, 0x0, 0x0}, 0x9}, {{0x0, 0x0, &(0x7f0000000200)=[{0x0, 0x38}, {&(0x7f0000000600)=""/164, 0xa4}], 0x2}, 0x9}], 0x2, 0x10002, 0x0) sendmsg$can_bcm(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[], 0x48}, 0x1, 0x0, 0x0, 0x801}, 0x40080) sendmsg$inet(r7, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000f00)=[{&(0x7f0000000200)="5c00000014006b05c84e21000ab16d6e230675f811000000440002005817d30461bc24eeb556a7ef595105ea1698fa51f60a64c9f408000000e786a6d0bdbdc3d44bd70011b6c0504bb9189d9193e9bd00"/92, 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x240040c4) r9 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r9, &(0x7f0000000040)={0x23, 0x0, 0x58}, 0x10) accept4(r6, 0x0, 0x0, 0x80000) r10 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, &(0x7f0000000100)}) setsockopt$PNPIPE_ENCAP(r9, 0x113, 0x1, &(0x7f0000000080)=0x1, 0x4) close_range(r6, r9, 0x0) close_range(r10, 0xffffffffffffffff, 0x0) 2.961898ms ago: executing program 2 (id=3): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000480)={'wlan0\x00'}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140100001000010000000000000000000a20000000000a01010000000000000000070000000900010073797a30000000002c0000000c0a000900010073797a6ec8ca450a321a946a300000040000000000000004400000daa66f4ed2c6d7000002000000000000000000840000a735681e4380d499ef54ce4f120cff313be4b87060b2b8000000000000000000000000060000"], 0x74}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x8) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000001700)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) ptrace$PTRACE_GETSIGMASK(0x420a, 0x0, 0x0, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) getsockopt$packet_int(r8, 0x107, 0xb, 0xffffffffffffffff, &(0x7f00000001c0)=0x4a) r9 = socket$kcm(0x10, 0x2, 0x4) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x2, 0x6, 0x2, 0x87, 0xffffffff, 0x40}) sendmsg$kcm(r9, 0x0, 0x0) recvmsg$kcm(r9, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a40)={0x258, r4, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_PEERS={0x20c, 0x8, 0x0, 0x1, [{0x134, 0x0, 0x0, 0x1, [@WGPEER_A_ALLOWEDIPS={0xec, 0x9, 0x0, 0x1, [{0xe8, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x22}}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @local}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @local}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @rand_addr=0x64010102}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @ipv4={'\x00', '\xff\xff', @local}}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @private1={0xfc, 0x1, '\x00', 0x1}}, {0x5}}]}]}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @a_g}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e21, 0x7, @loopback, 0x6d2}}]}, {0x84, 0x0, 0x0, 0x1, [@WGPEER_A_ALLOWEDIPS={0x5c, 0x9, 0x0, 0x1, [{0x58, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @multicast1}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @private2}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @private=0xa010100}, {0x5, 0x3, 0x3}}]}]}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "491bc0be1dc1f88092e741a88b64f6dd9218ad21b44b472e44f1d0807ee6675c"}]}, {0x50, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x9, 0x7, @empty, 0x3}}, @WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0xe8}]}]}, @WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @b}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}]}, 0x258}, 0x1, 0x0, 0x0, 0x4004840}, 0x40804) syz_usb_connect(0x0, 0x202, &(0x7f0000000180)=ANY=[@ANYBLOB], 0x0) syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) 2.185863ms ago: executing program 0 (id=8): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DEL(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="e00000000a06010100000000000000000300000908000940800000010900020073797a310000000005000100070000000800094000000005880008"], 0x13a}, 0x1, 0x0, 0x0, 0x4800}, 0x48080) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) socket$netlink(0x10, 0x3, 0x0) syz_mount_image$ext4(&(0x7f0000000740)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x40, &(0x7f00000000c0)={[{@mblk_io_submit}, {@init_itable_val}, {@minixdf}, {@jqfmt_vfsv1}, {@jqfmt_vfsold}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x100}}, {@barrier_val={'barrier', 0x3d, 0xb}}, {@errors_remount}, {@auto_da_alloc}, {@test_dummy_encryption}, {@min_batch_time={'min_batch_time', 0x3d, 0x4}}]}, 0xdf, 