last executing test programs: 3m9.045964281s ago: executing program 4 (id=847): socket$igmp(0x2, 0x3, 0x2) r0 = socket$inet6(0xa, 0x3, 0x3) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f00000000c0)={@mcast1, 0x800, 0x0, 0x103, 0x1}, 0x20) setsockopt$inet6_int(r1, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x1, 0x4) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000040), 0x6) write$bt_hci(r2, &(0x7f0000000280)=ANY=[], 0xa) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x2, r0}, 0x2) sendmsg$inet6(r1, &(0x7f0000000600)={&(0x7f0000000080)={0xa, 0x4e20, 0x1000000080000, @dev={0xfe, 0x80, '\x00', 0x25}}, 0x1c, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000000000029000000040000002b00000000000007180000000000000029"], 0x30}, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') read$qrtrtun(r4, &(0x7f00000004c0)=""/57, 0x39) r5 = syz_usb_connect$cdc_ncm(0x0, 0x89, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x77, 0x2, 0x1, 0x0, 0x40, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x0, 0x401}, {0x6, 0x24, 0x1a, 0x0, 0x5}, [@country_functional={0x6, 0x24, 0x7, 0xd, 0x2}, @mdlm={0x15}]}, {{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x0, 0x6}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10, 0x5}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x6, 0x10, 0x10, 0x10, 0x1000, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r5, 0x0, 0x0) 2m23.044250557s ago: executing program 4 (id=847): socket$igmp(0x2, 0x3, 0x2) r0 = socket$inet6(0xa, 0x3, 0x3) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f00000000c0)={@mcast1, 0x800, 0x0, 0x103, 0x1}, 0x20) setsockopt$inet6_int(r1, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x1, 0x4) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000040), 0x6) write$bt_hci(r2, &(0x7f0000000280)=ANY=[], 0xa) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x2, r0}, 0x2) sendmsg$inet6(r1, &(0x7f0000000600)={&(0x7f0000000080)={0xa, 0x4e20, 0x1000000080000, @dev={0xfe, 0x80, '\x00', 0x25}}, 0x1c, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000000000029000000040000002b00000000000007180000000000000029"], 0x30}, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') read$qrtrtun(r4, &(0x7f00000004c0)=""/57, 0x39) r5 = syz_usb_connect$cdc_ncm(0x0, 0x89, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x77, 0x2, 0x1, 0x0, 0x40, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x0, 0x401}, {0x6, 0x24, 0x1a, 0x0, 0x5}, [@country_functional={0x6, 0x24, 0x7, 0xd, 0x2}, @mdlm={0x15}]}, {{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x0, 0x6}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10, 0x5}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x6, 0x10, 0x10, 0x10, 0x1000, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r5, 0x0, 0x0) 1m46.777628668s ago: executing program 4 (id=847): socket$igmp(0x2, 0x3, 0x2) r0 = socket$inet6(0xa, 0x3, 0x3) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f00000000c0)={@mcast1, 0x800, 0x0, 0x103, 0x1}, 0x20) setsockopt$inet6_int(r1, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x1, 0x4) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000040), 0x6) write$bt_hci(r2, &(0x7f0000000280)=ANY=[], 0xa) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x2, r0}, 0x2) sendmsg$inet6(r1, &(0x7f0000000600)={&(0x7f0000000080)={0xa, 0x4e20, 0x1000000080000, @dev={0xfe, 0x80, '\x00', 0x25}}, 0x1c, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000000000029000000040000002b00000000000007180000000000000029"], 0x30}, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') read$qrtrtun(r4, &(0x7f00000004c0)=""/57, 0x39) r5 = syz_usb_connect$cdc_ncm(0x0, 0x89, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x77, 0x2, 0x1, 0x0, 0x40, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x0, 0x401}, {0x6, 0x24, 0x1a, 0x0, 0x5}, [@country_functional={0x6, 0x24, 0x7, 0xd, 0x2}, @mdlm={0x15}]}, {{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x0, 0x6}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10, 0x5}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x6, 0x10, 0x10, 0x10, 0x1000, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r5, 0x0, 0x0) 1m23.787285697s ago: executing program 4 (id=847): socket$igmp(0x2, 0x3, 0x2) r0 = socket$inet6(0xa, 0x3, 0x3) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f00000000c0)={@mcast1, 0x800, 0x0, 0x103, 0x1}, 0x20) setsockopt$inet6_int(r1, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x1, 0x4) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000040), 0x6) write$bt_hci(r2, &(0x7f0000000280)=ANY=[], 0xa) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x2, r0}, 0x2) sendmsg$inet6(r1, &(0x7f0000000600)={&(0x7f0000000080)={0xa, 0x4e20, 0x1000000080000, @dev={0xfe, 0x80, '\x00', 0x25}}, 0x1c, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000000000029000000040000002b00000000000007180000000000000029"], 0x30}, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') read$qrtrtun(r4, &(0x7f00000004c0)=""/57, 0x39) r5 = syz_usb_connect$cdc_ncm(0x0, 0x89, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x77, 0x2, 0x1, 0x0, 0x40, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x0, 0x401}, {0x6, 0x24, 0x1a, 0x0, 0x5}, [@country_functional={0x6, 0x24, 0x7, 0xd, 0x2}, @mdlm={0x15}]}, {{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x0, 0x6}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10, 0x5}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x6, 0x10, 0x10, 0x10, 0x1000, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r5, 0x0, 0x0) 37.666184147s ago: executing program 4 (id=847): socket$igmp(0x2, 0x3, 0x2) r0 = socket$inet6(0xa, 0x3, 0x3) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f00000000c0)={@mcast1, 0x800, 0x0, 0x103, 0x1}, 0x20) setsockopt$inet6_int(r1, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x1, 0x4) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000040), 0x6) write$bt_hci(r2, &(0x7f0000000280)=ANY=[], 0xa) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x2, r0}, 0x2) sendmsg$inet6(r1, &(0x7f0000000600)={&(0x7f0000000080)={0xa, 0x4e20, 0x1000000080000, @dev={0xfe, 0x80, '\x00', 0x25}}, 0x1c, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000000000029000000040000002b00000000000007180000000000000029"], 0x30}, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') read$qrtrtun(r4, &(0x7f00000004c0)=""/57, 0x39) r5 = syz_usb_connect$cdc_ncm(0x0, 0x89, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x77, 0x2, 0x1, 0x0, 0x40, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x0, 0x401}, {0x6, 0x24, 0x1a, 0x0, 0x5}, [@country_functional={0x6, 0x24, 0x7, 0xd, 0x2}, @mdlm={0x15}]}, {{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x0, 0x6}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10, 0x5}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x6, 0x10, 0x10, 0x10, 0x1000, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r5, 0x0, 0x0) 12.764531395s ago: executing program 0 (id=1680): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) epoll_create(0x7) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r4, 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) socket$inet_tcp(0x2, 0x1, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f0000000440)=@nat={'nat\x00', 0x62, 0x5, 0x3e0, 0x0, 0x178, 0xffffffff, 0x0, 0x2a0, 0x348, 0x348, 0xffffffff, 0x348, 0x348, 0x5, 0x0, {[{{@uncond, 0x0, 0x98, 0xd0, 0x0, {0x22e}, [@common=@unspec=@state={{0x28}}]}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x25, {0x3, @local, @broadcast}}}}, {{@uncond, 0x0, 0x70, 0xa8}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0x0, @remote, @empty, @gre_key, @gre_key}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @remote, 0x0, 0x0, 'batadv0\x00', 'bond0\x00'}, 0x0, 0xf0, 0x128, 0x0, {}, [@common=@osf={{0x50}, {'syz0\x00'}}, @common=@addrtype={{0x30}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x0, @multicast1, @multicast2, @gre_key, @gre_key}}}}, {{@uncond, 0x0, 0x70, 0xa8}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x0, @local, @broadcast, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x440) bpf$MAP_CREATE(0x0, 0x0, 0x50) 12.510330831s ago: executing program 3 (id=1681): writev(0xffffffffffffffff, 0x0, 0x0) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000740)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c00000002000000000000000000000d"], 0x0, 0x26}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x20, 0x4, 0x2, 0x0, 0x201, 0xffffffffffffffff, 0x1, '\x00', 0x0, r0, 0x1, 0x20002}, 0x50) r1 = syz_open_procfs$pagemap(0x0, &(0x7f0000000040)) ioctl$PAGEMAP_SCAN(r1, 0xc0606610, &(0x7f0000000080)={0x60, 0x1, &(0x7f0000fee000/0x2000)=nil, &(0x7f0000ff6000/0x4000)=nil, 0x7, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x14, 0x10}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newnexthop={0x2c, 0x68, 0x1, 0x100003, 0x7ffffffd, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x15}]}, @NHA_GROUP_TYPE={0x6, 0x3, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008018}, 0x4000080) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="040e0604250c", @ANYRES32=r1], 0x9) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb703000008000000b703000000000020850000007300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) connect$unix(0xffffffffffffffff, &(0x7f0000000140)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) 11.742481705s ago: executing program 0 (id=1684): socket$inet_sctp(0x2, 0x5, 0x84) r0 = dup(0xffffffffffffffff) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000b40)=@bpf_lsm={0x1d, 0x10, &(0x7f0000000500)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xb56}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}}}, &(0x7f00000000c0)='syzkaller\x00', 0x2, 0x45, &(0x7f0000000600)=""/69, 0x41000, 0x40, '\x00', 0x0, 0x1b, r0, 0x8, &(0x7f0000000700)={0x8, 0x1}, 0x8, 0x10, &(0x7f0000000740)={0x5, 0x6, 0xffff, 0xf}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000ac0)=[r0, r0, r0, r0, r0], &(0x7f0000000b00)=[{0x0, 0x2, 0xd, 0x2}, {0x1, 0x5, 0x4, 0x5}, {0x1, 0x3, 0xe, 0x8}, {0x5, 0x5, 0xf, 0x7}], 0x10, 0x3}, 0x94) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000004d00)='./file1\x00', 0x351142, 0x1cd) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r4, 0xfffffffc) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000009c0)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x20080, 0x80e1}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x28, r6, 0x7, 0x0, 0x242800, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0x0) 11.514909508s ago: executing program 3 (id=1685): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$inet_udp(0x2, 0x2, 0x0) recvmmsg(r0, &(0x7f0000002a00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000980)=""/6, 0x6}, 0x5}], 0x1, 0x2, 0x0) r1 = syz_io_uring_setup(0x83, 0x0, 0x0, 0x0) r2 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'bridge0\x00'}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0x5, &(0x7f00000027c0)=ANY=[@ANYBLOB="180000000000000000000000ff00"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x2, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) symlinkat(&(0x7f0000001040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x3) sched_setaffinity(0x0, 0xfffffdca, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) symlink(0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket(0x10, 0x3, 0x0) socket$kcm(0x10, 0x2, 0x0) io_uring_register$IORING_UNREGISTER_PBUF_RING(0xffffffffffffffff, 0x17, 0x0, 0x1) sendto$inet6(r5, &(0x7f0000000080)="7800000018002507b9409b14ffff00000204be04020506050e020409430009003f000c200a0000000d0085a168d0bf46d32345653600648d0a00120002000a0006005ade4a460c89b6ec0cff3959547f509058ba86c902000000004a32000400160005000a0000000000e000e218d1ddf66ed538f2523250", 0x78, 0x0, 0x0, 0x0) dup(r3) syz_usb_connect$cdc_ecm(0x4, 0x77, &(0x7f0000000040)=ANY=[@ANYBLOB="12015002020000102505a1a4400001020301090265dde52d405bc1180bf473c3cda56b48000101000000090400000002060003052406ffffa1f51f00051524120900a317a88b045e4f01a607c0ffcb7e552a15"], &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0}) 11.364093768s ago: executing program 1 (id=1686): syz_usb_connect(0x0, 0x3d, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320000980070705ab0b78"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x10000) writev(r0, &(0x7f0000000840)=[{&(0x7f0000000280)="01c0a35bb17777e878572c0b51752a677e4168052616d26d86e29f9969", 0x1d}, {&(0x7f0000000400)='os', 0x2}], 0x2) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) request_key(&(0x7f0000000040)='asymmetric\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\x10rust\xe3c*sgrVix:De', 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001080)=[{&(0x7f0000000040)="a72d11a15c048c0a7d63aebc5cea1f81510ff6091475aeec600831aa9d3944e60bc2ad06a619c560aa0118b28f68f1eb14549d633b4b23f179fb680716faa43414787559be90843c35ab30acad8a6740140e00721abc2eb362f7bde53b3c992d3e28ccc20ec84fdc569947047f6c09a647ee8c0a747b951e66c068ccf1af93ee9e6f9528ff79e2f989383b05a690a6bec4634b867c9446c1c644b3010e8a3514c6328323b4bbdd602b8f0dace6aea70902c4ddd2a2f2810f1348b0d0df3c1e6a5938fcfdc87e7580c6be0c6a06eca62d6f787dd16add086a21391c4c707d8b61929d1252681b84c245e0efafe2e6e73ad86a3cf59235ab0eacbb414af92ec3cdac420a064a98e8cc18bdf63f8997f96436e0fe6f06fdbf47fff353b01a861babd4a38d126bfe3e29049e6cc883e6efae6e70ef9ed124b1b09887a58c991e223b6420dca5ae238027e91b17b1707dc5c0d5f59f0ca95614f1ea1d263c1ee54dfe31ae35eb3c8e3b931dff7920c57fbba89adf2e392c1ad719b90c7ade0d38ff9792934ef1fb12f51d8e2fad12486d5883d5b1a46696fad128c6805cfb25bc6487e1e407d6b266971b09d0d864a7a550284e24b6cdc9f4ae1081a638175dffef002c76ac5558d23e41edbe68f4b4950a13aa000326dae5a857603dc5a40d6c6618a98c7b6e1eebd325ea2c14601a25658965f40864fd015d9b2fff83", 0x1fb}], 0x1}, 0x0) r6 = syz_io_uring_setup(0xd2, &(0x7f0000000340)={0x0, 0x6299, 0x80, 0x80000, 0x334}, &(0x7f0000000280)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000100)={0x1, &(0x7f0000000200)=[{0x30, 0x0, 0x0, 0x4}]}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r7, r8, &(0x7f0000000200)=@IORING_OP_MADVISE={0x19, 0x7b, 0x0, 0x0, 0x0, &(0x7f0000011000/0x4000)=nil, 0x4000, 0xc}) io_uring_enter(r6, 0x47bc, 0x0, 0x0, 0x0, 0x0) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000002000000000200000008005a25", @ANYRES32=r4, @ANYBLOB="0c009900f40000002e000000080026007f17000008009f0001000000"], 0x38}, 0x1, 0x0, 0x0, 0xd37697ff2c0d3c1b}, 0x8090) r9 = syz_open_pts(0xffffffffffffffff, 0x4a0042) ioctl$KDSKBMODE(r9, 0x4b45, &(0x7f0000000000)=0x4) close_range(r1, 0xffffffffffffffff, 0x0) 8.74709563s ago: executing program 1 (id=1688): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x5, &(0x7f0000006680)) r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000001c0)={'veth1_to_hsr\x00', 0x0}) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r1, &(0x7f00000000c0)="3f031c000302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r2, 0x1, 0x0, 0x6, @multicast}, 0x14) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'syz_tun\x00', 0x0}) bind$packet(r0, &(0x7f0000000300)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @remote}, 0x14) r4 = socket$packet(0x11, 0x2, 0x300) r5 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0x0) fchdir(r6) r7 = openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='.\x00', 0x0, 0x0) lseek(r7, 0x1, 0x0) bind$packet(r4, &(0x7f0000000000)={0x11, 0x0, r3, 0x1, 0x10, 0x6, @link_local}, 0x14) syz_emit_ethernet(0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="aaaaaaaaaaaa0000000000000800450000280000000000069078000000000000000000004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="500000009078000050aca2e590b714fc841056da3ce9b0c483b9ce7161208875be75a47d500d6cf1899364da57a2091a3b08c234e829958bfb30bebc852d6e861088686dcda3295f79a4bbd8776ee3965f9e4327e3de5e626826cbc4b88e4037da5d53a74bb0ca00baf4952b06452e9e09c0a4a229f20bfba90504ecf960bafe8ae52595f3cc0b5fa70b17122bb07b69f2f193d611fd69dfabeea6"], 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) syz_clone(0xa0122580, 0x0, 0x0, 0x0, 0x0, 0x0) 8.643509571s ago: executing program 0 (id=1690): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1c, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000a6c5ea39db24921e54d30e41", @ANYRES32, @ANYBLOB="0000000000000000b7080000020000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000030000009500000000000000"], 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0xd, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000073"], 0x0, 0x0, 0x0, 0x0, 0x40e00, 0x10, '\x00', 0x0, @sock_ops=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x39, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000080)={0xb, 0x0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x1f, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, r0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000400)='virtio_transport_alloc_pkt\x00', r1}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) openat$cgroup(0xffffffffffffffff, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(0xffffffffffffffff, 0xc0a85352, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0xffffffffffffffb3}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x400000bce) memfd_secret(0x80000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000002000)=""/102400, 0x19000) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000006c0), 0x48200, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$TIOCVHANGUP(r4, 0x5437, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f0000000500)=ANY=[@ANYBLOB="050000000000000071113300000000008510000002000000850000005600000095000000000000009500a50500000000a2fe937a6a29f464f5af2904fb96377ae14890a39c17d99b7fc0ac80def2470f7dcbe543edf50b15b9e6579ce90704e5652d9d452b6b883d502a991978a442ad2aeb73e6b3498920154d49ddebf14db6132fb9b69efd006b8b99911f2d3ab90b98f54b528abd0671bfb575c27e12e7b449c4540bdce311a247aad97c6c87fdfd5ffc1c0ce6db7ad0063ededa5a5e569c831cd0a397d983e9c630018652db021fa96301ea161bad463042be2b50ff5d9a70b0a28872c7deddc50c6c6650bd36f15dcbd7e88568aeabdf619809ef8a5f3960f03a1e9bbf464daf3aca9b"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x70) connect$vsock_stream(r2, &(0x7f0000000140)={0x28, 0x0, 0x0, @host}, 0x10) ioctl$SNDCTL_DSP_SETFMT(0xffffffffffffffff, 0xc0045005, &(0x7f00000000c0)=0x4) syz_usb_connect(0x2, 0x3f, &(0x7f0000000140)=ANY=[@ANYBLOB="1201500238e2aa08732b17000ea20102030109022d0002db0480e60904000400ff9e4d050904800202e2a5c60a09050404080009020909050500100010f807"], &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0x0, 0x0, &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x19, '\x00', 0x0, @fallback=0xd}, 0x94) syz_io_uring_setup(0x53f, &(0x7f0000000440)={0x0, 0x807734, 0x400, 0xfffffff8, 0xfe}, &(0x7f00000000c0)=0x0, &(0x7f00000002c0)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) 8.474162079s ago: executing program 2 (id=1691): r0 = fsopen(&(0x7f0000000280)='cifs\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xf, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x2d) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000160a03020002000000000000020000000900020073797a30000000000900010073797a30000000002c00038008000140000000000800024000000000180003801400010073797a5f74756e0000"], 0x80}}, 0x0) syz_emit_ethernet(0xbe, &(0x7f0000001040)={@multicast, @random="58a4ab044a92", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x3c, 0xb0, 0x0, 0x0, 0xfc, 0x11, 0x0, @empty, @broadcast}, {0x400, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "4e0ec4d8ec1533548dfb72e1261d7aeb619d49e98f3f4cadcd53ff011dd82418", "80bdd625bd905ba90d0a6927c37cefe3c4b48ef7ded481883e35fd85afe3254b3e1441af5775976715bf29ed4dcc166e", "7cdfd8ec14c7ce8bac951c90fcfaa4d6679b931ed70bb5b50f5b738d", {"fdeca3693c5b2785e92ce602a669b6dd", "af8ff0acae2f2a3d0d0de9d22c2e3cf8"}}}}}}}, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000040)='c:::\x00\xfdM\xab\x89\xff\xda\xc7dw2\xa1\xb2\xabuQQ\x14\x97\xc9\xfae\xc7\xa1U\xe2\xbe\"\xb9t\xa0\x0e\xfa\xdb\xf1\xa5.\xd87\xc3p\xa5l\xf8vC\xe2\xe8 \xd5-<#\x186\xe1\xbd\xc0\xc3\xb5N(vj\xa7+<:\xc4\xe00\x01\xdd \x82\x83\xed\x0e\xc4\x1d\xac\xef7\b\xd3Z5\\A\'\x18\xa2\xc3\xab\xc7`\xc3\v\xf3L\x9d[Q\x9e\x11@=\xa1\x9b\xdc\xb1\xef\xc3k<\x97L\xa0\xab\xa6\x1ce\xcd\x99\xb3m\xef\x87\xc5i^N\xbd@\x01\xc0\xb2\x88\xc3\xe2\x96T\xa3\xa5\xeb\x0f\xf2f\xb9$\xd2\x140x0}) sendmsg$nl_route_sched(r6, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newqdisc={0x148, 0x24, 0x4ee4e6a52ff56541, 0x0, 0xfffffffe, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_red={{0x8}, {0x11c, 0x2, [@TCA_RED_STAB={0x104, 0x2, "0af5b0699d46dac48f29d158dbe8cfb1979e12979688dc039b90627d7b60f0d5ca47f33eed46409b7c8722ce020df6b24c2e6ac7b97dc04d01be2092874115214b1ebb764511f69cd1e9f6263346363d2c639c7667ce67af25166c2f0f85f36aa8867406119c2a6f1f892e31dea982c5ab0348d560eae59ea49ef95d73202a6e3b5e1eb38244e694e7410d33bc92794ad27031f2a19698b51424df36e2a876a4fc871207bf12a84f1d4d132f5bb7edcf2d08d677e6a7268e106b6ced3c7f53df24092ddb9e0fac6a1153c3fc88bfd1404fef22cf3e825a6e19c6a48a5444eabb459af0ec9a278df4011773d2f2e6529ed0ad424b47ec67522477f979360b76d1"}, @TCA_RED_PARMS={0x14, 0x1, {0x3f26, 0x7, 0x81, 0x9, 0xb, 0x14, 0x5}}]}}]}, 0x148}}, 0x4000010) shmget$private(0x0, 0x1000, 0x4, &(0x7f0000cac000/0x1000)=nil) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) gettid() r8 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r8, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix={0x9, 0x8, 0x47524247, 0x3, 0x6, 0x2, 0x6, 0xa6e, 0x0, 0x4, 0x1, 0x5}}) syz_open_dev$vim2m(0x0, 0x3, 0x2) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000080)='acl', &(0x7f00000000c0)='/\'!