last executing test programs: 4m52.136434368s ago: executing program 32 (id=200): r0 = socket$kcm(0xa, 0x2, 0x11) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) setsockopt$sock_attach_bpf(r0, 0x1, 0x3d, &(0x7f00000002c0), 0x8) 4m51.151752794s ago: executing program 33 (id=215): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000380)={0x1, 0x0, [{0x1000, 0x5, &(0x7f0000000040)=""/5}]}) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0xa) readv(r0, 0x0, 0x0) 3m13.090823309s ago: executing program 3 (id=1615): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=@updpolicy={0xb8, 0x19, 0xfd3649826d894c67, 0x0, 0x0, {{@in6=@private0={0xfc, 0x0, '\x00', 0x2}, @in=@multicast2, 0x0, 0x0, 0x4e24, 0x0, 0xa, 0x80}, {0x1, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0xfffffffffffffffc}, {}, 0x400, 0x80000000, 0x0, 0x1, 0x3}}, 0xb8}}, 0x4c050) 3m13.050804449s ago: executing program 3 (id=1616): r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) pread64(r0, &(0x7f0000000180)=""/79, 0xfffffe69, 0x1) close(r0) 3m12.976630079s ago: executing program 3 (id=1619): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000540)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="8a", 0x440) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x18, 0x0, 0x400, 0x70bd2c, 0x25dfdbfb, {}, [@TIPC_NLA_MEDIA={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000800}, 0x4000) 3m12.887089368s ago: executing program 3 (id=1621): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) pivot_root(&(0x7f0000000500)='./file0/../file0/../file0/../file0\x00', &(0x7f0000000100)='./file0\x00') 3m12.886920489s ago: executing program 3 (id=1622): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x3, 0x0, 0x7997}]}) r1 = socket$packet(0x11, 0x2, 0x300) r2 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r2, &(0x7f00000002c0)={0x1, 0x5}, 0x2) write$USERIO_CMD_REGISTER(r2, &(0x7f00000000c0), 0x2) close_range(r0, r1, 0x0) 3m12.279009086s ago: executing program 3 (id=1630): prlimit64(0x0, 0x0, &(0x7f0000000000)={0x0, 0x3}, 0x0) r0 = socket(0x10, 0x3, 0x0) setitimer(0x1, &(0x7f00000001c0)={{}, {0x0, 0x2710}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001200010a0018000000000000"], 0x14}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) 3m12.114827965s ago: executing program 34 (id=1630): prlimit64(0x0, 0x0, &(0x7f0000000000)={0x0, 0x3}, 0x0) r0 = socket(0x10, 0x3, 0x0) setitimer(0x1, &(0x7f00000001c0)={{}, {0x0, 0x2710}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001200010a0018000000000000"], 0x14}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) 2m4.704240187s ago: executing program 5 (id=2267): socket$kcm(0x10, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$netlink(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x10, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x8, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x3, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, &(0x7f0000000340)=[{0x0, 0x1, 0xa, 0xb}, {0x5, 0x2, 0x13, 0x2}, {0x5, 0x5, 0x5, 0x9}], 0x10, 0x37, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0xfffffffffffffc33, &(0x7f0000000280)=0x2) semget$private(0x0, 0x207, 0x480) keyctl$dh_compute(0x17, &(0x7f0000000200), &(0x7f0000000040)=""/217, 0xd9, &(0x7f00000001c0)={&(0x7f0000000140)={'sha384-avx\x00'}}) socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e000a0010000000028000001294", 0x2e}, {&(0x7f0000000640)="9abe48978fc9d6d504d0c9f79768e69abc0d908c4b7714017340a5321e2091ace2f33de355e62b927a1ab681a738f2e4e6d33ce721479d3f68ea12ef5aeb17d903d95cddeb4e2754b78802e05f584c7ab407fc85efe9ab6d650e5eccd789e1e414ab7501f7fb6fd6404b0afab9d4c2078d1030121824daf273d8c33dae1bc50bf1d39fb4f04a10d235dd987de873824c5f97fc33c2e3fde23491dd6d53930ce1c914bc1cc17642dffa0933942972a97ea96b886ad243f6d5378f5d70d8379f5a316ec6c623a6a08674f92554652a32193775938997cb6b24d8355b79860057ea077f62b64ffbd9a886bf7ec98453e6a4792ea0882f8c1e1be8a4b699f4560545c55002fc6f2039736619ffb2c30f946ad7ca29bb4dc823c771b85d812e3f1bee51b20cd8e365a88fda649df477f1f3a1a7c60d0a4c875973658fe25ecb5d45e95dc7cb07f79b0dc0a78bff47ad5ccd5ab5dfc8ba2a8a48572c840fbc134628f698ac267d0eb5d52d37b1927ea10a15efbe12a926e22be39c4c6431b528fca59208b192939f1a4167d613d1fef58e30363112dcef611692353615a2bda0af0bdd5884045f748771b7c8ea5d82d31d048832995615bf68b51370d41a7e4db8cb3970066b6f9e9a55a7c8e41bff4a436ad7b0631250af307a0af8d0d72d7394421f4de5ac2918583f07d92c32d17098f20834ac2ba6bb39d504af6fe664be4e436ba30c885680d58a4ae70c680d553e15ac6c3d1f6b7a6ef99358c948a6c1b1db07c40d2a0b5c7b3c420ee63ee66117175b12ff259783f4cfa8bf5110b96e8417180cd8a413c23659033f8f1857e00df8de16041101a8166411c893af3f00b0596718fe76578301604d27f67ba625fae0e404293872f523b7496ddde4b09f33b7f7e3fcf6fe0d0ebe5eb603e5d8ed1ae18c654498b3db3c59aa51e8022ce90d6834108df0c73e886b49be39f60116ec2ac0e5540af3491ff4d6c526b6350bb5021933a79b4e102f3ff65f7bced45210bf5849a0188493798dc87f8b22ca1b104f5caa5018029bbf03afe7904dbfa0f5e1a2b74a196e0d153b7498b69986657c79bb1df1c9ed1dfe19d00de2040fd668ccedd62c775a9976aac1d9447d4045f499461a320443111bf56d8d7e1dadd1f4ca137c5796c2d7c8a015786a5fc5e7b9021eda74b575925d9d55683e1a940c55299046ac60d49fe05141a7f5280cade653bd2f19018121e18aca2ac846734e941b313242b9c41fa7c8d2058577aae640e8319710021cd89eb291ae0ad15ba292d45ebef0074386668123ed9961b13633043f54314c8f4fe8fc0036512fb088b6671e13d8481b5286e098cdcdf509473ee3c36c0cd218a81f4c2b8758a5573f21a5c12cdcce7e79f4cc8b5a9030f7d0f8a2c809db34b89ed5e063db518a18584c46806f863f7a192df439c5894eed6facd33927bbaa8df57ecd045ef6386ca46a05ab5573068955d21289a4286152c8a2a13df3429b16f4ee1d73a6f544c784b0cc49aa2c83b3738c25ee3d64ac9142131318f82981ae1a17d07941aa3bd05dd9c136cb061a71ae67614dc44ea2d9e350c0cd9dce03e0aa292b384e0f037e4bc392bffb4e847cf01b74e394736f08242a9ce03e5c4e163f5cead6b8446bd9c1fe9bfb31bca88511a74671e2bec33fe0b9aae1376303c979df69c0b305f042bf2e111b446533f4a6b3fac594e5903061e21e7f1c8a30cc1cb3d3078e48741a032723e7eda57fc83c6068ba086b08448af61988bd22dbdb8c3752828f40691e12b284080da18f0ff5f87f324cde7d7325c181560e5f4e7e028476b372bb8b64da996db88e31aef3acea54932b152b4422a6833853f0c217b895c8710473fcb36288faeadd0bc72f8f81b79cffc9c05fd8d30c769ac22f1e72773b0c7e8b234d8624b6cb6311978ec4568b692fda31a04cd795de2794f3376fc7376e30c85d7942b03d97f915289c5754eb057dcb504872e409acf1ff929698e5890161b12140fdef3d1838d41e25dfe0716241170a5392c31d766fe6313ae2aefdaeaffd53d0940949f18d9737a2aacb2111b6dc129e2812eb403446e655d5317e258eda59dfc57d1351c2d64e5074e485d98c06f35b5aec59baf8efc15866eef217c5dac6aad75f55d779c56662420d5b401bf0f19f5217f2d9395931def8f1f8b5847c8f052a8cdf942f567ba004e21c448067c5d2a3bd5cdac560495712f916dcebd06d6b65c767af15216e3c0b84212202356accac045004c612c4660470e593ed89e219ac1f547cfdda3c484b67b00096cd7993fa5a5ddd860d9e8d0c915aea5f6847d50a5283ea522e1d490a8151dc96911a261be4ed30da952b1d8b74c891fac193d5f83f2eb3d974b20523bdd3c7660e42635410073642b983393caf59b20d7ce8682c54fae87d8a57dfa243fcc2fd52d7372155d7e7bf9078e1ccd5046f21b95a5d61bbd1e78fb9c3d6704a141298fde37d09615d51ad10ec8eac5ebb3d1df8e0b559f6e88a77a074d2ffad60d4d58819a76482408c3a7c8edf41abce0f450c33b1cd6432363e6c4ed892f2b78d9b14acf0e8490cfb1f60229753d8eaab8df582c9fac7a54980442985b87bb41e47f415f8617e5025d2f1fdfa745e07b0626b547c7f310d5da65522b95e84a231716afc07da2d7562dc4b583fcdc21a22bc2132532c6713ec0e35004b78612585ff8bac697c8e8ad6da1545d6dfd2f3564f92457dae15cfcb3ca1c4ba9f4210c75bba216ca805b6c8760892257d5ec95252895bc9870adb6b47da48478fc718898c3e1d353fc233227d71c2c7a7dab22c8a5acb19e75eecd1fce82dcf36b7da813b7102cd426a67c3e721505bbcfa4c76c4b93ee06c477a9526cc36cb6e1ec0fc55284c7379766d5771a8db5781fd5b10d22959aeb1ae73ce24721f39aa62bc84ec58ab5cc3b9a5677c25c2240911184667f4f3726efb9aced16eb0967bd9b177b18050dcb554829d38419c8f74aa9279f90e9fec58b755c9ea38533f07d09e23a1540ba794710a46b7d7341aab573a26ad01702794b9c2a5b957ec5d22ea079b8a81f4d6108941d84c588c13458e3d10556df61231e43ea0f84851515b00f4f68cb95ff182fe1a95dd0007c92a84d5fe503dd3cd8bfd81b3a2b351de8d2d5f6020cb1d5523e5e76278e66755d9e9b278f1d4142887c3ac85509abbcc49f8b649bda581e6fdd58fc7662705b843fe49d543cf46fb0c701e41379927731890c1b284071d92f1747dbc4fa906727bc8d0ce783d9079c7735eebe2c9887d9b7ebf5862a9607a038895325f9c54ec0faed2dd3d46b50c1795a1342140fc326e1e24b0434b72fdd3cc4d48dfbefd5df53716cf709235a9d39ddff93ead149c3cd57f680212b5036e99439046791795ead6dfe330d405d90bc6a849b305b0c60d62e4d53b5af25870a0b5e105dcee40360d9594900c4aef9db5d2c11d76de448ff9ad85046a655890820a1092f643c5af63b05762e036df228f5cc0ea00b9664dcdb647684d45aefa01605dfffbf31ea1a7501b82521f49bd36d1f5977932e0b6fe6eb2039e3d91b6129a879b96719a9f3c4e05dc02222ffccca0cb682be2a4fb54c5a590653cef00c2399449cabfa4d2e2e3143ce0d0a49dcddfc59697f0953a93515d0c9672d03bfa96db5ca4902f584eaa4ab32ec348d9f059921b8d6c8ba3e9300e4f4014f8777f588856729bb82dbb95e96a812bde444d62731415896c7cb6336cf8bc05ae1f40f550a21905969a98e551925bc167b1e267670266b3c2f8a75acb3cdb30c993b02e246e7629bad825a84cca2fcc60540a6f8750b6736a19e8854715e0e900431f530b03ba0552ef2272a693a357bd0fe64bf549e5354b954d8651ab6d87cb512dd613981e1a65bd87f36448d974d967bda619b5ec581508a842db9c77292fd2fe0f1e4d248c786ef40fc41ffab06f75f4b293cfece7cd9a9433dabf3cf4a42e16617ecc70f40d28d15316e26433c7ed8276db489ba94cd2314203e05936f48a842f57acfeecc97fec0c433121bef994e780e6761771d9280e9868f03415c11d68b7c0ba2046b089ecbf73de963b206895c090227ee6b348ee6d1af087141c52c109b11c1a8805344c84aca98835cc227e2bd8192a97a11559f048fbf3d6c5ef4714c7045652c271ca859812f1e8485e34e550646aa898d8fcd6ec973c2ca02da1524f454d1468a130b7f6da4a8abc9e221991b9185742276e8a75b949a7c6565276926f617b20217531b626b1479392f9768a1848e528c7a25d2fbe3a32e47a1d9eabf5a32c8e239e3cd3e8e666c6e5a5c02c942b691b721b79142f855240f18005458913b297304beb95bbf61c17348ad74c7f86d642dadf18bc6328122ec84de076d73bb94af4224cc556ffa3f32b5c7ac7d0dedea3c8ee9f0fe16fb2740b2e6e1b7de8b210167614756b1264118dbe3420eb9cc541054f914fd91a853be3a12a0a5be123b8962b02aafac12cb1e931879f480cb0c29885aa91421c5971c7b85a887ca95aefefbfa3a476be3bafb549d92f5471e1f6aca1d9d4d826ea5fc7b7bc3cc20023d6536ee5406ec21b71ed8f146765cfba901ed59cafb2dff9aafd9373bbabbfaff1da0dbf1dd07ab058a8beba78f9222373c87b416d92567ada44c01de4004202bd4d70ee285e8b9b86efeaa5ef62680e4676a8e651b3d1e6aae639b1c4e79a7e583de5c10db7864261273d754e2abf5e47e4b79c970243c16d440a9e6f6b99eb94c9ce436195d7017aeb6f6695622f51c2f237fee93c7f2f76f13a7bc8eb5d574c97d7b2be0a91de2869bec13e0765b54ca44951d4b15fb79228ef3d0090e0aaee13586674b40ce272be597d72a5042ef5ead82fe20331b5b6361889339e35d62fafa4c9dbb20016ed58479fd0a0ee8382fe872894d98b7f59186d0994509a216be36b15b76a134752f58748debaa9b36bc4c188d5c782df6d32f6403082edd4eedda2814638e8ac1b28286b8ce54360c44acb55bb10a73fa09fbd86bfcf4ce4943e4d14535f7a9fd80e2911824fa9dadbba245d85658a2bc827423aea", 0xe00}, {&(0x7f00000000c0)="26fc4bcf8b00c19cd0eed8a91f7c36de44eed2752c4d27ee2e10986d2b", 0x1d}, {&(0x7f0000000280)="507a820941f6d234a757b2de2fe516eb6857f51051e27bb99b33442507ee3dd395c93381abb5e6b9ff76eea128b6f395f74b64bc081efc463b192c1838538c8719738008a47502b4207297de026ed4ea30bef60af76f2b26e1a2768a7226f918253314511129725d1bdaaf35826dc04373837263fdf17c4b2639c8819e6d203132318162b1501b0ff936", 0x8a}, {&(0x7f0000000200)="57247d533633c256b37c6a4aedc53a12d585f860d01b94c14c8d", 0x1a}, {&(0x7f0000003280)="be1ac182fe08000000000000004b3a9a9b791e900ba3d654bb44d4402987f407bdbcefe93f535279d99bb839a1a305184c608120acd7bb9f4f977c892d823c8ac59dd719390cb1bdf32e1dd3c4fac36da5428bbfb1c9d7cb7dbd54bacfce8d5a1b665688b6da22d8b30a1549e378bf9529f1f29a985b763fe1de2d576df774f57052ff12c8d38875e24c4e11d389812557389ab2c608bb45b7d023557c1f025cf78b3430f49af446052cca3779db2f01922d", 0xb2}, {&(0x7f00000004c0)="91f0807b6afddf80750c5a560c2081f08de8a721aa5e3cfd5a6bc6cabda994bf8693656d03e1ecd9d468f2d4bb42292991d19fba6097597c9e6f16fdcb2b551f2bfeaaf98a60bc01df68984cf336e2d257b29840e3adfa847b5f420ea7b5e4d1545ae88f63dfbb3ecdfa6633997cbaaa79e2ada80941ed932cbd7a0b11325041f526151f6be00828495864ad9f61c009821728b246b5957891caf322b4a8c97874073ecf48e0cde8e05ba00619d7d90907550d123307265ef06a5ba4a640b82641a834e2684781e4b3e0a93e8d25795a7949e0864c40b8396a01a59b509e34ef484c938c3a677a072a4fba", 0xeb}, {0x0}], 0x8}, 0x0) openat$btrfs_control(0xffffff9c, &(0x7f0000000380), 0x2001, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x3, &(0x7f0000000040)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) setsockopt$pppl2tp_PPPOL2TP_SO_SENDSEQ(r0, 0x111, 0x3, 0x1, 0x4) read$FUSE(0xffffffffffffffff, &(0x7f0000001240)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) syz_open_procfs(r4, &(0x7f0000000040)='timers\x00') 2m3.636026523s ago: executing program 2 (id=2270): syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) add_key$user(0x0, &(0x7f0000000300)={'syz', 0x2}, 0x0, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x9) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ab4000000060a01040000000000000000020000280900010073797a30000000000900020073797a320000000088000480100001800c000100636f756e7465720014000180090001006d6173710000000004000280600001800a0001006c696d6974000000500002800c000140000000000000000808000440000000010c00014000000000000080010c00024000000000000000090800034000000fba0c00024000000000000000000c000140000000000000000714000000110001"], 0xdc}}, 0x0) sendmsg$NFT_MSG_GETRULE(r2, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r1, &(0x7f0000002840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x20044000) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000001c0)={0x28, r4, 0x9, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1d}]}]}, 0x28}}, 0x0) 2m3.522454363s ago: executing program 5 (id=2271): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f000000ab80)={0x14, 0x3b, 0x107, 0x0, 0x0, {0x1, 0x7c}}, 0x14}}, 0xc000) 2m3.177769611s ago: executing program 5 (id=2273): r0 = socket(0x10, 0x803, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x14) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000060c0)=@newtfilter={0x34, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x7}, {}, {0x7}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x4}}]}, 0x34}}, 0x0) r5 = socket(0x10, 0x803, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x24, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0xf0, 0x7}, {}, {0x7, 0xc}}}, 0x24}}, 0x8000) 2m2.306553168s ago: executing program 2 (id=2277): syz_emit_ethernet(0x82, &(0x7f00000005c0)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x18, 0x2, 0x0, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0x6}, @exp_smc={0xfe, 0x6}, @exp_fastopen={0xfe, 0x10, 0xf989, "9fca59893b5031248415bcf1"}, @timestamp={0x8, 0xa, 0x200, 0x9}, @sack={0x5, 0xa, [0x2, 0x2]}, @exp_fastopen={0xfe, 0x0, 0xf989, "43ecdca921d221"}, @sack_perm={0x4, 0x2}, @fastopen={0x22, 0xfffffffffffffcf7, "8537c85532"}, @sack={0x5, 0xa, [0x6, 0x9]}]}}}}}}}, 0x0) 2m1.998807087s ago: executing program 2 (id=2279): r0 = socket(0x10, 0x80003, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB], 0x78}, 0x1, 0x0, 0x0, 0x44010}, 0xc0) recvmmsg(r0, &(0x7f0000001140)=[{{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x5}], 0x2, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r0) 2m1.998622246s ago: executing program 1 (id=2280): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="180000000114010029bdea0014dcdf25070001"], 0x18}, 0x1, 0x0, 0x0, 0x4000090}, 0x802) 2m1.056865263s ago: executing program 1 (id=2282): ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, 0x0) syz_emit_vhci(&(0x7f0000000080)=@HCI_EVENT_PKT={0x4, @hci_ev_le_meta={{0x3e, 0xd}, @hci_ev_le_ltk_req={{}, {0xc8, 0x3, 0x1000}}}}, 0x10) 2m1.056458543s ago: executing program 7 (id=2283): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000180)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x18, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x40}}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="2c00000011000500020000000000000007000000", @ANYRES32=r2, @ANYBLOB="0040020047839d000c001a800800"], 0x2c}}, 0x0) 2m0.989255553s ago: executing program 1 (id=2284): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2802, 0x0) ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000001180)=0x2000000) mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3, 0x12, r0, 0x0) ioctl$SNDCTL_DSP_GETOPTR(r0, 0x5008, 0x0) syz_open_dev$vim2m(&(0x7f0000000040), 0x7fff, 0x2) epoll_create1(0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) socket$kcm(0x2, 0xa, 0x2) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x300, 0x0, 0x0, 0x4}, 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) 2m0.629826382s ago: executing program 7 (id=2286): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(twofish)\x00'}, 0x58) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x8031, 0xffffffffffffffff, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7", 0xf) r1 = accept4(r0, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r1) 2m0.509785581s ago: executing program 5 (id=2287): r0 = socket(0x10, 0x803, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)) r1 = socket(0x1, 0x803, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@ipv6_newaddr={0x48, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x40, 0x0, 0x0, r2}, [@IFA_LOCAL={0x14, 0x2, @mcast1={0xff, 0x2}}, @IFA_FLAGS={0x8, 0x8, 0x41a}, @IFA_ADDRESS={0x14, 0x1, @loopback}]}, 0x48}}, 0x0) 2m0.39986735s ago: executing program 5 (id=2288): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000200)=@framed, &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x4, r0}) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000540)=0x1) 2m0.3242865s ago: executing program 2 (id=2290): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000160a03020002000000000000020000000900020073797a30000000000900010073797a30000000002c00038008000140000000000800024000000000180003801400010073797a5f74756e00000000000000000014000000110001"], 0x80}}, 0x0) syz_emit_ethernet(0x32, &(0x7f0000000440)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x19}, @remote, @val={@val={0x88a8, 0x2, 0x1, 0x4}, {0x8100, 0x1, 0x1, 0x3}}, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x3, 0x8, 0x1c, 0x68, 0x0, 0x54, 0x1, 0x0, @empty, @private=0xa010100}, @echo_reply={0x0, 0x0, 0x0, 0x67, 0x4}}}}}, 0x0) 2m0.16832162s ago: executing program 5 (id=2292): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r2) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) write(0xffffffffffffffff, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc) r6 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r6, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @empty}, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x13}}, 0x0, {0x2, 0x0, @multicast1=0xe000cc02}}) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r1, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) close(r0) 2m0.050741529s ago: executing program 2 (id=2293): getpid() socketpair$unix(0x1, 0x2, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) recvmmsg(0xffffffffffffffff, &(0x7f0000000c40)=[{{&(0x7f00000002c0)=@caif=@rfm, 0x80, &(0x7f0000000780)=[{&(0x7f0000000680)=""/243, 0xf3}, {0x0}, {&(0x7f0000000240)=""/48, 0x30}, {&(0x7f0000000340)=""/11, 0xb}, {&(0x7f0000000380)=""/18, 0x12}, {&(0x7f0000001500)=""/4096, 0x1000}, {&(0x7f0000000480)=""/49, 0x31}, {&(0x7f00000004c0)=""/25, 0x19}], 0x8, &(0x7f0000000980)=""/103, 0x67}, 0x1}, {{&(0x7f0000000a00)=@generic, 0x80, &(0x7f0000000b00)=[{&(0x7f00000007c0)=""/20, 0x14}], 0x1, &(0x7f0000000b40)=""/244, 0xf4}}], 0x2, 0x3, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x138, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x30, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @val={0x72, 0x6}, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @beacon=[@NL80211_ATTR_FTM_RESPONDER={0xd4, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_ENABLED={0x4}, @NL80211_FTM_RESP_ATTR_LCI={0x6, 0x2, "1952"}, @NL80211_FTM_RESP_ATTR_LCI={0xc2, 0x2, "5e08e3e23064af28550f02d97143f991c2749705277e1cf3bd32db882b090b6235cd0ddaaef54ded392840da8051e482c87dba6e0e25a2a65e8831169cfd6ef47bb193babafb91352dae48b516c408856c39c73697e3b336509fa8e53162bb99ba9228d180b29b46ead1f16f9043d4c07b7e5413110f113971a854829178c2304ddfdcb47f9c9d413eab119672e22e54dfee3d85a792d6d9ffcfc4540405fc7c67602871ffd78e2e28cf5a3a5fb16d009dff2fb03f2a61ddca516184efcb"}]}]]}, 0x138}}, 0x20000880) 1m58.906344875s ago: executing program 7 (id=2296): r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x2) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000080)=0x40) 1m58.670752514s ago: executing program 7 (id=2297): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)={0x5c, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x48, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "e3de3d7b4cd07ec3ee777de774fc7987cca41989"}}, @TIPC_NLA_NODE_REKEYING={0x8}]}]}, 0x5c}}, 0x0) 1m58.508325423s ago: executing program 1 (id=2298): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000003c0)={0x44, r2, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_STATUS_CODE={0x6}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_TDLS_ACTION={0x5}, @NL80211_ATTR_IE={0x4}, @NL80211_ATTR_TDLS_DIALOG_TOKEN={0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 1m58.454152533s ago: executing program 7 (id=2299): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'macvlan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000000c0)=@newlink={0x44, 0x10, 0x503, 0xfffffffd, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x5003}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MACADDR_MODE={0x8, 0x3, 0x2}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x44}}, 0x0) 1m58.255020963s ago: executing program 2 (id=2300): r0 = socket(0x10, 0x80003, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="18000000"], 0x78}, 0x1, 0x0, 0x0, 0x44010}, 0xc0) recvmmsg(r0, &(0x7f0000001140)=[{{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x5}], 0x2, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r0) 1m58.055196982s ago: executing program 1 (id=2301): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000011c0)={'vxcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000001200)={0x1d, r1}, 0x18) connect$can_j1939(r0, &(0x7f0000000080)={0x1d, r1}, 0x18) 1m58.026065741s ago: executing program 7 (id=2302): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x10000000004e20, 0x0, @mcast2, 0x6}, 0x1c) r0 = openat$random(0xffffffffffffff9c, &(0x7f00000007c0), 0x202, 0x0) write$binfmt_script(r0, &(0x7f0000000000), 0x4) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) r1 = socket$kcm(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a5c000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000300004"], 0x84}}, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001900599c6d0eab070004000523"], 0xfe33) 1m57.869680531s ago: executing program 1 (id=2303): unshare(0x62040200) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000200)=@framed, &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0, r0}, 0x18) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$EBT_SO_GET_INFO(r1, 0x0, 0x80, &(0x7f0000000000)={'filter\x00'}, &(0x7f0000000080)=0x78) getsockopt$EBT_SO_GET_ENTRIES(r1, 0x0, 0x81, &(0x7f0000000240)={'broute\x00', 0x0, 0x20, 0x0, [0xca, 0x2, 0x0, 0xd], 0x0, 0x0, 0x0}, &(0x7f0000000300)=0x50) 1m45.128822242s ago: executing program 35 (id=2292): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r2) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) write(0xffffffffffffffff, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b2b8f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de", 0xfc) r6 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r6, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @empty}, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x13}}, 0x0, {0x2, 0x0, @multicast1=0xe000cc02}}) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r1, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) close(r0) 1m42.922545764s ago: executing program 36 (id=2300): r0 = socket(0x10, 0x80003, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="18000000"], 0x78}, 0x1, 0x0, 0x0, 0x44010}, 0xc0) recvmmsg(r0, &(0x7f0000001140)=[{{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x5}], 0x2, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r0) 1m42.762582523s ago: executing program 37 (id=2302): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x10000000004e20, 0x0, @mcast2, 0x6}, 0x1c) r0 = openat$random(0xffffffffffffff9c, &(0x7f00000007c0), 0x202, 0x0) write$binfmt_script(r0, &(0x7f0000000000), 0x4) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) r1 = socket$kcm(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a5c000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000300004"], 0x84}}, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001900599c6d0eab070004000523"], 0xfe33) 1m41.687866929s ago: executing program 38 (id=2303): unshare(0x62040200) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000200)=@framed, &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0, r0}, 0x18) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$EBT_SO_GET_INFO(r1, 0x0, 0x80, &(0x7f0000000000)={'filter\x00'}, &(0x7f0000000080)=0x78) getsockopt$EBT_SO_GET_ENTRIES(r1, 0x0, 0x81, &(0x7f0000000240)={'broute\x00', 0x0, 0x20, 0x0, [0xca, 0x2, 0x0, 0xd], 0x0, 0x0, 0x0}, &(0x7f0000000300)=0x50) 12.165536926s ago: executing program 4 (id=2625): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r1) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12013f00000000407f04ffff0000000000010902"], 0x0) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) syz_open_procfs$namespace(r0, &(0x7f0000000040)='ns/time_for_children\x00') 9.855203288s ago: executing program 4 (id=2631): openat$ptmx(0xffffffffffffff9c, 0x0, 0x41, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000540)={0x26, 'hash\x00', 0x0, 0x0, 'sha512-generic\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) sendmmsg$inet(r3, &(0x7f0000001200)=[{{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f00000003c0)="ba", 0x1}, {&(0x7f00000005c0)='0', 0xcea40}], 0x2}}], 0x1, 0x0) 6.570932145s ago: executing program 4 (id=2653): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x18, 0x3, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0xe769, 0x0, 0x0, 0x0, 0x401}}, &(0x7f0000000280)='GPL\x00', 0x5, 0xa, &(0x7f00000002c0)=""/10, 0x40f00, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000380)={0x5, 0xf, 0x4, 0x9}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x351f, @void, @value}, 0x94) 6.398998314s ago: executing program 4 (id=2655): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x1f6, 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x1002, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc, 0x7, {0x1}}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x800}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000040)=@assoc_value={0x0, 0x1}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f0000003240)=[{{&(0x7f0000000100)={0x2, 0x4e23, @empty}, 0x10, &(0x7f00000016c0)=[{&(0x7f0000001540)="94", 0xffe3}], 0x1}}], 0x1, 0x4000800) 5.812796442s ago: executing program 6 (id=2657): syz_emit_ethernet(0x66, &(0x7f00000002c0)={@broadcast, @random="05009211d49c", @void, {@ipv4={0x800, @icmp={{0x14, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x88, 0x0, @private=0xa010101, @broadcast, {[@cipso={0x86, 0x38, 0x3, [{0x7, 0xb, "ba81760deb948765f0"}, {0x5, 0x3, "fa"}, {0x7, 0xd, "98d3b04cf09ab9eb48aa77"}, {0x7, 0xe, "45ec966b5d7069edc4736883"}, {0x5, 0x3, '$'}, {0x5, 0x6, "29f76aca"}]}, @end]}}, @address_request={0x11, 0x0, 0x0, 0x7e}}}}}, 0x0) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000340)=0x0) quotactl$Q_GETQUOTA(0xffffffff80000702, &(0x7f0000000240)=@nbd={'/dev/nbd', 0x0}, r0, &(0x7f00000004c0)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b40)={0x18, 0x10, &(0x7f0000000400)=ANY=[@ANYBLOB, @ANYBLOB="da2261875f58323cf5704ca92bdcc7e39a892ad9ce2e9482b397d74faa777043c79850203e844203a9e2442046"], &(0x7f0000000080)='syzkaller\x00', 0x8, 0xac, &(0x7f0000000140)=""/172, 0x41000, 0x48, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) socket$packet(0x11, 0x3, 0x300) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x8, &(0x7f0000000740)=0x2) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0xfffffffffffffc33, &(0x7f0000000280)=0x2) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000000280)={0x10, 0x0, 0x1, 0x2ffffffff}, 0xc) r5 = socket$inet(0x2, 0x2, 0x1) bind$inet(r5, &(0x7f0000000340)={0x2, 0x0, @local}, 0x10) sendmsg$inet(r5, &(0x7f0000000600)={&(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000400)='\b\x00', 0x2}, {&(0x7f0000000180)="96bc1480bb58", 0x6}], 0x2}, 0x0) 5.005569439s ago: executing program 9 (id=2663): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) socket$packet(0x11, 0x2, 0x300) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000d7c9000009"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000000)={{r0}, &(0x7f0000000580), &(0x7f00000005c0)}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000a40)={&(0x7f0000000980)='sys_enter\x00'}, 0x10) io_destroy(0x0) semget$private(0x0, 0x6, 0x98) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_buf(r1, 0x0, 0x8008000000010, &(0x7f00000003c0)="17000000020001000003d68c5ee17688a2003208030300ecff3f0000000300000a0000000098fc5ad9485bbb6a880000d6c8db0000dba67e06000000e28900000200df018000000000f50607bdff59100ac45761547a681f009cee4a5acb3da400001fb700674f00c88ebbf9315033bf79ac2dff060115003901000000000000ea000000000000000002ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e0", 0xb8) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0x6, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) setsockopt$inet_buf(r2, 0x0, 0x8008000000010, &(0x7f00000003c0)="17000000020001000003d68c5ee17688a2003208030300ecff3f0000000300000a0000000098fc5ad9485bbb6a880000d6c8db0000dba67e06000000e28900000200df018000000000f50607bdff59100ac45761547a681f009cee4a5acb3da400001fb700674f00c88ebbf9315033bf79ac2dff060115003901000000000000ea000000000000000002ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e0", 0xb8) r3 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="021200000200000000010000865107ba"], 0x10}}, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) 4.294949656s ago: executing program 4 (id=2664): openat$ptmx(0xffffffffffffff9c, 0x0, 0x41, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000540)={0x26, 'hash\x00', 0x0, 0x0, 'sha512-generic\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) sendmmsg$inet(r3, &(0x7f0000001200)=[{{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f00000003c0)="ba", 0x1}, {&(0x7f00000005c0)='0', 0xcea40}], 0x2}}], 0x1, 0x0) 4.294700886s ago: executing program 9 (id=2665): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='sys_enter\x00', r0}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00'}, 0x10) msgsnd(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0300"], 0x8, 0x800) 4.177305116s ago: executing program 9 (id=2667): unshare(0x2c020400) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000900)={'bridge0\x00', @broadcast}) 4.006956165s ago: executing program 9 (id=2668): r0 = io_uring_setup(0x79af, &(0x7f0000000100)={0x0, 0xaa00, 0x2}) r1 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000500)={'bridge_slave_0\x00', &(0x7f00000004c0)=@ethtool_dump={0x3f}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x10, &(0x7f0000000240)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x8, 0xa2, &(0x7f0000000140)=""/162, 0x41100, 0x3, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000340), 0x10, 0x37, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0xfffffffffffffc33, &(0x7f0000000280)=0x2) syz_open_dev$I2C(&(0x7f0000003000), 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000400)={0x0, &(0x7f0000000380)}) syz_init_net_socket$rose(0xb, 0x5, 0x0) socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000100), 0x2001, 0x0) request_key(&(0x7f0000000040)='keyring\x00', &(0x7f0000000100)={'syz', 0x1}, 0x0, 0xfffffffffffffffe) io_uring_register$IORING_REGISTER_IOWQ_AFF(r0, 0x11, &(0x7f0000000040)="d25b49eaa837aca70b55963d847cb9cdc64c6cb78f6fd498cd9bba2a17c0e17da219082fa57699f4f249087bddafb95f5df23a60cbb6a1633839a9d2ada455c0ba8f8d191df1879e6e9b66eb51a57735e48c743fa4", 0x55) close_range(r0, 0xffffffffffffffff, 0x0) 3.985120815s ago: executing program 6 (id=2669): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000040)={r1, 0x8001}, &(0x7f0000000200)=0x8) 3.802658854s ago: executing program 0 (id=2671): socket$inet(0x2, 0x3, 0x7) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() fanotify_init(0x0, 0x0) setrlimit(0xc, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2000000, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r3}, 0x10) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = dup(r4) ioctl$PIO_UNIMAP(r5, 0x4b67, &(0x7f00000002c0)={0x1, &(0x7f0000000000)=[{0x4, 0x8}]}) getrlimit(0x4, &(0x7f0000000040)) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r6, &(0x7f0000d84000)={0xa, 0x2, 0x0, @empty}, 0x1c) mount$9p_fd(0x0, 0x0, &(0x7f0000000640), 0x0, &(0x7f0000000240)) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f00000000c0)=0x2, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r6, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e28, 0x0, @remote}}, 0x0, 0x0, 0xb, 0x0, "3f114438efdaca16d374b49a365be44d5e860ea3ba676c0b5047b80e2c3535d5bd9db3c8572560f4d1be5cd41f7716082ee3589f099942e6f1c395ddb8160381baadf27900"}, 0xd8) setsockopt$inet6_tcp_TCP_MD5SIG(r6, 0x6, 0xe, &(0x7f0000000100)={@in6={{0xa, 0x0, 0x23, @remote}}, 0x0, 0x0, 0x0, 0x0, "ddfd3b7ed7c6a1c172a987ae5ce3cafd64c9a736831a5912d606798fb75c9981c4b3ac0e06891ff18bc5543ed57215a3c45f9154dfa319e52a15a2b9acf80c07fb1a854dad742eef6187f2304844c296"}, 0xd8) sendto$inet6(r6, 0x0, 0x0, 0x20004002, 0x0, 0x0) 3.802488274s ago: executing program 6 (id=2672): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000700)={0x0, &(0x7f0000000640)=[0x0], 0x0, 0x0, 0x0, 0x1}) syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, &(0x7f0000000440)={0x0, 0x0, r2, 0x0}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r0, 0xc01864b0, &(0x7f0000000080)={r2, r3}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r0, 0xc01864b0, &(0x7f0000000180)={0x0, r3}) 3.198222142s ago: executing program 6 (id=2674): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x6, 0x5, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffff9}, [@call={0x85, 0x0, 0x0, 0x36}, @call={0x85, 0x0, 0x0, 0x5}]}, &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) 3.160191891s ago: executing program 9 (id=2675): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWFLOWTABLE={0x6c, 0x16, 0xa, 0x203, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x5}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x40, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x2c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'wg2\x00'}, {0x14, 0x1, 'tunl0\x00'}]}]}]}], {0x14}}, 0x94}}, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000006c0)={'bridge0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x9, r1, 0x1, 0x5, 0x6, @remote}, 0x14) close(r0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000000280)={0x3, 0x0, 0x0, 0x81, 0xffffffff}) r3 = syz_open_dev$loop(&(0x7f0000000080), 0x113b4850, 0x4000) syz_emit_ethernet(0x0, 0x0, 0x0) r4 = socket$inet_sctp(0x2, 0x5, 0x84) r5 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000240)=0x4) setsockopt$inet_sctp_SCTP_ASSOCINFO(r4, 0x84, 0x1, &(0x7f0000000000)={r6, 0xfff, 0x8, 0x1, 0x7fffffff, 0x101}, 0x14) ioctl$IOC_PR_RELEASE(r3, 0x401070ca, 0x0) r7 = socket$inet6(0xa, 0x3, 0xff) sendmsg$inet6(r7, &(0x7f00000006c0)={&(0x7f0000000040)={0xa, 0x7, 0x3ae3, @mcast2, 0x6}, 0x1c, 0x0, 0x0, &(0x7f00000001c0)=[@hoplimit={{0x14, 0x29, 0x34, 0x80}}], 0x18}, 0x24044010) sendmsg$DEVLINK_CMD_PORT_GET(r2, 0x0, 0x0) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0xa031, 0xffffffffffffffff, 0x0) r8 = syz_usb_connect(0x0, 0x41, &(0x7f0000000480)=ANY=[@ANYBLOB="12010000d2e776100a115316a75e01020301090212000100000000090400000043d37800c1b40af05ab3b4747948b119fe03c78abe870967bf51a6ea3058fb8e8532f8b34030e85498c525e1086cddded111c14eced2e34bee7b6a4af95ee411c42545f7005cd68fb4c19782e6823dfd6cbb2da75c46770fb910cf3423269bae97e885c8de6d25deb103a2c83faf7ac39b7ef80cc453da2faa49f627d316fdb2f664423d363a98505b696ebadbbc7e34be0208a4f8ff8bfdccc760c09c5bc8b0919e4d48e4545ef0d2d852f71f822fab548a11445e428be4623d16b0bccadef51b58f10623aa5cd2ebbd9a276f0350dcc29631689de7ddca82ed18e69207b256471de77481b2030d353f8c"], 0x0) syz_usb_control_io$hid(r8, 0x0, 0x0) mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffc000/0x1000)=nil) 3.107746012s ago: executing program 4 (id=2676): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x1f6, 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x1002, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc, 0x7, {0x1}}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x800}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000040)=@assoc_value={0x0, 0x1}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f0000003240)=[{{&(0x7f0000000100)={0x2, 0x4e23, @empty}, 0x10, &(0x7f00000016c0)=[{&(0x7f0000001540)="94", 0xffe3}], 0x1}}], 0x1, 0x4000800) 2.958495771s ago: executing program 6 (id=2679): syz_emit_ethernet(0x66, &(0x7f00000002c0)={@broadcast, @random="05009211d49c", @void, {@ipv4={0x800, @icmp={{0x14, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x88, 0x0, @private=0xa010101, @broadcast, {[@cipso={0x86, 0x38, 0x3, [{0x7, 0xb, "ba81760deb948765f0"}, {0x5, 0x3, "fa"}, {0x7, 0xd, "98d3b04cf09ab9eb48aa77"}, {0x7, 0xe, "45ec966b5d7069edc4736883"}, {0x5, 0x3, '$'}, {0x5, 0x6, "29f76aca"}]}, @end]}}, @address_request={0x11, 0x0, 0x0, 0x7e}}}}}, 0x0) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000340)=0x0) quotactl$Q_GETQUOTA(0xffffffff80000702, &(0x7f0000000240)=@nbd={'/dev/nbd', 0x0}, r0, &(0x7f00000004c0)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b40)={0x18, 0x10, &(0x7f0000000400)=ANY=[@ANYBLOB, @ANYBLOB="da2261875f58323cf5704ca92bdcc7e39a892ad9ce2e9482b397d74faa777043c79850203e844203a9e2442046"], &(0x7f0000000080)='syzkaller\x00', 0x8, 0xac, &(0x7f0000000140)=""/172, 0x41000, 0x48, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) socket$packet(0x11, 0x3, 0x300) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x8, &(0x7f0000000740)=0x2) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0xfffffffffffffc33, &(0x7f0000000280)=0x2) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000000280)={0x10, 0x0, 0x1, 0x2ffffffff}, 0xc) r5 = socket$inet(0x2, 0x2, 0x1) bind$inet(r5, &(0x7f0000000340)={0x2, 0x0, @local}, 0x10) sendmsg$inet(r5, &(0x7f0000000600)={&(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000400)='\b\x00', 0x2}, {&(0x7f0000000180)="96bc1480bb58", 0x6}], 0x2}, 0x0) 2.84302159s ago: executing program 0 (id=2680): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7d2}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x8001}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x80000, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xb}, {0x0, 0x7}}}, 0x24}, 0x1, 0x0, 0x0, 0x20004021}, 0x0) 2.73672693s ago: executing program 8 (id=2682): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000000c0)="e4e32dd2b696733552eca3e954943a18709f72fbd259a936c67ebe806ab21823f4a0c47bff45323c2b30982dfc67b46cc9a5a07c33fc", 0xff6d}, {&(0x7f0000000100)="3a10bd003aba0c7026336b", 0xb}], 0x2, &(0x7f0000000740)=ANY=[@ANYBLOB="300000000000000017e2ffff010000001800000045f43a7ce45002bdb85e47ab3e39597e422ffab456dd963a00000000180000000000000017010000040000000602000000400000180000000000000017010000030000000100000000000079240809000000ac87448793609bd8299d6dfc465829b711ce28eb8f568438917ebd0699be96bd1485f6aaa8486e00000000e301f2e09aebda6eeb1c61f96b6d3f91c0f8c1ffbb85cfdd5b8b437a3720ba4cdfb681516c3a240207b6bbdfb37747cc7411886fdba55bcbfa68226644556e8117f9f9fc5be3b7095b2ab7c19b0c6fada03a7f9b9172f0cc960ee263e82e3232edea82b9736d65309e0ad2922ecbb7cde9ce78555fabb941d114e83b37255d6b43b2927696e4f4cf3b23086021fe4e33d049de5318ef3803ceacddc02734c96a9765486a9bf8d65791b000000000000000000000000000000000000000009d97cea3f950d55b265e480ff02c27bda4848c64ca7dcbcd060b9c0dea483c6069d2cdc473cfacc9052cc2c9e3ee037042fd329173c5e7c9ef8800a51332df5a08602a72a553035711cb9159757303a5e7d389786df44441dc82a9d32c56db8a8b3578cd0faabfa23fb46e22b45a464e35315d8c2dd3fae8b530cf8eb0d8dcb682772bed766be5208e61eab965c6c9a217a4e13f0085626c0408f381205251c18a8f6a44"], 0x60}], 0x1, 0x8001) recvmmsg(r1, &(0x7f0000001440)=[{{0x0, 0x0, &(0x7f0000000940)=[{&(0x7f00000001c0)=""/156, 0xff78}, {&(0x7f0000000300)=""/92, 0x33}], 0x2}}], 0x1, 0x0, 0x0) sendto$inet6(r1, &(0x7f0000000040)='N', 0x1, 0x0, 0x0, 0x0) 2.562823109s ago: executing program 0 (id=2683): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x11, 0x0, &(0x7f0000000400)=[@acquire], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000300)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000006c0)={0x4c, 0x0, &(0x7f0000000580)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000740)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 2.539696269s ago: executing program 8 (id=2684): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000700)={0x0, &(0x7f0000000640)=[0x0], 0x0, 0x0, 0x0, 0x1}) syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, &(0x7f0000000440)={0x0, 0x0, r2, 0x0}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r0, 0xc01864b0, &(0x7f0000000080)={r2, r3}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r0, 0xc01864b0, &(0x7f0000000180)={0x0, r3}) 2.423268019s ago: executing program 8 (id=2685): r0 = io_uring_setup(0x79af, &(0x7f0000000100)={0x0, 0xaa00, 0x2}) r1 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000500)={'bridge_slave_0\x00', &(0x7f00000004c0)=@ethtool_dump={0x3f}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x10, &(0x7f0000000240)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x8, 0xa2, &(0x7f0000000140)=""/162, 0x41100, 0x3, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000340), 0x10, 0x37, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0xfffffffffffffc33, &(0x7f0000000280)=0x2) syz_open_dev$I2C(&(0x7f0000003000), 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000400)={0x0, &(0x7f0000000380)}) syz_init_net_socket$rose(0xb, 0x5, 0x0) socket(0x10, 0x3, 0x0) openat$drirender128(0xffffff9c, &(0x7f0000000100), 0x2001, 0x0) request_key(&(0x7f0000000040)='keyring\x00', &(0x7f0000000100)={'syz', 0x1}, 0x0, 0xfffffffffffffffe) io_uring_register$IORING_REGISTER_IOWQ_AFF(r0, 0x11, &(0x7f0000000040)="d25b49eaa837aca70b55963d847cb9cdc64c6cb78f6fd498cd9bba2a17c0e17da219082fa57699f4f249087bddafb95f5df23a60cbb6a1633839a9d2ada455c0ba8f8d191df1879e6e9b66eb51a57735e48c743fa4", 0x55) close_range(r0, 0xffffffffffffffff, 0x0) 2.401022469s ago: executing program 0 (id=2686): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r0}, 0x18) r1 = fanotify_init(0x0, 0x0) fanotify_mark(r1, 0x1, 0x4800003a, 0xffffffffffffffff, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) write$binfmt_aout(r2, &(0x7f0000000100)=ANY=[@ANYRES32], 0xff2e) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x5, 0x0, "0062ba7d82000000000000000000f7ffffff00"}) r3 = syz_open_pts(r2, 0x0) dup3(r3, r2, 0x0) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000001100)=0x12) 2.268271168s ago: executing program 9 (id=2687): openat$ptmx(0xffffffffffffff9c, 0x0, 0x41, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000540)={0x26, 'hash\x00', 0x0, 0x0, 'sha512-generic\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) sendmmsg$inet(r3, &(0x7f0000001200)=[{{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f00000003c0)="ba", 0x1}, {&(0x7f00000005c0)='0', 0xcea40}], 0x2}}], 0x1, 0x0) 622.554682ms ago: executing program 8 (id=2688): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r0) sendmsg$NFC_CMD_START_POLL(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)={0x1c, r1, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_PROTOCOLS={0x8, 0x3, 0xffffffff}]}, 0x1c}}, 0x0) sendmsg$NFC_CMD_ACTIVATE_TARGET(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100230100003402000007000000080001", @ANYRES32=0x0], 0x2c}}, 0x0) 483.445641ms ago: executing program 8 (id=2689): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000900000000000000213f0000c500"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) move_pages(0x0, 0x2064, &(0x7f0000000040)=[&(0x7f0000ff9000/0x2000)=nil], &(0x7f0000001180), &(0x7f0000000000), 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x15) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x20001400) ioctl$TUNSETOFFLOAD(r0, 0x40047451, 0x2000000c) 249.930501ms ago: executing program 6 (id=2690): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000180)=[{0x6, 0x0, 0x0, 0x7fc00101}]}) epoll_create1(0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r0, 0xc0182101, &(0x7f0000000300)) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f00000004c0)={0x0}) r2 = socket$key(0xf, 0x3, 0x2) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000000)={r1, 0x3, r2}) 139.00243ms ago: executing program 0 (id=2691): r0 = socket(0x2a, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000000)={'erspan0\x00', 0x0}) 40.20954ms ago: executing program 8 (id=2692): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) socket(0x2b, 0x1, 0x1) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) socket$nl_audit(0x10, 0x3, 0x9) syz_open_dev$sndpcmp(0x0, 0x0, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "8a37f2", 0x14, 0x2c, 0x0, @remote, @local, {[], {{0x3b00, 0x3, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000040)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) syz_io_uring_setup(0x10d, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x2}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_CONNECT={0x10, 0xa, 0x0, 0xffffffffffffffff, 0x0, 0x0}) close_range(r0, 0xffffffffffffffff, 0x0) 0s ago: executing program 0 (id=2693): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7d2}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x8001}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x80000, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xb}, {0x0, 0x7}}}, 0x24}, 0x1, 0x0, 0x0, 0x20004021}, 0x0) kernel console output (not intermixed with test programs): [ 107.729481][ T5871] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.731344][ T5871] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.732860][ T5871] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.736970][ T5871] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 108.167728][ T5884] tipc: Started in network mode [ 108.173328][ T5884] tipc: Node identity ac1414aa, cluster identity 4711 [ 108.184803][ T5884] tipc: Enabled bearer , priority 10 [ 109.028543][ T5933] netlink: 4 bytes leftover after parsing attributes in process `syz.3.485'. [ 109.030959][ T5933] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 109.032445][ T5933] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 109.034830][ T5933] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 109.036385][ T5933] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 109.291666][ T24] tipc: Node number set to 2886997162 [ 109.542501][ T4302] Bluetooth: hci3: command 0x0409 tx timeout [ 109.741292][ T5953] netlink: 'syz.5.495': attribute type 10 has an invalid length. [ 109.777521][ T5953] team0: Device veth0_macvtap failed to register rx_handler [ 109.849189][ T5956] syz.5.495 uses obsolete (PF_INET,SOCK_PACKET) [ 109.953130][ T5959] netlink: 4 bytes leftover after parsing attributes in process `syz.2.497'. [ 110.494784][ T5966] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 110.498591][ T5966] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 111.067621][ T5982] netlink: 'syz.3.508': attribute type 10 has an invalid length. [ 111.481837][ T5997] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 111.485129][ T5997] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 111.938534][ T6020] netlink: 8 bytes leftover after parsing attributes in process `syz.5.520'. [ 112.115026][ T4308] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 112.117228][ T4308] CPU: 1 PID: 4308 Comm: kworker/u5:4 Tainted: G W 6.1.121-syzkaller #0 [ 112.119405][ T4308] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 112.121559][ T4308] Workqueue: hci3 hci_rx_work [ 112.122672][ T4308] Call trace: [ 112.123405][ T4308] dump_backtrace+0x1c8/0x1f4 [ 112.124348][ T4308] show_stack+0x2c/0x3c [ 112.125234][ T4308] dump_stack_lvl+0x108/0x170 [ 112.126199][ T4308] dump_stack+0x1c/0x58 [ 112.127030][ T4308] sysfs_create_dir_ns+0x278/0x318 [ 112.128100][ T4308] kobject_add_internal+0x598/0xb14 [ 112.129243][ T4308] kobject_add+0x14c/0x21c [ 112.130273][ T4308] device_add+0x400/0xef4 [ 112.131247][ T4308] hci_conn_add_sysfs+0xc4/0x1cc [ 112.132371][ T4308] le_conn_complete_evt+0xa0c/0xfe0 [ 112.133622][ T4308] hci_le_enh_conn_complete_evt+0x114/0x414 [ 112.134856][ T4308] hci_le_meta_evt+0x2b8/0x47c [ 112.135867][ T4308] hci_event_packet+0x6f8/0x109c [ 112.136857][ T4308] hci_rx_work+0x310/0xa84 [ 112.137791][ T4308] process_one_work+0x7ac/0x1404 [ 112.138855][ T4308] worker_thread+0x8e4/0xfec [ 112.139862][ T4308] kthread+0x250/0x2d8 [ 112.140722][ T4308] ret_from_fork+0x10/0x20 [ 112.143851][ T4308] kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 112.146803][ T4308] Bluetooth: hci3: failed to register connection device [ 112.167311][ T6026] netlink: 'syz.5.521': attribute type 10 has an invalid length. [ 112.190957][ T6026] bridge0: port 2(bridge_slave_1) entered disabled state [ 112.192601][ T6026] bridge0: port 1(bridge_slave_0) entered disabled state [ 112.255064][ T4495] bond0: (slave bridge0): link status definitely down, disabling slave [ 112.443122][ T6034] [U]  [ 112.567795][ T6041] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 112.569946][ T6041] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 112.806469][ T6047] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 112.818776][ T6047] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 112.951952][ T6053] binder: 6051 invalid dec weak, ref 2 desc 0 s 1 w 0 [ 113.064957][ T6056] usb usb7: usbfs: process 6056 (syz.3.531) did not claim interface 0 before use [ 113.119149][ T6060] netlink: 20 bytes leftover after parsing attributes in process `syz.3.534'. [ 113.168402][ T6062] netlink: 16 bytes leftover after parsing attributes in process `syz.2.533'. [ 113.294556][ T6070] sctp: [Deprecated]: syz.1.538 (pid 6070) Use of struct sctp_assoc_value in delayed_ack socket option. [ 113.294556][ T6070] Use struct sctp_sack_info instead [ 113.461552][ T6083] netlink: 'syz.5.541': attribute type 10 has an invalid length. [ 113.493200][ T6083] device syz_tun entered promiscuous mode [ 113.531639][ T6083] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 113.672591][ T6094] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 113.690811][ T6094] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 113.959281][ T6115] device syz_tun entered promiscuous mode [ 114.180803][ T4302] Bluetooth: hci3: command 0x2016 tx timeout [ 114.428758][ T6142] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 114.438917][ T6142] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 114.704873][ T6154] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 114.706794][ T6154] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 115.049296][ T6159] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 115.052938][ T6159] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 115.057105][ T6160] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 115.061263][ T6160] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 115.266988][ T6166] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 115.271296][ T6159] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 115.273285][ T6159] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 115.330307][ T6170] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 115.333883][ T6170] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 115.543228][ T6170] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 115.559441][ T6170] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 115.639284][ T4308] Bluetooth: Wrong link type (-22) [ 116.100675][ T4302] Bluetooth: hci2: command 0x201b tx timeout [ 116.520253][ T6193] sch_tbf: burst 4398 is lower than device lo mtu (11337746) ! [ 116.863019][ T6217] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 116.867616][ T6217] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 117.281450][ T6241] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 117.298775][ T6241] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 117.521189][ T6241] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 117.523250][ T6241] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 117.667381][ T6258] netlink: 44 bytes leftover after parsing attributes in process `syz.6.596'. [ 118.155365][ T6286] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 118.166239][ T6286] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 119.062689][ T6326] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 119.064640][ T6326] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 119.190250][ T6334] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 119.206339][ T6334] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 119.289610][ T6341] netlink: 4 bytes leftover after parsing attributes in process `syz.3.619'. [ 119.421392][ T6334] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 119.423299][ T6334] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 119.441275][ T6354] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 119.443397][ T6354] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 119.566514][ T6361] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 119.969446][ T6390] binder: 6389:6390 got transaction to invalid handle, 1 [ 119.997915][ T6390] binder: 6390:6389 cannot find target node [ 119.999164][ T6390] binder: 6389:6390 transaction async to 0:0 failed 5/29201/-22, size 0-0 line 3054 [ 120.007977][ T4379] binder: undelivered TRANSACTION_ERROR: 29201 [ 120.155200][ T6402] netlink: 8 bytes leftover after parsing attributes in process `syz.5.635'. [ 120.157455][ T6402] netlink: 4 bytes leftover after parsing attributes in process `syz.5.635'. [ 120.367630][ T6420] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 120.381303][ T6420] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 120.510853][ T6429] netlink: 4 bytes leftover after parsing attributes in process `syz.3.643'. [ 120.513128][ C0] vcan0: j1939_tp_txtimer: 0x00000000e06cee50: tx aborted with unknown reason: -2 [ 120.892342][ T6444] usb usb8: usbfs: process 6444 (syz.6.645) did not claim interface 0 before use [ 120.998013][ T6453] netlink: 20 bytes leftover after parsing attributes in process `syz.1.649'. [ 121.538980][ T6495] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 121.546564][ T6495] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 121.794070][ T6511] netlink: 16 bytes leftover after parsing attributes in process `syz.2.667'. [ 121.796080][ T6511] netlink: 12 bytes leftover after parsing attributes in process `syz.2.667'. [ 121.805342][ T6511] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 39760 - 0 [ 121.807342][ T6511] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 39760 - 0 [ 121.809235][ T6511] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 39760 - 0 [ 121.813801][ T6511] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 39760 - 0 [ 121.898201][ T6519] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 121.900194][ T6519] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 122.168214][ T6541] netlink: 68 bytes leftover after parsing attributes in process `syz.3.673'. [ 122.436292][ T6559] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 122.439475][ T6559] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 122.451100][ T6557] netlink: 8 bytes leftover after parsing attributes in process `syz.3.677'. [ 122.568947][ T6567] netlink: 'syz.3.680': attribute type 3 has an invalid length. [ 122.797639][ T6582] usb usb7: usbfs: process 6582 (syz.6.684) did not claim interface 0 before use [ 123.187900][ T6613] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 123.190154][ T6613] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 124.107654][ T4892] atkbd serio0: keyboard reset failed on [ 125.022917][ T6667] __nla_validate_parse: 1 callbacks suppressed [ 125.022931][ T6667] netlink: 8 bytes leftover after parsing attributes in process `syz.3.710'. [ 125.035379][ T6668] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 125.037791][ T6668] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 125.152205][ T6677] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 125.154990][ T6677] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 125.203361][ T6681] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 125.485681][ T6692] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 125.944412][ T2061] ieee802154 phy0 wpan0: encryption failed: -22 [ 125.948173][ T2061] ieee802154 phy1 wpan1: encryption failed: -22 [ 126.740968][ T4302] Bluetooth: hci0: unexpected subevent 0x01 length: 0 < 18 [ 126.771303][ T6732] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 126.773588][ T6732] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 129.145464][ T6789] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 129.148085][ T6789] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 129.155216][ T6793] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 129.232158][ T6796] netlink: 4 bytes leftover after parsing attributes in process `syz.1.760'. [ 130.332080][ T6783] netlink: 8 bytes leftover after parsing attributes in process `syz.6.754'. [ 130.731747][ T6836] sch_tbf: burst 32855 is lower than device lo mtu (11337746) ! [ 130.787125][ T6840] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 130.809520][ T6840] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 130.856406][ T6848] xt_hashlimit: max too large, truncated to 1048576 [ 131.424990][ T6862] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 131.447981][ T6862] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 131.963342][ T6877] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 132.102583][ T6864] netlink: 8 bytes leftover after parsing attributes in process `syz.3.785'. [ 132.312596][ T6893] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 132.314636][ T6893] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 132.535531][ T6906] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 132.554202][ T6906] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 132.585600][ T6908] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 132.673878][ T6916] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 132.677162][ T6916] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 132.999185][ T6934] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 134.370941][ T6963] sch_tbf: burst 32855 is lower than device lo mtu (11337746) ! [ 135.664515][ T7000] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 136.941739][ T7038] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 136.945411][ T7038] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 138.478086][ T7095] netlink: 4 bytes leftover after parsing attributes in process `syz.3.891'. [ 138.482849][ T7095] device bridge_slave_1 left promiscuous mode [ 138.485458][ T7095] bridge0: port 2(bridge_slave_1) entered disabled state [ 138.517311][ T7095] device bridge_slave_0 left promiscuous mode [ 138.518687][ T7095] bridge0: port 1(bridge_slave_0) entered disabled state [ 138.604449][ T7095] bond0: (slave bridge0): Releasing backup interface [ 138.640941][ T7095] device bridge0 left promiscuous mode [ 139.178136][ T7144] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 139.186608][ T7144] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 139.308535][ T7152] ip6t_srh: unknown srh match flags B153 [ 139.312758][ T7152] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 139.315107][ T7152] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 139.749985][ T7180] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 139.752847][ T7180] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 139.767407][ T7182] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 139.769378][ T7182] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 139.839453][ T7184] tipc: Started in network mode [ 139.846871][ T7184] tipc: Node identity 4, cluster identity 4711 [ 139.848492][ T7184] tipc: Node number set to 4 [ 140.207064][ T7208] ip6t_srh: unknown srh match flags B153 [ 140.210097][ T7208] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 140.212674][ T7208] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 140.646328][ T7234] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 140.648475][ T7234] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 141.103950][ T7262] ip6t_srh: unknown srh match flags B153 [ 141.106885][ T7262] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 141.116015][ T7262] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 141.549306][ T7296] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 141.552962][ T7296] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 142.734700][ T7357] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 142.736555][ T7357] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 142.854086][ T7346] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 142.856260][ T7346] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 143.647207][ T4302] Bluetooth: hci2: Malformed LE Event: 0x1b [ 143.792041][ T4302] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 143.794054][ T4302] Bluetooth: hci0: Injecting HCI hardware error event [ 143.796608][ T4308] Bluetooth: hci0: hardware error 0x00 [ 143.945180][ T7421] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 143.988949][ T7421] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 144.031104][ T112] binder: undelivered death notification, 0000000000000000 [ 144.446913][ T7451] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 144.448957][ T7451] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 144.634666][ T7459] netlink: 'syz.1.1057': attribute type 15 has an invalid length. [ 145.398856][ T4302] Bluetooth: hci0: unexpected event for opcode 0x0c58 [ 145.940605][ T4308] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 146.078049][ T7541] netlink: 'syz.5.1097': attribute type 15 has an invalid length. [ 147.187733][ T7589] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 147.189765][ T7589] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 147.425356][ T7599] tipc: Started in network mode [ 147.426490][ T7599] tipc: Node identity 2eb39befc8f3, cluster identity 4711 [ 147.428096][ T7599] tipc: Enabled bearer , priority 10 [ 147.435287][ T7599] tipc: Cannot configure node identity twice [ 147.682244][ T7609] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 147.684465][ T7609] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 148.115605][ T7637] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 148.117673][ T7637] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 148.157860][ T7641] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1145'. [ 148.306956][ T7651] usb usb4: usbfs: process 7651 (syz.3.1150) did not claim interface 0 before use [ 148.540822][ T4349] tipc: Node number set to 3862993903 [ 148.608835][ T7667] TCP: request_sock_TCP: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 148.810952][ T7676] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1162'. [ 149.392840][ T7703] device gtp0 entered promiscuous mode [ 150.912460][ T7766] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 150.914424][ T7766] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 151.170180][ T7778] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 151.172508][ T7778] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 151.467639][ T7785] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 151.469798][ T7785] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 151.823198][ T7797] loop2: detected capacity change from 0 to 7 [ 151.825610][ T7797] Dev loop2: unable to read RDB block 7 [ 151.826827][ T7797] loop2: unable to read partition table [ 151.828062][ T7797] loop2: partition table beyond EOD, truncated [ 151.829456][ T7797] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 151.966223][ T7805] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 151.969709][ T7805] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 152.316468][ T7819] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1225'. [ 152.340565][ T7819] bridge0: port 3(vlan2) entered blocking state [ 152.345766][ T7819] bridge0: port 3(vlan2) entered disabled state [ 152.347795][ T7819] device vlan2 entered promiscuous mode [ 152.545073][ T7831] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 152.549455][ T7831] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 153.136609][ T7859] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 153.146943][ T7859] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 153.920100][ T7881] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 153.933128][ T7881] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 154.002426][ T7885] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 154.004368][ T7885] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 154.255994][ T7892] netlink: 'syz.3.1260': attribute type 10 has an invalid length. [ 154.257942][ T7892] device bond0 left promiscuous mode [ 154.259063][ T7892] device bond_slave_0 left promiscuous mode [ 154.260362][ T7892] device bond_slave_1 left promiscuous mode [ 154.498339][ T7899] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 154.500307][ T7899] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 155.115920][ T7921] device netdevsim0 entered promiscuous mode [ 155.146359][ T7921] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 155.710268][ T7951] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 155.713338][ T7951] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 155.866692][ T7958] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 155.868743][ T7958] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 156.377480][ T7969] capability: warning: `syz.3.1295' uses 32-bit capabilities (legacy support in use) [ 156.410202][ T7972] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 156.635165][ T7981] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 156.639734][ T7981] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 158.260893][ T8026] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 158.375044][ T8030] tipc: Started in network mode [ 158.376103][ T8030] tipc: Node identity 164bc8ea317, cluster identity 4711 [ 158.377854][ T8030] tipc: Enabled bearer , priority 10 [ 158.485152][ T8034] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 158.489072][ T8034] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 158.715817][ T8046] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1330'. [ 158.740922][ T4302] Bluetooth: hci3: command 0x0406 tx timeout [ 158.742352][ T4302] Bluetooth: hci2: command 0x0406 tx timeout [ 158.743527][ T4302] Bluetooth: hci4: command 0x0406 tx timeout [ 159.735205][ T8060] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 159.737011][ T8060] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 159.752525][ T4348] tipc: Node number set to 658229482 [ 160.083409][ T8082] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 160.085565][ T8082] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 161.337986][ T8110] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 161.629809][ T8128] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 161.645256][ T8128] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 161.830431][ T8134] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1371'. [ 162.832607][ T8160] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1382'. [ 163.209434][ T8187] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 163.213155][ T8187] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 163.366015][ T8189] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1396'. [ 163.876388][ T8212] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 163.894178][ T8214] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1407'. [ 164.150975][ T8228] tipc: Enabled bearer , priority 10 [ 164.200223][ T8232] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1417'. [ 164.205984][ T8232] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1417'. [ 164.643446][ T8263] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 164.647888][ T8263] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 164.790805][ T8265] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1433'. [ 165.865887][ T27] audit: type=1326 audit(165.840:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8324 comm="syz.3.1460" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffbb753b68 code=0x7ffc0000 [ 165.871923][ T27] audit: type=1326 audit(165.850:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8324 comm="syz.3.1460" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=56 compat=0 ip=0xffffbb752094 code=0x7ffc0000 [ 165.877772][ T27] audit: type=1326 audit(165.850:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8324 comm="syz.3.1460" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=56 compat=0 ip=0xffffbb752094 code=0x7ffc0000 [ 165.890174][ T27] audit: type=1326 audit(165.850:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8324 comm="syz.3.1460" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffbb753b68 code=0x7ffc0000 [ 165.899520][ T27] audit: type=1326 audit(165.850:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8324 comm="syz.3.1460" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=80 compat=0 ip=0xffffbb753b68 code=0x7ffc0000 [ 165.915105][ T27] audit: type=1326 audit(165.850:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8324 comm="syz.3.1460" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffbb753b68 code=0x7ffc0000 [ 166.505624][ T8356] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 166.517833][ T8356] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 168.283151][ T8445] TCP: request_sock_TCP: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 168.586269][ T8471] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 168.589429][ T8471] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 168.845390][ T8486] tipc: Enabling of bearer rejected, already enabled [ 170.284400][ T8535] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 171.309369][ T8557] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 171.506519][ T8573] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 171.516654][ T8573] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 172.439633][ T8582] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1567'. [ 172.659717][ T8600] sctp: [Deprecated]: syz.6.1574 (pid 8600) Use of int in max_burst socket option deprecated. [ 172.659717][ T8600] Use struct sctp_assoc_value instead [ 173.995601][ T8634] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 174.000068][ T8634] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 174.032524][ T8636] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 174.036188][ T8636] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 175.194066][ T8654] netlink: 44 bytes leftover after parsing attributes in process `syz.5.1599'. [ 175.489920][ T8674] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 175.501072][ T8674] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 176.476622][ T8696] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 176.482693][ T8696] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 177.146536][ T8719] netlink: 'syz.2.1629': attribute type 10 has an invalid length. [ 177.564748][ T4302] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 177.567923][ T4302] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 177.570403][ T4302] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 177.573441][ T4302] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 177.576076][ T4302] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 177.577836][ T4302] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 177.893791][ T8752] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1643'. [ 177.895817][ T8752] device bridge_slave_1 left promiscuous mode [ 177.897430][ T8752] bridge0: port 2(bridge_slave_1) entered disabled state [ 177.931898][ T8752] device bridge_slave_0 left promiscuous mode [ 177.932040][ T8752] bridge0: port 1(bridge_slave_0) entered disabled state [ 178.031640][ T8752] bond0: (slave bridge0): Releasing backup interface [ 178.233969][ T8729] chnl_net:caif_netlink_parms(): no params data found [ 178.309367][ T8729] bridge0: port 1(bridge_slave_0) entered blocking state [ 178.313614][ T8729] bridge0: port 1(bridge_slave_0) entered disabled state [ 178.318943][ T8729] device bridge_slave_0 entered promiscuous mode [ 178.346857][ T8729] bridge0: port 2(bridge_slave_1) entered blocking state [ 178.348554][ T8729] bridge0: port 2(bridge_slave_1) entered disabled state [ 178.352896][ T8729] device bridge_slave_1 entered promiscuous mode [ 178.429811][ T8729] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 178.447569][ T8729] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 178.475099][ T8774] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 178.478675][ T8774] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 178.494841][ T8729] team0: Port device team_slave_0 added [ 178.497981][ T8729] team0: Port device team_slave_1 added [ 178.513613][ T8729] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 178.515248][ T8729] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 178.521347][ T8729] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 178.525226][ T8729] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 178.526767][ T8729] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 178.532721][ T8729] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 178.576776][ T8778] netlink: 104 bytes leftover after parsing attributes in process `syz.5.1651'. [ 178.602471][ T8729] device hsr_slave_0 entered promiscuous mode [ 178.630865][ T8729] device hsr_slave_1 entered promiscuous mode [ 178.660843][ T8729] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 178.662438][ T8729] Cannot create hsr debugfs directory [ 178.751248][ T8785] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 178.756632][ T8785] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 178.803590][ T8729] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 178.853012][ T8729] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 178.883513][ T8729] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 178.919610][ T8729] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 178.972647][ T8729] bridge0: port 2(bridge_slave_1) entered blocking state [ 178.974300][ T8729] bridge0: port 2(bridge_slave_1) entered forwarding state [ 178.975953][ T8729] bridge0: port 1(bridge_slave_0) entered blocking state [ 178.977574][ T8729] bridge0: port 1(bridge_slave_0) entered forwarding state [ 179.024769][ T8729] 8021q: adding VLAN 0 to HW filter on device bond0 [ 179.055370][ T4543] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 179.058357][ T4543] bridge0: port 1(bridge_slave_0) entered disabled state [ 179.061639][ T4543] bridge0: port 2(bridge_slave_1) entered disabled state [ 179.065500][ T4543] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 179.086482][ T8729] 8021q: adding VLAN 0 to HW filter on device team0 [ 179.099296][ T4543] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 179.101538][ T4543] bridge0: port 1(bridge_slave_0) entered blocking state [ 179.103230][ T4543] bridge0: port 1(bridge_slave_0) entered forwarding state [ 179.108388][ T4543] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 179.111611][ T4543] bridge0: port 2(bridge_slave_1) entered blocking state [ 179.113148][ T4543] bridge0: port 2(bridge_slave_1) entered forwarding state [ 179.129197][ T4543] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 179.135970][ T4543] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 179.138720][ T4543] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 179.155228][ T4543] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 179.162133][ T4543] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 179.169043][ T8729] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 179.458437][ T8729] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 179.461240][ T4543] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 179.462894][ T4543] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 179.621295][ T4308] Bluetooth: hci3: command 0x0409 tx timeout [ 179.664603][ T8828] binder: 8826:8828 tried to acquire reference to desc 0, got 1 instead [ 179.712644][ T4349] binder: undelivered transaction 12, process died. [ 179.797779][ T8839] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 179.817256][ T4543] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 179.817376][ T8839] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 179.819531][ T4543] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 179.866261][ T4495] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 179.868581][ T4495] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 179.871700][ T4495] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 179.875642][ T4495] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 179.880960][ T8729] device veth0_vlan entered promiscuous mode [ 179.887946][ T8729] device veth1_vlan entered promiscuous mode [ 179.906341][ T4545] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 179.908639][ T4545] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 179.920878][ T4545] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 179.923149][ T4545] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 179.927089][ T8729] device veth0_macvtap entered promiscuous mode [ 179.941562][ T8729] device veth1_macvtap entered promiscuous mode [ 179.980024][ T8729] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 179.987228][ T8729] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 179.992661][ T8729] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 179.995030][ T8729] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 179.997443][ T8729] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 180.001781][ T8729] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 180.007287][ T8729] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 180.009522][ T8729] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 180.013153][ T8729] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 180.017812][ T180] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 180.019957][ T180] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 180.026495][ T180] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 180.028902][ T180] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 180.036520][ T8729] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 180.042268][ T8729] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 180.047785][ T8729] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 180.053485][ T8729] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 180.058064][ T8729] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 180.065446][ T8729] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 180.085719][ T8729] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 180.087828][ T8729] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 180.106306][ T8729] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 180.108835][ T4543] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 180.111537][ T4543] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 180.116499][ T8729] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 180.118386][ T8729] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 180.120244][ T8729] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 180.128939][ T8729] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 180.216468][ T4543] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 180.218376][ T4543] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 180.239343][ T4545] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 180.262245][ T8858] netlink: 16 bytes leftover after parsing attributes in process `syz.6.1683'. [ 180.269455][ T4496] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 180.277435][ T4496] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 180.284907][ T4496] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 180.485908][ T8869] device syzkaller1 entered promiscuous mode [ 180.547355][ T8877] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 180.551119][ T8877] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 180.614927][ T8875] tipc: Enabling of bearer rejected, already enabled [ 181.113675][ T8907] tipc: Enabling of bearer rejected, already enabled [ 181.661688][ T27] audit: type=1326 audit(181.640:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8928 comm="syz.1.1712" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff7f553b68 code=0x7ffc0000 [ 181.666482][ T27] audit: type=1326 audit(181.640:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8928 comm="syz.1.1712" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=29 compat=0 ip=0xffff7f553b68 code=0x7ffc0000 [ 181.691898][ T27] audit: type=1326 audit(181.640:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8928 comm="syz.1.1712" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff7f553b68 code=0x7ffc0000 [ 181.701671][ T4308] Bluetooth: hci3: command 0x041b tx timeout [ 181.709875][ T27] audit: type=1326 audit(181.640:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8928 comm="syz.1.1712" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=81 compat=0 ip=0xffff7f553b68 code=0x7ffc0000 [ 181.732440][ T27] audit: type=1326 audit(181.700:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8928 comm="syz.1.1712" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff7f553b68 code=0x7ffc0000 [ 181.736885][ T27] audit: type=1326 audit(181.700:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8928 comm="syz.1.1712" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff7f553b68 code=0x7ffc0000 [ 182.071476][ T8944] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 182.125623][ T8944] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 182.138422][ T8944] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 182.979474][ T8973] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1729'. [ 183.690434][ T8990] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 183.718303][ T8990] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 183.780634][ T4302] Bluetooth: hci3: command 0x040f tx timeout [ 183.814625][ T8998] capability: warning: `syz.6.1740' uses deprecated v2 capabilities in a way that may be insecure [ 184.358872][ T9003] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 184.361194][ T9003] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 184.383765][ T9008] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 184.386646][ T9008] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 184.462759][ T9011] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1746'. [ 184.923713][ T9043] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 184.923713][ T9043] The task syz.6.1758 (9043) triggered the difference, watch for misbehavior. [ 185.197557][ T9062] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1770'. [ 185.218768][ T9064] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 185.222786][ T9064] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 185.223800][ T9060] usb usb7: usbfs: process 9060 (syz.7.1768) did not claim interface 0 before use [ 185.567335][ T9080] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 185.575508][ T9080] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 185.860764][ T4308] Bluetooth: hci3: command 0x0419 tx timeout [ 186.528427][ T9125] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 186.532875][ T9125] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 187.201363][ T9153] netlink: 20 bytes leftover after parsing attributes in process `syz.7.1808'. [ 187.382303][ T2061] ieee802154 phy0 wpan0: encryption failed: -22 [ 187.383696][ T2061] ieee802154 phy1 wpan1: encryption failed: -22 [ 188.198697][ T9181] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 188.619434][ T9184] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 188.629603][ T9184] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 189.262383][ T9204] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1830'. [ 189.658540][ T9224] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 189.761265][ T9224] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 191.159130][ T9261] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1850'. [ 191.173536][ T9263] ieee802154 phy0 wpan0: encryption failed: -22 [ 191.315062][ T9272] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 191.328551][ T9272] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 191.358122][ T9275] ubi1: attaching mtd0 [ 191.376746][ T9275] ubi1 error: ubi_attach_mtd_dev: bad VID header (3) or data offsets (67) [ 191.753661][ T9293] netlink: 24 bytes leftover after parsing attributes in process `syz.7.1862'. [ 192.421054][ T9312] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1865'. [ 193.217540][ T9347] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 193.304370][ T9345] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 193.435300][ T9356] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1877'. [ 193.751478][ C0] vxcan0: j1939_tp_txtimer: 0x00000000e8ec91db: tx aborted with unknown reason: -2 [ 193.756921][ C0] vxcan0: j1939_xtp_rx_abort_one: 0x000000002744d4a6: 0x00000: (250) Any other reason (if a Connection Abort reason is identified that is not listed in the table use code 250) [ 193.761193][ C0] vxcan0: j1939_xtp_rx_abort_one: 0x00000000e8ec91db: 0x00000: (250) Any other reason (if a Connection Abort reason is identified that is not listed in the table use code 250) [ 193.767184][ T9371] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1881'. [ 193.920878][ T9376] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1883'. [ 194.025321][ T9380] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 194.038863][ T9380] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 194.209423][ T9388] 9pnet_virtio: no channels available for device syz [ 194.446401][ T9394] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1891'. [ 194.581485][ T9398] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 194.591109][ T9398] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 195.556635][ T27] audit: type=1326 audit(195.530:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9379 comm="syz.7.1885" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=172 compat=0 ip=0xffffa7b4b64c code=0x7ffc0000 [ 195.563507][ T27] audit: type=1326 audit(195.530:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9379 comm="syz.7.1885" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=139 compat=0 ip=0xffffa898a89c code=0x7ffc0000 [ 195.582764][ T27] audit: type=1326 audit(195.530:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9379 comm="syz.7.1885" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=172 compat=0 ip=0xffffa7b4b64c code=0x7ffc0000 [ 195.598994][ T27] audit: type=1326 audit(195.530:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9379 comm="syz.7.1885" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=139 compat=0 ip=0xffffa898a89c code=0x7ffc0000 [ 195.617127][ T27] audit: type=1326 audit(195.530:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9379 comm="syz.7.1885" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=172 compat=0 ip=0xffffa7b4b64c code=0x7ffc0000 [ 195.634781][ T27] audit: type=1326 audit(195.530:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9379 comm="syz.7.1885" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=139 compat=0 ip=0xffffa898a89c code=0x7ffc0000 [ 195.656595][ T27] audit: type=1326 audit(195.530:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9379 comm="syz.7.1885" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=172 compat=0 ip=0xffffa7b4b64c code=0x7ffc0000 [ 195.679256][ T27] audit: type=1326 audit(195.530:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9379 comm="syz.7.1885" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=139 compat=0 ip=0xffffa898a89c code=0x7ffc0000 [ 195.703282][ T27] audit: type=1326 audit(195.530:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9379 comm="syz.7.1885" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=172 compat=0 ip=0xffffa7b4b64c code=0x7ffc0000 [ 195.727640][ T27] audit: type=1326 audit(195.530:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9379 comm="syz.7.1885" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=139 compat=0 ip=0xffffa898a89c code=0x7ffc0000 [ 196.339404][ T9424] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1901'. [ 196.778193][ T9433] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 196.780298][ T9433] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 198.089113][ T9450] device syzkaller1 entered promiscuous mode [ 198.552968][ T9466] overlayfs: statfs failed on './file0' [ 200.825735][ T9509] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 200.990962][ T9509] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 201.161444][ T9527] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 201.165637][ T9527] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 201.630211][ T9545] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 201.636209][ T9545] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 204.902036][ T4302] Bluetooth: hci1: command 0x0406 tx timeout [ 206.829933][ T9642] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1983'. [ 210.506487][ T9708] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2007'. [ 210.748291][ T9717] netlink: 'syz.1.2005': attribute type 12 has an invalid length. [ 212.100049][ T9737] binder: 9734:9737 ioctl c0306201 0 returned -14 [ 214.751644][ T9798] 9pnet_virtio: no channels available for device syz [ 218.163264][ T4302] Bluetooth: hci3: unexpected cc 0x0c58 length: 1 < 2 [ 219.850362][ T9932] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 220.339902][ T9947] binder: 9946:9947 unknown command 0 [ 220.341476][ T9947] binder: 9946:9947 ioctl c0306201 20000080 returned -22 [ 220.349273][ T9947] binder: 9946:9947 tried to acquire reference to desc 0, got 1 instead [ 220.358455][ T9947] binder_alloc: 9946: binder_alloc_buf size 8 failed, no address space [ 220.361113][ T9947] binder_alloc: allocated: 4096 (num: 1 largest: 4096), free: 0 (num: 0 largest: 0) [ 220.364534][ T9947] binder: cannot allocate buffer: no space left [ 220.364574][ T9947] binder: 9946:9947 transaction async to 9946:0 failed 20/29201/-28, size 0-0 line 3239 [ 220.370336][ T4348] binder: release 9946:9947 transaction 19 out, still active [ 220.372673][ T4348] binder: undelivered TRANSACTION_COMPLETE [ 220.373922][ T4348] binder: undelivered TRANSACTION_ERROR: 29201 [ 220.390453][ T4348] binder: send failed reply for transaction 19, target dead [ 221.291052][ T9979] netlink: 'syz.1.2110': attribute type 21 has an invalid length. [ 221.487369][ T9985] block device autoloading is deprecated and will be removed. [ 221.724745][ T9996] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 221.780172][ T9996] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 221.840930][ T9996] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 221.869590][ T9996] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 221.915865][ T9996] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 221.923656][ T9996] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 221.928047][ T9996] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 222.185455][ T4302] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 222.187766][ T4302] Bluetooth: hci3: Injecting HCI hardware error event [ 222.190767][ T4302] Bluetooth: hci3: hardware error 0x00 [ 223.815825][T10040] binder: 10039:10040 unknown command 0 [ 223.821038][T10040] binder: 10039:10040 ioctl c0306201 20000080 returned -22 [ 223.851263][T10040] binder: 10039:10040 got transaction to invalid handle, 1 [ 223.852950][T10040] binder: 10040:10039 cannot find target node [ 223.854247][T10040] binder: 10039:10040 transaction call to 0:0 failed 23/29201/-22, size 0-0 line 3054 [ 223.864778][ T4349] binder: undelivered TRANSACTION_ERROR: 29201 [ 224.424946][ T4302] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 225.421789][T10074] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2148'. [ 225.434885][T10074] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2148'. [ 226.414302][T10103] kernel profiling enabled (shift: 7) [ 226.727026][T10111] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 226.729122][T10111] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 227.452425][T10128] mmap: syz.7.2169 (10128) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 228.624363][T10145] could not allocate digest TFM handle sha384-avx [ 228.912978][T10156] tipc: Started in network mode [ 228.930630][T10156] tipc: Node identity 7f000001, cluster identity 4711 [ 228.932630][T10156] tipc: Enabled bearer , priority 10 [ 228.942807][T10159] netlink: 'syz.6.2179': attribute type 1 has an invalid length. [ 228.944552][T10159] netlink: 24 bytes leftover after parsing attributes in process `syz.6.2179'. [ 229.858646][T10174] input: syz0 as /devices/virtual/input/input5 [ 229.938909][ T4892] tipc: Node number set to 2130706433 [ 232.846401][T10232] binder: 10231:10232 unknown command 0 [ 232.847714][T10232] binder: 10231:10232 ioctl c0306201 20000080 returned -22 [ 232.860130][T10232] binder: 10231:10232 tried to acquire reference to desc 0, got 1 instead [ 232.900532][ T4349] binder: undelivered TRANSACTION_COMPLETE [ 232.945098][ T4349] binder: undelivered transaction 28, process died. [ 233.923984][T10248] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 233.934132][T10248] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 234.963844][T10267] binder: 10266:10267 unknown command 0 [ 234.977938][T10267] binder: 10266:10267 ioctl c0306201 20000080 returned -22 [ 234.990208][T10267] binder: 10266:10267 tried to acquire reference to desc 0, got 1 instead [ 235.019203][ T4379] binder: undelivered TRANSACTION_COMPLETE [ 235.140558][ T4348] binder: undelivered transaction 33, process died. [ 237.820886][T10312] binder: 10309:10312 unknown command 0 [ 237.822220][T10312] binder: 10309:10312 ioctl c0306201 20000080 returned -22 [ 237.851358][T10312] binder: 10309:10312 got transaction to invalid handle, 1 [ 237.852970][T10312] binder: 10312:10309 cannot find target node [ 237.854257][T10312] binder: 10309:10312 transaction call to 0:0 failed 37/29201/-22, size 0-0 line 3054 [ 237.892882][ T4348] binder: undelivered TRANSACTION_ERROR: 29201 [ 239.673545][T10344] ax25_connect(): syz.1.2245 uses autobind, please contact jreuter@yaina.de [ 240.305692][ C0] Unknown status report in ack skb [ 240.519894][T10363] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 240.526334][T10363] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 243.079151][T10374] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 243.094196][T10374] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 243.142262][T10377] netlink: 134744 bytes leftover after parsing attributes in process `syz.1.2260'. [ 243.174761][T10377] netlink: zone id is out of range [ 243.191325][T10377] netlink: zone id is out of range [ 243.204308][T10377] netlink: zone id is out of range [ 243.212177][T10377] netlink: get zone limit has 4 unknown bytes [ 243.327272][T10380] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 243.338904][T10380] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 245.735552][T10404] could not allocate digest TFM handle sha384-avx [ 246.136885][T10418] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2272'. [ 246.145791][T10418] device vlan2 left promiscuous mode [ 246.170940][T10418] bridge0: port 3(vlan2) entered disabled state [ 246.951058][T10418] device bridge_slave_1 left promiscuous mode [ 246.952567][T10418] bridge0: port 2(bridge_slave_1) entered disabled state [ 247.290882][T10418] device bridge_slave_0 left promiscuous mode [ 247.292308][T10418] bridge0: port 1(bridge_slave_0) entered disabled state [ 248.292305][T10447] netlink: 'syz.1.2280': attribute type 1 has an invalid length. [ 248.438306][T10418] bond0: (slave bridge0): Releasing backup interface [ 248.826643][ T2061] ieee802154 phy0 wpan0: encryption failed: -22 [ 248.828101][ T2061] ieee802154 phy1 wpan1: encryption failed: -22 [ 250.389783][T10477] device syzkaller0 entered promiscuous mode [ 250.510712][ T4308] Bluetooth: hci4: command 0x201b tx timeout [ 250.516356][T10484] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 250.703925][T10484] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 259.578486][T10535] could not allocate digest TFM handle sha384-avx [ 264.792361][ T4308] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 264.816009][ T4308] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 264.830755][ T4308] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 264.865168][ T4308] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 264.886283][ T4308] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 264.900382][ T4308] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 266.984059][ T4308] Bluetooth: hci5: command 0x0409 tx timeout [ 267.093810][ T4308] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 267.097307][ T4308] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 267.105815][ T4308] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 267.121741][ T4308] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 267.135142][ T4308] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 267.142175][ T4308] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 267.168586][ T4308] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 267.173579][ T4306] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 267.182023][ T4308] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 267.209882][ T4308] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 267.228900][ T4308] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 267.240813][ T4308] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 268.026556][ T4308] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 268.034925][ T4308] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 268.042439][ T4308] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 268.063645][ T4308] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 268.073775][ T4308] Bluetooth: hci8: unexpected cc 0x0c25 length: 249 > 3 [ 268.081987][ T4308] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 269.066557][ T4308] Bluetooth: hci5: command 0x041b tx timeout [ 269.227453][ T4308] Bluetooth: hci6: command 0x0409 tx timeout [ 269.305648][ T4308] Bluetooth: hci7: command 0x0409 tx timeout [ 270.107774][ T4308] Bluetooth: hci8: command 0x0409 tx timeout [ 270.188349][T10500] netlink: 'syz.7.2302': attribute type 1 has an invalid length. [ 270.190044][T10500] netlink: 'syz.7.2302': attribute type 4 has an invalid length. [ 270.191739][T10500] netlink: 15334 bytes leftover after parsing attributes in process `syz.7.2302'. [ 270.220565][T10544] sch_tbf: burst 4398 is lower than device lo mtu (65550) ! [ 271.147474][ T4308] Bluetooth: hci5: command 0x040f tx timeout [ 271.201385][T10495] bond0: (slave syz_tun): Releasing backup interface [ 271.330507][ T4302] Bluetooth: hci6: command 0x041b tx timeout [ 271.394100][ T4308] Bluetooth: hci7: command 0x041b tx timeout [ 272.033827][ T1800] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 272.180587][ T4302] Bluetooth: hci8: command 0x041b tx timeout [ 272.863462][ T1800] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 272.974988][ T1800] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 273.083547][ T1800] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 273.129500][T10558] chnl_net:caif_netlink_parms(): no params data found [ 273.186872][T10556] chnl_net:caif_netlink_parms(): no params data found [ 273.220746][ T4302] Bluetooth: hci5: command 0x0419 tx timeout [ 273.277032][T10549] chnl_net:caif_netlink_parms(): no params data found [ 273.316223][T10558] bridge0: port 1(bridge_slave_0) entered blocking state [ 273.317892][T10558] bridge0: port 1(bridge_slave_0) entered disabled state [ 273.320045][T10558] device bridge_slave_0 entered promiscuous mode [ 273.327042][T10558] bridge0: port 2(bridge_slave_1) entered blocking state [ 273.328762][T10558] bridge0: port 2(bridge_slave_1) entered disabled state [ 273.331936][T10558] device bridge_slave_1 entered promiscuous mode [ 273.380613][ T4308] Bluetooth: hci6: command 0x040f tx timeout [ 273.456957][ T1800] tipc: Disabling bearer [ 273.460898][ T4302] Bluetooth: hci7: command 0x040f tx timeout [ 273.462939][ T1800] tipc: Left network mode [ 273.473872][T10558] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 273.508245][T10558] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 273.517010][T10549] bridge0: port 1(bridge_slave_0) entered blocking state [ 273.518739][T10549] bridge0: port 1(bridge_slave_0) entered disabled state [ 273.521853][T10549] device bridge_slave_0 entered promiscuous mode [ 273.530438][T10563] chnl_net:caif_netlink_parms(): no params data found [ 273.561490][T10556] bridge0: port 1(bridge_slave_0) entered blocking state [ 273.563143][T10556] bridge0: port 1(bridge_slave_0) entered disabled state [ 273.565529][T10556] device bridge_slave_0 entered promiscuous mode [ 273.647222][T10549] bridge0: port 2(bridge_slave_1) entered blocking state [ 273.648924][T10549] bridge0: port 2(bridge_slave_1) entered disabled state [ 273.661614][T10549] device bridge_slave_1 entered promiscuous mode [ 273.671813][T10556] bridge0: port 2(bridge_slave_1) entered blocking state [ 273.673384][T10556] bridge0: port 2(bridge_slave_1) entered disabled state [ 273.675611][T10556] device bridge_slave_1 entered promiscuous mode [ 273.852448][T10558] team0: Port device team_slave_0 added [ 273.863509][T10549] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 273.867596][T10549] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 273.886317][T10556] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 273.890207][T10556] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 273.952958][T10558] team0: Port device team_slave_1 added [ 274.129848][T10556] team0: Port device team_slave_0 added [ 274.147110][T10549] team0: Port device team_slave_0 added [ 274.149661][T10558] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 274.151740][T10558] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 274.157342][T10558] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 274.162079][T10549] team0: Port device team_slave_1 added [ 274.165866][T10556] team0: Port device team_slave_1 added [ 274.168061][T10563] bridge0: port 1(bridge_slave_0) entered blocking state [ 274.169594][T10563] bridge0: port 1(bridge_slave_0) entered disabled state [ 274.174051][T10563] device bridge_slave_0 entered promiscuous mode [ 274.177153][T10558] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 274.178650][T10558] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 274.184578][T10558] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 274.260770][ T4308] Bluetooth: hci8: command 0x040f tx timeout [ 274.265461][T10563] bridge0: port 2(bridge_slave_1) entered blocking state [ 274.266997][T10563] bridge0: port 2(bridge_slave_1) entered disabled state [ 274.269501][T10563] device bridge_slave_1 entered promiscuous mode [ 274.275108][T10549] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 274.276720][T10549] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 274.284134][T10549] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 274.354434][T10549] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 274.355891][T10549] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 274.364122][T10549] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 274.372302][T10556] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 274.373896][T10556] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 274.379209][T10556] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 274.383581][T10556] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 274.385112][T10556] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 274.391164][T10556] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 274.478296][T10563] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 274.532539][T10549] device hsr_slave_0 entered promiscuous mode [ 274.561185][T10549] device hsr_slave_1 entered promiscuous mode [ 274.581045][T10549] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 