0x475, &(0x7f0000000780)="$eJzs289vFFUcAPDvTLeAgGxFREGQKpo0/mhpQeVgYjSaeNDERA94rG0hyEINrYmQRqsxeDQk3o1HE/8CT56MejLxikcTQ0KUmIheXDO7M6VddssubNna/XySoe/NvHk/dubNvn2PCaBvDWf/JBHbI+JSRJTr0ZUJhut/rl1dmPr76sJUEtXqG78ntXR/XV2YquaK87bleY6kEeknSV5IDC7Pdu7c+VOTlcrM2Tw+Nn/63bG5c+efOnl68sTMiZkzE0ePHjk8/uwzE083qfWvFztq5ED+d+8Hs/v2vPLWxdemjl18+4evs/ru3l8/lLWjozzbMJw1/I/6Z9N47LFuF9Zj/1avtzMp9bo2tCvrGqW8c16KcgzE9YtXjpc/7mnlgDWVPbM3tz68WAU2sCR6XQOgN4ov+uz3b7HdoaHHunDlhfoPoKzd1/KtfqQUaZ5mcA3LH46IY4v/fJFt0TAPUW0ybwAAcLu+zcY/TzYb/6Wxe1m6Hfna0FBE3BMROyPi3ojYFRH3RdTS3h8RD3RY/nBD/MbxZ3r5lhrWpmz891y+trVy/FeM/mJoII/dXWv/YHL8ZGXmUP6ZjMTg5iw+3izzIouXfv6sVfnLx3/ZlpVfjAXzTC6X6hN0W4o905Pzk90alF75KGJvqVn7k6WVgCQi9kTE3s6y3lEETj7+1b5WiW7e/lV0YZ2p+mWRycJiNLS/kKy+Pjm2JSozh8aKu+JGP/504fVW5d9W+7sgu/5bV97/DSnKfybL12vnlg48324ZF375tOVvylL79/+S7P7flLxZW7PelO97f3J+/ux4xKbk1Vp8xf6J6+cW8SJ91v6Rg837/878nKz9D0ZEdhPvj4iHIuJAfu0ejohHIuLgKu3//sVH32l1bD1c/+mmz7+l+39o5fXvPDBw6rtvWpXf3vPvSC00ku+pPf9uonV1isdotufY3K1+bgAAAPB/kkbE9kjS0aVwmo6O1v8P/67YmlZm5+afOD773pnp+jsCQzGYFjNd5WXzoePJYp5jPT6RzxUXxw/n88afD9xVi49OzVame9x26HfbWvT/zG8Dva4dsOa8rwX9q7H/pz2qB3Dn+f6H/qX/Q/+6of97IEDfaNbdP2yIWwuAjaha7vgUE4SwYRjuQ//S/6F/6f/Ql27nvf61CpRWeXtfoMeBrRFRC0S6LuqzbgIH1lFvKnWhd/f4wQQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANAl/wUAAP//xgL2dQ==") openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeeb, 0x8031, 0xffffffffffffffff, 0xbf5ce000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x0, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) symlinkat(&(0x7f0000001040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00') r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="4c000000020681010000000000000000000000000500050002000000050001000700000005000400030000000900020073797a310000000011000300686173683a6e65742c6e6574"], 0x4c}, 0x1, 0x0, 0x0, 0x4040000}, 0x800) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000580)={0x50, 0x9, 0x6, 0x201, 0x0, 0x0, {0x3}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP2={0xc, 0x14, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @remote}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @rand_addr=0x64010101}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0xd24f4d5778621d46}, 0x4) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r7, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) 0s ago: executing program 1 (id=9): r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000140)={0xbf48ce7, "1803c80980000000080000000003000000d600", 0xffffffffffffffff}) r2 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x0, 0xc95a, 0xf, 0x8, 0x80, 0x4, 0x3, 0x80000000, 0x20000006, 0x1, 0x9, 0x5d, 0x9, 0x5, 0xffff2d37, 0xffffff03, 0x6, 0x3, 0x0, 0xe, 0x4, 0x0, 0x7, 0x23c5b, 0x1, 0x20, 0xd, 0x7, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x4, 0xa, 0x4c74, 0x80000003, 0x242, 0x3, 0x6, 0x0, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x6, 0x3e, 0x4000008c, 0x6, 0x7, 0x0, 0x4, 0x4, 0x8008, 0x400, 0x80, 0x10, 0x6, 0x6, 0x6, 0x4, 0x11, 0xf], [0x10000007, 0x9, 0x8000012f, 0x2008004, 0x5, 0xfffffff3, 0x129432e8, 0xc8, 0xf9, 0xe, 0x2c0, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0x0, 0x312, 0x78, 0xe, 0x0, 0x4, 0x7, 0x7fff, 0x5, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f2e, 0x1, 0x4e2, 0xc, 0x4, 0xb, 0x10000, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x0, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0x953, 0x48c93690, 0x42, 0x3], [0x5, 0x408, 0x7, 0x5, 0xfffffffe, 0x6, 0x8d2, 0x9, 0x5, 0x8002, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0x3e7, 0xb, 0xffff, 0x2, 0x2, 0x3, 0x2, 0x24, 0x6d01, 0x3, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0xc8, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xca, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0xa3ae, 0x1, 0x1c, 0x120000, 0x3, 0x2006, 0x5, 0x4, 0x3c484551], [0x9, 0xbb33, 0x7, 0x0, 0x5, 0x93a, 0x5, 0x2, 0xfffffffc, 0xb9, 0xce7, 0x203, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10000, 0x2000004, 0x3, 0x28, 0xa620, 0x2, 0x5, 0x1, 0x7ff, 0x14c, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x4, 0xc8, 0xfffffff9, 0xfffff000, 0x10000, 0x0, 0x7e, 0x100, 0x9602, 0x7, 0xaf, 0x5, 0xfffffff7, 0x226, 0x5, 0x5, 0x8, 0x30b1d693, 0xb1f, 0x8, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) ioctl$SYNC_IOC_MERGE(r1, 0xc0303e03, &(0x7f0000000100)={"6739669f274d13b691eb645b00e4f5b53e0ca34dd02ac6cdc67c5e3126628168", r1, 0xffffffffffffffff}) r7 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000180), 0x28d00, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, &(0x7f0000000240)={0x1b, "8a6035ceeae3ecc42317afad010000000000000400", 0xffffffffffffffff}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r7, 0xc0285700, &(0x7f00000004c0)={0x9, "34e6498c270e0000b56a000005000000000000000000000000000100", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r6, 0xc0303e03, &(0x7f00000000c0)={"0e337b42cc00d331ff0007000000000000001a00", r9, 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r8, 0xc0303e03, &(0x7f0000000040)={"130f2672af9ee0452321864922cd3bebd7f9cec5064e58445f1268334b4900", r10}) r11 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x5a042, 