\\&+)}+\')#@\x00', 0x0) 7.839060223s ago: executing program 3 (id=1692): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b0000"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0xc, &(0x7f0000000600)=ANY=[@ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_open_dev$mouse(&(0x7f0000000040), 0x5, 0x2000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={0x0, r1}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18060000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000003000000b703000000000000850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000080)='sched_switch\x00', r7}, 0x10) r8 = syz_open_procfs(0x0, &(0x7f0000000100)='syscall\x00') r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket(0x1, 0x803, 0x0) getsockname$packet(r10, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newlink={0x40, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x8, 0x2, 0x0, 0x1, [@IFLA_IPTUN_COLLECT_METADATA={0x4}]}}}, @IFLA_MASTER={0x8, 0x3, r11}]}, 0x40}}, 0x0) recvfrom(r8, &(0x7f00000001c0)=""/4, 0x4, 0x2044, &(0x7f0000000240)=@hci={0x1f, 0x1}, 0x80) syz_emit_ethernet(0xfdef, &(0x7f0000000440)={@broadcast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0xfffffffffffffdaa, 0x0, 0x0, 0x0, 0x88, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @parameter_prob={0xc, 0x0, 0x0, 0x0, 0x0, 0x3, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast2}}}}}}, 0x0) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x20, r6, 0x9c3fa077fa966179, 0x0, 0x0, {{0x7e}, {@void, @val={0xc, 0x99, {0xe, 0x55}}}}}, 0x20}}, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x3a155000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001440)={0x11, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10000}, 0x94) 6.976739526s ago: executing program 2 (id=1693): openat$kvm(0xffffffffffffff9c, 0x0, 0x181040, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f000001aa40)=""/102400, 0x19000) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000021c0)='/proc/asound/timers\x00', 0x0, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r2, &(0x7f00000001c0)="5cba", 0x2) ioctl$SNDCTL_DSP_RESET(r2, 0x5000, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r3, &(0x7f0000000200)={0xa, 0x4e20, 0x4, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000000c0), 0x4) getsockopt$ax25_int(r1, 0x101, 0x8, &(0x7f0000000040), &(0x7f0000000300)=0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, 0x0, 0x0) getsockopt$IP_SET_OP_GET_BYINDEX(r3, 0x1, 0x53, &(0x7f0000000100)={0x7, 0x7, 0x1}, &(0x7f00000002c0)=0x28) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f0000000140)=@gcm_128={{0x303}, "87ee8ac6c46dad33", "2607080d7f4fcf00fd4ef2dece6c7c58", '\x00', '#\x00'}, 0x28) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') epoll_pwait(0xffffffffffffffff, 0x0, 0x0, 0x10001, 0x0, 0x0) syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) ioctl$TUNSETLINK(r4, 0x400454cd, 0x20) r5 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r5, 0xc0045006, &(0x7f0000000080)=0x7f) ioctl$SNDCTL_DSP_SPEED(r5, 0xc0045002, &(0x7f0000000180)=0x10000) sendmsg$inet(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000240)="6e37cff5b5", 0x5}], 0x1}, 0x40400) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x2, 0x0, 0x0) 6.677238399s ago: executing program 3 (id=1694): r0 = socket(0x25, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0xa00000000000000, 0x80, 0x0, 0xa08) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000340)=ANY=[@ANYRES16=r2, @ANYBLOB="010000000000000000001400000018000180140002006e657464657673696d3000000000000008001b"], 0x34}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0x0, 0x1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_FWMARK={0x8, 0x12, 0x80}]}}]}, 0x3c}}, 0x20000000) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000c80)={'lo\x00'}) sendmsg$nl_route_sched(r6, &(0x7f0000001200)={0x0, 0x0, 0x0}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$packet(r8, &(0x7f0000000040)={0x10, 0x6}, 0x14) r9 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r9, 0x29, 0x40, &(0x7f0000000d40)=@raw={'raw\x00', 0x8, 0x3, 0x450, 0x0, 0xffffffff, 0xffffffff, 0x150, 0xffffffff, 0x3d8, 0xffffffff, 0xffffffff, 0x3d8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x4b0) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r0, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, 0x0}, 0x4000080) r10 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0xe7, 0xcc, 0x61, 0x20, 0x10c4, 0x818a, 0x7d8f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0xc0, 0x5, [{{0x9, 0x4, 0x23, 0x0, 0x0, 0x3}}]}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r10, 0x0, &(0x7f0000000dc0)={0x44, &(0x7f0000000bc0)={0x0, 0x15, 0x3, "c39242"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 6.094901285s ago: executing program 1 (id=1695): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$sg(&(0x7f00000003c0), 0x1000000000000000, 0x20007) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000194c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_INTERFACE(r0, &(0x7f0000019580)={&(0x7f0000019440)={0x10, 0x0, 0x0, 0x28000000}, 0xc, &(0x7f0000019540)={&(0x7f0000019500)={0x28, 0x0, 0x800, 0x70bd29, 0x25dfdbff, {{}, {@val={0x8, 0x3, r1}, @val={0xc, 0x99, {0x3, 0x3a}}}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x4000010}, 0x10010) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000000300)=""/102392, 0x18ff8) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_timeval(r3, 0x1, 0x14, &(0x7f0000000040)={0x0, 0x2710}, 0x10) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') getrlimit(0xf, &(0x7f00000000c0)) pwritev2(r4, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000019400)={&(0x7f0000019300)=@updpolicy={0xc8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}}, [@proto={0x5, 0x19, 0x2b}, @replay_thresh={0x8}]}, 0xc8}}, 0x0) sendmsg$nl_xfrm(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@updpolicy={0xb8, 0x15, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x10}, {0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, {}, 0x0, 0x6e6bb5}}, 0xb8}}, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)={0x38, r6, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0x5, 0x34, @random='\x00'}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_KEYS={0x8, 0x51, 0x0, 0x1, [{0x4}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x4010}, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000019480)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000400)={r8, 0x3, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r9 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt$SO_J1939_FILTER(r9, 0x6b, 0x1, &(0x7f0000000280)=[{0x3, 0x3, {0x2, 0xf0}, {0x6, 0xff, 0x4}, 0xfe, 0xfd}, {0x3, 0x2, {0x2, 0x0, 0x4}, {0x0, 0xff, 0x2}, 0xfd, 0xfd}, {0x0, 0x0, {0x1, 0xf0, 0x1}, {0x2, 0x1, 0x2}, 0x0, 0xfd}], 0x60) 6.013188779s ago: executing program 2 (id=1696): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000240)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f00000002c0)={0x0, 0x0, 0x0, 'queue1\x00', 0x49}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r3, 0x0, 0xd}, 0x18) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80280, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x101, 0x400001) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="200000002a0000000000000a100200000002006e6c3830323131000000000000"], 0x20}}, 0x0) r6 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) r7 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x3c00, 0x2, 0xbfdffffc}, &(0x7f0000000000)=0x0, &(0x7f00000000c0)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, 0x0, 0x0, 0x4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) memfd_secret(0x80000) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[], 0xb4}, 0x1, 0x0, 0x0, 0x24000090}, 0x800) io_uring_enter(r7, 0x47f6, 0x0, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r6, 0xc018643a, &(0x7f00000000c0)={0x4000001, 0x71, 0x200000009}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r6, 0xc01064b5, &(0x7f0000000140)={0x0}) ioctl$DRM_IOCTL_MODE_GETPLANE(r6, 0xc02064b6, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 5.111232348s ago: executing program 1 (id=1697): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d1040206402d14e0102030109021b000100000000090400000190f19c00090584"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) ioctl$I2C_RDWR(0xffffffffffffffff, 0x707, &(0x7f0000002340)={&(0x7f00000022c0)=[{0x1, 0x9800, 0x1000, &(0x7f0000000040)="f6fd4a9feb94f26638522f42b907e7e0b47b9f7386911d72480b0095c43c2b48e10920acc0a8548862a6480b90e765b5779849e428a4c8dd9cf21b4e353deca4c67837e73da47ef4769473b24ce4421594083695723c5132559244a0ae54ccab4c5668b0e6860fe6ef91920bcff499caad63fd5cf8a18c069534d22ba40350a512a93f61199e4a3d52176dad49b052343430eb084462e34d0458f1c6f1f1e1473fa525ae4b49c91c027711eb46307ae3fd928002157ef2d91924831954a3c6f2088010ee0ccf6ab59c85ba607364347224e388e6fe786530c40784621e678d91751976af30cdf2518361c83ca43f4901229c2e14355e98baffe0de8a942b9a67ac2e020c769fc55a9f99eb4bdc7869cae404583ebfdd8441822118754b5d239d8629fc3ef4cf667c919a7f34b81450d287945df998a21c8b6b3c31b23ec18ff13d0a8c93998edaa274b1c1fb559f4c5a0016414a6646abec7a3b23af0d8ff0204e3ce4f6a2896d32dc6e0ae2eee6135b373d10c02693b56dc3a7ac7a8e1666045bc6e85fab740b23270efbc20b4112f4fcd1645353a5bff4f41819aebdc1b1740a7bc337a1aa1d35c22bb740ced0f533ce7b0e982dacc10fc52cafba219099dec664273a92d66fb195f11c2a862c4b0e8bccabb94075e49b3742a006b88e4c60d22bd742ff4707bb2452b70970fbc3d94e585839d928f48568b3afa4f35984cf3110f279cf23d344c5d7fbaa3ebde4892fbee1f9175971b8bb691531255b3ea31c2e19a4e70dc5d27f096ad693cd5ba18f848b890e0b9c6f30420cc8c5bd7c0b8f60a0da17f47a481e4e7fb36154bae1eab71d15f240b0d8f8794cb2cdc19d43584ab62ddf59ace33fa97edcb7f46fa49beeaf6a87c0fbb53edd03cf1f192ff46458e9d0697b1c17140cb23d61f3cbdd9ca4ab10037352a715435d3000f7e6d96c33b8a1f8d29a368867ca6692ffd7467d41103574f3dc72c706cc65949b7b4289362cf41f3c92b0a058377faebb5a4741c3c11fdc1edc04e6681cc02dd7d25db8ca2ec5578ab336b2a5f0e9b70ac28091bd331ba4e3940c141619a9fa5243027f7307a482a245f7fc7a9ef5d56d3d8261b21208f7c2fced6849f0504e04afec093facedc8810f0e3d76ca899559ce6387a515171d4d3e89d9036c883d215fd0bb0533bc56015d1fd1f87eb0080fbf9ea8be75d639b0ae7a28fcd913defcbc6710edc394b5b79b4f72e3c4282b368b8148b189760a639a2f04571fca39da92f6ce982ca43aed3d8c50bd11bce470ebb689c15282738506875446bef0fef1e409e72937449fdd16c759d73eb3cf4d52e7efae7d1fe7a3bf1472ac17d7f5831f25826137b3bee126b9e1d1e9ba4ca8f6b37f99f75287d4aa56574dd2c59615c0b60e29236c94e7420313e12a27023fcbce2e1c1d826b177ea74ecc53aeab687fcdfc54f5d5c5c1185738cb57e779f085127e8d0c345043b10b23ac34bf866e4b03e688eca5de677492de8573777d99133ab9b5f8ed63ad1d4650dd7d8218e2baa18e5ee7155e250962db910cdd8401fbad29143e0ce44b86c5d2809d710a8cdef0af9a3745f90df5735124a617d1c285eb25f1e6dbee276f57b98815e9846adaa8b061567083cf3619396e2db397947c217b5a213bb0d75d6dce5c86d779607c7b17299c6a76eecd24d6d3f92045b9d3cfc1053e298550b60e40a58a0c746d90ab32a6db5d789487febef088cecc6528bb1431ccbe73ba976496e5a008d37b9c5a0b696a60cda4ecbe62098a33b961f25c5ab93a26e0e78f584671122b1fe8193802e7be1654054d070f1932e6ad82aefd0e0c8a69c9a234e05e0431eb82f5320e48aa812b70e3f351635a2be37ae1b68cc7a7a8c8c4ba6c5afbfb45a14e50f7cb04e87a4f7817e4cfeb40c6348dda624b5fc27a8cf9f3311d78f43a072fc8037a2030b9c0af2a428340707672de470e40a2c1a22f08f5fa5ebd4274f41c81ae8e2ad2dfaf5dfd35accd8411ab4353ce614dc57873bec159101da5f76bd5f6653827af16773c0df62e654d0d8ee639ff24398dffd51a2468f621b0e7d71c0120e3bc849af4e121a029f105ceb64200efd85cbb1ce6c113c48c56ddbac2a95e5cf65341d507acb147e722a8a18479bf31251b5eebdde6d42b400421fa89259d6bda8692feda04f6aee8308524e27872d009e77f07a6b9141abfb426f12869cda7305f45c0494aef5b16b247bf7d9478a8b1a840fd09001b394b9f3520c1f83a97c4b6ea133db006be7f3c262248e11a1f25e7226ae667f7be339c3fef719d0da75ea05498404e114b6ae9d0dcb4f7b4da82072d6509046035652f7430fce12a4af4c98f6681967c88d9e330baf28e2fbb684423bf435c7a43858a4b07298dfef45cc035dad798c72435a229827c6cd0a38f4d66bcfbc2c2d3c9ae03bf171bc529aebf70d2f8e30f98ba1ac8c7b99aa1ed46d5a360881b50785ab107ef53201da89f39b22ba0b5f72dfdfb849152572680d750747c85de091e1644a87f1be5f53b494fb8c861ccb4f90214fd413f42f86d2ce0c4bc842aba04ef8eba919950081d02afc3dd7f3a4113d8b03df5bd8d9189bc622c043403e153f1fb535093f930d2b41a13a0cbadecd99c542969d923ea97f17ef010f4243f5f05f14f514231fa53210da638bfebb4ffcd4ccf269cf34c0ab56b2abe61e282f2a96e1bbc5ea929c3232c8958d5edf8b299c05a57abdd97b7129c71582b3b02d783d429d2094285fac050bf72375a414a2fc651809504f049541f3ac1d3cbcae49d2add31b144704ac4c006276b260545133a24759e5e2a05cc6f629fdbeedd6d55fd8fbde33a49301818b452be8550fd46dec3b233a7ee7ef665b226e9620f084aa2f2ef6649bd5fa88667ecb893d537846451376554e41a74d64e8ee38634aa1ab2fcd55d4163db29b17ab99da5cae3f6f45d70d4993fe07abdcca99e92fecd69b66bff9e1ce988dcfd3833b0e54bc9769a9cd8c9522a56ee1206f186a0d92ddebd4fb28f778ec51d847dcb15ead2288f8a1631c9b401033ba1144cf2d30674b3f33df78f6a9b7c6afb2c7308503d99a4f02d9950d652db6b632a9259f1274351cee11c4fe6745c6dfcb0ae0832fa8213a9f771b32461abe2e3baa5da2f1974e76eb5c31da2ac4fe9a9b77a0fe51634ce6d069128661ff252f225102bcc5b6a74876b2156c9a91ece5cd6e3365876b75186b7824b12f6b1753bd8f8af39c9d68891e6ec40319c4b3e2b3f89beb18644aa74256e5c36ed4cac0e4263af7b669fe6872469532b7e92d9e5a84771f31eeec5e37ab56fff2ea9b0cd1102d4ed1e2495fde4b090f142df1a2ce96c5f96bffcc8ed47bd57c59cc0d95179bd11b904610e1e19b8bdbf8e73a5a6db68bd3b99db42dcfe8ef587e4baa6e24002f6cfeec1b6491caf81d2d203b2fe7e948634e6de24f0e9fa8521f358df96ff6077eaa42f95f741c09280a906f67f04f54045cac3987b38ba403a7e66db5e0da4d34891ff7362fb3aa2ad7882b9881c7a918e2ee6c1b69452b76aad62ba1367185d92d8bfa3e929643a5129421fdc4bfbfd237ef42bcfdf16feee80bcbb40b4011f392ffa8b7a58c0c4d10db70134ae1053f183f89dd9127bf1307af06a79ec13548995236e88a5d6b3cc81b20db236ae89b4c079da0bfcc2c87d314b013c8584364f6174ec55a05df0b82f46c26520d08824eb640358b017577f703844cc52d3ce6e9e0a9ebbddae0714244547403e3251e7f188c660567f0ca1d90249f435beeef1e5b48e3fb15cd058630e6c209bdda7c0b3e5b614baf049c1b34cc17fa71c27850150958ff088176ea9d05517c9af46c2b41ac932cf0a13bcd79719fc708b951973a881e72ec832cf009cea582a228ea570208a8a94c4efa3b0b323ced40f4d9702e1dafead24bd52e6175de78770689a2b7cb0d182793b8c2d95a6496fa4ec2566d0c30cec2ffd734beeb86befbd3319bb43a482eb0be5257cef9abcd9883f6d656a67539c301e9d7f649921f4fbf96bbd64917519cd3dd2bfd4a432c3617ae51e3501452c538c729cffa7d820bbdcad06b2faa3d7eb70e66aa4819a5ed00951fa73f6ea45f048f3cbaf638355118455b3497ec32a39e4f461d0538aa3edadb786d810eac9a9aa8b33b3e8f23ca6b10de0ab9708f5215bfe0214db7d2370cbc6e549e39ac54ae28ba0cd79aaeb06b3e781ca3ddc4d474db42f8222cfd5db694a24c239e3ea8ccaa2307c3ef5642dc62ff5b68480752350178aa67e2b5a20f27d67276aa6391696c1a763b1a1625b43347626d1c4f93246b1abc6ae5d47fe5a0dcac074f19214fae4932314ab3fafe9b6e9ff4bfcc72c6a7bda264dc60fc205c5192fa59fbd8db95da83677b7376b166d542720fca5539acc003a78003a518dd12b614dbad9541f6615deb0ef2dc085f9da4905e15c2b420c2e57405bda3ff50ba7912c53649bbd7e9d6cd930abb1c18c4a974d08653620c3e435285097aa9a1a7921d1239add0566a66e8389382da16e3160e40cad9127dbd635ef6d7672f51381cc003866e5d98b45c479fb4dac94b72ae9a193b11cca52c3e499cc7dba7551f120851a8a545c71f976c3600226c25bd3ea229062f72ea3a47a7173b3531face483f536dc457cb325f6c71a0802e1a6621d3c249782d7490e68e259be89e145840bb6c14c11a1ef8100dd770c8ec00f2894f243fca6d1d17cad208436d5c95d5f6ae679c4f9fc6a17c57e77e89d6876e5a3ba3a63ac316910cc044cc68502194f2e26ce2063a681e35e21ff71a2ebb94ddb32d03414e14dfbbc281f9319e6ecc99e56f210599f8dfbe6c230180d59b14e4b14175f49c13a6d3829b2b8ea1e27f7b1eae93884d49f277d571c4b9015587e0a96ebf1d8afc53a4ba046ebb212c0a433a611603904c3db7d0e1029531ffcc57c70d824d7cb4430c75fd8cb57fe8f2a21d4e684f91095022768efdd0110289b6fe4af536f49bd424d01674dafde4933e3d4ec390d8261568d6dae1a656000577c8cea5738447ec70173eb8ad3c8c7ef45b7016f790e77178712ce607171620fc2e7030999c5d072a3d0b25375d8e4d16178ddd0c648024ebaa285b2fd05be13e4ea5b9d1410861196f0d998db1acf9e504af350fa6dd8cdc26d67a70ab9784020f31f016714514792bb69fdccb0b679c1cdc4e42ef97570106768ce7dd0cfeb159a1d1e7bd579b348add1f21ed272e1f4ebd1a518a66a70e5ef601ecf58724e18ae903dd250d4d99f7e916ed96141b9ccc5703f113ec5a4eb3ace0771abec0aa914023da346321b1cd9e84f1e5ec78df1d0d473e15569b009f70a8a8de348277829391ca4bcf5cb2b77ff9a781c894a6d937f8d59d6ef2cc5d73994ee1e0fa918f0817e61e9589746fbe4201078e2cc58b4f2cf31c38a4341fdc1971f8bf3b190d9691d3accd25bb0539089d5c3628395dc7258650bbe473604d2d816d1accff4f1dbd4fe6aed7dc02e56d8d2a9e942081ac7a119c8367cd9b1f8db79817decda75e17627447b40af1b2cf1884f3e83f6e23f30a25796522409c7f7bedbd84b6c05c96ab600752290959d3d97db303ad18f5f171be5ed3e32c0966f5b95b8169b2e4e7dd682b7367432b6e520e8a7a174e6cff4e3533432fb9ef0345a92af1ceb9cf985205e3981cc0bcee8ed5d748a609b255cdc304118dd4cf2f5a9d0ad13a2092f1e351bc3a1d9bcb0f5a9b4dbfa116161bef044e4722248c390afd19a93e15985573d1e113bcd0cc2eba6afc243502950bb8224c4d6a556"}, {0x4, 0x4c00, 0x96, &(0x7f0000001040)="aeb51485765d632ecfcef9c3a0319299fe5fd2684430e2a1234d0b489d5182b65f058fa3e02be85660c17aea6e48bc39d20165cef372ffe6989037f0c43ccca44171c2a4dbe45b849e5b02537e7b9e62eb5e006bfaebd8f673c93a22d65d3dd0a3ac39c349d590b2b84e2fc515479b4256ee14242d2c7427a1f7832e0b59718a2a3309618e7f49ebaf4f79a4dcd9c09e9928c89494e7"}, {0x8, 0x2000, 0x71, &(0x7f0000001100)="eab081287e95cf4ae835d94cb9bd488a257ebaa03255e48ac6af3f10c81bb1a1fe74ae48c5a08ba99139da7f4e1c02f3a8a29f340ec51e83f1b4b69cf2f08b66595198979602c3fc759c13339692b96c585266f401b43fe1b08da64396079a2f2f11a4b91e0425fc49aea456fcded52d3e"}, {0x0, 0x8201, 0x1000, &(0x7f0000001180)="b9915013e2823140a1c6091d7f255e8cd1aff70775cf8f59341b9f5a19c0c2a3c270dbd234b25c5c5798f2019b0ef91e2757fa0c56e3075161c46ff3ddde5251e3b4bb003ff5af730e7c72a02b9e1dd4fa9f350f5e1bee19442c98f72fecce463d5d1dd03527e7d2f307170e7e4305a68d67f0ff95d0cd620fdd1d1eaad4c58a8da088bfd0b55b5b97bd5b7877b41b3729f3b85fdf86737127eaf71a198495d5861f94164a5c1f9aa581324cd04df185ca7cd600db471efb67f5be77da7797838843f81922e1e8102fa20d760353d7b9f5cf848f08448401910b1c1a087daf432442cd1d2da2834f13431b3c395e30dad4e2a5ffb8f9a34d0ad7d8e78fa07d84460496bd413553ea7b48b62a26ec3f0fa9cacc1d1fa56dd7ef630a5947d0e0e0b196869d5e9a06cf65727adc8af2895e19b6c27fecfdcaf20a0dad7778f87128eef650bdac8775a04fc197d7380dc1f37531c0049d907766d2130b158157877434bb1a207da7d728ec469166eaa1ebb5decd950d9571f48c1364cabcea629e8a45e96a437d116e2f4e6edd891896acbbfd57dbab962df32bfe44f71fc24c44cef078237d752621b5c816fe1c4746f9bd777ea3c322a3cda9c4d98a94db4f96dd351af67adcb408bd9590bd530bc2ada0b82309e67dbf9dcd203b13f827847c554fc41a6cc5e1903ebeda964198c31ee19809cd93cd6db34b6bc5e519b0e7a6f57a608b37389379f2690dcb818a2fd48c4a65888871f8d246db06af0f7cbe83d5126cc742b933d90469a8d062acaec4e294f177362a05de9dd7ffa2a9ee2faba8623fb20c2d9053c7d1e03beb370cfb914c89f0c281e63224c3988efdbf0a987a84c545a286ced0182ddb318a3bdfe459232cc38fef0c000c438ba0ab27ad44ae26ba9fc9bff2ce4c25066666cae381c6e13ff5c0278562d0f4bd61ba676be8906fb8571aa045a002a870e522bedf213f6e26878199644066e2600d2e08168c361a944fd8ea0a76c1b1dce709d7e0f5244425198c4ba917179ab2ae6827d04c3b4041e2d99bd91a358a7cb48aac42bca5490824f9f33853b828b5f4afc62d98a5002c2017efec0759cd9e11b566a26d71725060667e578ee0e72784a5f921b25dcf427fab6a5a0801e8e97db263537878a596fccf863e356a1086c3d9e05bf1e924610fa5d9ad54f2e0f23cdb081e09808a083e6b06d1dd5e9faac8cb8bb4904295e24632f7d4d0ad6d79c2b4e9fe1a414550e26548f3a6c07c3734785b1bbf95efa9c9222af6dc657fbe672b9eb10b5e64e8398bc78ae5d859d27ede5f3b0c6fbd32fca1489d26b2918b949ac8295e5dc22fbdf4aa17ab7216b386667a455355fa88470428718c2cad74c7f8cff4cb6a04b0a1e44adf968a257c98d16c766a3a0dae69979db9d96586783cc7ffd38b4a921cec78078e051879819c76d7f110ad1d6c859a1f15ee1cce27d23bf5bfea0f23a3ef43bbbc96cc325832ec05fc7fa28c69ca3c1b86152371a57a8f67a6c26b80d928fd6a0827293dfbe1a437dfa9c83dbf03c1b1177cf344a6c85b9cff3c89f2f1f4dc128cf9c0b7c50cedc3af1483e0153f76ff7fc3466b6b2b52fa6041daa71e6bb82ac91aabb41c893e736cd42dae0c939c9821f710694d99e0261ffe538767e0f3270893b3652168565a49596e9d17f5671b1b52b6b995bdb5eb5acd58f8adf47d877ac1e94a208954a461a3e32207d243c37b30d94e473ec1455e9e7782be183611287dd0b84d20efa514a2f124a37961d7182bbc918be262b5ed3c4c7a026f901d008acd22e732a432e764fb02ea368cbda791ad895ea45a56f8307ed3a4ed1fff607bd07ddc55da5281f605a4737cda4d327e48a81a6109ccfa21c4c8a5f515e5329eafd61f0ea160b4e203ac62b3c3d7853db2a6f1868de7f384f2d062b8f7fa05d0a4a938568e8835a43db61209e4c91ae5c65ec87b728f302186d4407cbece8d60ab6ef0112474adbd101d27c9d51232cb029431cfec92ece579c3aadc19dace8b08962c267a3c170822b5960db9a17cfa74a6a2fc707464c9e476db83fc38f979f260816149697c9c633b3fdfeb5258282e620dd57253bfa2e934056c1a36693bad1083c099dd04f48e204be0422ced8efc8e2079bea0b17207da5e2f41ebbcf1858e0f6a419ec25df97e76a3b72e43b31c58b781fbcd9145262ac0dfe1a4691aa7600fc41e9faa4e2b071ba916908b8d284444d424ce1eecfab54657c7b9e4bda3c441eccd8037352e73313d93cfbe97252812e70d75ebfe751f98dbba52dc9db63342685d7ef8a1a25e56fdd80ce8219fcc7b744c4e7345c8e1a655c5a15fe7181e91b4806f0fd3adef9f7c9745e3b0d150e87f78cb36183dea452533dd395c08fe76d606cb3bb42339c76c8e3157c1cfae5f87c27979a1fa14aa7320459a3cb13ab28fbf1f88e7aafab652827cfc40e55d8cd45ba9ab574481a6f709b56d04dc4beb4c48df27ec51f5c7a1053b2e79a4faaa64e7b8db587bf6003f074ac0a1f41ef676d307fa1f0f1fd0c54a5c3e73aa1b4cc4559b6b1a56a772f42b32f02cfd3ce20b265c7174682efd03a25cd44368ee9fd1097c3e21d0e91f51ba3f0e5c457664347a397110119d2fa72fdfe5a04e2fa6a3a2bbbc84af30e2c25a945a8cba0c5ab61af5dae7015f55259961e4892715d89cbe56af7775474c75fc3988b89e7b2156c7cd4479e93b5d80a3f81fa79033809b817b90d39c53e5b562c9e49387f15f8adf2dae3ac5a09d09fcb81beb02fa8403befa502e8586f2be669301fb6b0804ed10f71eb6570d1e8e3c3b2b619b79b5251ef0410fbcea76742010dca8aed56eb1490967bc746b4a7b093c8070990e1ad8de35c5a1b0fcd2e17cd3c63610d02025a0fec1fe0e1203bae084443447961b67eb37d1de96eba2ccfe44d530d32c7c952ed238ce5696865e47845a1f8f0b11545fe5ff5aa96e9a17390c988153ebaf39ae0e70cc421bca627ea8cd0beb66ef22d42bab78eb6fcc7093ebd16b2e5d99e7416419b60226d49af19e4776e5718e5583ac3b0112c13e36c9037b8bea36d9f63c68a4da7e90f0630688c6b1fde3504624e5ba3f2e2f93253a87b5c26bd1204e1bb9b1bf46cd907885216109bb99d96c00cb2b23595e7b575cd856d21f4462e282b69bf28ddb83cacb4eb5a0c7e77c503c833de797fe63e42f9c2244802c2e36942ec4eeff5b670db904c1aef89755e77d8021a5a6b9917e594398886f0fe521a31ae9e9da78696012d39596e56f58e39e19a0bb13b88624ff7bc0f56efa25db87741f7cd94c3d2548fb84ba8d6000d83fd9297c4ffc8d9013b589376a7b575a3486d2504f7010a05368853c7cfe4f96f28a67ecc3435ad2ac3f49c129e2dcc32acf4abb97bb3417ccd15e7c867a22ef83ac7f6f5e751b00cce1ca44b3c77db5b1f420a32f0fc4e1939e46e47a8908e3737b8a75c49ee1aba215e40c276118ca7f96f5cbdd5ed7c305202804f11274c209d83d61f02990eb0ddfad1b15164ff462dab22d82af8314b840627ee7f8e12139312e1139da517f035307531ce93d441e81fc2623f57e06dc4e44b27700c8b0b125016041e410cad69d9748a0572235142bbae74543c38d37742f9a83f313a31cf4486e6fcc37cff313cf009ee95d68dbbdcff8c93147c35f2bdc5c6f242044cbc883dc674fc05e3525a33290fb114ae1a6959de8997897cd942522458553368ffa28824c22518c731a9f950d9d23f095b38875ffc7fd3b56f17391574449c7fbfcaee0a73a87335ba20132a8031050c1bc7ad505e5d3638527005950c41bdc9bb04eca12ca26feed2b2099cf29c2b6f2e447cc918e0060536f20d0721784ecf52a0ee03aaacf6aaed68b57628bfab627228f4088c4c381895455928da46bd2a09ddbc4eec0e54d1734cb4cb5c1ee1e89de0cada12a3d5808ca0504376c2f6229d8c02b56b61ab98e9211b084984fe36963e5482ed15d95ec38a653e17ac422003f4e1345c19a1f668e464edfe5d6955ab8e7d54af297021ea8b497e81b3a99ec18a467f62d157660826f5d899d5bb47290b68237ce5c7a62f6d49ccae5e28fca034b3b577918d2da661d95322ba7f75079e303fbb682646009b084046680c209356f9b2d85ebfdb616e6e28c7d1fd03b1b78872de55fd02edf5d8f92a9db4f2aeb38cad19375e7190e5f6bd5a71f50636d019e3a226a7a6672689c981fbfb54159d10b0fec60ad9f9d314ab24fdaafbc40e6a69c6fc19c3c0d5212d1847b7e63a692edb5a4c590635499085a0b591dc7c1410bd4b2a179eb5d1846d6bda462991453d04c83d5df6dedd72c664f36aef81fa49d8a2e7a1fd9b79703c2f85a58bca7c4d571bfbd6a759a53bc69306e27fcb36cd0c2c9d6535fc80c2e46c1060fc789c920af9b729b5626fcd080255f591be93fc75d7534f2c5a435e75e514e0dda74f1f76748993317fa3e74f3ec1af7ba84eb917f1a0750460901a08945cec3eb99e853d0328576782f094f6e62ce5c7fd92e38cd75494a2893735607acc1eb99bff7dfd6ed4395f5d112ed8aa4f3bdf5c08821644a2a437c3e31a4f028deae4a8cf04ec18caede9406087639bc0f5468caced0d20d27b69e132f898ffb17d6ac6a218de124a21d3e3e40fa15e2d53d3add7c98d289074ab863aee9cd76e8f5ce168b53d5fab18ea50bf7e86f99749747e1e0e45f4ce3294f8dbd4a44eb3c2cd90700de48599828f6650ef98ebdaf827b4be74c9a354047beca2de060d5030ec5d8785b91a816ee882b14c1ef35df90edd3366a4bedf37b665b2a343cb0888931db15967e782ec285d655b97fad34b770bfbc1fc9c5de866bbe4e1fefb80e1b37099730521a3a6dde8d58e0855fdb297cd26f32456734a41f2cc7f16ba8fbbb7524412465e3eba9cd98f0fcf46261337c4f422fae3367a68bc96ddcd36d33bdc141fce09b7c1c04a999d363cf98202f282e8feb0443f10ee7448a0ddcba7e198ad765fc56bd0addcd85f6bb06afcc53f124f14e7240f4d1fd9ccdd3a4f131002873a84e2b4870205817ce8391ecc64b62cfb5c675407418010da890072f4eb5f018ecf0d1bffa83c681d76f991f9af86dbfae9c4e0af6d5364877e07e0a3b12280d399cf15fc5a49b57d387ecbaf3cbcf06e34c0e3321014ca172ea7e949878a441a482ee20cc60683d889183735e81a8d6799fc4f998087a1cd918b2da05f15f35952ddf862f5320bf7ab7505ddf0bcea4da5af9286e9935ebbc9ea28c6fa3b245f31eceb8038bca1bfd4717cb0116a5b4ec9e9a99d5b14d027f4f4d426f3ca76d47a97748667fa1c93e61c8ed65ee41acd27bfaa2cc630eaa395ca99e5b0cc810815f1d8ab9693ef194f96fab17fef3b81033719f08327141dbfe67c89b6512e804c73cb6d5e9a31089587897af27c0b1950c98568bec5f8abcbfac6f9b11d7531e7653241f091e0984e24c1784b67fbfe9befdf8769896f50a666ab1f547628e4d8fc0f127351376438dc2544776f0a4a50b25f8aa7e074a41a1fdd4afc1e15b5ab947bfc2c60d4389e183f22bdf59852603cfd14a1cee2587cc7cc0a03788a8b5c2f95d218e6e881668d5615c813c46822f6220ceee1e4da0db8c536ca5e346ff6b020f16f6c54aacabd4811c5d76e9b03e0bc23469e6f55039f79f5433f2ba4b6b17c95c5b87a2bbfffc82fae0fb648d106e56ced23defe92d1ad7089cf7d9dd2496340fabf1668bbfbc85c8d8de3742c7c7522ed89505e3ffa26b668c2234dd75165d48d5ca623dcf60c9fb17b45517b3fa"}, {0x8, 0x1000, 0x91, &(0x7f0000002180)="3088b55b358533ed8c57cc9ec33f673f22b94432074da916609dca310e8de5bc3f7b07d6441d8db111153704e66c54ddc0d0b4c225d1e04ae87ff35470e998f2d15496190395d6cdd28dc32012919621d0fabcd8c3d4b5d49111d1a81cf74575f7c3c955109dc69421eb17b90df7374403ccef3258d7e66895731174858e75e3738e28c46946f2d48c957f1f3cabc7920d"}, {0xf9, 0x1400, 0x23, &(0x7f0000002240)="9ca76e86d4ad5621fd0a6c5a0f64afd1d67861bb6dd90273591591916c979eaaee91b7"}, {0x93, 0x3010, 0x28, &(0x7f0000002280)="7a1ed2561180caddf9f4924dfbcba4810c410ed3780fec0e96d74ab18b11d005a385fcff8ffb6123"}], 0x7}) 5.044353539s ago: executing program 0 (id=1698): r0 = socket$netlink(0x10, 0x3, 0x0) sendfile(r0, r0, &(0x7f0000000140)=0x7, 0x46f3) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000800)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in=@initdev={0xac, 0x1e, 0x0, 0x0}}, {@in=@dev={0xac, 0x14, 0x14, 0x28}, 0x1, 0x33}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', {0x0, 0xfffffffffffffc00}, {}, {}, 0x0, 0x3502, 0xa, 0x0, 0x0, 0x18}, [@offload={0xc, 0x1c, {0x0, 0x6}}, @algo_auth_trunc={0x4c, 0x14, {{'sha1\x00'}}}]}, 0x148}}, 0x0) sendmsg$tipc(0xffffffffffffffff, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000003900)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b07080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf5af51d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3abe0fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945ecefa26b8471d42645288d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f93c0984b5c2d4523497e4d64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4e064c98e494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6eba3bd4c440e6e2172e3fcc01b8babb757b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa16509945ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd231088e570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88c3c44b3b7486f979e8a3174b531f573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb423c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50261a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e48701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867ec92d13a4fa4ae033a09673866cd77f4bcdaaa05207166b19a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d93e1fe9c0b4a4a268921738938aa9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9ea81232fbef665f6212f875b2a0000000000000000000000000000cf7b6c4ba9bec153d6834bfef080df374703a8ff56a63ec1fe5f2e05a79e3cace7283dd68d41e94420c325fe4dae144fde5ec25a87d625cab20753a77b323fa3783c8b675859b9012647885a242adfee2fe812ecbe5191e0a15142f7349e7627cc39d724e2e34e7a24154f26ae3125b36d0504965295d0453902ac7079b11a3a1e655e482331e3dc35b2e7e4e3ea99064fe5b9c8ae0ca3e5fd653f3286a99d81ce4eba765c38d097391ad4babac38ce5b4344e24a361cd54e5"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x2e) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000540)='rcu_utilization\x00', r2}, 0x10) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@ipv4_newrule={0x1c, 0x20, 0x301}, 0x1c}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) 3.852284502s ago: executing program 4 (id=847): socket$igmp(0x2, 0x3, 0x2) r0 = socket$inet6(0xa, 0x3, 0x3) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f00000000c0)={@mcast1, 0x800, 0x0, 0x103, 0x1}, 0x20) setsockopt$inet6_int(r1, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x1, 0x4) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000040), 0x6) write$bt_hci(r2, &(0x7f0000000280)=ANY=[], 0xa) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x2, r0}, 0x2) sendmsg$inet6(r1, &(0x7f0000000600)={&(0x7f0000000080)={0xa, 0x4e20, 0x1000000080000, @dev={0xfe, 0x80, '\x00', 0x25}}, 0x1c, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000000000029000000040000002b00000000000007180000000000000029"], 0x30}, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') read$qrtrtun(r4, &(0x7f00000004c0)=""/57, 0x39) r5 = syz_usb_connect$cdc_ncm(0x0, 0x89, &(0x7f0000000100)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x77, 0x2, 0x1, 0x0, 0x40, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x0, 0x401}, {0x6, 0x24, 0x1a, 0x0, 0x5}, [@country_functional={0x6, 0x24, 0x7, 0xd, 0x2}, @mdlm={0x15}]}, {{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x0, 0x6}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10, 0x5}}, {{0x9, 0x5, 0x3, 0x2, 0x200}}}}}}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r5, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x6, 0x10, 0x10, 0x10, 0x1000, 0x10, 0x10, 0x10, 0x10}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r5, 0x0, 0x0) 3.068115199s ago: executing program 0 (id=1699): syz_emit_ethernet(0x56, &(0x7f0000000280)=ANY=[@ANYBLOB="0180c2000000bbbbbbbbbbbb86dd6001044800203aff2001000000a5b811992d08aca40000000000000000000001fe8000000000000000000000000000aa8800907800000000fe8000000000000000000000000000bb"], 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000200)={0x2, 0x0, &(0x7f0000000080)=""/35, &(0x7f00000000c0)=""/207, &(0x7f00000001c0)=""/25, 0xeeef0000}) r1 = open_tree(r0, &(0x7f0000000640)='\x00', 0x89901) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KIOCSOUND(r2, 0x4b2f, 0x7) openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x802, 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89101) r4 = openat$cgroup_ro(r3, &(0x7f00000002c0)='blkio.throttle.io_serviced_recursive\x00', 0x275a, 0x0) syz_open_dev$sndctrl(0x0, 0x0, 0x0) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB='X\x00\x00', @ANYBLOB="010000000000000000000100000044000180060001000a00000008"], 0x58}}, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000380)={'wpan1\x00', 0x0}) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000640), 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_KEY(r7, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000a00)={0x1c, r8, 0x1, 0x70bd2b, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x48004}, 0x20008094) pipe2(&(0x7f0000000040), 0x0) sendmsg$AUDIT_TTY_GET(0xffffffffffffffff, 0x0, 0x8000) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)={{0x14}, [@NFT_MSG_NEWRULE={0x80, 0x6, 0xa, 0x801, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x4c, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @log={{0x8}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_LOG_FLAGS={0x8, 0x6, 0x1, 0x0, 0x30}, @NFTA_LOG_PREFIX={0x6, 0x2, 0x1, 0x0, '{\x00'}]}}}, {0x28, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_NAT_REG_PROTO_MIN={0x8, 0x5, 0x1, 0x0, 0xc}, @NFTA_NAT_TYPE={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_NAT_FAMILY={0x8, 0x2, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_POSITION_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14}}, 0xa8}}, 0x8000) syz_emit_ethernet(0x46, &(0x7f0000000440)={@local, @local, @void, {@ipv4={0x800, @tcp={{0x9, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x6, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0xd}, {[@lsrr={0x83, 0x7, 0xd7, [@multicast2]}, @cipso={0x86, 0x6}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, 0x0) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000000200)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2407000005000000000000000c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r3, @ANYBLOB="05", @ANYRES16=r3, @ANYRES16=r4], 0x0) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000000000)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2407000005000000000000000c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r1, @ANYRESOCT=r1], 0x0) 1.304799328s ago: executing program 0 (id=1700): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f00000002c0)={0x0, 0x0, 0x0, 'queue1\x00', 0x49}) write$sndseq(r2, &(0x7f0000000000)=[{0x1e, 0x0, 0x0, 0x0, @tick, {}, {}, @raw32}], 0x1001a) 1.30168058s ago: executing program 2 (id=1701): r0 = syz_io_uring_setup(0x23a, &(0x7f0000000400)={0x0, 0x80d7, 0x10, 0x5, 0x2cd}, &(0x7f0000000380), 0x0) io_uring_register$IORING_REGISTER_NAPI(r0, 0x1b, &(0x7f00000001c0)={0x3dfa, 0x5}, 0x1) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='fdinfo/3\x00') preadv(r1, &(0x7f0000000000)=[{&(0x7f00000000c0)=""/29, 0x1d}], 0x1, 0x0, 0x0) 1.295932717s ago: executing program 3 (id=1702): socket$inet_sctp(0x2, 0x5, 0x84) dup(0xffffffffffffffff) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000004d00)='./file1\x00', 0x351142, 0x1cd) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r3, 0xfffffffc) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) close(0x4) syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r6, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 1.243672578s ago: executing program 1 (id=1703): bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d}, 0x94) syz_io_uring_setup(0x24fe, &(0x7f0000000300)={0x0, 0xf36e, 0x10100}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x2e, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='='], 0x38}}, 0x80) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$UHID_CREATE2(r2, &(0x7f0000000180)=ANY=[], 0x118) socket$nl_route(0x10, 0x3, 0x0) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f00000003c0)={0x0, &(0x7f0000000300)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r4, 0xc01864c6, &(0x7f0000000040)={&(0x7f0000000640)=[r5], 0x1}) r6 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r7 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r8 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000000c0)="5c00000014006b05c84e21000ab16d6e230675f811000000440002005817d30461bc24", 0x23}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r7, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0), 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETCRTC(r7, 0xc06864a1, &(0x7f0000000d40)={0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r7, 0xc06864ce, &(0x7f0000000340)={r9, 0x0, 0x0, 0x0, 0x1, [0x0], [0x0, 0x7], [0x0, 0x80000002, 0x2], [0x0, 0x0, 0x1, 0x1]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r6, 0xc02064b2, &(0x7f0000000140)={0x2000401, 0x2, 0x806}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r6, 0xc00c642d, &(0x7f0000000080)={r10}) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r7, 0xc00c642d, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r2, 0x0) syz_io_uring_submit(r0, r1, &(0x7f0000000000)=@IORING_OP_FALLOCATE={0x11, 0x10, 0x0, @fd_index=0x8, 0xfff, 0x0, 0x6, 0x0, 0x1}) 1.189003375s ago: executing program 2 (id=1704): socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWCHAIN={0x28, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xffffffffffffffff}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x3c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @masq={{0x9}, @void}}]}, @NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x8c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r1, 0x0, 0xca, 0x0, 0x0) syz_emit_ethernet(0x5a, &(0x7f0000000100)={@empty, @remote, @val={@void, {0x8100, 0x2, 0x1}}, {@canfd={0xd, {{0x1, 0x1, 0x1}, 0x3c, 0x2, 0x0, 0x0, "8941bd5d33539f6214ad5ddcc11db2758a32b767e3a16aedd7a73d64a5ff4112beaf3ddc129b411300f08bd71684ea5a1c5b0d58d878556d1262c0a77c215b01"}}}}, &(0x7f0000000080)={0x0, 0x3, [0x670, 0x703, 0x4b6, 0x3d6]}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000440)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) socket$inet_udp(0x2, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, 0x0, 0x0) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000140)=0x200000000) sendmsg$RDMA_NLDEV_CMD_RES_QP_GET(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x60, 0x140a, 0x400, 0x70bd29, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x2}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x6}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x3}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x4}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}]}, 0x60}, 0x1, 0x0, 0x0, 0x4050}, 0x40080) preadv2(r3, &(0x7f0000000180)=[{&(0x7f0000000040)=""/86, 0x56}], 0x1, 0x7fff, 0x2, 0x1) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r4, 0xffffffffffffffff, 0x0) 327.388074ms ago: executing program 3 (id=1705): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1c, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000a6c5ea39db24921e54d30e41", @ANYRES32, @ANYBLOB="0000000000000000b7080000020000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000030000009500000000000000"], 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0xd, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000073"], 0x0, 0x0, 0x0, 0x0, 0x40e00, 0x10, '\x00', 0x0, @sock_ops=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x39, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000080)={0xb, 0x0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x1f, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, r0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000400)='virtio_transport_alloc_pkt\x00', r1}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) openat$cgroup(0xffffffffffffffff, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(0xffffffffffffffff, 0xc0a85352, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0xffffffffffffffb3}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x400000bce) memfd_secret(0x80000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000002000)=""/102400, 0x19000) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000006c0), 0x48200, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$TIOCSETD(r4, 0x5423, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f0000000500)=ANY=[@ANYBLOB="050000000000000071113300000000008510000002000000850000005600000095000000000000009500a50500000000a2fe937a6a29f464f5af2904fb96377ae14890a39c17d99b7fc0ac80def2470f7dcbe543edf50b15b9e6579ce90704e5652d9d452b6b883d502a991978a442ad2aeb73e6b3498920154d49ddebf14db6132fb9b69efd006b8b99911f2d3ab90b98f54b528abd0671bfb575c27e12e7b449c4540bdce311a247aad97c6c87fdfd5ffc1c0ce6db7ad0063ededa5a5e569c831cd0a397d983e9c630018652db021fa96301ea161bad463042be2b50ff5d9a70b0a28872c7deddc50c6c6650bd36f15dcbd7e88568aeabdf619809ef8a5f3960f03a1e9bbf464daf3aca9b"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x70) connect$vsock_stream(r2, &(0x7f0000000140)={0x28, 0x0, 0x0, @host}, 0x10) ioctl$SNDCTL_DSP_SETFMT(0xffffffffffffffff, 0xc0045005, &(0x7f00000000c0)=0x4) syz_usb_connect(0x2, 0x3f, &(0x7f0000000140)=ANY=[@ANYBLOB="1201500238e2aa08732b17000ea20102030109022d0002db0480e60904000400ff9e4d050904800202e2a5c60a09050404080009020909050500100010f807"], &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0x0, 0x0, &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x19, '\x00', 0x0, @fallback=0xd}, 0x94) syz_io_uring_setup(0x53f, &(0x7f0000000440)={0x0, 0x807734, 0x400, 0xfffffff8, 0xfe}, &(0x7f00000000c0)=0x0, &(0x7f00000002c0)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) 230.050397ms ago: executing program 1 (id=1706): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.kill\x00', 0x275a, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424d", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000300)={'gre0\x00', &(0x7f0000000200)={'syztnl2\x00', 0x0, 0x700, 0x20, 0x0, 0x5, {{0x23, 0x4, 0x0, 0x9, 0x8c, 0x66, 0x0, 0x80, 0x2f, 0x0, @multicast2, @local, {[@cipso={0x86, 0x27, 0x0, [{0x6, 0x9, "2b145afef03dc4"}, {0x1, 0x11, "ac20e12ff8b4579652645a9269a0c8"}, {0x2, 0x7, "7efc2e00d9"}]}, @noop, @timestamp_prespec={0x44, 0xc, 0xb, 0x3, 0x0, [{@remote, 0x7}]}, @lsrr={0x83, 0x23, 0x90, [@private=0xa010100, @initdev={0xac, 0x1e, 0x1, 0x0}, @remote, @dev={0xac, 0x14, 0x14, 0x30}, @initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, @initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @noop, @rr={0x7, 0x1f, 0x7d, [@broadcast, @empty, @private=0xa010100, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x1d}, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x3c}]}]}}}}}) openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x0, 0x3ff, 0x0, 0x4b, 0x0, &(0x7f0000000180)="539ff763e3e2a3434c627e76bc577f357a4a981a81412d20cb9bd41537eacf70788a60b716efd2860424f31453b6f43066df271edeeabfbc13e96d45a8eb52c95d51cd3961ea000707c9a4", &(0x7f0000000200), 0x0, 0x0, 0x100}, 0x50) unshare(0x22020600) timerfd_create(0x1, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_emit_ethernet(0x4e, &(0x7f0000007300)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x14}, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "5f815d", 0x18, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}, @private2, {[@dstopts={0x2f, 0x2, '\x00', [@calipso={0x7, 0x8, {0x3, 0x0, 0xeb, 0xd3}}, @jumbo]}]}}}}}, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$PIO_SCRNMAP(r4, 0x4b52, &(0x7f0000000180)) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000006c0)={0x1, &(0x7f0000000500)=[{0x6, 0x43, 0x0, 0x7fff0000}]}) socket$inet_udp(0x2, 0x2, 0x0) r5 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) ioctl$COMEDI_DEVCONFIG(r5, 0x40946400, &(0x7f0000000080)={'pcl818\x00', [0x2f00, 0x7, 0x5, 0xa, 0x12, 0x400000, 0x1, 0x9, 0x1000, 0x1, 0xa, 0xfffffffa, 0x6, 0x4, 0x3, 0x8000, 0xfffffffd, 0x9, 0x200, 0x1, 0x3ff, 0x10000, 0x800, 0xe2df, 0x3, 0x5, 0x4, 0x4, 0x7, 0x2, 0x4]}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000340)=ANY=[@ANYRESDEC=r0], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', r2}, 0x94) recvmmsg(r1, &(0x7f0000003d40)=[{{0x0, 0x0, 0x0}, 0x5}], 0x1, 0x2, 0x0) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb}, 0x94) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0xbd, 0x2, 0xc4, 0x40, 0x856, 0xac31, 0x931e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xd2, 0xc8, 0x7f}}]}}]}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 0s ago: executing program 2 (id=1707): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$sg(&(0x7f00000003c0), 0x1000000000000000, 0x20007) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000194c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_INTERFACE(r0, &(0x7f0000019580)={&(0x7f0000019440)={0x10, 0x0, 0x0, 0x28000000}, 0xc, &(0x7f0000019540)={&(0x7f0000019500)={0x28, 0x0, 0x800, 0x70bd29, 0x25dfdbff, {{}, {@val={0x8, 0x3, r1}, @val={0xc, 0x99, {0x3, 0x3a}}}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x4000010}, 0x10010) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000000300)=""/102392, 0x18ff8) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_timeval(r3, 0x1, 0x14, &(0x7f0000000040)={0x0, 0x2710}, 0x10) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') getrlimit(0xf, &(0x7f00000000c0)) pwritev2(r4, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000019400)={&(0x7f0000019300)=@updpolicy={0xc8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}}, [@proto={0x5, 0x19, 0x2b}, @replay_thresh={0x8}]}, 0xc8}}, 0x0) sendmsg$nl_xfrm(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@updpolicy={0xb8, 0x15, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x10}, {0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, {}, 0x0, 0x6e6bb5}}, 0xb8}}, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)={0x38, r6, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0x5, 0x34, @random='\x00'}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_KEYS={0x8, 0x51, 0x0, 0x1, [{0x4}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x4010}, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000019480)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000400)={r8, 0x3, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r9 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt$SO_J1939_FILTER(r9, 0x6b, 0x1, &(0x7f0000000280)=[{0x3, 0x3, {0x2, 0xf0}, {0x6, 0xff, 0x4}, 0xfe, 0xfd}, {0x3, 0x2, {0x2, 0x0, 0x4}, {0x0, 0xff, 0x2}, 0xfd, 0xfd}, {0x0, 0x0, {0x1, 0xf0, 0x1}, {0x2, 0x1, 0x2}, 0x0, 0xfd}], 0x60) kernel console output (not intermixed with test programs): remote control event. [ 591.627331][ T24] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I / HAMA USB1.1 DVB-T device successfully initialized and connected. [ 591.796129][ T24] usb 3-1: USB disconnect, device number 47 [ 591.824942][ T5854] Bluetooth: hci3: command tx timeout [ 592.124620][ T5970] usb 2-1: new full-speed USB device number 36 using dummy_hcd [ 594.302729][ T5854] Bluetooth: hci3: command tx timeout [ 596.354858][ T5854] Bluetooth: hci3: command tx timeout [ 596.393815][ T24] dvb-usb: TwinhanDTV USB-Ter USB1.1 / Magic Box I successfully deinitialized and disconnected. [ 596.394104][ T5970] usb 2-1: device descriptor read/all, error -71 [ 597.715151][T11634] netlink: 'syz.0.1302': attribute type 10 has an invalid length. [ 598.434703][ T5854] Bluetooth: hci3: command tx timeout [ 600.498498][ T3527] hsr_slave_0: left promiscuous mode [ 600.633236][ T3527] hsr_slave_1: left promiscuous mode [ 600.716938][ T3527] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 600.756113][ T3527] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 600.892913][ T3527] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 600.901028][ T3527] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 600.933624][ T3527] veth1_macvtap: left promiscuous mode [ 600.940426][ T3527] veth0_macvtap: left promiscuous mode [ 600.947365][ T3527] veth1_vlan: left promiscuous mode [ 600.953640][T11654] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1306'. [ 600.963444][ T3527] veth0_vlan: left promiscuous mode [ 601.304818][ T5970] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 601.464765][ T5970] usb 4-1: Using ep0 maxpacket: 16 [ 601.539483][ T5970] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 601.638198][ T5970] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 601.716016][ T5970] usb 4-1: Product: syz [ 601.758267][ T5970] usb 4-1: Manufacturer: syz [ 601.798608][ T5970] usb 4-1: SerialNumber: syz [ 601.976594][ T5970] r8152-cfgselector 4-1: Unknown version 0x0000 [ 602.033913][ T5970] r8152-cfgselector 4-1: config 0 descriptor?? [ 603.255102][T11674] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 603.603341][ T3527] team0 (unregistering): Port device team_slave_1 removed [ 603.662837][ T3527] team0 (unregistering): Port device team_slave_0 removed [ 604.109237][T11653] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -12 [ 604.118741][T11653] platform regulatory.0: Direct firmware load for regulatory.db failed with error -12 [ 604.128351][T11653] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 604.141029][ T30] audit: type=1800 audit(1752329432.854:62): pid=11653 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.1.1304" name="regulatory.db" dev="sda1" ino=448 res=0 errno=0 [ 604.643544][ T24] r8152-cfgselector 4-1: USB disconnect, device number 45 [ 605.396268][T11573] chnl_net:caif_netlink_parms(): no params data found [ 607.461543][T11711] netlink: 'syz.1.1315': attribute type 10 has an invalid length. [ 611.115643][ T5970] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 612.335367][ T5970] usb 3-1: Using ep0 maxpacket: 16 [ 612.346339][ T5970] usb 3-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 612.364434][ T5970] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 612.405369][ T5970] usb 3-1: config 0 descriptor?? [ 612.425957][ T5970] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 612.589551][T11573] bridge0: port 1(bridge_slave_0) entered blocking state [ 