0x0) unshare(0x26000400) getsockopt$MRT(r11, 0x0, 0xce, &(0x7f0000000140), &(0x7f00000001c0)=0x4) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r12, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000880)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a20000000000a01030000000000000000010000000900010073797a31000000002c000000030a01020000000000000000000000000900030073797a3000000000f0fe010073797a31000000003c000000050a01010000000000000000010020000c00024000000000000000010900010073797a3100000000100008800c000209000000000000000f140000001100010000000000000000000000000a"], 0xb0}, 0x1, 0x0, 0x0, 0x20000014}, 0x0) r13 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(r13, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x6}]}, 0x10) syz_emit_ethernet(0x2a, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaafad1e048716e08004500001c00000000001190780000d2552564000000004e2000089078"], 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.193' (ED25519) to the list of known hosts. [ 28.176588][ T4653] cgroup: Unknown subsys name 'net' [ 28.276144][ T4653] cgroup: Unknown subsys name 'cpuset' [ 28.278437][ T4653] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 28.458840][ T4653] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 29.257747][ T4679] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 29.258341][ T4679] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 29.258490][ T4679] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 29.258627][ T4679] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 29.258759][ T4679] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 29.259602][ T4679] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 29.259679][ T4679] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 29.259898][ T4679] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 29.260494][ T4679] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 29.260718][ T4679] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 29.272548][ T4681] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 29.274460][ T4681] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 29.277808][ T4680] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 29.277953][ T4679] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 29.281130][ T4680] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 29.282611][ T4681] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 29.284174][ T4680] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 29.286294][ T4675] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 29.288010][ T4681] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 29.289756][ T4681] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 29.291564][ T4681] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 29.293262][ T4675] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 29.296784][ T4669] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 29.300856][ T4681] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 29.303002][ T4681] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 29.648457][ T4668] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.650292][ T4668] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.651905][ T4668] bridge_slave_0: entered allmulticast mode [ 29.655491][ T4668] bridge_slave_0: entered promiscuous mode [ 29.660888][ T4668] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.660968][ T4668] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.661041][ T4668] bridge_slave_1: entered allmulticast mode [ 29.661493][ T4668] bridge_slave_1: entered promiscuous mode [ 29.692738][ T4668] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.715969][ T4668] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.741212][ T4670] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.741265][ T4670] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.741369][ T4670] bridge_slave_0: entered allmulticast mode [ 29.741879][ T4670] bridge_slave_0: entered promiscuous mode [ 29.742620][ T4670] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.742643][ T4670] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.742698][ T4670] bridge_slave_1: entered allmulticast mode [ 29.743153][ T4670] bridge_slave_1: entered promiscuous mode [ 29.750316][ T4670] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.751227][ T4670] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.757905][ T4670] team0: Port device team_slave_0 added [ 29.759695][ T4668] team0: Port device team_slave_0 added [ 29.769233][ T4670] team0: Port device team_slave_1 added [ 29.772099][ T4665] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.773504][ T4665] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.774836][ T4665] bridge_slave_0: entered allmulticast mode [ 29.775276][ T4665] bridge_slave_0: entered promiscuous mode [ 29.776153][ T4665] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.776179][ T4665] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.776235][ T4665] bridge_slave_1: entered allmulticast mode [ 29.776658][ T4665] bridge_slave_1: entered promiscuous mode [ 29.783454][ T4668] team0: Port device team_slave_1 added [ 29.796431][ T4665] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.797427][ T4665] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.806580][ T4666] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.807991][ T4666] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.809682][ T4666] bridge_slave_0: entered allmulticast mode [ 29.811549][ T4666] bridge_slave_0: entered promiscuous mode [ 29.815920][ T4670] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.817312][ T4670] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.822439][ T4670] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.825700][ T4670] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.825723][ T4670] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.825739][ T4670] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.835643][ T4665] team0: Port device team_slave_0 added [ 29.836480][ T4665] team0: Port device team_slave_1 added [ 29.845252][ T4665] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.845279][ T4665] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.845606][ T4665] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.845856][ T4666] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.845888][ T4666] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.845953][ T4666] bridge_slave_1: entered allmulticast mode [ 29.846747][ T4666] bridge_slave_1: entered promiscuous mode [ 29.865689][ T4670] hsr_slave_0: entered promiscuous mode [ 29.866057][ T4670] hsr_slave_1: entered promiscuous mode [ 29.866900][ T4668] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.866908][ T4668] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.866923][ T4668] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.867547][ T4668] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.867554][ T4668] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.867568][ T4668] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.877751][ T4668] hsr_slave_0: entered promiscuous mode [ 29.878045][ T4668] hsr_slave_1: entered promiscuous mode [ 29.878245][ T4668] debugfs: 'hsr0' already exists in 'hsr' [ 29.878281][ T4668] Cannot create hsr debugfs directory [ 29.894428][ T4665] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.894457][ T4665] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.894483][ T4665] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 29.916075][ T4673] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.917480][ T4673] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.919148][ T4673] bridge_slave_0: entered allmulticast mode [ 29.920783][ T4673] bridge_slave_0: entered promiscuous mode [ 29.926280][ T4666] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.934075][ T4665] hsr_slave_0: entered promiscuous mode [ 29.934562][ T4665] hsr_slave_1: entered promiscuous mode [ 29.935003][ T4665] debugfs: 'hsr0' already exists in 'hsr' [ 29.935013][ T4665] Cannot create hsr debugfs directory [ 29.935342][ T4673] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.935369][ T4673] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.935437][ T4673] bridge_slave_1: entered allmulticast mode [ 29.935907][ T4673] bridge_slave_1: entered promiscuous mode [ 29.939215][ T4666] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.946524][ T4666] team0: Port device team_slave_0 added [ 29.961529][ T4666] team0: Port device team_slave_1 added [ 29.971922][ T4666] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 29.973465][ T4666] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.975192][ T4666] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 29.982913][ T4673] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.984447][ T4673] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.992523][ T4673] team0: Port device team_slave_0 added [ 29.992807][ T4666] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 29.992814][ T4666] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 29.992828][ T4666] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.003105][ T4673] team0: Port device team_slave_1 added [ 30.021062][ T4673] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.021092][ T4673] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.021108][ T4673] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.032356][ T4673] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.032387][ T4673] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 30.032405][ T4673] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.036376][ T4666] hsr_slave_0: entered promiscuous mode [ 30.036703][ T4666] hsr_slave_1: entered promiscuous mode [ 30.036920][ T4666] debugfs: 'hsr0' already exists in 'hsr' [ 30.036930][ T4666] Cannot create hsr debugfs directory [ 30.062365][ T4673] hsr_slave_0: entered promiscuous mode [ 30.064224][ T4673] hsr_slave_1: entered promiscuous mode [ 30.065949][ T4673] debugfs: 'hsr0' already exists in 'hsr' [ 30.065981][ T4673] Cannot create hsr debugfs directory [ 30.083277][ T4668] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 30.086760][ T4668] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.087134][ T4668] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 30.089177][ T4668] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.101988][ T4668] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 30.103368][ T4668] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.113779][ T4668] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 30.116540][ T4668] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.139823][ T4668] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.139883][ T4668] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.140037][ T4668] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.140072][ T4668] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.188037][ T4670] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 30.191210][ T4670] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.192383][ T4670] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 30.194390][ T4670] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.197736][ T4670] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 30.200284][ T4670] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.200844][ T4670] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 30.202521][ T4670] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.226392][ T4670] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.226450][ T4670] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.226558][ T4670] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.226596][ T4670] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.233090][ T4673] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 30.236124][ T4673] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.236498][ T4673] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 30.238406][ T4673] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.239260][ T4673] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 30.241383][ T4673] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.250277][ T4673] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 30.252757][ T4673] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.261499][ T4668] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.271673][ T40] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.273707][ T40] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.277349][ T40] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.279078][ T40] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.295981][ T4670] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.300630][ T4668] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.309306][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.309358][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.315860][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.315904][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.323871][ T4665] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 30.326521][ T4665] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.332524][ T4670] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.334433][ T4665] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 30.337784][ T4665] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.338098][ T4665] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 30.340097][ T4665] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.352210][ T4665] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 30.354526][ T4665] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.364092][ T40] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.364139][ T40] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.378438][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.378488][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.413013][ T4666] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 30.416236][ T4666] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 30.418171][ T4666] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 30.421035][ T4666] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 30.428157][ T4666] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 30.430675][ T4666] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 30.432394][ T4666] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 30.434894][ T4666] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 30.449481][ T4665] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.458330][ T4673] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.477528][ T4665] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.481768][ T4673] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.505959][ T4666] 8021q: adding VLAN 0 to HW filter on device bond0 [ 30.519394][ T4665] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 30.521461][ T4665] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 30.537808][ T4699] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.537854][ T4699] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.542268][ T4699] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.542307][ T4699] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.545664][ T4699] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.545696][ T4699] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.551039][ T4699] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.551080][ T4699] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.594233][ T4666] 8021q: adding VLAN 0 to HW filter on device team0 [ 30.597201][ T4668] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.614480][ T4668] veth0_vlan: entered promiscuous mode [ 30.618843][ T4668] veth1_vlan: entered promiscuous mode [ 30.639985][ T4699] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.640323][ T4699] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.642052][ T4699] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.642074][ T4699] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.649996][ T4670] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.662479][ T4668] veth0_macvtap: entered promiscuous mode [ 30.674513][ T4668] veth1_macvtap: entered promiscuous mode [ 30.685323][ T4666] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 30.687433][ T4666] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 30.701764][ T4668] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.710070][ T4668] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.722790][ T15] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.724131][ T15] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.724278][ T15] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.724405][ T15] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.765571][ T4113] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.765606][ T4113] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.786455][ T15] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 30.786490][ T15] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 30.823848][ T4668] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 30.872100][ T4670] veth0_vlan: entered promiscuous mode [ 30.875278][ T4670] veth1_vlan: entered promiscuous mode [ 30.882050][ T4670] veth0_macvtap: entered promiscuous mode [ 30.884332][ T4670] veth1_macvtap: entered promiscuous mode [ 30.889566][ T4670] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 30.892287][ T4670] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 30.918176][ T4665] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.940518][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.942890][ T4113] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.942943][ T4113] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.942971][ T4113] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 30.953985][ T4665] veth0_vlan: entered promiscuous mode [ 30.958147][ T4665] veth1_vlan: entered promiscuous mode [ 30.963875][ T4673] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 30.984622][ T4665] veth0_macvtap: entered promiscuous mode [ 31.257039][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.257066][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.261257][ T4844] xt_CT: You must specify a L4 protocol and not use inversions on it [ 31.264376][ T4665] veth1_macvtap: entered promiscuous mode [ 31.281689][ T4666] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.283727][ T4814] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.286215][ T50] Bluetooth: hci3: command tx timeout [ 31.287488][ T4814] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.296053][ T4665] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.299391][ T4665] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.312212][ T15] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.312406][ T15] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.312550][ T15] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.312643][ T15] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.343131][ T4673] veth0_vlan: entered promiscuous mode [ 31.354796][ T50] Bluetooth: hci4: command tx timeout [ 31.354899][ T4678] Bluetooth: hci0: command tx timeout [ 31.354901][ T50] Bluetooth: hci2: command tx timeout [ 31.358524][ T4666] veth0_vlan: entered promiscuous mode [ 31.362935][ T4673] veth1_vlan: entered promiscuous mode [ 31.365116][ T4681] Bluetooth: hci1: command tx timeout [ 31.379771][ T4666] veth1_vlan: entered promiscuous mode [ 31.418514][ T4673] veth0_macvtap: entered promiscuous mode [ 31.423294][ T170] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.427531][ T4673] veth1_macvtap: entered promiscuous mode [ 31.431700][ T4673] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.432848][ T4673] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.441057][ T4666] veth0_macvtap: entered promiscuous mode [ 31.442405][ T4666] veth1_macvtap: entered promiscuous mode [ 31.449203][ T170] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.453486][ T15] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.461105][ T4113] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.462156][ T4666] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 31.463276][ T4666] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 31.467022][ T4113] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.470479][ T15] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.472578][ T15] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.477268][ T15] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.477452][ T15] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.477483][ T15] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.483101][ T15] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.483144][ T15] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 31.872236][ T15] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.872264][ T15] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.902500][ T170] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.904796][ T170] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 31.933191][ T15] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 31.934978][ T15] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.293728][ T39] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 32.293771][ T39] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 32.698191][ T4874] x_tables: duplicate underflow at hook 1 [ 32.730142][ T4878] netlink: 32 bytes leftover after parsing attributes in process `syz.0.8'. [ 33.022860][ T4888] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 33.024073][ T4888] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 33.354909][ T4681] Bluetooth: hci3: command tx timeout [ 33.435277][ T50] Bluetooth: hci4: command tx timeout [ 33.437092][ T4678] Bluetooth: hci2: command tx timeout [ 33.438867][ T4681] Bluetooth: hci1: command tx timeout [ 33.444821][ T4681] Bluetooth: hci0: command tx timeout [ 33.878899][ T4893] netlink: 'syz.3.4': attribute type 2 has an invalid length. [ 33.950390][ T4878] loop0: detected capacity change from 0 to 512 [ 33.965639][ T4878] ======================================================= [ 33.965639][ T4878] WARNING: The mand mount option has been deprecated and [ 33.965639][ T4878] and is ignored by this kernel. Remove the mand [ 33.965639][ T4878] option from the mount to silence this warning. [ 33.965639][ T4878] ======================================================= [ 33.965695][ T4878] EXT4-fs: Ignoring removed mblk_io_submit option [ 33.989328][ T4878] EXT4-fs (loop0): Test dummy encryption mode enabled [ 34.006071][ T4878] EXT4-fs (loop0): mounted filesystem 00000005-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 34.015933][ T4878] fscrypt: AES-256-XTS using implementation "xts-aes-ce" [ 34.024990][ C0] [ 34.025533][ C0] ================================ [ 34.026584][ C0] WARNING: inconsistent lock state [ 34.027624][ C0] syzkaller #0 Not tainted [ 34.028493][ C0] -------------------------------- [ 34.029537][ C0] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. [ 34.030916][ C0] syz.3.4/4893 [HC0[0]:SC1[1]:HE1:SE0] takes: [ 34.032164][ C0] ffff0000f4f2bc68 (slock-AF_PHONET/1){+.?.