613.024726][T11573] bridge0: port 1(bridge_slave_0) entered disabled state [ 613.067150][T11573] bridge_slave_0: entered allmulticast mode [ 613.084351][T11573] bridge_slave_0: entered promiscuous mode [ 613.120571][T11573] bridge0: port 2(bridge_slave_1) entered blocking state [ 613.145649][T11573] bridge0: port 2(bridge_slave_1) entered disabled state [ 613.152971][T11573] bridge_slave_1: entered allmulticast mode [ 613.166445][T11573] bridge_slave_1: entered promiscuous mode [ 614.185383][ T5970] gspca_sonixj: reg_w1 err -110 [ 614.190359][ T5970] sonixj 3-1:0.0: probe with driver sonixj failed with error -110 [ 614.240560][T11573] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 614.268928][ T5970] usb 3-1: USB disconnect, device number 48 [ 614.351621][T11573] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 614.498010][T11573] team0: Port device team_slave_0 added [ 614.521194][T11573] team0: Port device team_slave_1 added [ 614.614820][ T43] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 614.631535][T11573] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 614.654488][T11573] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 614.704992][T11573] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 614.736666][T11573] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 614.743638][T11573] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 614.800056][T11573] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 614.814492][ T43] usb 1-1: Using ep0 maxpacket: 32 [ 614.826986][ T43] usb 1-1: unable to get BOS descriptor or descriptor too short [ 614.839314][ T43] usb 1-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 614.855937][ T43] usb 1-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 614.865290][ T43] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 614.873298][ T43] usb 1-1: Product: syz [ 614.877730][ T43] usb 1-1: Manufacturer: syz [ 614.882347][ T43] usb 1-1: SerialNumber: syz [ 615.201693][ T43] usb 1-1: Cannot retrieve CPort count: 0 [ 615.218576][ T43] usb 1-1: Cannot retrieve CPort count: -5 [ 615.239430][ T43] es2_ap_driver 1-1:7.0: probe with driver es2_ap_driver failed with error -5 [ 615.381693][T11573] hsr_slave_0: entered promiscuous mode [ 615.407128][T11573] hsr_slave_1: entered promiscuous mode [ 615.413600][T11573] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 615.435127][T11573] Cannot create hsr debugfs directory [ 615.891939][ T43] usb 1-1: USB disconnect, device number 39 [ 617.278709][ T5970] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 617.817502][ T5970] usb 4-1: Using ep0 maxpacket: 8 [ 617.848875][ T5970] usb 4-1: too many configurations: 249, using maximum allowed: 8 [ 617.877436][ T5970] usb 4-1: New USB device found, idVendor=055f, idProduct=a800, bcdDevice=b3.ff [ 617.906417][ T5970] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=2 [ 617.926680][ T5970] usb 4-1: Product: syz [ 617.941313][ T5970] usb 4-1: Manufacturer: syz [ 617.947890][ T5970] usb 4-1: SerialNumber: syz [ 617.986599][T11804] syz1: rxe_newlink: already configured on veth0_to_bridge [ 618.185491][ T5936] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 618.242319][ T5970] usb 4-1: config 0 descriptor?? [ 618.408827][ T5936] usb 3-1: Using ep0 maxpacket: 32 [ 618.420136][ T5936] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 618.485531][ T5936] usb 3-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 618.514452][ T5936] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 618.525955][ T5970] mdc800 4-1:0.0: probe fails -> wrong Number of Configuration [ 618.542891][ T5936] usb 3-1: Product: syz [ 618.567228][ T5936] usb 3-1: Manufacturer: syz [ 618.581429][ T5936] usb 3-1: SerialNumber: syz [ 618.589018][ T5970] usb 4-1: USB disconnect, device number 46 [ 619.017204][ T5936] usb 3-1: config 0 descriptor?? [ 619.034851][ T5936] cdc_ether 3-1:0.0: skipping garbage [ 619.042344][ T5936] usb 3-1: bad CDC descriptors [ 619.101091][ T5936] usb 3-1: unsupported MDLM descriptors [ 619.261778][T11796] random: crng reseeded on system resumption [ 619.398683][T11830] batadv_slave_0: entered promiscuous mode [ 619.462930][ T9] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 619.705188][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 619.957122][ T9] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 620.184746][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 620.203302][ T9] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 620.214535][ T9] usb 1-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 620.223609][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 620.357456][ T9] usb 1-1: config 0 descriptor?? [ 620.461646][ T43] usb 3-1: USB disconnect, device number 49 [ 620.743298][ T9] hdpvr 1-1:0.0: firmware version 0x69 dated Ì [ 620.764444][ T9] hdpvr 1-1:0.0: untested firmware, the driver might not work. [ 620.930062][T11573] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 620.947855][T11573] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 620.964037][T11821] overlayfs: conflicting lowerdir path [ 620.979621][T11573] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 621.030688][T11573] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 621.047383][T11821] fuse: Unknown parameter '' [ 621.070068][ T9] hdpvr 1-1:0.0: device init failed [ 621.078326][ T9] hdpvr 1-1:0.0: probe with driver hdpvr failed with error -12 [ 621.242745][ T9] usb 1-1: USB disconnect, device number 40 [ 622.062323][T11868] rdma_rxe: rxe_newlink: failed to add veth0_to_bridge [ 622.338078][T11573] 8021q: adding VLAN 0 to HW filter on device bond0 [ 622.403359][T11573] 8021q: adding VLAN 0 to HW filter on device team0 [ 622.450266][ T8945] bridge0: port 1(bridge_slave_0) entered blocking state [ 622.457475][ T8945] bridge0: port 1(bridge_slave_0) entered forwarding state [ 622.506805][ T8945] bridge0: port 2(bridge_slave_1) entered blocking state [ 622.514012][ T8945] bridge0: port 2(bridge_slave_1) entered forwarding state [ 623.019191][T11573] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 624.279718][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 625.414521][ T9] usb 2-1: new full-speed USB device number 38 using dummy_hcd [ 625.638907][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 625.658811][ T9] usb 2-1: not running at top speed; connect to a high speed hub [ 625.683977][ T9] usb 2-1: config 219 has an invalid interface number: 128 but max is 1 [ 625.698866][ T9] usb 2-1: config 219 has no interface number 1 [ 625.705898][ T9] usb 2-1: config 219 interface 0 has no altsetting 0 [ 625.837960][T11573] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 625.839693][ T9] usb 2-1: config 219 interface 128 has no altsetting 0 [ 626.695845][ T9] usb 2-1: New USB device found, idVendor=2b73, idProduct=0017, bcdDevice=a2.0e [ 626.714490][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 626.722522][ T9] usb 2-1: Product: syz [ 626.744564][ T9] usb 2-1: Manufacturer: syz [ 626.751054][ T9] usb 2-1: SerialNumber: syz [ 627.569413][ T9] snd-usb-audio 2-1:219.0: probe with driver snd-usb-audio failed with error -22 [ 627.787562][ T9] usb 2-1: USB disconnect, device number 38 [ 628.226346][T11955] rdma_rxe: rxe_newlink: failed to add veth0_to_bridge [ 628.243560][ T9489] udevd[9489]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:219.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 629.473367][T11573] veth0_vlan: entered promiscuous mode [ 629.532843][T11573] veth1_vlan: entered promiscuous mode [ 629.621754][T11573] veth0_macvtap: entered promiscuous mode [ 629.668697][T11573] veth1_macvtap: entered promiscuous mode [ 629.725022][ T9] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 629.728192][T11573] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 629.783283][T11573] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 629.825845][T11573] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 629.846565][T11573] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 629.924032][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 629.933845][T11573] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 629.941339][ T9] usb 1-1: config 0 has an invalid interface number: 32 but max is 0 [ 629.946984][T11573] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 629.979180][ T9] usb 1-1: config 0 has no interface number 0 [ 630.000637][ T9] usb 1-1: config 0 interface 32 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 64 [ 630.078387][ T3527] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 630.102459][ T9] usb 1-1: New USB device found, idVendor=1943, idProduct=2255, bcdDevice=15.e8 [ 630.122292][ T3527] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 630.145658][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 630.171866][ T9] usb 1-1: Product: syz [ 630.188250][ T9] usb 1-1: Manufacturer: syz [ 630.200313][ T9] usb 1-1: SerialNumber: syz [ 630.213931][ T8945] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 630.233437][ T9] usb 1-1: config 0 descriptor?? [ 630.240343][ T8945] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 630.431658][T11971] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 630.445853][ T9] s2255 1-1:0.32: Could not find bulk-in endpoint [ 630.452786][ T9] Sensoray 2255 driver load failed: 0xfffffff4 [ 630.475393][ T9] s2255 1-1:0.32: probe with driver s2255 failed with error -12 [ 630.786918][ T9] usb 1-1: USB disconnect, device number 41 [ 633.048414][T12014] 9pnet_fd: Insufficient options for proto=fd [ 633.520321][ T9] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 633.585997][ T6199] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 633.744846][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 633.885899][ T9] usb 4-1: config 0 has an invalid interface number: 35 but max is 0 [ 634.035598][ T9] usb 4-1: config 0 has no interface number 0 [ 634.222785][ T9] usb 4-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.8f [ 634.278616][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 634.287552][ T9] usb 4-1: Product: syz [ 634.291813][ T9] usb 4-1: Manufacturer: syz [ 634.407649][ T6199] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 634.423050][ T9] usb 4-1: SerialNumber: syz [ 634.435706][ T9] usb 4-1: config 0 descriptor?? [ 634.446565][ T9] radio-si470x 4-1:0.35: could not find interrupt in endpoint [ 634.454136][ T9] radio-si470x 4-1:0.35: probe with driver radio-si470x failed with error -5 [ 634.652590][ T9] radio-raremono 4-1:0.35: this is not Thanko's Raremono. [ 634.655432][ T6199] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 634.670474][ T9] usbhid 4-1:0.35: couldn't find an input interrupt endpoint [ 634.838911][ T6199] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 634.906858][ T43] usb 4-1: USB disconnect, device number 47 [ 635.124933][ T6199] bridge_slave_1: left allmulticast mode [ 635.130628][ T6199] bridge_slave_1: left promiscuous mode [ 635.160387][ T6199] bridge0: port 2(bridge_slave_1) entered disabled state [ 635.189143][ T6199] bridge_slave_0: left allmulticast mode [ 635.198217][ T6199] bridge_slave_0: left promiscuous mode [ 635.204014][ T6199] bridge0: port 1(bridge_slave_0) entered disabled state [ 636.336802][T12059] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1379'. [ 637.151645][T12077] netlink: 'syz.0.1383': attribute type 10 has an invalid length. [ 638.748242][ T5843] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 638.758475][ T5843] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 638.769218][ T5843] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 638.789657][ T5843] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 638.802742][ T5843] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 639.184059][ T6199] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 639.213972][ T6199] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 639.226480][ T6199] bond0 (unregistering): Released all slaves [ 639.269988][T12060] batman_adv: batadv0: Interface deactivated: gretap1 [ 639.383576][T12064] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1381'. [ 639.422100][T12069] netlink: 550 bytes leftover after parsing attributes in process `syz.3.1381'. [ 640.844605][ T5843] Bluetooth: hci3: command tx timeout [ 643.252702][ T5843] Bluetooth: hci3: command tx timeout [ 643.463894][T12159] netlink: 14 bytes leftover after parsing attributes in process `syz.1.1397'. [ 643.756868][ T6199] hsr_slave_0: left promiscuous mode [ 643.762688][ T6199] hsr_slave_1: left promiscuous mode [ 643.771053][ T6199] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 643.779015][ T6199] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 643.882988][ T6199] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 643.892192][ T6199] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 644.006650][ T6199] veth1_macvtap: left promiscuous mode [ 644.012262][ T6199] veth0_macvtap: left promiscuous mode [ 644.018266][ T6199] veth1_vlan: left promiscuous mode [ 644.023618][ T6199] veth0_vlan: left promiscuous mode [ 644.087169][T12171] netlink: 76 bytes leftover after parsing attributes in process `syz.0.1399'. [ 644.796660][ T6199] team0 (unregistering): Port device team_slave_1 removed [ 644.883930][ T6199] team0 (unregistering): Port device team_slave_0 removed [ 645.109343][T12183] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1400'. [ 645.314968][ T5843] Bluetooth: hci3: command tx timeout [ 646.715557][T12083] chnl_net:caif_netlink_parms(): no params data found [ 647.339863][T12213] FAULT_INJECTION: forcing a failure. [ 647.339863][T12213] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 647.357119][T12213] CPU: 0 UID: 0 PID: 12213 Comm: syz.3.1409 Not tainted 6.16.0-rc5-syzkaller-00224-g379f604cc3dc #0 PREEMPT(full) [ 647.357145][T12213] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 647.357157][T12213] Call Trace: [ 647.357165][T12213] [ 647.357174][T12213] dump_stack_lvl+0x189/0x250 [ 647.357200][T12213] ? __pfx____ratelimit+0x10/0x10 [ 647.357225][T12213] ? __pfx_dump_stack_lvl+0x10/0x10 [ 647.357245][T12213] ? __pfx__printk+0x10/0x10 [ 647.357267][T12213] ? __might_fault+0xb0/0x130 [ 647.357302][T12213] should_fail_ex+0x414/0x560 [ 647.357331][T12213] _copy_from_user+0x2d/0xb0 [ 647.357352][T12213] snd_seq_ioctl+0x1d8/0x420 [ 647.357375][T12213] ? smk_tskacc+0x2fc/0x370 [ 647.357401][T12213] ? __pfx_snd_seq_ioctl+0x10/0x10 [ 647.357422][T12213] ? smack_file_ioctl+0x2a9/0x340 [ 647.357462][T12213] ? __fget_files+0x3a0/0x420 [ 647.357479][T12213] ? __fget_files+0x2a/0x420 [ 647.357498][T12213] ? bpf_lsm_file_ioctl+0x9/0x20 [ 647.357515][T12213] ? __pfx_snd_seq_ioctl+0x10/0x10 [ 647.357539][T12213] __se_sys_ioctl+0xf9/0x170 [ 647.357564][T12213] do_syscall_64+0xfa/0x3b0 [ 647.357580][T12213] ? lockdep_hardirqs_on+0x9c/0x150 [ 647.357603][T12213] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 647.357621][T12213] ? clear_bhb_loop+0x60/0xb0 [ 647.357642][T12213] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 647.357660][T12213] RIP: 0033:0x7f6a3d58e929 [ 647.357676][T12213] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 647.357690][T12213] RSP: 002b:00007f6a3e49b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 647.357710][T12213] RAX: ffffffffffffffda RBX: 00007f6a3d7b5fa0 RCX: 00007f6a3d58e929 [ 647.357724][T12213] RDX: 00002000000000c0 RSI: 00000000c0bc5351 RDI: 0000000000000003 [ 647.357736][T12213] RBP: 00007f6a3e49b090 R08: 0000000000000000 R09: 0000000000000000 [ 647.357747][T12213] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 647.357759][T12213] R13: 0000000000000000 R14: 00007f6a3d7b5fa0 R15: 00007ffc14eef1d8 [ 647.357788][T12213] [ 647.623860][ T5843] Bluetooth: hci3: command tx timeout [ 648.672187][T12232] netlink: 14 bytes leftover after parsing attributes in process `syz.2.1412'. [ 649.627216][T12083] bridge0: port 1(bridge_slave_0) entered blocking state [ 649.635399][T12083] bridge0: port 1(bridge_slave_0) entered disabled state [ 649.642903][T12083] bridge_slave_0: entered allmulticast mode [ 650.091514][T12083] bridge_slave_0: entered promiscuous mode [ 650.132500][T12083] bridge0: port 2(bridge_slave_1) entered blocking state [ 650.146237][T12083] bridge0: port 2(bridge_slave_1) entered disabled state [ 650.153483][T12083] bridge_slave_1: entered allmulticast mode [ 650.266693][T12083] bridge_slave_1: entered promiscuous mode [ 651.328519][T12232] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 651.352953][T12232] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 651.370145][T12232] bond0 (unregistering): (slave batadv0): Releasing backup interface [ 651.388155][T12232] bond0 (unregistering): Released all slaves [ 651.552682][T12083] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 651.805618][T12083] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 652.328941][T12269] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1416'. [ 652.382046][T12272] netlink: 'syz.0.1416': attribute type 1 has an invalid length. [ 652.835410][T12272] netlink: 228 bytes leftover after parsing attributes in process `syz.0.1416'. [ 652.847684][T12083] team0: Port device team_slave_0 added [ 652.855581][T12083] team0: Port device team_slave_1 added [ 652.904613][ T9] usb 4-1: new full-speed USB device number 48 using dummy_hcd [ 652.991072][T12083] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 653.028161][T12083] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 653.100896][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 653.112682][T12083] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 653.131195][ T9] usb 4-1: not running at top speed; connect to a high speed hub [ 653.146916][T12083] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 653.175268][T12083] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 653.225419][ T9] usb 4-1: config 219 has an invalid interface number: 128 but max is 1 [ 653.354776][ T9] usb 4-1: config 219 has no interface number 1 [ 653.674501][ T9] usb 4-1: config 219 interface 0 has no altsetting 0 [ 653.686230][T12083] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 653.701129][ T9] usb 4-1: config 219 interface 128 has no altsetting 0 [ 653.720502][ T9] usb 4-1: New USB device found, idVendor=2b73, idProduct=0017, bcdDevice=a2.0e [ 653.760635][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 653.931345][ T9] usb 4-1: Product: syz [ 653.941664][ T9] usb 4-1: Manufacturer: syz [ 653.966874][ T9] usb 4-1: SerialNumber: syz [ 654.121746][T12083] hsr_slave_0: entered promiscuous mode [ 654.147224][T12083] hsr_slave_1: entered promiscuous mode [ 654.168789][T12083] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 654.187210][T12083] Cannot create hsr debugfs directory [ 654.438661][ T9] snd-usb-audio 4-1:219.0: probe with driver snd-usb-audio failed with error -22 [ 654.520706][ T9] usb 4-1: USB disconnect, device number 48 [ 656.897716][ T9489] udevd[9489]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:219.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 657.194716][T12320] netlink: 14 bytes leftover after parsing attributes in process `syz.1.1427'. [ 658.842475][T12339] netlink: 'syz.3.1432': attribute type 3 has an invalid length. [ 660.189949][ T9] usb 3-1: new full-speed USB device number 50 using dummy_hcd [ 661.189210][ T9] usb 3-1: unable to get BOS descriptor or descriptor too short [ 661.205268][ T9] usb 3-1: not running at top speed; connect to a high speed hub [ 661.214039][ T9] usb 3-1: config 219 has an invalid interface number: 128 but max is 1 [ 661.237988][ T43] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 661.243075][ T9] usb 3-1: config 219 has no interface number 1 [ 661.252436][ T9] usb 3-1: config 219 interface 0 has no altsetting 0 [ 661.273244][ T9] usb 3-1: config 219 interface 128 has no altsetting 0 [ 661.467938][ T9] usb 3-1: New USB device found, idVendor=2b73, idProduct=0017, bcdDevice=a2.0e [ 661.493456][ T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 661.545047][ T43] usb 1-1: Using ep0 maxpacket: 16 [ 661.577981][ T43] usb 1-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 661.722767][ T9] usb 3-1: Product: syz [ 661.759143][ T43] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 661.763617][ T9] usb 3-1: Manufacturer: syz [ 661.791917][ T43] usb 1-1: Product: syz [ 661.795211][ T9] usb 3-1: SerialNumber: syz [ 661.797716][ T43] usb 1-1: Manufacturer: syz [ 661.807704][ T43] usb 1-1: SerialNumber: syz [ 662.162353][ T43] r8152-cfgselector 1-1: Unknown version 0x0000 [ 662.196774][ T43] r8152-cfgselector 1-1: config 0 descriptor?? [ 662.313372][ T43] r8152-cfgselector 1-1: can't set config #0, error -71 [ 662.358479][ T43] r8152-cfgselector 1-1: USB disconnect, device number 42 [ 662.476331][ T9] snd-usb-audio 3-1:219.0: probe with driver snd-usb-audio failed with error -22 [ 662.574541][ T9] usb 3-1: USB disconnect, device number 50 [ 662.580046][T12386] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1444'. [ 662.587926][T12083] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 662.622053][ T9489] udevd[9489]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:219.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 662.645668][T12083] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 662.695475][T12083] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 662.876121][T12083] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 663.678347][T12414] netlink: 'syz.1.1447': attribute type 3 has an invalid length. [ 663.688215][T12083] 8021q: adding VLAN 0 to HW filter on device bond0 [ 663.740119][T12083] 8021q: adding VLAN 0 to HW filter on device team0 [ 663.769189][ T6035] bridge0: port 1(bridge_slave_0) entered blocking state [ 663.776450][ T6035] bridge0: port 1(bridge_slave_0) entered forwarding state [ 663.872529][ T154] bridge0: port 2(bridge_slave_1) entered blocking state [ 663.879755][ T154] bridge0: port 2(bridge_slave_1) entered forwarding state [ 663.887654][ T24] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 664.044694][ T24] usb 3-1: Using ep0 maxpacket: 16 [ 664.070176][ T24] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 112, changing to 10 [ 664.107440][ T24] usb 3-1: New USB device found, idVendor=05ac, idProduct=0224, bcdDevice= 0.00 [ 664.125587][ T24] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 664.138835][ T24] usb 3-1: config 0 descriptor?? [ 664.360002][T12412] netlink: 'syz.2.1449': attribute type 1 has an invalid length. [ 664.388928][ T5936] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 664.571606][ T5936] usb 2-1: config 0 has no interfaces? [ 664.607512][ T5936] usb 2-1: New USB device found, idVendor=1241, idProduct=5015, bcdDevice= 0.04 [ 664.680057][ T5936] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 664.788907][ T5936] usb 2-1: config 0 descriptor?? [ 665.086763][T12083] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 665.127464][ T5936] usb 2-1: USB disconnect, device number 39 [ 665.224597][ T24] usb 3-1: string descriptor 0 read error: -71 [ 665.239833][ T24] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input19 [ 665.271531][ T5191] bcm5974 3-1:0.0: could not read from device [ 665.362884][ T5191] bcm5974 3-1:0.0: could not read from device [ 665.390914][ T24] usb 3-1: USB disconnect, device number 51 [ 665.714770][ T5936] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 666.104457][ T5936] usb 1-1: Using ep0 maxpacket: 16 [ 666.506073][ T5936] usb 1-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 666.531284][ T5936] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 666.570336][ T5936] usb 1-1: Product: syz [ 666.606435][ T5936] usb 1-1: Manufacturer: syz [ 666.644632][ T5936] usb 1-1: SerialNumber: syz [ 666.734244][ T5936] r8152-cfgselector 1-1: Unknown version 0x0000 [ 666.766917][ T5936] r8152-cfgselector 1-1: config 0 descriptor?? [ 666.846611][T12083] veth0_vlan: entered promiscuous mode [ 666.876499][T12083] veth1_vlan: entered promiscuous mode [ 667.037849][T12083] veth0_macvtap: entered promiscuous mode [ 667.063313][T12083] veth1_macvtap: entered promiscuous mode [ 667.076730][T12471] FAULT_INJECTION: forcing a failure. [ 667.076730][T12471] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 667.270636][ T5936] r8152-cfgselector 1-1: USB disconnect, device number 43 [ 667.284275][T12083] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 667.293717][T12471] CPU: 1 UID: 0 PID: 12471 Comm: syz.2.1458 Not tainted 6.16.0-rc5-syzkaller-00224-g379f604cc3dc #0 PREEMPT(full) [ 667.293742][T12471] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 667.293752][T12471] Call Trace: [ 667.293759][T12471] [ 667.293767][T12471] dump_stack_lvl+0x189/0x250 [ 667.293792][T12471] ? __pfx____ratelimit+0x10/0x10 [ 667.293815][T12471] ? __pfx_dump_stack_lvl+0x10/0x10 [ 667.293833][T12471] ? __pfx__printk+0x10/0x10 [ 667.293854][T12471] ? __might_fault+0xb0/0x130 [ 667.293887][T12471] should_fail_ex+0x414/0x560 [ 667.293914][T12471] _copy_from_iter+0x1db/0x16f0 [ 667.293943][T12471] ? __pfx__copy_from_iter+0x10/0x10 [ 667.293960][T12471] ? __pfx_smack_socket_sendmsg+0x10/0x10 [ 667.293985][T12471] ? skb_put+0x11b/0x210 [ 667.294010][T12471] hci_sock_sendmsg+0x422/0xef0 [ 667.294045][T12471] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 667.294069][T12471] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 667.294092][T12471] ? __pfx_hci_sock_sendmsg+0x10/0x10 [ 667.294114][T12471] __sock_sendmsg+0x21c/0x270 [ 667.294140][T12471] sock_write_iter+0x258/0x330 [ 667.294166][T12471] ? __pfx_sock_write_iter+0x10/0x10 [ 667.294201][T12471] ? bpf_lsm_file_permission+0x9/0x20 [ 667.294216][T12471] ? security_file_permission+0x75/0x290 [ 667.294248][T12471] vfs_write+0x548/0xa90 [ 667.294276][T12471] ? __pfx_sock_write_iter+0x10/0x10 [ 667.294299][T12471] ? __pfx_vfs_write+0x10/0x10 [ 667.294332][T12471] ? __fget_files+0x2a/0x420 [ 667.294361][T12471] ksys_write+0x145/0x250 [ 667.294383][T12471] ? __pfx_ksys_write+0x10/0x10 [ 667.294402][T12471] ? rcu_is_watching+0x15/0xb0 [ 667.294425][T12471] ? do_syscall_64+0xbe/0x3b0 [ 667.294446][T12471] do_syscall_64+0xfa/0x3b0 [ 667.294459][T12471] ? lockdep_hardirqs_on+0x9c/0x150 [ 667.294482][T12471] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.294499][T12471] ? clear_bhb_loop+0x60/0xb0 [ 667.294520][T12471] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.294537][T12471] RIP: 0033:0x7fc4a278e929 [ 667.294554][T12471] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 667.294568][T12471] RSP: 002b:00007fc4a36c7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 667.294588][T12471] RAX: ffffffffffffffda RBX: 00007fc4a29b5fa0 RCX: 00007fc4a278e929 [ 667.294601][T12471] RDX: 000000000000000d RSI: 0000200000000000 RDI: 0000000000000005 [ 667.294612][T12471] RBP: 00007fc4a36c7090 R08: 0000000000000000 R09: 0000000000000000 [ 667.294623][T12471] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 667.294634][T12471] R13: 0000000000000000 R14: 00007fc4a29b5fa0 R15: 00007ffc19d8ba08 [ 667.294663][T12471] [ 667.556807][ C1] vkms_vblank_simulate: vblank timer overrun [ 667.590319][T12083] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 667.601064][T12083] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 667.662481][T12083] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 667.809228][T12083] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 667.857003][T12083] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 668.125946][ T5936] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 668.232737][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 668.280529][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 668.305383][ T5936] usb 3-1: Using ep0 maxpacket: 32 [ 668.324206][ T5936] usb 3-1: unable to get BOS descriptor or descriptor too short [ 668.360009][ T5936] usb 3-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 668.396412][ T5936] usb 3-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 668.417299][ T3527] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 668.425487][ T5936] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 668.442968][ T5936] usb 3-1: Product: syz [ 668.445062][ T3527] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 668.476104][ T5936] usb 3-1: Manufacturer: syz [ 668.485345][ T5936] usb 3-1: SerialNumber: syz [ 668.722465][ T5936] usb 3-1: Cannot retrieve CPort count: 0 [ 668.740032][ T5936] usb 3-1: Cannot retrieve CPort count: -5 [ 668.757166][ T5936] es2_ap_driver 3-1:7.0: probe with driver es2_ap_driver failed with error -5 [ 670.296415][ T24] usb 3-1: USB disconnect, device number 52 [ 670.393626][ T154] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 670.700888][ T154] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 670.806624][ T154] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 670.904702][ T154] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 671.061374][ T154] bridge_slave_1: left allmulticast mode [ 671.067214][ T154] bridge_slave_1: left promiscuous mode [ 671.073016][ T154] bridge0: port 2(bridge_slave_1) entered disabled state [ 671.084010][ T154] bridge_slave_0: left allmulticast mode [ 671.090568][ T154] bridge_slave_0: left promiscuous mode [ 671.096797][ T154] bridge0: port 1(bridge_slave_0) entered disabled state [ 671.548815][ T154] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 671.560179][ T154] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 671.570592][ T154] bond0 (unregistering): Released all slaves [ 672.982770][T12545] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -12 [ 672.992261][T12545] platform regulatory.0: Direct firmware load for regulatory.db failed with error -12 [ 673.002107][T12545] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 673.016823][ T30] audit: type=1800 audit(1752329501.724:63): pid=12545 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.0.1465" name="regulatory.db" dev="sda1" ino=448 res=0 errno=0 [ 673.601525][ T5854] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 673.610865][ T5854] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 673.630153][ T5854] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 673.649995][ T5854] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 673.659123][ T5854] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 673.789212][T12566] loop4: detected capacity change from 0 to 7 [ 673.918689][T12566] Dev loop4: unable to read RDB block 7 [ 673.926647][T12566] loop4: unable to read partition table [ 674.022898][T12566] loop4: partition table beyond EOD, truncated [ 674.205800][T12566] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 675.056451][T12583] FAULT_INJECTION: forcing a failure. [ 675.056451][T12583] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 675.123753][ T154] hsr_slave_0: left promiscuous mode [ 675.263545][T12583] CPU: 1 UID: 0 PID: 12583 Comm: syz.3.1476 Not tainted 6.16.0-rc5-syzkaller-00224-g379f604cc3dc #0 PREEMPT(full) [ 675.263574][T12583] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 675.263586][T12583] Call Trace: [ 675.263595][T12583] [ 675.263604][T12583] dump_stack_lvl+0x189/0x250 [ 675.263630][T12583] ? __pfx____ratelimit+0x10/0x10 [ 675.263656][T12583] ? __pfx_dump_stack_lvl+0x10/0x10 [ 675.263676][T12583] ? __pfx__printk+0x10/0x10 [ 675.263701][T12583] ? fs_reclaim_acquire+0x7d/0x100 [ 675.263730][T12583] should_fail_ex+0x414/0x560 [ 675.263762][T12583] prepare_alloc_pages+0x213/0x610 [ 675.263790][T12583] __alloc_frozen_pages_noprof+0x123/0x370 [ 675.263815][T12583] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 675.263846][T12583] ? policy_nodemask+0x27c/0x720 [ 675.263879][T12583] alloc_pages_mpol+0x232/0x4a0 [ 675.263910][T12583] vma_alloc_folio_noprof+0xe4/0x200 [ 675.263938][T12583] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 675.263986][T12583] folio_prealloc+0x30/0x180 [ 675.264014][T12583] do_wp_page+0x1231/0x5800 [ 675.264061][T12583] ? __pfx_do_wp_page+0x10/0x10 [ 675.264080][T12583] ? do_raw_spin_lock+0x121/0x290 [ 675.264106][T12583] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 675.264141][T12583] __handle_mm_fault+0x1144/0x5620 [ 675.264187][T12583] ? __pfx___handle_mm_fault+0x10/0x10 [ 675.264233][T12583] ? find_vma+0xe7/0x160 [ 675.264255][T12583] ? __pfx_find_vma+0x10/0x10 [ 675.264280][T12583] handle_mm_fault+0x2d5/0x7f0 [ 675.264316][T12583] do_user_addr_fault+0x764/0x1390 [ 675.264361][T12583] exc_page_fault+0x76/0xf0 [ 675.264386][T12583] asm_exc_page_fault+0x26/0x30 [ 675.264402][T12583] RIP: 0010:rep_movs_alternative+0x4a/0x90 [ 675.264421][T12583] Code: 00 04 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 e9 0f 00 04 00 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 675.264435][T12583] RSP: 0018:ffffc9000c1a7a18 EFLAGS: 00050202 [ 675.264450][T12583] RAX: ffffffff84b84701 RBX: ffff88802a218000 RCX: 000000000000072f [ 675.264463][T12583] RDX: 0000000000000000 RSI: ffff88802a218000 RDI: 0000200000004ac0 [ 675.264475][T12583] RBP: ffffc9000c1a7b78 R08: ffff88802a21872e R09: 1ffff110054430e5 [ 675.264488][T12583] R10: dffffc0000000000 R11: ffffed10054430e6 R12: 1ffff92001834faf [ 675.264500][T12583] R13: 0000200000004ac0 R14: ffffc9000c1a7d88 R15: 000000000000072f [ 675.264523][T12583] ? _copy_to_iter+0x171/0x16f0 [ 675.264548][T12583] _copy_to_iter+0x24c/0x16f0 [ 675.264569][T12583] ? __pfx_proc_keys_show+0x10/0x10 [ 675.264598][T12583] ? __pfx__copy_to_iter+0x10/0x10 [ 675.264627][T12583] ? do_raw_spin_unlock+0x122/0x240 [ 675.264654][T12583] seq_read_iter+0xbeb/0xe10 [ 675.264698][T12583] proc_reg_read_iter+0x1b7/0x280 [ 675.264723][T12583] vfs_read+0x4cd/0x980 [ 675.264756][T12583] ? __pfx_vfs_read+0x10/0x10 [ 675.264790][T12583] ? __fget_files+0x2a/0x420 [ 675.264818][T12583] ksys_read+0x145/0x250 [ 675.264842][T12583] ? __pfx_ksys_read+0x10/0x10 [ 675.264861][T12583] ? rcu_is_watching+0x15/0xb0 [ 675.264886][T12583] ? do_syscall_64+0xbe/0x3b0 [ 675.264908][T12583] do_syscall_64+0xfa/0x3b0 [ 675.264923][T12583] ? lockdep_hardirqs_on+0x9c/0x150 [ 675.264946][T12583] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 675.264973][T12583] ? clear_bhb_loop+0x60/0xb0 [ 675.264995][T12583] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 675.265012][T12583] RIP: 0033:0x7f6a3d58e929 [ 675.265027][T12583] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 675.265041][T12583] RSP: 002b:00007f6a3e49b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 675.265064][T12583] RAX: ffffffffffffffda RBX: 00007f6a3d7b5fa0 RCX: 00007f6a3d58e929 [ 675.265077][T12583] RDX: 0000000000002020 RSI: 0000200000004ac0 RDI: 0000000000000003 [ 675.265088][T12583] RBP: 00007f6a3e49b090 R08: 0000000000000000 R09: 0000000000000000 [ 675.265100][T12583] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 675.265110][T12583] R13: 0000000000000000 R14: 00007f6a3d7b5fa0 R15: 00007ffc14eef1d8 [ 675.265142][T12583] [ 675.662770][ C1] vkms_vblank_simulate: vblank timer overrun [ 675.775346][ T5843] Bluetooth: hci3: command tx timeout [ 675.781881][ T154] hsr_slave_1: left promiscuous mode [ 675.788057][ T154] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 675.795568][ T154] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 675.804084][ T154] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 675.814393][ T154] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 675.856205][ T154] veth1_macvtap: left promiscuous mode [ 675.861794][ T154] veth0_macvtap: left promiscuous mode [ 675.867635][ T154] veth1_vlan: left promiscuous mode [ 675.873401][ T154] veth0_vlan: left promiscuous mode [ 675.940333][ T9] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 676.006918][ T9] hid-generic 0000:0000:0000.0009: hidraw0: HID v0.00 Device [syz1] on syz0 [ 676.227029][T12601] fido_id[12601]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 676.264527][ T975] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 676.427212][ T975] usb 4-1: Using ep0 maxpacket: 32 [ 676.437080][ T975] usb 4-1: unable to get BOS descriptor or descriptor too short [ 676.446838][ T975] usb 4-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 676.459565][ T975] usb 4-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 676.486130][ T975] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 676.501170][ T975] usb 4-1: Product: syz [ 676.506189][ T975] usb 4-1: Manufacturer: syz [ 676.514668][ T975] usb 4-1: SerialNumber: syz [ 676.674180][ T154] team0 (unregistering): Port device team_slave_1 removed [ 676.725985][ T154] team0 (unregistering): Port device team_slave_0 removed [ 676.734679][ T975] usb 4-1: Cannot retrieve CPort count: 0 [ 676.740424][ T975] usb 4-1: Cannot retrieve CPort count: -5 [ 676.758084][ T975] es2_ap_driver 4-1:7.0: probe with driver es2_ap_driver failed with error -5 [ 677.026553][ T975] usb 4-1: USB disconnect, device number 49 [ 677.830530][ T5843] Bluetooth: hci3: command tx timeout [ 677.954474][ T9] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 678.104732][ T9] usb 2-1: Using ep0 maxpacket: 32 [ 678.147670][ T9] usb 2-1: unable to get BOS descriptor or descriptor too short [ 678.248101][ T9] usb 2-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 678.376153][ T9] usb 2-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 678.422494][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 678.672736][ T9] usb 2-1: Product: syz [ 678.690249][ T9] usb 2-1: Manufacturer: syz [ 678.773608][ T9] usb 2-1: SerialNumber: syz [ 679.010532][ T9] usb 2-1: Cannot retrieve CPort count: 0 [ 679.033411][ T9] usb 2-1: Cannot retrieve CPort count: -5 [ 679.038613][T12563] chnl_net:caif_netlink_parms(): no params data found [ 679.044225][ T9] es2_ap_driver 2-1:7.0: probe with driver es2_ap_driver failed with error -5 [ 679.439585][T12563] bridge0: port 1(bridge_slave_0) entered blocking state [ 679.453300][T12563] bridge0: port 1(bridge_slave_0) entered disabled state [ 679.461366][T12563] bridge_slave_0: entered allmulticast mode [ 679.480357][T12563] bridge_slave_0: entered promiscuous mode [ 679.500334][T12563] bridge0: port 2(bridge_slave_1) entered blocking state [ 679.520955][T12563] bridge0: port 2(bridge_slave_1) entered disabled state [ 679.539106][T12563] bridge_slave_1: entered allmulticast mode [ 679.564279][T12563] bridge_slave_1: entered promiscuous mode [ 679.701378][T12563] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 679.744960][ T5906] usb 2-1: USB disconnect, device number 40 [ 679.833881][T12563] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 679.874726][ T5843] Bluetooth: hci3: command tx timeout [ 679.891345][T12563] team0: Port device team_slave_0 added [ 679.901207][T12563] team0: Port device team_slave_1 added [ 679.946579][T12563] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 679.967108][T12563] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 679.995774][T12563] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 680.008485][T12563] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 680.015591][ T9] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 680.023449][T12563] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 680.052419][T12563] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 680.063442][ T975] usb 4-1: new full-speed USB device number 50 using dummy_hcd [ 680.155112][T12563] hsr_slave_0: entered promiscuous mode [ 680.172675][T12563] hsr_slave_1: entered promiscuous mode [ 680.192011][T12563] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 680.200917][ T9] usb 1-1: Using ep0 maxpacket: 32 [ 680.207686][T12563] Cannot create hsr debugfs directory [ 680.219008][ T9] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 680.233612][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 680.245333][ T975] usb 4-1: config 0 has an invalid interface number: 138 but max is 0 [ 680.253517][ T975] usb 4-1: config 0 has no interface number 0 [ 680.280211][ T975] usb 4-1: config 0 interface 138 altsetting 0 has an endpoint descriptor with address 0x61, changing to 0x1 [ 680.300082][ T9] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 680.324190][ T975] usb 4-1: config 0 interface 138 altsetting 0 has an endpoint descriptor with address 0x97, changing to 0x87 [ 680.340393][ T9] usb 1-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 680.359861][ T975] usb 4-1: config 0 interface 138 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 4 [ 680.372117][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 680.399392][ T9] usb 1-1: config 0 descriptor?? [ 680.410212][ T975] usb 4-1: config 0 interface 138 altsetting 0 endpoint 0x87 has invalid maxpacket 1152, setting to 1023 [ 680.432240][T12652] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 680.446820][ T9] hub 1-1:0.0: USB hub found [ 680.462858][ T975] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= f.66 [ 680.631621][ T975] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 680.901000][ T975] usb 4-1: config 0 descriptor?? [ 680.979373][T12652] netlink: 588 bytes leftover after parsing attributes in process `syz.0.1489'. [ 681.020341][ T9] hub 1-1:0.0: 2 ports detected [ 681.109871][ T975] usb 4-1: string descriptor 0 read error: -71 [ 681.123807][ T975] usbtest 4-1:0.138: Linux gadget zero [ 681.132176][ T975] usbtest 4-1:0.138: full-speed {control in/out bulk-out iso-in} tests (+alt) [ 681.220323][ T975] usb 4-1: USB disconnect, device number 50 [ 681.284753][ T5936] usb 3-1: new high-speed USB device number 53 using dummy_hcd [ 681.413354][ T9] hub 1-1:0.0: hub_hub_status failed (err = -71) [ 681.421426][ T9] hub 1-1:0.0: config failed, can't get hub status (err -71) [ 681.442027][ T9] usbhid 1-1:0.0: can't add hid device: -71 [ 681.448125][ T5936] usb 3-1: Using ep0 maxpacket: 32 [ 681.460362][ T5936] usb 3-1: unable to get BOS descriptor or descriptor too short [ 681.475773][ T9] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 681.489486][ T5936] usb 3-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 681.522578][ T5936] usb 3-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 681.537011][ T9] usb 1-1: USB disconnect, device number 44 [ 681.542981][ T5936] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 681.571631][ T5936] usb 3-1: Product: syz [ 681.599630][ T5936] usb 3-1: Manufacturer: syz [ 681.606547][ T5936] usb 3-1: SerialNumber: syz [ 681.875175][ T5936] usb 3-1: Cannot retrieve CPort count: 0 [ 681.881771][ T5936] usb 3-1: Cannot retrieve CPort count: -5 [ 681.887754][ T5936] es2_ap_driver 3-1:7.0: probe with driver es2_ap_driver failed with error -5 [ 681.955567][ T5843] Bluetooth: hci3: command tx timeout [ 682.681532][ T5936] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 682.753690][ T975] usb 3-1: USB disconnect, device number 53 [ 682.848140][ T5936] usb 1-1: Using ep0 maxpacket: 16 [ 682.856626][ T5936] usb 1-1: config 1 has an invalid interface number: 223 but max is 0 [ 682.874431][ T5936] usb 1-1: config 1 has no interface number 0 [ 682.890942][ T5936] usb 1-1: config 1 interface 223 has no altsetting 0 [ 682.930672][ T5936] usb 1-1: New USB device found, idVendor=05ac, idProduct=0262, bcdDevice=42.53 [ 682.943841][ T5936] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 682.959076][ T5936] usb 1-1: Product: syz [ 683.044989][ T5936] usb 1-1: Manufacturer: syz [ 683.049687][ T5936] usb 1-1: SerialNumber: syz [ 683.093018][ T5936] input: bcm5974 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.223/input/input20 [ 683.229479][T12563] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 683.242474][T12563] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 683.258618][T12563] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 683.277304][T12563] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 683.344734][ T5906] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 683.403270][T12563] 8021q: adding VLAN 0 to HW filter on device bond0 [ 683.431262][T12563] 8021q: adding VLAN 0 to HW filter on device team0 [ 683.446248][ T1163] bridge0: port 1(bridge_slave_0) entered blocking state [ 683.453503][ T1163] bridge0: port 1(bridge_slave_0) entered forwarding state [ 683.475072][ T5191] bcm5974 1-1:1.223: could not write to device [ 683.493107][ T3559] bridge0: port 2(bridge_slave_1) entered blocking state [ 683.500377][ T3559] bridge0: port 2(bridge_slave_1) entered forwarding state [ 683.525285][ T5906] usb 4-1: Using ep0 maxpacket: 16 [ 683.538654][ T5906] usb 4-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 683.539636][ T5936] usb 1-1: USB disconnect, device number 45 [ 683.561991][ T5906] usb 4-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 683.564604][ T5191] bcm5974 1-1:1.223: could not read from device [ 683.616505][ T5906] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 683.633069][ T5191] bcm5974 1-1:1.223: could not read from device [ 683.656170][ T5906] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 683.669046][T12708] syz.2.1498: attempt to access beyond end of device [ 683.669046][T12708] nbd2: rw=0, sector=16, nr_sectors = 1 limit=0 [ 683.683108][ T5906] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 683.714876][ T5906] usb 4-1: Product: syz [ 683.720080][T12708] qnx6: unable to read the first superblock [ 683.727697][T12708] syz.2.1498: attempt to access beyond end of device [ 683.727697][T12708] nbd2: rw=0, sector=0, nr_sectors = 1 limit=0 [ 683.731642][ T9574] udevd[9574]: Error opening device "/dev/input/event4": No such file or directory [ 683.741782][T12708] qnx6: unable to read the first superblock [ 683.758189][T12708] qnx6: unable to read the first superblock [ 683.770922][ T5906] usb 4-1: Manufacturer: syz [ 683.784832][ T5906] usb 4-1: SerialNumber: syz [ 683.813343][ T9574] udevd[9574]: Unable to EVIOCGABS device "/dev/input/event4" [ 683.831658][ T9574] udevd[9574]: Unable to EVIOCGABS device "/dev/input/event4" [ 683.849068][ T9574] udevd[9574]: Unable to EVIOCGABS device "/dev/input/event4" [ 683.867289][ T9574] udevd[9574]: Unable to EVIOCGABS device "/dev/input/event4" [ 684.028457][ T5906] usb 4-1: 0:2 : does not exist [ 684.118909][ T5906] usb 4-1: USB disconnect, device number 51 [ 684.251117][ T9489] udevd[9489]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 684.328770][T12563] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 685.727410][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.232228][ T5906] kernel write not supported for file /1168/net/ip_vs_stats (pid: 5906 comm: kworker/1:6) [ 686.319038][T12708] netlink: 'syz.2.1498': attribute type 5 has an invalid length. [ 687.587376][T12767] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 688.668309][T12563] veth0_vlan: entered promiscuous mode [ 689.160741][T12563] veth1_vlan: entered promiscuous mode [ 689.281412][T12563] veth0_macvtap: entered promiscuous mode [ 689.304669][T12794] netlink: 14 bytes leftover after parsing attributes in process `syz.1.1515'. [ 