}-{3:3}, at: __sk_receive_skb+0x1ac/0x8d4 [ 34.034087][ C0] {SOFTIRQ-ON-W} state was registered at: [ 34.035219][ C0] lock_acquire+0x140/0x368 [ 34.036097][ C0] _raw_spin_lock_nested+0x50/0x6c [ 34.037093][ C0] __sk_receive_skb+0x1ac/0x8d4 [ 34.038043][ C0] pep_do_rcv+0x208/0x684 [ 34.038909][ C0] __release_sock+0x178/0x2c0 [ 34.039811][ C0] release_sock+0x174/0x228 [ 34.040709][ C0] pep_sock_accept+0x804/0xc08 [ 34.041651][ C0] pn_socket_accept+0xc8/0x26c [ 34.042573][ C0] do_accept+0x304/0x42c [ 34.043397][ C0] __sys_accept4+0x11c/0x1f8 [ 34.044314][ C0] __arm64_sys_accept4+0x9c/0xb8 [ 34.045327][ C0] invoke_syscall+0x98/0x244 [ 34.046212][ C0] el0_svc_common+0xe8/0x23c [ 34.047111][ C0] do_el0_svc+0x48/0x58 [ 34.047936][ C0] el0_svc+0x64/0x260 [ 34.048747][ C0] el0t_64_sync_handler+0x48/0x148 [ 34.049762][ C0] el0t_64_sync+0x198/0x19c [ 34.050625][ C0] irq event stamp: 1598 [ 34.051433][ C0] hardirqs last enabled at (1598): [] _raw_spin_unlock_irq+0x30/0x80 [ 34.053337][ C0] hardirqs last disabled at (1597): [] _raw_spin_lock_irq+0x28/0x70 [ 34.055250][ C0] softirqs last enabled at (1592): [] netif_rx+0xac/0xd4 [ 34.056941][ C0] softirqs last disabled at (1593): [] __do_softirq+0x14/0x20 [ 34.058657][ C0] [ 34.058657][ C0] other info that might help us debug this: [ 34.059225][ T4878] EXT4-fs error (device loop0): __ext4_add_entry:2412: inode #2: comm syz.0.8: Directory hole found for htree leaf block 0 [ 34.059957][ T4878] EXT4-fs (loop0): Remounting filesystem read-only [ 34.064083][ C0] Possible unsafe locking scenario: [ 34.064083][ C0] [ 34.065544][ C0] CPU0 [ 34.066203][ C0] ---- [ 34.066825][ C0] lock(slock-AF_PHONET/1); [ 34.067714][ C0] [ 34.068409][ C0] lock(slock-AF_PHONET/1); [ 34.069376][ C0] [ 34.069376][ C0] *** DEADLOCK *** [ 34.069376][ C0] [ 34.070991][ C0] 5 locks held by syz.3.4/4893: [ 34.071961][ C0] #0: ffff0000f458be40 (&sb->s_type->i_mutex_key#12){+.+.}-{4:4}, at: __sock_release+0x7c/0x1d4 [ 34.073986][ C0] #1: ffff0000f4f2c360 (sk_lock-AF_PHONET){+.+.}-{0:0}, at: pep_sock_close+0x90/0x4a8 [ 34.075952][ C0] #2: ffff800088ad72a0 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x574/0x16f8 [ 34.077916][ C0] #3: ffff0000f4f2c968 (slock-AF_PHONET){+.-.}-{3:3}, at: __sk_receive_skb+0x1e0/0x8d4 [ 34.079913][ C0] #4: ffff0000f4f2c9e0 (sk_lock-AF_PHONET){+.+.}-{0:0}, at: phonet_rcv+0x64c/0xa94 [ 34.081779][ C0] [ 34.081779][ C0] stack backtrace: [ 34.082908][ C0] CPU: 0 UID: 0 PID: 4893 Comm: syz.3.4 Not tainted syzkaller #0 PREEMPT [ 34.084620][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 34.086552][ C0] Call trace: [ 34.087187][ C0] show_stack+0x2c/0x3c (C) [ 34.088079][ C0] __dump_stack+0x30/0x40 [ 34.088956][ C0] dump_stack_lvl+0xd8/0x12c [ 34.089867][ C0] dump_stack+0x1c/0x28 [ 34.090693][ C0] print_usage_bug+0x310/0x384 [ 34.091668][ C0] mark_lock_irq+0x4a0/0x4a8 [ 34.092594][ C0] mark_lock+0x144/0x1a4 [ 34.093439][ C0] __lock_acquire+0x6bc/0x2f44 [ 34.094368][ C0] lock_acquire+0x140/0x368 [ 34.095274][ C0] _raw_spin_lock_nested+0x50/0x6c [ 34.096279][ C0] __sk_receive_skb+0x1ac/0x8d4 [ 34.097242][ C0] pep_do_rcv+0x208/0x684 [ 34.098127][ C0] __sk_receive_skb+0x458/0x8d4 [ 34.099082][ C0] phonet_rcv+0x64c/0xa94 [ 34.099965][ C0] __netif_receive_skb_one_core+0xc4/0x10c [ 34.101171][ C0] __netif_receive_skb+0x34/0x128 [ 34.102181][ C0] process_backlog+0x610/0x16f8 [ 34.103119][ C0] __napi_poll+0xb0/0x324 [ 34.103972][ C0] net_rx_action+0x568/0xbcc [ 34.104867][ C0] handle_softirqs+0x2e4/0xd34 [ 34.105828][ C0] __do_softirq+0x14/0x20 [ 34.106655][ C0] ____do_softirq+0x14/0x20 [ 34.107550][ C0] call_on_irq_stack+0x30/0x48 [ 34.108447][ C0] do_softirq_own_stack+0x20/0x2c [ 34.109453][ C0] do_softirq+0x90/0xf8 [ 34.110262][ C0] __local_bh_enable_ip+0x240/0x35c [ 34.111293][ C0] netif_rx+0xb4/0xd4 [ 34.112084][ C0] pn_send+0x4e8/0x780 [ 34.112899][ C0] pn_skb_send+0x1dc/0x508 [ 34.113781][ C0] pipe_handler_request+0x128/0x234 [ 34.114812][ C0] pep_sock_close+0x124/0x4a8 [ 34.115746][ C0] pn_socket_release+0x9c/0xbc [ 34.116707][ C0] __sock_release+0xa0/0x1d4 [ 34.117641][ C0] sock_close+0x24/0x38 [ 34.118490][ C0] __fput+0x340/0x744 [ 34.119330][ C0] ____fput+0x20/0x30 [ 34.120162][ C0] task_work_run+0x1c4/0x254 [ 34.121122][ C0] exit_to_user_mode_loop+0x10c/0x17c [ 34.122255][ C0] el0_svc+0x18c/0x260 [ 34.123127][ C0] el0t_64_sync_handler+0x48/0x148 [ 34.124185][ C0] el0t_64_sync+0x198/0x19c [ 34.229023][ T4901] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9'. [ 34.317614][ T4893] gprs0: detached [ 34.957923][ T4894] Set syz1 is full, maxelem 65536 reached [ 34.996027][ T4668] EXT4-fs (loop0): unmounting filesystem 00000005-0000-0000-0000-000000000000. [ 35.434842][ T4681] Bluetooth: hci3: command tx timeout [ 35.514694][ T4681] Bluetooth: hci0: command tx timeout [ 35.514716][ T50] Bluetooth: hci2: command tx timeout [ 35.514726][ T4681] Bluetooth: hci4: command tx timeout [ 35.517909][ T4678] Bluetooth: hci1: command tx timeout [ 37.514969][ T4678] Bluetooth: hci3: command tx timeout [ 37.594878][ T4669] Bluetooth: hci1: command tx timeout [ 37.594908][ T4669] Bluetooth: hci4: command tx timeout [ 37.594930][ T4669] Bluetooth: hci0: command tx timeout [ 37.596160][ T4678] Bluetooth: hci2: command tx timeout