689.309447][T12563] veth1_macvtap: entered promiscuous mode [ 689.684622][T12798] tmpfs: Bad value for 'mpol' [ 689.756503][T12802] FAULT_INJECTION: forcing a failure. [ 689.756503][T12802] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 689.837996][T12563] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 689.876112][T12802] CPU: 0 UID: 0 PID: 12802 Comm: syz.2.1517 Not tainted 6.16.0-rc5-syzkaller-00224-g379f604cc3dc #0 PREEMPT(full) [ 689.876136][T12802] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 689.876147][T12802] Call Trace: [ 689.876154][T12802] [ 689.876163][T12802] dump_stack_lvl+0x189/0x250 [ 689.876185][T12802] ? __pfx____ratelimit+0x10/0x10 [ 689.876210][T12802] ? __pfx_dump_stack_lvl+0x10/0x10 [ 689.876229][T12802] ? __pfx__printk+0x10/0x10 [ 689.876264][T12802] should_fail_ex+0x414/0x560 [ 689.876293][T12802] _copy_from_user+0x2d/0xb0 [ 689.876314][T12802] bpf_test_init+0xf8/0x170 [ 689.876336][T12802] bpf_prog_test_run_skb+0x1e9/0x1560 [ 689.876352][T12802] ? __fget_files+0x2a/0x420 [ 689.876367][T12802] ? __fget_files+0x2a/0x420 [ 689.876386][T12802] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 689.876404][T12802] bpf_prog_test_run+0x2c7/0x340 [ 689.876433][T12802] __sys_bpf+0x4a4/0x860 [ 689.876457][T12802] ? __pfx___sys_bpf+0x10/0x10 [ 689.876476][T12802] ? preempt_schedule_irq+0xde/0x150 [ 689.876529][T12802] __x64_sys_bpf+0x7c/0x90 [ 689.876552][T12802] do_syscall_64+0xfa/0x3b0 [ 689.876570][T12802] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 689.876588][T12802] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 689.876605][T12802] ? clear_bhb_loop+0x60/0xb0 [ 689.876626][T12802] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 689.876642][T12802] RIP: 0033:0x7fc4a278e929 [ 689.876658][T12802] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 689.876674][T12802] RSP: 002b:00007fc4a36c7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 689.876693][T12802] RAX: ffffffffffffffda RBX: 00007fc4a29b5fa0 RCX: 00007fc4a278e929 [ 689.876707][T12802] RDX: 0000000000000050 RSI: 00002000000002c0 RDI: 000000000000000a [ 689.876727][T12802] RBP: 00007fc4a36c7090 R08: 0000000000000000 R09: 0000000000000000 [ 689.876738][T12802] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 689.876749][T12802] R13: 0000000000000000 R14: 00007fc4a29b5fa0 R15: 00007ffc19d8ba08 [ 689.876778][T12802] [ 689.880922][T12563] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 690.038030][ C1] vkms_vblank_simulate: vblank timer overrun [ 690.172718][T12807] FAULT_INJECTION: forcing a failure. [ 690.172718][T12807] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 690.194784][T12807] CPU: 1 UID: 0 PID: 12807 Comm: syz.2.1518 Not tainted 6.16.0-rc5-syzkaller-00224-g379f604cc3dc #0 PREEMPT(full) [ 690.194808][T12807] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 690.194817][T12807] Call Trace: [ 690.194822][T12807] [ 690.194827][T12807] dump_stack_lvl+0x189/0x250 [ 690.194844][T12807] ? __pfx____ratelimit+0x10/0x10 [ 690.194859][T12807] ? __pfx_dump_stack_lvl+0x10/0x10 [ 690.194870][T12807] ? __pfx__printk+0x10/0x10 [ 690.194889][T12807] should_fail_ex+0x414/0x560 [ 690.194906][T12807] _copy_from_user+0x2d/0xb0 [ 690.194918][T12807] bpf_test_init+0xf8/0x170 [ 690.194932][T12807] bpf_prog_test_run_xdp+0x37c/0x1000 [ 690.194952][T12807] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 690.194966][T12807] ? __fget_files+0x2a/0x420 [ 690.194979][T12807] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 690.194990][T12807] bpf_prog_test_run+0x2c7/0x340 [ 690.195008][T12807] __sys_bpf+0x4a4/0x860 [ 690.195022][T12807] ? __pfx___sys_bpf+0x10/0x10 [ 690.195042][T12807] ? ksys_write+0x22a/0x250 [ 690.195056][T12807] ? __pfx_ksys_write+0x10/0x10 [ 690.195067][T12807] ? rcu_is_watching+0x15/0xb0 [ 690.195082][T12807] __x64_sys_bpf+0x7c/0x90 [ 690.195095][T12807] do_syscall_64+0xfa/0x3b0 [ 690.195104][T12807] ? lockdep_hardirqs_on+0x9c/0x150 [ 690.195117][T12807] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 690.195127][T12807] ? clear_bhb_loop+0x60/0xb0 [ 690.195139][T12807] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 690.195148][T12807] RIP: 0033:0x7fc4a278e929 [ 690.195158][T12807] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 690.195166][T12807] RSP: 002b:00007fc4a36c7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 690.195178][T12807] RAX: ffffffffffffffda RBX: 00007fc4a29b5fa0 RCX: 00007fc4a278e929 [ 690.195185][T12807] RDX: 0000000000000050 RSI: 0000200000000600 RDI: 000000000000000a [ 690.195192][T12807] RBP: 00007fc4a36c7090 R08: 0000000000000000 R09: 0000000000000000 [ 690.195198][T12807] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 690.195204][T12807] R13: 0000000000000000 R14: 00007fc4a29b5fa0 R15: 00007ffc19d8ba08 [ 690.195220][T12807] [ 690.420588][ C1] vkms_vblank_simulate: vblank timer overrun [ 690.552717][T12563] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 690.561573][T12563] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 690.573641][T12563] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 690.584430][T12563] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 690.742636][T12815] FAULT_INJECTION: forcing a failure. [ 690.742636][T12815] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 690.766903][T12815] CPU: 1 UID: 0 PID: 12815 Comm: syz.3.1521 Not tainted 6.16.0-rc5-syzkaller-00224-g379f604cc3dc #0 PREEMPT(full) [ 690.766928][T12815] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 690.766939][T12815] Call Trace: [ 690.766947][T12815] [ 690.766954][T12815] dump_stack_lvl+0x189/0x250 [ 690.766978][T12815] ? __pfx____ratelimit+0x10/0x10 [ 690.767002][T12815] ? __pfx_dump_stack_lvl+0x10/0x10 [ 690.767020][T12815] ? __pfx__printk+0x10/0x10 [ 690.767054][T12815] should_fail_ex+0x414/0x560 [ 690.767082][T12815] _copy_to_user+0x31/0xb0 [ 690.767104][T12815] simple_read_from_buffer+0xe1/0x170 [ 690.767132][T12815] proc_fail_nth_read+0x1df/0x250 [ 690.767155][T12815] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 690.767176][T12815] ? rw_verify_area+0x258/0x650 [ 690.767196][T12815] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 690.767216][T12815] vfs_read+0x200/0x980 [ 690.767243][T12815] ? __pfx___mutex_lock+0x10/0x10 [ 690.767261][T12815] ? __pfx_vfs_read+0x10/0x10 [ 690.767284][T12815] ? __fget_files+0x2a/0x420 [ 690.767306][T12815] ? __fget_files+0x3a0/0x420 [ 690.767320][T12815] ? __fget_files+0x2a/0x420 [ 690.767344][T12815] ksys_read+0x145/0x250 [ 690.767368][T12815] ? __pfx_ksys_read+0x10/0x10 [ 690.767385][T12815] ? rcu_is_watching+0x15/0xb0 [ 690.767436][T12815] ? do_syscall_64+0xbe/0x3b0 [ 690.767457][T12815] do_syscall_64+0xfa/0x3b0 [ 690.767472][T12815] ? lockdep_hardirqs_on+0x9c/0x150 [ 690.767496][T12815] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 690.767513][T12815] ? clear_bhb_loop+0x60/0xb0 [ 690.767535][T12815] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 690.767552][T12815] RIP: 0033:0x7f6a3d58d33c [ 690.767569][T12815] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 690.767583][T12815] RSP: 002b:00007f6a3e49b030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 690.767603][T12815] RAX: ffffffffffffffda RBX: 00007f6a3d7b5fa0 RCX: 00007f6a3d58d33c [ 690.767616][T12815] RDX: 000000000000000f RSI: 00007f6a3e49b0a0 RDI: 0000000000000004 [ 690.767628][T12815] RBP: 00007f6a3e49b090 R08: 0000000000000000 R09: 000000000000001c [ 690.767639][T12815] R10: 0000000020000004 R11: 0000000000000246 R12: 0000000000000001 [ 690.767650][T12815] R13: 0000000000000000 R14: 00007f6a3d7b5fa0 R15: 00007ffc14eef1d8 [ 690.767679][T12815] [ 691.004626][ C1] vkms_vblank_simulate: vblank timer overrun [ 691.076603][ T8945] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 691.105053][ T5843] Bluetooth: hci1: unexpected event for opcode 0x0c25 [ 691.142723][ T8945] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 691.144572][ T6214] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 691.159428][ T6214] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 692.792907][ T6035] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 692.844657][T12847] FAULT_INJECTION: forcing a failure. [ 692.844657][T12847] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 692.905679][T12847] CPU: 0 UID: 0 PID: 12847 Comm: syz.1.1528 Not tainted 6.16.0-rc5-syzkaller-00224-g379f604cc3dc #0 PREEMPT(full) [ 692.905700][T12847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 692.905710][T12847] Call Trace: [ 692.905718][T12847] [ 692.905725][T12847] dump_stack_lvl+0x189/0x250 [ 692.905748][T12847] ? __pfx____ratelimit+0x10/0x10 [ 692.905768][T12847] ? __pfx_dump_stack_lvl+0x10/0x10 [ 692.905783][T12847] ? __pfx__printk+0x10/0x10 [ 692.905800][T12847] ? __might_fault+0xb0/0x130 [ 692.905828][T12847] should_fail_ex+0x414/0x560 [ 692.905852][T12847] _copy_from_user+0x2d/0xb0 [ 692.905869][T12847] ___sys_sendmsg+0x158/0x2a0 [ 692.905890][T12847] ? __pfx____sys_sendmsg+0x10/0x10 [ 692.905939][T12847] ? __fget_files+0x2a/0x420 [ 692.905951][T12847] ? __fget_files+0x3a0/0x420 [ 692.905976][T12847] __x64_sys_sendmsg+0x19b/0x260 [ 692.905999][T12847] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 692.906027][T12847] ? __pfx_ksys_write+0x10/0x10 [ 692.906043][T12847] ? rcu_is_watching+0x15/0xb0 [ 692.906065][T12847] ? do_syscall_64+0xbe/0x3b0 [ 692.906086][T12847] do_syscall_64+0xfa/0x3b0 [ 692.906101][T12847] ? lockdep_hardirqs_on+0x9c/0x150 [ 692.906124][T12847] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 692.906141][T12847] ? clear_bhb_loop+0x60/0xb0 [ 692.906162][T12847] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 692.906179][T12847] RIP: 0033:0x7fe2e678e929 [ 692.906203][T12847] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 692.906217][T12847] RSP: 002b:00007fe2e768e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 692.906237][T12847] RAX: ffffffffffffffda RBX: 00007fe2e69b5fa0 RCX: 00007fe2e678e929 [ 692.906250][T12847] RDX: 0000000000003880 RSI: 00002000000002c0 RDI: 0000000000000004 [ 692.906262][T12847] RBP: 00007fe2e768e090 R08: 0000000000000000 R09: 0000000000000000 [ 692.906274][T12847] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 692.906285][T12847] R13: 0000000000000000 R14: 00007fe2e69b5fa0 R15: 00007fffd0bded48 [ 692.906315][T12847] [ 693.382914][ T6035] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 693.455607][ T6035] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 693.551754][ T6035] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 693.688402][ T6035] bridge_slave_1: left allmulticast mode [ 693.694077][ T6035] bridge_slave_1: left promiscuous mode [ 693.700594][ T6035] bridge0: port 2(bridge_slave_1) entered disabled state [ 693.710085][ T6035] bridge_slave_0: left allmulticast mode [ 693.716206][ T6035] bridge_slave_0: left promiscuous mode [ 693.723317][ T6035] bridge0: port 1(bridge_slave_0) entered disabled state [ 694.030830][ T6035] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 694.042014][ T6035] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 694.052441][ T6035] bond0 (unregistering): Released all slaves [ 694.977287][T12871] netlink: 'syz.2.1533': attribute type 10 has an invalid length. [ 696.374521][ T5936] usb 1-1: new full-speed USB device number 46 using dummy_hcd [ 696.908288][ T5854] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 696.927322][ T5854] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 696.941416][ T5854] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 696.977628][ T5854] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 696.997265][ T5854] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 697.066931][ T5936] usb 1-1: unable to get BOS descriptor or descriptor too short [ 697.101953][ T5936] usb 1-1: not running at top speed; connect to a high speed hub [ 697.143061][ T5936] usb 1-1: config 219 has an invalid interface number: 128 but max is 1 [ 697.176869][ T5936] usb 1-1: config 219 has no interface number 1 [ 697.183196][ T5936] usb 1-1: config 219 interface 0 has no altsetting 0 [ 697.218276][ T5936] usb 1-1: config 219 interface 128 has no altsetting 0 [ 697.459855][ T5936] usb 1-1: New USB device found, idVendor=2b73, idProduct=0017, bcdDevice=a2.0e [ 697.641612][ T5936] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 697.834742][ T5936] usb 1-1: Product: syz [ 697.838975][ T5936] usb 1-1: Manufacturer: syz [ 697.843582][ T5936] usb 1-1: SerialNumber: syz [ 698.431288][T12909] FAULT_INJECTION: forcing a failure. [ 698.431288][T12909] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 698.445328][T12909] CPU: 0 UID: 0 PID: 12909 Comm: syz.3.1541 Not tainted 6.16.0-rc5-syzkaller-00224-g379f604cc3dc #0 PREEMPT(full) [ 698.445352][T12909] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 698.445364][T12909] Call Trace: [ 698.445372][T12909] [ 698.445380][T12909] dump_stack_lvl+0x189/0x250 [ 698.445406][T12909] ? __pfx____ratelimit+0x10/0x10 [ 698.445431][T12909] ? __pfx_dump_stack_lvl+0x10/0x10 [ 698.445451][T12909] ? __pfx__printk+0x10/0x10 [ 698.445479][T12909] ? __might_fault+0xb0/0x130 [ 698.445509][T12909] should_fail_ex+0x414/0x560 [ 698.445539][T12909] _copy_from_user+0x2d/0xb0 [ 698.445561][T12909] evdev_ioctl_handler+0x419/0x1f10 [ 698.445601][T12909] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 698.445626][T12909] ? __pfx_evdev_ioctl_handler+0x10/0x10 [ 698.445649][T12909] ? __pfx_smack_log+0x10/0x10 [ 698.445670][T12909] ? smk_access+0x14c/0x4e0 [ 698.445690][T12909] ? rcu_is_watching+0x15/0xb0 [ 698.445713][T12909] ? smk_tskacc+0x2fc/0x370 [ 698.445746][T12909] ? __pfx_smack_file_ioctl+0x10/0x10 [ 698.445785][T12909] ? smack_file_ioctl+0xa/0x340 [ 698.445809][T12909] ? bpf_lsm_file_ioctl+0x9/0x20 [ 698.445827][T12909] ? __pfx_evdev_ioctl+0x10/0x10 [ 698.445849][T12909] __se_sys_ioctl+0xf9/0x170 [ 698.445875][T12909] do_syscall_64+0xfa/0x3b0 [ 698.445894][T12909] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 698.445911][T12909] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 698.445928][T12909] ? clear_bhb_loop+0x60/0xb0 [ 698.445950][T12909] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 698.445967][T12909] RIP: 0033:0x7f6a3d58e929 [ 698.445986][T12909] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 698.446001][T12909] RSP: 002b:00007f6a3e459038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 698.446021][T12909] RAX: ffffffffffffffda RBX: 00007f6a3d7b6160 RCX: 00007f6a3d58e929 [ 698.446034][T12909] RDX: 0000200000000000 RSI: 0000000080084504 RDI: 0000000000000005 [ 698.446047][T12909] RBP: 00007f6a3e459090 R08: 0000000000000000 R09: 0000000000000000 [ 698.446059][T12909] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 698.446070][T12909] R13: 0000000000000000 R14: 00007f6a3d7b6160 R15: 00007ffc14eef1d8 [ 698.446101][T12909] [ 698.757824][ T5936] snd-usb-audio 1-1:219.0: probe with driver snd-usb-audio failed with error -22 [ 698.831966][ T5936] usb 1-1: USB disconnect, device number 46 [ 698.876528][ T6035] hsr_slave_0: left promiscuous mode [ 698.902283][ T6035] hsr_slave_1: left promiscuous mode [ 698.964645][ T6035] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 698.973985][ T9474] udevd[9474]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:219.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 699.000598][ T6035] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 699.021810][ T6035] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 699.093261][ T5854] Bluetooth: hci3: command tx timeout [ 699.100421][ T6035] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 699.185917][ T6035] veth1_macvtap: left promiscuous mode [ 699.219353][ T6035] veth0_macvtap: left promiscuous mode [ 699.233310][ T6035] veth1_vlan: left promiscuous mode [ 699.257639][ T6035] veth0_vlan: left promiscuous mode [ 699.515404][T12927] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1544'. [ 699.587575][T12927] netlink: 336 bytes leftover after parsing attributes in process `syz.3.1544'. [ 699.968155][T12935] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 701.156486][ T5854] Bluetooth: hci3: command tx timeout [ 701.354500][ T6035] team0 (unregistering): Port device team_slave_1 removed [ 701.400037][ T6035] team0 (unregistering): Port device team_slave_0 removed [ 702.867231][T12964] syz.3.1551 (12964) used greatest stack depth: 16856 bytes left [ 703.235995][ T5854] Bluetooth: hci3: command tx timeout [ 704.541156][T12886] chnl_net:caif_netlink_parms(): no params data found [ 705.105914][T12998] binder: 12997:12998 ioctl c0306201 200000000640 returned -22 [ 705.319820][ T5854] Bluetooth: hci3: command tx timeout [ 705.325702][T13003] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(4) [ 705.332241][T13003] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 705.354522][T13003] vhci_hcd vhci_hcd.0: Device attached [ 705.366380][T13005] vhci_hcd: unknown pdu 2 [ 705.374043][ T6214] vhci_hcd: stop threads [ 705.404474][ T6214] vhci_hcd: release socket [ 705.408937][ T6214] vhci_hcd: disconnect device [ 706.004898][ T5970] usb 4-1: new full-speed USB device number 52 using dummy_hcd [ 706.162842][T12886] bridge0: port 1(bridge_slave_0) entered blocking state [ 706.180683][ T5970] usb 4-1: unable to get BOS descriptor or descriptor too short [ 706.188746][T12886] bridge0: port 1(bridge_slave_0) entered disabled state [ 706.204974][T12886] bridge_slave_0: entered allmulticast mode [ 706.211300][ T5970] usb 4-1: not running at top speed; connect to a high speed hub [ 706.247008][ T5970] usb 4-1: config 219 has an invalid interface number: 128 but max is 1 [ 706.257225][T12886] bridge_slave_0: entered promiscuous mode [ 706.269276][ T5970] usb 4-1: config 219 has no interface number 1 [ 706.282516][ T5970] usb 4-1: config 219 interface 0 has no altsetting 0 [ 706.292283][ T5970] usb 4-1: config 219 interface 128 has no altsetting 0 [ 706.303808][T12886] bridge0: port 2(bridge_slave_1) entered blocking state [ 706.325180][ T5970] usb 4-1: New USB device found, idVendor=2b73, idProduct=0017, bcdDevice=a2.0e [ 706.336226][T12886] bridge0: port 2(bridge_slave_1) entered disabled state [ 706.343469][T12886] bridge_slave_1: entered allmulticast mode [ 706.349492][ T5970] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 706.360599][T12886] bridge_slave_1: entered promiscuous mode [ 706.366624][ T5970] usb 4-1: Product: syz [ 706.372764][ T5970] usb 4-1: Manufacturer: syz [ 706.378231][ T5970] usb 4-1: SerialNumber: syz [ 706.445950][T12886] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 706.460846][T12886] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 706.573400][T12886] team0: Port device team_slave_0 added [ 706.587856][T12886] team0: Port device team_slave_1 added [ 707.433791][ T5970] snd-usb-audio 4-1:219.0: probe with driver snd-usb-audio failed with error -22 [ 707.474079][T12886] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 707.487383][T12886] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 707.520997][ T5970] usb 4-1: USB disconnect, device number 52 [ 707.665383][T13027] netlink: 104 bytes leftover after parsing attributes in process `syz.1.1563'. [ 707.891456][ T9474] udevd[9474]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:219.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 707.911031][T12886] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 707.998899][T12886] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 708.076213][T12886] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 708.153717][T12886] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 708.454674][ T24] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 708.674694][ T24] usb 1-1: Using ep0 maxpacket: 16 [ 708.832189][ T24] usb 1-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 2.00 [ 708.868773][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 709.519038][ T24] usb 1-1: config 0 descriptor?? [ 709.547625][ T24] ftdi_sio 1-1:0.0: FTDI USB Serial Device converter detected [ 710.255456][T13035] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 710.474478][T13035] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 710.518116][T12886] hsr_slave_0: entered promiscuous mode [ 710.525754][T12886] hsr_slave_1: entered promiscuous mode [ 710.532300][T12886] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 710.540111][T12886] Cannot create hsr debugfs directory [ 711.074495][ T5970] usb 3-1: new high-speed USB device number 54 using dummy_hcd [ 711.792583][ T5970] usb 3-1: Using ep0 maxpacket: 16 [ 711.816756][ T5970] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 112, changing to 10 [ 711.839164][ T5970] usb 3-1: New USB device found, idVendor=05ac, idProduct=0224, bcdDevice= 0.00 [ 711.876752][ T5970] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 711.941114][ T5970] usb 3-1: config 0 descriptor?? [ 712.078349][T13085] tmpfs: Bad value for 'mpol' [ 712.241388][T13069] netlink: 'syz.2.1570': attribute type 1 has an invalid length. [ 712.316845][ T5970] usb 3-1: string descriptor 0 read error: -71 [ 712.375891][ T5970] input: bcm5974 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input21 [ 712.406772][ T5191] bcm5974 3-1:0.0: could not read from device [ 712.689346][ T5191] bcm5974 3-1:0.0: could not read from device [ 712.730429][ T5191] bcm5974 3-1:0.0: could not read from device [ 712.741797][ T5970] usb 3-1: USB disconnect, device number 54 [ 712.775144][ T5191] bcm5974 3-1:0.0: could not read from device [ 713.221846][ T5854] Bluetooth: hci1: unexpected event for opcode 0x0c25 [ 715.144661][ T24] usb 1-1: Detected FT232A [ 715.192762][ T24] usb 1-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 716.006900][ T24] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 716.234874][ T24] usb 3-1: Using ep0 maxpacket: 32 [ 716.445315][ T24] usb 3-1: unable to get BOS descriptor or descriptor too short [ 716.471813][ T24] usb 3-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 716.545002][ T24] usb 3-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 716.588696][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 716.624919][ T24] usb 3-1: Product: syz [ 716.629134][ T24] usb 3-1: Manufacturer: syz [ 716.645211][ T24] usb 3-1: SerialNumber: syz [ 716.914875][ T24] usb 3-1: Cannot retrieve CPort count: 0 [ 716.925754][ T24] usb 3-1: Cannot retrieve CPort count: -5 [ 717.116858][ T24] es2_ap_driver 3-1:7.0: probe with driver es2_ap_driver failed with error -5 [ 718.452443][ T5970] usb 1-1: USB disconnect, device number 47 [ 718.561717][ T5970] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 718.616263][ T5970] ftdi_sio 1-1:0.0: device disconnected [ 718.799655][T13153] FAULT_INJECTION: forcing a failure. [ 718.799655][T13153] name failslab, interval 1, probability 0, space 0, times 0 [ 718.812796][T13153] CPU: 1 UID: 0 PID: 13153 Comm: syz.1.1583 Not tainted 6.16.0-rc5-syzkaller-00224-g379f604cc3dc #0 PREEMPT(full) [ 718.812821][T13153] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 718.812832][T13153] Call Trace: [ 718.812841][T13153] [ 718.812850][T13153] dump_stack_lvl+0x189/0x250 [ 718.812877][T13153] ? __pfx____ratelimit+0x10/0x10 [ 718.812904][T13153] ? __pfx_dump_stack_lvl+0x10/0x10 [ 718.812925][T13153] ? __pfx__printk+0x10/0x10 [ 718.812955][T13153] ? __pfx___might_resched+0x10/0x10 [ 718.812981][T13153] should_fail_ex+0x414/0x560 [ 718.813012][T13153] should_failslab+0xa8/0x100 [ 718.813039][T13153] __kmalloc_cache_noprof+0x70/0x3d0 [ 718.813064][T13153] ? cma_alloc_port+0xb9/0x610 [ 718.813089][T13153] cma_alloc_port+0xb9/0x610 [ 718.813113][T13153] rdma_bind_addr_dst+0x29b4/0x3410 [ 718.813138][T13153] ? do_raw_spin_lock+0x121/0x290 [ 718.813175][T13153] ? lockdep_hardirqs_on+0x9c/0x150 [ 718.813203][T13153] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 718.813227][T13153] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 718.813264][T13153] rdma_resolve_addr+0x664/0x2030 [ 718.813289][T13153] ? __pfx___mutex_trylock_common+0x10/0x10 [ 718.813320][T13153] ? __pfx_rdma_resolve_addr+0x10/0x10 [ 718.813342][T13153] ? trace_contention_end+0x39/0x120 [ 718.813364][T13153] ? __mutex_lock+0x330/0xe80 [ 718.813392][T13153] ? ucma_resolve_ip+0x1a5/0x280 [ 718.813442][T13153] ucma_resolve_ip+0x1db/0x280 [ 718.813467][T13153] ? __pfx_ucma_resolve_ip+0x10/0x10 [ 718.813505][T13153] ucma_write+0x249/0x2e0 [ 718.813528][T13153] ? __pfx_ucma_write+0x10/0x10 [ 718.813547][T13153] ? security_file_permission+0x75/0x290 [ 718.813576][T13153] ? rw_verify_area+0x258/0x650 [ 718.813598][T13153] ? __pfx_ucma_write+0x10/0x10 [ 718.813619][T13153] vfs_write+0x27e/0xa90 [ 718.813652][T13153] ? __pfx_vfs_write+0x10/0x10 [ 718.813678][T13153] ? __fget_files+0x2a/0x420 [ 718.813699][T13153] ? __fget_files+0x2a/0x420 [ 718.813715][T13153] ? __fget_files+0x3a0/0x420 [ 718.813732][T13153] ? __fget_files+0x2a/0x420 [ 718.813766][T13153] ksys_write+0x145/0x250 [ 718.813793][T13153] ? __pfx_ksys_write+0x10/0x10 [ 718.813813][T13153] ? rcu_is_watching+0x15/0xb0 [ 718.813839][T13153] ? do_syscall_64+0xbe/0x3b0 [ 718.813861][T13153] do_syscall_64+0xfa/0x3b0 [ 718.813878][T13153] ? lockdep_hardirqs_on+0x9c/0x150 [ 718.813902][T13153] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 718.813920][T13153] ? clear_bhb_loop+0x60/0xb0 [ 718.813942][T13153] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 718.813960][T13153] RIP: 0033:0x7fe2e678e929 [ 718.813977][T13153] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 718.813993][T13153] RSP: 002b:00007fe2e764c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 718.814013][T13153] RAX: ffffffffffffffda RBX: 00007fe2e69b6160 RCX: 00007fe2e678e929 [ 718.814027][T13153] RDX: 0000000000000048 RSI: 0000200000000280 RDI: 0000000000000008 [ 718.814040][T13153] RBP: 00007fe2e764c090 R08: 0000000000000000 R09: 0000000000000000 [ 718.814052][T13153] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 718.814063][T13153] R13: 0000000000000000 R14: 00007fe2e69b6160 R15: 00007fffd0bded48 [ 718.814095][T13153] [ 719.163903][T12886] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 719.365104][ T24] usb 3-1: USB disconnect, device number 55 [ 720.248620][T12886] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 720.294745][T12886] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 720.528667][T12886] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 722.126439][ T975] usb 3-1: new full-speed USB device number 56 using dummy_hcd [ 722.177936][T12886] 8021q: adding VLAN 0 to HW filter on device bond0 [ 722.245409][T12886] 8021q: adding VLAN 0 to HW filter on device team0 [ 722.287622][ T975] usb 3-1: unable to get BOS descriptor or descriptor too short [ 722.306516][ T3559] bridge0: port 1(bridge_slave_0) entered blocking state [ 722.313680][ T3559] bridge0: port 1(bridge_slave_0) entered forwarding state [ 722.331847][ T975] usb 3-1: not running at top speed; connect to a high speed hub [ 722.365959][ T975] usb 3-1: config 219 has an invalid interface number: 128 but max is 1 [ 722.392552][ T3559] bridge0: port 2(bridge_slave_1) entered blocking state [ 722.399768][ T3559] bridge0: port 2(bridge_slave_1) entered forwarding state [ 722.407717][ T975] usb 3-1: config 219 has no interface number 1 [ 722.414033][ T975] usb 3-1: config 219 interface 0 has no altsetting 0 [ 722.441398][ T975] usb 3-1: config 219 interface 128 has no altsetting 0 [ 722.503867][ T975] usb 3-1: New USB device found, idVendor=2b73, idProduct=0017, bcdDevice=a2.0e [ 722.533234][ T975] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 722.562959][ T975] usb 3-1: Product: syz [ 722.571658][ T975] usb 3-1: Manufacturer: syz [ 722.598891][ T975] usb 3-1: SerialNumber: syz [ 723.989693][T12886] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 724.096510][T12886] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 724.102116][ T975] snd-usb-audio 3-1:219.0: probe with driver snd-usb-audio failed with error -22 [ 724.118576][T13192] FAULT_INJECTION: forcing a failure. [ 724.118576][T13192] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 724.187544][ T975] usb 3-1: USB disconnect, device number 56 [ 724.324609][T13192] CPU: 0 UID: 0 PID: 13192 Comm: syz.2.1591 Not tainted 6.16.0-rc5-syzkaller-00224-g379f604cc3dc #0 PREEMPT(full) [ 724.324638][T13192] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 724.324651][T13192] Call Trace: [ 724.324660][T13192] [ 724.324669][T13192] dump_stack_lvl+0x189/0x250 [ 724.324694][T13192] ? __pfx____ratelimit+0x10/0x10 [ 724.324720][T13192] ? __pfx_dump_stack_lvl+0x10/0x10 [ 724.324740][T13192] ? __pfx__printk+0x10/0x10 [ 724.324778][T13192] should_fail_ex+0x414/0x560 [ 724.324808][T13192] _copy_from_user+0x2d/0xb0 [ 724.324829][T13192] bpf_test_init+0xf8/0x170 [ 724.324853][T13192] bpf_prog_test_run_skb+0x1e9/0x1560 [ 724.324872][T13192] ? __fget_files+0x2a/0x420 [ 724.324893][T13192] ? __fget_files+0x2a/0x420 [ 724.324919][T13192] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 724.324937][T13192] bpf_prog_test_run+0x2c7/0x340 [ 724.324966][T13192] __sys_bpf+0x4a4/0x860 [ 724.324991][T13192] ? __pfx___sys_bpf+0x10/0x10 [ 724.325028][T13192] ? ksys_write+0x22a/0x250 [ 724.325052][T13192] ? __pfx_ksys_write+0x10/0x10 [ 724.325070][T13192] ? rcu_is_watching+0x15/0xb0 [ 724.325096][T13192] __x64_sys_bpf+0x7c/0x90 [ 724.325119][T13192] do_syscall_64+0xfa/0x3b0 [ 724.325135][T13192] ? lockdep_hardirqs_on+0x9c/0x150 [ 724.325158][T13192] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 724.325186][T13192] ? clear_bhb_loop+0x60/0xb0 [ 724.325207][T13192] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 724.325224][T13192] RIP: 0033:0x7fc4a278e929 [ 724.325241][T13192] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 724.325257][T13192] RSP: 002b:00007fc4a36c7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 724.325277][T13192] RAX: ffffffffffffffda RBX: 00007fc4a29b5fa0 RCX: 00007fc4a278e929 [ 724.325290][T13192] RDX: 0000000000000050 RSI: 00002000000002c0 RDI: 000000000000000a [ 724.325302][T13192] RBP: 00007fc4a36c7090 R08: 0000000000000000 R09: 0000000000000000 [ 724.325314][T13192] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 724.325325][T13192] R13: 0000000000000000 R14: 00007fc4a29b5fa0 R15: 00007ffc19d8ba08 [ 724.325355][T13192] [ 724.328347][T13200] usb usb8: usbfs: process 13200 (syz.1.1593) did not claim interface 0 before use [ 724.633946][ T9474] udevd[9474]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:219.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 724.747620][T13205] netlink: 104 bytes leftover after parsing attributes in process `syz.0.1594'. [ 725.501109][T13217] program syz.2.1596 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 725.639858][T12886] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 730.484990][T12886] veth0_vlan: entered promiscuous mode [ 731.029705][T12886] veth1_vlan: entered promiscuous mode [ 731.058535][T12886] veth0_macvtap: entered promiscuous mode [ 731.616069][T12886] veth1_macvtap: entered promiscuous mode [ 731.902352][T12886] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 732.770877][T13287] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -12 [ 732.784443][T13287] platform regulatory.0: Direct firmware load for regulatory.db failed with error -12 [ 732.787687][T13294] FAULT_INJECTION: forcing a failure. [ 732.787687][T13294] name failslab, interval 1, probability 0, space 0, times 0 [ 732.797129][T13287] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 732.808254][T13294] CPU: 0 UID: 0 PID: 13294 Comm: syz.2.1608 Not tainted 6.16.0-rc5-syzkaller-00224-g379f604cc3dc #0 PREEMPT(full) [ 732.808280][T13294] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 732.808291][T13294] Call Trace: [ 732.808299][T13294] [ 732.808308][T13294] dump_stack_lvl+0x189/0x250 [ 732.808332][T13294] ? __pfx____ratelimit+0x10/0x10 [ 732.808356][T13294] ? __pfx_dump_stack_lvl+0x10/0x10 [ 732.808375][T13294] ? __pfx__printk+0x10/0x10 [ 732.808401][T13294] ? __pfx___might_resched+0x10/0x10 [ 732.808418][T13294] ? fs_reclaim_acquire+0x7d/0x100 [ 732.808440][T13294] should_fail_ex+0x414/0x560 [ 732.808469][T13294] should_failslab+0xa8/0x100 [ 732.808495][T13294] kmem_cache_alloc_noprof+0x73/0x3c0 [ 732.808515][T13294] ? alloc_empty_file+0x55/0x1d0 [ 732.808538][T13294] alloc_empty_file+0x55/0x1d0 [ 732.808557][T13294] path_openat+0x107/0x3830 [ 732.808576][T13294] ? arch_stack_walk+0xfc/0x150 [ 732.808623][T13294] ? kasan_save_track+0x4f/0x80 [ 732.808642][T13294] ? kasan_save_track+0x3e/0x80 [ 732.808661][T13294] ? __kasan_slab_alloc+0x6c/0x80 [ 732.808681][T13294] ? getname_flags+0xb8/0x540 [ 732.808698][T13294] ? __pfx_path_openat+0x10/0x10 [ 732.808715][T13294] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 732.808752][T13294] do_filp_open+0x1fa/0x410 [ 732.808771][T13294] ? __lock_acquire+0xab9/0xd20 [ 732.808789][T13294] ? __pfx_do_filp_open+0x10/0x10 [ 732.808831][T13294] ? _raw_spin_unlock+0x28/0x50 [ 732.808852][T13294] ? alloc_fd+0x64c/0x6c0 [ 732.808887][T13294] do_sys_openat2+0x121/0x1c0 [ 732.808909][T13294] ? __pfx_do_sys_openat2+0x10/0x10 [ 732.808929][T13294] ? ksys_write+0x22a/0x250 [ 732.808953][T13294] ? __pfx_ksys_write+0x10/0x10 [ 732.808972][T13294] ? rcu_is_watching+0x15/0xb0 [ 732.808995][T13294] __x64_sys_openat+0x138/0x170 [ 732.809019][T13294] do_syscall_64+0xfa/0x3b0 [ 732.809052][T13294] ? lockdep_hardirqs_on+0x9c/0x150 [ 732.809080][T13294] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 732.809098][T13294] ? clear_bhb_loop+0x60/0xb0 [ 732.809118][T13294] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 732.809135][T13294] RIP: 0033:0x7fc4a278e929 [ 732.809151][T13294] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 732.809165][T13294] RSP: 002b:00007fc4a36c7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 732.809183][T13294] RAX: ffffffffffffffda RBX: 00007fc4a29b5fa0 RCX: 00007fc4a278e929 [ 732.809196][T13294] RDX: 0000000000000800 RSI: 00002000000000c0 RDI: ffffffffffffff9c [ 732.809208][T13294] RBP: 00007fc4a36c7090 R08: 0000000000000000 R09: 0000000000000000 [ 732.809219][T13294] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 732.809229][T13294] R13: 0000000000000000 R14: 00007fc4a29b5fa0 R15: 00007ffc19d8ba08 [ 732.809258][T13294] [ 733.171269][T12886] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 733.567061][T13294] vxfs: WRONG superblock magic 00000000 at 1 [ 733.573515][T13294] vxfs: WRONG superblock magic 00000000 at 8 [ 733.579561][T13294] vxfs: can't find superblock. [ 733.613871][T12886] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 733.670433][T13297] xt_time: unknown flags 0xb4 [ 733.684427][T12886] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 733.693158][T12886] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 734.124514][T12886] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 734.199062][T13301] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 734.209278][T13301] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 734.225885][T13301] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 734.247314][T13314] Illegal XDP return value 4292505600 on prog (id 458) dev N/A, expect packet loss! [ 734.260792][T13301] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 734.282182][T13301] geneve2: entered promiscuous mode [ 734.402741][T13301] tipc: Started in network mode [ 734.411106][T13301] tipc: Node identity b6c32247cd96, cluster identity 4711 [ 734.420224][T13301] tipc: Enabled bearer , priority 0 [ 734.459556][T13301] syzkaller0: entered promiscuous mode [ 734.526312][T13301] syzkaller0: entered allmulticast mode [ 735.664707][ T975] tipc: Node number set to 2069176903 [ 735.721260][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 735.754280][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 735.877057][T13298] tipc: Resetting bearer [ 736.081005][T13333] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1615'. [ 736.322203][T13298] tipc: Disabling bearer [ 736.333340][T13333] netlink: 336 bytes leftover after parsing attributes in process `syz.2.1615'. [ 736.390085][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 736.422210][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 736.682145][T13347] vlan3: entered allmulticast mode [ 736.706926][ T43] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 736.868498][ T43] usb 4-1: device descriptor read/64, error -71 [ 737.154603][ T43] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 737.454532][ T43] usb 4-1: device descriptor read/64, error -71 [ 737.485028][T13354] FAULT_INJECTION: forcing a failure. [ 737.485028][T13354] name failslab, interval 1, probability 0, space 0, times 0 [ 737.532058][T13354] CPU: 0 UID: 0 PID: 13354 Comm: syz.2.1621 Not tainted 6.16.0-rc5-syzkaller-00224-g379f604cc3dc #0 PREEMPT(full) [ 737.532085][T13354] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 737.532097][T13354] Call Trace: [ 737.532104][T13354] [ 737.532112][T13354] dump_stack_lvl+0x189/0x250 [ 737.532136][T13354] ? __pfx____ratelimit+0x10/0x10 [ 737.532161][T13354] ? __pfx_dump_stack_lvl+0x10/0x10 [ 737.532179][T13354] ? __pfx__printk+0x10/0x10 [ 737.532206][T13354] ? __pfx___might_resched+0x10/0x10 [ 737.532229][T13354] should_fail_ex+0x414/0x560 [ 737.532258][T13354] should_failslab+0xa8/0x100 [ 737.532282][T13354] kmem_cache_alloc_node_noprof+0x76/0x3c0 [ 737.532310][T13354] ? __alloc_skb+0x112/0x2d0 [ 737.532333][T13354] __alloc_skb+0x112/0x2d0 [ 737.532355][T13354] netlink_sendmsg+0x5c6/0xb30 [ 737.532384][T13354] ? __pfx_netlink_sendmsg+0x10/0x10 [ 737.532413][T13354] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 737.532435][T13354] ? __pfx_netlink_sendmsg+0x10/0x10 [ 737.532456][T13354] __sock_sendmsg+0x21c/0x270 [ 737.532484][T13354] ____sys_sendmsg+0x505/0x830 [ 737.532510][T13354] ? __pfx_____sys_sendmsg+0x10/0x10 [ 737.532539][T13354] ? import_iovec+0x74/0xa0 [ 737.532562][T13354] ___sys_sendmsg+0x21f/0x2a0 [ 737.532594][T13354] ? __pfx____sys_sendmsg+0x10/0x10 [ 737.532653][T13354] ? __fget_files+0x2a/0x420 [ 737.532669][T13354] ? __fget_files+0x3a0/0x420 [ 737.532697][T13354] __x64_sys_sendmsg+0x19b/0x260 [ 737.532721][T13354] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 737.532751][T13354] ? __pfx_ksys_write+0x10/0x10 [ 737.532771][T13354] ? rcu_is_watching+0x15/0xb0 [ 737.532797][T13354] ? do_syscall_64+0xbe/0x3b0 [ 737.532818][T13354] do_syscall_64+0xfa/0x3b0 [ 737.532833][T13354] ? lockdep_hardirqs_on+0x9c/0x150 [ 737.532856][T13354] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 737.532874][T13354] ? clear_bhb_loop+0x60/0xb0 [ 737.532895][T13354] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 737.532911][T13354] RIP: 0033:0x7fc4a278e929 [ 737.532927][T13354] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 737.532942][T13354] RSP: 002b:00007fc4a36c7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 737.532961][T13354] RAX: ffffffffffffffda RBX: 00007fc4a29b5fa0 RCX: 00007fc4a278e929 [ 737.532974][T13354] RDX: 0000000004000000 RSI: 0000200000000100 RDI: 0000000000000003 [ 737.532985][T13354] RBP: 00007fc4a36c7090 R08: 0000000000000000 R09: 0000000000000000 [ 737.532996][T13354] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 737.533007][T13354] R13: 0000000000000000 R14: 00007fc4a29b5fa0 R15: 00007ffc19d8ba08 [ 737.533037][T13354] [ 737.800476][ T43] usb usb4-port1: attempt power cycle [ 738.154600][ T43] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 738.747307][ T36] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 738.838079][ T43] usb 4-1: device descriptor read/8, error -71 [ 739.104624][ T43] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 739.131304][ T36] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 739.173799][ T43] usb 4-1: device descriptor read/8, error -71 [ 739.291273][ T36] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 739.304161][ T43] usb usb4-port1: unable to enumerate USB device [ 739.381314][ T36] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 739.605813][ T36] bridge_slave_1: left allmulticast mode [ 739.613385][ T36] bridge_slave_1: left promiscuous mode [ 739.623156][ T36] bridge0: port 2(bridge_slave_1) entered disabled state [ 739.634104][ T36] bridge_slave_0: left allmulticast mode [ 739.644040][ T36] bridge_slave_0: left promiscuous mode [ 739.650772][ T36] bridge0: port 1(bridge_slave_0) entered disabled state [ 740.098526][ T36] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 740.110126][ T36] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 740.125460][ T36] bond0 (unregistering): Released all slaves [ 740.704970][T13412] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 741.769250][T13418] atomic_op ffff88803520d198 conn xmit_atomic 0000000000000000 [ 742.930488][T13434] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1632'. [ 742.953990][T13434] netlink: 336 bytes leftover after parsing attributes in process `syz.2.1632'. [ 743.138415][T13443] netlink: 14 bytes leftover after parsing attributes in process `syz.3.1634'. [ 743.814926][ T5843] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 743.824970][ T5843] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 743.834767][ T5843] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 743.853849][ T5843] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 743.864537][ T5843] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 744.014466][ T43] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 744.062597][T13443] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 744.180983][T13443] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 744.206420][T13443] bond0 (unregistering): (slave batadv0): Releasing backup interface [ 744.281726][ T43] usb 1-1: config 88 has too many interfaces: 172, using maximum allowed: 32 [ 744.398576][ T43] usb 1-1: config 88 has an invalid descriptor of length 163, skipping remainder of the config [ 744.443642][ T43] usb 1-1: config 88 has 0 interfaces, different from the descriptor's value: 172 [ 744.520283][ T43] usb 1-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 744.582241][ T43] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 744.962446][ T43] usb 1-1: string descriptor 0 read error: -71 [ 745.035717][T13443] bond0 (unregistering): Released all slaves [ 745.065730][ T43] usb 1-1: USB disconnect, device number 48 [ 745.101839][ T36] hsr_slave_0: left promiscuous mode [ 745.110835][ T36] hsr_slave_1: left promiscuous mode [ 745.117548][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 745.128676][ T36] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 745.138118][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 745.180638][ T36] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 745.367133][ T36] veth1_macvtap: left promiscuous mode [ 745.382783][ T36] veth0_macvtap: left promiscuous mode [ 745.400861][ T36] veth1_vlan: left promiscuous mode [ 745.417727][ T36] veth0_vlan: left promiscuous mode [ 745.966720][ T5854] Bluetooth: hci3: command tx timeout [ 746.240273][T13475] netlink: 104 bytes leftover after parsing attributes in process `syz.3.1640'. [ 746.762146][ T36] team0 (unregistering): Port device team_slave_1 removed [ 746.863298][ T36] team0 (unregistering): Port device team_slave_0 removed [ 747.170763][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.649099][ T5854] Bluetooth: hci1: unexpected event for opcode 0x0c25 [ 747.743230][ T5970] usb 3-1: new high-speed USB device number 57 using dummy_hcd [ 748.134481][ T5854] Bluetooth: hci3: command tx timeout [ 748.164418][ T5970] usb 3-1: Using ep0 maxpacket: 32 [ 748.171788][ T5970] usb 3-1: unable to get BOS descriptor or descriptor too short [ 748.181261][ T5970] usb 3-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 748.196285][ T5970] usb 3-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 748.205919][ T5970] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 748.214061][ T5970] usb 3-1: Product: syz [ 748.218432][ T5970] usb 3-1: Manufacturer: syz [ 748.223092][ T5970] usb 3-1: SerialNumber: syz [ 748.629029][ T5970] usb 3-1: Cannot retrieve CPort count: 0 [ 748.680944][ T5970] usb 3-1: Cannot retrieve CPort count: -5 [ 748.830750][ T5970] es2_ap_driver 3-1:7.0: probe with driver es2_ap_driver failed with error -5 [ 750.185445][T13514] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1649'. [ 750.197896][ T5854] Bluetooth: hci3: command tx timeout [ 750.232610][ T24] usb 3-1: USB disconnect, device number 57 [ 750.243996][T13517] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1649'. [ 750.718716][T13528] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1650'. [ 750.731313][T13528] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1650'. [ 750.793410][T13531] program syz.1.1652 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 750.862606][T13528] ipvlan2: entered promiscuous mode [ 750.991780][T13455] chnl_net:caif_netlink_parms(): no params data found [ 751.114560][ T24] usb 4-1: new full-speed USB device number 57 using dummy_hcd [ 752.239477][ T24] usb 4-1: unable to get BOS descriptor or descriptor too short [ 752.269577][ T24] usb 4-1: not running at top speed; connect to a high speed hub [ 752.284424][ T5854] Bluetooth: hci3: command tx timeout [ 752.318186][ T24] usb 4-1: config 219 has an invalid interface number: 128 but max is 1 [ 752.328510][ T24] usb 4-1: config 219 has no interface number 1 [ 752.552730][ T24] usb 4-1: config 219 interface 0 has no altsetting 0 [ 752.669678][T13455] bridge0: port 1(bridge_slave_0) entered blocking state [ 752.796475][ T24] usb 4-1: config 219 interface 128 has no altsetting 0 [ 752.804084][T13455] bridge0: port 1(bridge_slave_0) entered disabled state [ 752.830957][ T24] usb 4-1: New USB device found, idVendor=2b73, idProduct=0017, bcdDevice=a2.0e [ 752.834563][T13455] bridge_slave_0: entered allmulticast mode [ 752.867985][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 752.901556][ T24] usb 4-1: Product: syz [ 752.907191][ T24] usb 4-1: Manufacturer: syz [ 752.909092][T13455] bridge_slave_0: entered promiscuous mode [ 753.024276][ T24] usb 4-1: SerialNumber: syz [ 753.065338][T13455] bridge0: port 2(bridge_slave_1) entered blocking state [ 753.072782][T13455] bridge0: port 2(bridge_slave_1) entered disabled state [ 753.084830][T13455] bridge_slave_1: entered allmulticast mode [ 753.093602][T13455] bridge_slave_1: entered promiscuous mode [ 753.792877][ T24] snd-usb-audio 4-1:219.0: probe with driver snd-usb-audio failed with error -22 [ 754.565468][ T24] usb 4-1: USB disconnect, device number 57 [ 754.611614][T13455] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 754.615119][ T43] usb 3-1: new high-speed USB device number 58 using dummy_hcd [ 754.628431][ T9474] udevd[9474]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:219.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 754.686236][T13455] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 754.930148][ T43] usb 3-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 754.975119][ T43] usb 3-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 754.980099][T13455] team0: Port device team_slave_0 added [ 755.007679][ T43] usb 3-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 755.022280][T13455] team0: Port device team_slave_1 added [ 755.049705][ T43] usb 3-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 755.082567][ T43] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 755.130828][T13560] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 755.267582][T13455] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 755.270979][T13582] FAULT_INJECTION: forcing a failure. [ 755.270979][T13582] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 755.278283][T13455] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 755.323657][T13582] CPU: 1 UID: 0 PID: 13582 Comm: syz.1.1661 Not tainted 6.16.0-rc5-syzkaller-00224-g379f604cc3dc #0 PREEMPT(full) [ 755.323702][T13582] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 755.323714][T13582] Call Trace: [ 755.323722][T13582] [ 755.323730][T13582] dump_stack_lvl+0x189/0x250 [ 755.323754][T13582] ? __pfx____ratelimit+0x10/0x10 [ 755.323779][T13582] ? __pfx_dump_stack_lvl+0x10/0x10 [ 755.323799][T13582] ? __pfx__printk+0x10/0x10 [ 755.323835][T13582] should_fail_ex+0x414/0x560 [ 755.323863][T13582] _copy_from_user+0x2d/0xb0 [ 755.323884][T13582] bpf_test_init+0xf8/0x170 [ 755.323909][T13582] bpf_prog_test_run_skb+0x1e9/0x1560 [ 755.323928][T13582] ? __fget_files+0x2a/0x420 [ 755.323947][T13582] ? __fget_files+0x2a/0x420 [ 755.323972][T13582] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 755.323993][T13582] bpf_prog_test_run+0x2c7/0x340 [ 755.324028][T13582] __sys_bpf+0x4a4/0x860 [ 755.324054][T13582] ? __pfx___sys_bpf+0x10/0x10 [ 755.324090][T13582] ? ksys_write+0x22a/0x250 [ 755.324120][T13582] ? __pfx_ksys_write+0x10/0x10 [ 755.324145][T13582] ? rcu_is_watching+0x15/0xb0 [ 755.324172][T13582] __x64_sys_bpf+0x7c/0x90 [ 755.324195][T13582] do_syscall_64+0xfa/0x3b0 [ 755.324211][T13582] ? lockdep_hardirqs_on+0x9c/0x150 [ 755.324234][T13582] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 755.324251][T13582] ? clear_bhb_loop+0x60/0xb0 [ 755.324273][T13582] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 755.324290][T13582] RIP: 0033:0x7fe2e678e929 [ 755.324306][T13582] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 755.324320][T13582] RSP: 002b:00007fe2e768e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 755.324337][T13582] RAX: ffffffffffffffda RBX: 00007fe2e69b5fa0 RCX: 00007fe2e678e929 [ 755.324349][T13582] RDX: 0000000000000048 RSI: 0000200000000080 RDI: 000000000000000a [ 755.324360][T13582] RBP: 00007fe2e768e090 R08: 0000000000000000 R09: 0000000000000000 [ 755.324369][T13582] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 755.324378][T13582] R13: 0000000000000000 R14: 00007fe2e69b5fa0 R15: 00007fffd0bded48 [ 755.324404][T13582] [ 755.548198][T13455] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 755.561447][T13455] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 755.568493][T13455] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 755.594510][T13455] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 755.700304][T13560] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1658'. [ 756.594104][T13455] hsr_slave_0: entered promiscuous mode [ 756.622732][T13455] hsr_slave_1: entered promiscuous mode [ 756.642467][T13455] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 756.665390][T13455] Cannot create hsr debugfs directory [ 757.837656][ T43] aiptek 3-1:17.0: Aiptek using 400 ms programming speed [ 758.226737][ T43] input: Aiptek as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:17.0/input/input22 [ 758.437127][ T43] usb 3-1: USB disconnect, device number 58 [ 758.443125][ C1] aiptek 3-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 758.535086][ T5854] Bluetooth: hci4: unexpected event for opcode 0x0c25 [ 758.626971][T13620] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1669'. [ 759.184823][ T5958] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 759.454736][ T5958] usb 4-1: New USB device found, idVendor=055f, idProduct=c230, bcdDevice=b6.ac [ 759.495372][ T5958] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 759.503422][ T5958] usb 4-1: Product: syz [ 759.574607][ T5958] usb 4-1: Manufacturer: syz [ 759.579246][ T5958] usb 4-1: SerialNumber: syz [ 759.635690][ T5958] usb 4-1: config 0 descriptor?? [ 759.676623][ T5958] gspca_main: sunplus-2.14.0 probing 055f:c230 [ 759.791847][T13635] netlink: 'syz.1.1673': attribute type 10 has an invalid length. [ 760.819625][T13625] tipc: Started in network mode [ 760.825849][T13625] tipc: Node identity ff010000000000000000000000000001, cluster identity 4711 [ 760.835061][T13625] tipc: Enabling of bearer rejected, failed to enable media [ 761.058878][ T5958] gspca_sunplus: reg_r err -71 [ 761.063727][ T5958] sunplus 4-1:0.0: probe with driver sunplus failed with error -71 [ 761.189792][ T5958] usb 4-1: USB disconnect, device number 58 [ 761.907879][ T5906] usb 3-1: new high-speed USB device number 59 using dummy_hcd [ 762.084792][ T5906] usb 3-1: Using ep0 maxpacket: 32 [ 762.097826][ T5906] usb 3-1: config 0 has an invalid interface number: 35 but max is 0 [ 762.138442][ T5906] usb 3-1: config 0 has no interface number 0 [ 762.220521][ T5906] usb 3-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.8f [ 762.232093][ T5906] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 762.342152][ T5906] usb 3-1: Product: syz [ 762.346656][ T5906] usb 3-1: Manufacturer: syz [ 762.352264][ T5906] usb 3-1: SerialNumber: syz [ 762.360474][ T5906] usb 3-1: config 0 descriptor?? [ 762.390165][ T5906] radio-si470x 3-1:0.35: could not find interrupt in endpoint [ 763.243531][ T5906] radio-si470x 3-1:0.35: probe with driver radio-si470x failed with error -5 [ 763.325992][ T5906] radio-raremono 3-1:0.35: this is not Thanko's Raremono. [ 763.333408][ T5906] usbhid 3-1:0.35: couldn't find an input interrupt endpoint [ 763.648810][ T5906] usb 3-1: USB disconnect, device number 59 [ 764.482874][T13677] FAULT_INJECTION: forcing a failure. [ 764.482874][T13677] name failslab, interval 1, probability 0, space 0, times 0 [ 764.495887][T13677] CPU: 1 UID: 0 PID: 13677 Comm: syz.1.1682 Not tainted 6.16.0-rc5-syzkaller-00224-g379f604cc3dc #0 PREEMPT(full) [ 764.495913][T13677] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 764.495924][T13677] Call Trace: [ 764.495933][T13677] [ 764.495941][T13677] dump_stack_lvl+0x189/0x250 [ 764.495966][T13677] ? __pfx____ratelimit+0x10/0x10 [ 764.495991][T13677] ? __pfx_dump_stack_lvl+0x10/0x10 [ 764.496011][T13677] ? __pfx__printk+0x10/0x10 [ 764.496035][T13677] ? __pfx___might_resched+0x10/0x10 [ 764.496055][T13677] ? fs_reclaim_acquire+0x7d/0x100 [ 764.496076][T13677] should_fail_ex+0x414/0x560 [ 764.496105][T13677] should_failslab+0xa8/0x100 [ 764.496132][T13677] __kmalloc_noprof+0xcb/0x4f0 [ 764.496153][T13677] ? tomoyo_encode+0x28b/0x550 [ 764.496177][T13677] tomoyo_encode+0x28b/0x550 [ 764.496201][T13677] tomoyo_realpath_from_path+0x58d/0x5d0 [ 764.496232][T13677] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 764.496255][T13677] tomoyo_path_number_perm+0x1e8/0x5a0 [ 764.496281][T13677] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 764.496324][T13677] ? __lock_acquire+0xab9/0xd20 [ 764.496364][T13677] ? __fget_files+0x2a/0x420 [ 764.496384][T13677] ? __fget_files+0x2a/0x420 [ 764.496400][T13677] ? __fget_files+0x3a0/0x420 [ 764.496415][T13677] ? __fget_files+0x2a/0x420 [ 764.496437][T13677] security_file_ioctl+0xcb/0x2d0 [ 764.496464][T13677] __se_sys_ioctl+0x47/0x170 [ 764.496488][T13677] do_syscall_64+0xfa/0x3b0 [ 764.496504][T13677] ? lockdep_hardirqs_on+0x9c/0x150 [ 764.496527][T13677] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 764.496544][T13677] ? clear_bhb_loop+0x60/0xb0 [ 764.496565][T13677] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 764.496582][T13677] RIP: 0033:0x7fe2e678e929 [ 764.496599][T13677] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 764.496614][T13677] RSP: 002b:00007fe2e768e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 764.496634][T13677] RAX: ffffffffffffffda RBX: 00007fe2e69b5fa0 RCX: 00007fe2e678e929 [ 764.496647][T13677] RDX: 0000200000000380 RSI: 00000000c0306201 RDI: 0000000000000008 [ 764.496659][T13677] RBP: 00007fe2e768e090 R08: 0000000000000000 R09: 0000000000000000 [ 764.496670][T13677] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 764.496681][T13677] R13: 0000000000000000 R14: 00007fe2e69b5fa0 R15: 00007fffd0bded48 [ 764.496711][T13677] [ 764.496740][T13677] ERROR: Out of memory at tomoyo_realpath_from_path. [ 764.711689][T13455] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 764.799932][T13455] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 764.815706][T13455] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 764.901467][T13690] netlink: 'syz.3.1685': attribute type 5 has an invalid length. [ 764.966309][T13455] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 765.559788][T13455] 8021q: adding VLAN 0 to HW filter on device bond0 [ 765.604825][ T5906] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 765.606918][T13455] 8021q: adding VLAN 0 to HW filter on device team0 [ 765.633900][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 765.641104][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 765.658506][ T154] bridge0: port 2(bridge_slave_1) entered blocking state [ 765.665627][ T154] bridge0: port 2(bridge_slave_1) entered forwarding state [ 765.757271][ T5958] usb 3-1: new high-speed USB device number 60 using dummy_hcd [ 765.765110][ T5906] usb 2-1: Using ep0 maxpacket: 8 [ 765.772970][ T5906] usb 2-1: config 0 has an invalid interface number: 55 but max is 0 [ 765.790092][ T5906] usb 2-1: config 0 has no interface number 0 [ 765.808898][ T5906] usb 2-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 765.838294][ T5906] usb 2-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 765.850685][ T5906] usb 2-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 765.868279][ T5906] usb 2-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 765.882257][ T5906] usb 2-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 765.896284][ T5906] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 765.926987][ T5958] usb 3-1: Using ep0 maxpacket: 8 [ 765.942944][ T5958] usb 3-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 765.969601][ T5906] usb 2-1: config 0 descriptor?? [ 766.000790][ T5958] usb 3-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 766.022220][ T5906] ldusb 2-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 766.032775][ T5958] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 766.057331][ T5958] usb 3-1: Product: syz [ 766.068842][ T5958] usb 3-1: Manufacturer: syz [ 766.079185][ T5958] usb 3-1: SerialNumber: syz [ 766.099025][ T5958] usb 3-1: config 0 descriptor?? [ 766.123957][ T5958] streamzap 3-1:0.0: streamzap_probe: Unexpected desc.bNumEndpoints (0) [ 766.226277][T13455] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 766.341068][ T5958] usb 2-1: USB disconnect, device number 41 [ 766.347126][ C1] ldusb 2-1:0.55: usb_submit_urb failed (-19) [ 766.359580][T13695] ldusb 2-1:0.55: Couldn't submit interrupt_out_urb -19 [ 766.381114][T13703] netlink: 144 bytes leftover after parsing attributes in process `syz.2.1687'. [ 766.805709][ T5958] ldusb 2-1:0.55: LD USB Device #0 now disconnected [ 766.943243][ T5970] usb 3-1: USB disconnect, device number 60 [ 767.366769][T13455] veth0_vlan: entered promiscuous mode [ 767.400241][T13455] veth1_vlan: entered promiscuous mode [ 767.485276][T13455] veth0_macvtap: entered promiscuous mode [ 767.520916][T13455] veth1_macvtap: entered promiscuous mode [ 767.597851][T13455] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 767.661423][T13455] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 767.740128][T13455] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 768.142417][T13455] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 768.159565][T13455] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 768.309152][T13455] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 768.354741][ T5970] usb 1-1: new full-speed USB device number 49 using dummy_hcd [ 769.187269][ T5970] usb 1-1: unable to get BOS descriptor or descriptor too short [ 769.190120][ T1163] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 769.218300][ T5970] usb 1-1: not running at top speed; connect to a high speed hub [ 769.235594][ T5970] usb 1-1: config 219 has an invalid interface number: 128 but max is 1 [ 769.243966][ T5970] usb 1-1: config 219 has no interface number 1 [ 769.281359][ T5970] usb 1-1: config 219 interface 0 has no altsetting 0 [ 769.287093][ T1163] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 769.305176][ T5970] usb 1-1: config 219 interface 128 has no altsetting 0 [ 769.333802][T13760] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -12 [ 769.343207][T13760] platform regulatory.0: Direct firmware load for regulatory.db failed with error -12 [ 769.352819][T13760] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 769.370544][ T5970] usb 1-1: New USB device found, idVendor=2b73, idProduct=0017, bcdDevice=a2.0e [ 769.482965][ T5970] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 769.519312][ T5970] usb 1-1: Product: syz [ 769.655672][ T5970] usb 1-1: Manufacturer: syz [ 769.749727][ T5970] usb 1-1: SerialNumber: syz [ 769.927232][ T1163] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 769.954566][ T1163] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 770.326902][ T5936] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 770.572790][T13775] netlink: 104 bytes leftover after parsing attributes in process `syz.1.1695'. [ 770.623296][ T5970] snd-usb-audio 1-1:219.0: probe with driver snd-usb-audio failed with error -22 [ 770.676446][ T5970] usb 1-1: USB disconnect, device number 49 [ 770.702547][ T9474] udevd[9474]: setting mode of /dev/bus/usb/001/049 to 020664 failed: No such file or directory [ 770.714531][ T5936] usb 4-1: Using ep0 maxpacket: 32 [ 770.725318][ T5936] usb 4-1: config 0 has an invalid interface number: 35 but max is 0 [ 770.744193][ T5936] usb 4-1: config 0 has no interface number 0 [ 770.759174][ T5936] usb 4-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.8f [ 770.778565][ T9474] udevd[9474]: setting owner of /dev/bus/usb/001/049 to uid=0, gid=0 failed: No such file or directory [ 770.817629][ T9474] udevd[9474]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:219.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 771.088629][ T5936] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 771.185509][ T5936] usb 4-1: Product: syz [ 771.330222][ T5936] usb 4-1: Manufacturer: syz [ 771.336280][ T5936] usb 4-1: SerialNumber: syz [ 771.346659][ T5936] usb 4-1: config 0 descriptor?? [ 771.354960][ T43] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 771.371563][ T5936] radio-si470x 4-1:0.35: could not find interrupt in endpoint [ 771.380198][ T5936] radio-si470x 4-1:0.35: probe with driver radio-si470x failed with error -5 [ 771.555352][ T43] usb 2-1: Using ep0 maxpacket: 16 [ 771.598305][ T43] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 771.629904][ T43] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 772.184391][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 772.192419][ T43] usb 2-1: Product: syz [ 772.209902][ T43] usb 2-1: Manufacturer: syz [ 772.215682][ T43] usb 2-1: SerialNumber: syz [ 772.223353][ T43] usb 2-1: config 0 descriptor?? [ 772.433570][ T5936] radio-raremono 4-1:0.35: this is not Thanko's Raremono. [ 772.459729][ T5936] usbhid 4-1:0.35: couldn't find an input interrupt endpoint [ 772.463031][ T43] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 773.154627][ T43] em28xx 2-1:0.0: DVB interface 0 found: bulk [ 773.202654][ T975] usb 4-1: USB disconnect, device number 59 [ 773.247475][ T61] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 773.480706][ T61] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 773.593308][ T43] em28xx 2-1:0.0: unknown em28xx chip ID (0) [ 773.624532][ T5936] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 773.697175][ T61] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 773.831713][ T61] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 773.872996][ T5936] usb 1-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 773.903045][ T5936] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 773.935580][ T5936] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 773.952336][ T5936] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 773.974187][ T5936] usb 1-1: SerialNumber: syz [ 774.058845][ T43] em28xx 2-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 774.077451][ T43] em28xx 2-1:0.0: board has no eeprom [ 774.172952][ T61] bridge_slave_1: left allmulticast mode [ 774.181048][ T61] bridge_slave_1: left promiscuous mode [ 774.187337][ T61] bridge0: port 2(bridge_slave_1) entered disabled state [ 774.198603][T13793] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 774.209427][T13793] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 774.222961][ T61] bridge_slave_0: left allmulticast mode [ 774.225519][ T5936] usb 1-1: 0:2 : does not exist [ 774.240596][ T61] bridge_slave_0: left promiscuous mode [ 774.248783][ T61] bridge0: port 1(bridge_slave_0) entered disabled state [ 774.259295][ T5936] usb 1-1: unit 6 not found! [ 774.319679][ T5936] usb 1-1: USB disconnect, device number 50 [ 774.354873][ T43] em28xx 2-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 774.362759][ T43] em28xx 2-1:0.0: dvb set to bulk mode. [ 774.379455][ T24] em28xx 2-1:0.0: Binding DVB extension [ 774.408969][ T9474] udevd[9474]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 774.445555][ T43] usb 2-1: USB disconnect, device number 42 [ 774.452844][ T43] em28xx 2-1:0.0: Disconnecting em28xx [ 774.501323][ T24] em28xx 2-1:0.0: Registering input extension [ 774.529002][ T43] em28xx 2-1:0.0: Closing input extension [ 774.563104][ T43] em28xx 2-1:0.0: Freeing device [ 775.106316][ T61] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 775.869030][ T61] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 775.913840][ T61] bond0 (unregistering): Released all slaves [ 776.705934][ T5936] usb 4-1: new full-speed USB device number 60 using dummy_hcd [ 776.879326][T13843] netlink: 104 bytes leftover after parsing attributes in process `syz.2.1707'. [ 777.126572][T13839] comedi comedi3: pcl818: I/O port conflict (0x2f00,16) [ 777.137468][T13839] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN PTI [ 777.149385][T13839] KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] [ 777.157805][T13839] CPU: 0 UID: 0 PID: 13839 Comm: syz.1.1706 Not tainted 6.16.0-rc5-syzkaller-00224-g379f604cc3dc #0 PREEMPT(full) [ 777.169851][T13839] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 777.179906][T13839] RIP: 0010:pcl818_ai_cancel+0x69/0x3f0 [ 777.185440][T13839] Code: 8b 1b 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 a9 c4 47 f9 48 8b 03 48 89 04 24 49 83 c4 28 4c 89 e0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 e7 e8 88 c4 47 f9 4d 8b 24 24 48 83 c3 [ 777.205119][T13839] RSP: 0018:ffffc9000b7ef9f0 EFLAGS: 00010206 [ 777.211173][T13839] RAX: 0000000000000005 RBX: ffff888054ddc200 RCX: 0000000000080000 [ 777.219128][T13839] RDX: ffffc9000d8ed000 RSI: 0000000000002dc2 RDI: 0000000000002dc3 [ 777.227087][T13839] RBP: 0000000000000001 R08: ffff88803028992f R09: 1ffff11006051325 [ 777.235041][T13839] R10: dffffc0000000000 R11: ffffffff88d9a300 R12: 0000000000000028 [ 777.242991][T13839] R13: dffffc0000000000 R14: ffff888030289800 R15: dffffc0000000000 [ 777.250943][T13839] FS: 00007fe2e766d6c0(0000) GS:ffff888125c4f000(0000) knlGS:0000000000000000 [ 777.259852][T13839] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 777.266415][T13839] CR2: 00007fe2e762af98 CR3: 0000000028e6e000 CR4: 00000000003526f0 [ 777.274379][T13839] Call Trace: [ 777.277651][T13839] [ 777.280567][T13839] pcl818_detach+0x66/0xd0 [ 777.284968][T13839] comedi_device_detach+0x137/0x720 [ 777.290154][T13839] ? __pfx_pcl818_attach+0x10/0x10 [ 777.295245][T13839] comedi_device_attach+0x568/0x670 [ 777.300424][T13839] comedi_unlocked_ioctl+0x686/0xf40 [ 777.305696][T13839] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 777.311486][T13839] ? __pfx_smack_log+0x10/0x10 [ 777.316230][T13839] ? smk_access+0x14c/0x4e0 [ 777.320745][T13839] ? smk_tskacc+0x2fc/0x370 [ 777.325236][T13839] ? smack_file_ioctl+0x24a/0x340 [ 777.330244][T13839] ? __pfx_smack_file_ioctl+0x10/0x10 [ 777.335601][T13839] ? __fget_files+0x2a/0x420 [ 777.340171][T13839] ? __fget_files+0x3a0/0x420 [ 777.344824][T13839] ? __fget_files+0x2a/0x420 [ 777.349485][T13839] ? bpf_lsm_file_ioctl+0x9/0x20 [ 777.354407][T13839] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 777.360193][T13839] __se_sys_ioctl+0xf9/0x170 [ 777.364771][T13839] do_syscall_64+0xfa/0x3b0 [ 777.369258][T13839] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 777.375301][T13839] ? asm_sysvec_call_function_single+0x1a/0x20 [ 777.381435][T13839] ? clear_bhb_loop+0x60/0xb0 [ 777.386091][T13839] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 777.391962][T13839] RIP: 0033:0x7fe2e678e929 [ 777.396367][T13839] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 777.415966][T13839] RSP: 002b:00007fe2e766d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 777.424373][T13839] RAX: ffffffffffffffda RBX: 00007fe2e69b6080 RCX: 00007fe2e678e929 [ 777.432338][T13839] RDX: 0000200000000080 RSI: 0000000040946400 RDI: 0000000000000009 [ 777.440292][T13839] RBP: 00007fe2e6810b39 R08: 0000000000000000 R09: 0000000000000000 [ 777.448245][T13839] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 777.456207][T13839] R13: 0000000000000000 R14: 00007fe2e69b6080 R15: 00007fffd0bded48 [ 777.464171][T13839] [ 777.467181][T13839] Modules linked in: [ 777.473078][T13839] ---[ end trace 0000000000000000 ]--- [ 777.478704][T13839] RIP: 0010:pcl818_ai_cancel+0x69/0x3f0 [ 777.484352][T13839] Code: 8b 1b 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 a9 c4 47 f9 48 8b 03 48 89 04 24 49 83 c4 28 4c 89 e0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 e7 e8 88 c4 47 f9 4d 8b 24 24 48 83 c3 [ 777.504154][T13839] RSP: 0018:ffffc9000b7ef9f0 EFLAGS: 00010206 [ 777.510395][T13839] RAX: 0000000000000005 RBX: ffff888054ddc200 RCX: 0000000000080000 [ 777.518529][T13839] RDX: ffffc9000d8ed000 RSI: 0000000000002dc2 RDI: 0000000000002dc3 [ 777.526669][T13839] RBP: 0000000000000001 R08: ffff88803028992f R09: 1ffff11006051325 [ 777.534796][T13839] R10: dffffc0000000000 R11: ffffffff88d9a300 R12: 0000000000000028 [ 777.542819][T13839] R13: dffffc0000000000 R14: ffff888030289800 R15: dffffc0000000000 [ 777.550955][T13839] FS: 00007fe2e766d6c0(0000) GS:ffff888125c4f000(0000) knlGS:0000000000000000 [ 777.560109][T13839] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 777.566836][T13839] CR2: 00007fe2e762af98 CR3: 0000000028e6e000 CR4: 00000000003526f0 [ 777.574925][T13839] Kernel panic - not syncing: Fatal exception [ 777.581231][T13839] Kernel Offset: disabled [ 777.585542][T13839] Rebooting in 86400 seconds..