274.582658][T10549] Cannot create hsr debugfs directory [ 274.599121][T10563] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 274.683587][T10558] device hsr_slave_0 entered promiscuous mode [ 274.730964][T10558] device hsr_slave_1 entered promiscuous mode [ 274.761067][T10558] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 274.762803][T10558] Cannot create hsr debugfs directory [ 274.903494][T10556] device hsr_slave_0 entered promiscuous mode [ 274.941508][T10556] device hsr_slave_1 entered promiscuous mode [ 274.980566][T10556] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 274.982323][T10556] Cannot create hsr debugfs directory [ 275.005423][T10563] team0: Port device team_slave_0 added [ 275.086873][T10563] team0: Port device team_slave_1 added [ 275.237758][T10563] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 275.239409][T10563] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 275.245810][T10563] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 275.460730][ T4308] Bluetooth: hci6: command 0x0419 tx timeout [ 275.538879][T10563] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 275.540814][ T4302] Bluetooth: hci7: command 0x0419 tx timeout [ 275.542586][T10563] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 275.548680][T10563] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 276.340840][ T4308] Bluetooth: hci8: command 0x0419 tx timeout [ 276.359163][ T1800] device hsr_slave_0 left promiscuous mode [ 276.406053][ T1800] device hsr_slave_1 left promiscuous mode [ 276.540852][ T1800] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 276.542555][ T1800] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 276.544835][ T1800] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 276.546442][ T1800] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 276.551349][ T1800] device bridge_slave_1 left promiscuous mode [ 276.552812][ T1800] bridge0: port 2(bridge_slave_1) entered disabled state [ 276.611560][ T1800] device bridge_slave_0 left promiscuous mode [ 276.612966][ T1800] bridge0: port 1(bridge_slave_0) entered disabled state [ 277.500778][ T1800] device veth1_macvtap left promiscuous mode [ 277.502307][ T1800] device veth0_macvtap left promiscuous mode [ 277.503797][ T1800] device veth1_vlan left promiscuous mode [ 277.505090][ T1800] device veth0_vlan left promiscuous mode [ 279.256179][ T1800] team0 (unregistering): Port device team_slave_1 removed [ 279.423891][ T1800] team0 (unregistering): Port device team_slave_0 removed [ 279.603985][ T1800] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 279.812110][ T1800] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 282.433761][ T1800] bond0 (unregistering): Released all slaves [ 282.684776][T10563] device hsr_slave_0 entered promiscuous mode [ 282.720959][T10563] device hsr_slave_1 entered promiscuous mode [ 282.760712][T10563] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 282.762307][T10563] Cannot create hsr debugfs directory [ 284.402968][T10704] netlink: 'syz.6.2326': attribute type 4 has an invalid length. [ 284.552552][T10558] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 284.625115][T10558] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 284.695858][T10558] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 285.489010][T10558] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 285.552343][T10549] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 285.592419][T10549] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 285.634385][T10549] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 285.691818][T10549] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 285.974523][ T1800] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 285.977271][ T1800] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 286.153176][T10556] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 286.194978][T10556] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 286.253444][T10556] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 286.272464][T10556] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 286.492630][ T1800] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 286.495361][ T1800] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 286.684133][ T1800] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 286.686380][ T1800] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 286.912339][ T1800] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 286.914669][ T1800] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 286.938687][T10558] 8021q: adding VLAN 0 to HW filter on device bond0 [ 287.005791][ T4543] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 287.008138][ T4543] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 287.023072][T10558] 8021q: adding VLAN 0 to HW filter on device team0 [ 287.048494][ T4408] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 287.051507][ T4408] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 287.053493][ T4408] bridge0: port 1(bridge_slave_0) entered blocking state [ 287.055028][ T4408] bridge0: port 1(bridge_slave_0) entered forwarding state [ 287.056951][ T4408] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 287.111623][ T9723] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 287.114237][ T9723] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 287.116584][ T9723] bridge0: port 2(bridge_slave_1) entered blocking state [ 287.118182][ T9723] bridge0: port 2(bridge_slave_1) entered forwarding state [ 287.157000][ T9440] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 287.159494][ T9440] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 287.188553][ T9440] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 287.195512][ T9440] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 287.197968][ T9440] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 287.221603][T10556] 8021q: adding VLAN 0 to HW filter on device bond0 [ 287.227794][T10549] 8021q: adding VLAN 0 to HW filter on device bond0 [ 287.251732][ T9723] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 287.259009][ T9723] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 287.268804][ T1800] tipc: Disabling bearer [ 287.270103][ T1800] tipc: Disabling bearer [ 287.272676][ T1800] tipc: Left network mode [ 287.437702][ T4543] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 287.439979][ T4543] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 287.447246][ T4543] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 287.456534][ T4543] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 287.522818][T10556] 8021q: adding VLAN 0 to HW filter on device team0 [ 287.722931][ T4543] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 287.776514][ T4543] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 287.870648][ T4543] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 288.271654][ T4543] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 288.408604][T10563] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 288.436846][ T4543] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 288.439153][ T4543] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 288.441503][ T4543] bridge0: port 1(bridge_slave_0) entered blocking state [ 288.443032][ T4543] bridge0: port 1(bridge_slave_0) entered forwarding state [ 288.445053][ T4543] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 288.449163][T10758] netlink: 'syz.6.2331': attribute type 4 has an invalid length. [ 288.521367][T10563] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 288.565689][T10563] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 288.617220][T10549] 8021q: adding VLAN 0 to HW filter on device team0 [ 288.636345][T10774] netlink: 76 bytes leftover after parsing attributes in process `syz.6.2332'. [ 288.659768][T10774] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2332'. [ 288.704199][ T9723] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 288.706557][ T9723] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 288.710890][ T9723] bridge0: port 2(bridge_slave_1) entered blocking state [ 288.712556][ T9723] bridge0: port 2(bridge_slave_1) entered forwarding state [ 288.714590][ T9723] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 288.723498][ T9723] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 288.729954][T10563] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 288.784666][ T9723] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 288.787096][ T9723] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 288.789924][ T9723] bridge0: port 1(bridge_slave_0) entered blocking state [ 288.791539][ T9723] bridge0: port 1(bridge_slave_0) entered forwarding state [ 288.804168][ T9723] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 288.925692][ T9723] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 288.937042][ T9723] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 289.043535][ T9723] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 289.045816][ T9723] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 289.048033][ T9723] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 289.050025][ T9723] bridge0: port 2(bridge_slave_1) entered blocking state [ 289.051583][ T9723] bridge0: port 2(bridge_slave_1) entered forwarding state [ 289.066509][ T9723] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 289.069128][ T9723] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 289.077136][ T9723] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 289.087964][ T9723] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 289.090397][ T9723] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 289.097378][ T9723] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 289.124532][ T9723] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 289.270582][ T9492] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 289.272964][ T9492] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 290.289692][T10549] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 290.294224][T10549] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 290.296691][ T9233] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 290.298889][ T9233] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 290.332316][ T4545] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 290.335898][ T4545] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 291.174133][T10812] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 291.180346][ T4545] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 291.182950][ T4545] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 291.184592][ T4545] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 291.186647][ T4545] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 291.274680][T10558] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 291.291889][T10556] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 291.302103][T10556] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 291.324984][ T4545] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 291.327169][ T4545] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 291.824150][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 291.879064][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 292.397937][T10558] device veth0_vlan entered promiscuous mode [ 292.418701][T10563] 8021q: adding VLAN 0 to HW filter on device bond0 [ 292.429782][T10844] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 292.438296][ T4495] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 292.441474][ T4495] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 292.441574][T10844] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 292.445568][ T4495] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 292.450944][ T4495] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 292.474831][T10558] device veth1_vlan entered promiscuous mode [ 292.851994][ T9634] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 292.853807][ T9634] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 292.862498][T10549] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 292.869530][T10558] device veth0_macvtap entered promiscuous mode [ 292.879811][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 292.884388][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 292.887489][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 292.892169][ T4546] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 292.894369][ T4546] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 292.946288][T10558] device veth1_macvtap entered promiscuous mode [ 292.965255][T10558] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 292.967424][T10558] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 292.969536][T10558] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 292.972317][T10558] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 292.982966][T10558] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 292.987947][T10558] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 293.011802][T10558] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 293.016771][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 293.018913][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 293.021927][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 293.334005][T10556] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 293.346372][T10558] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 293.348500][T10558] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 293.350400][T10558] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 293.353264][T10558] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 293.355437][T10558] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 293.357637][T10558] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 293.361719][T10558] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 293.363393][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 293.365094][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 293.366761][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 293.369062][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 293.376428][T10563] 8021q: adding VLAN 0 to HW filter on device team0 [ 293.434287][ T1800] device hsr_slave_0 left promiscuous mode [ 293.503348][ T1800] device hsr_slave_1 left promiscuous mode [ 293.561135][ T1800] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 293.562913][ T1800] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 293.565142][ T1800] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 293.566667][ T1800] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 293.570033][ T1800] device bridge_slave_1 left promiscuous mode [ 293.574610][ T1800] bridge0: port 2(bridge_slave_1) entered disabled state [ 293.611927][ T1800] device bridge_slave_0 left promiscuous mode [ 293.613413][ T1800] bridge0: port 1(bridge_slave_0) entered disabled state [ 293.810938][ T1800] device veth1_macvtap left promiscuous mode [ 293.812523][ T1800] device veth1_vlan left promiscuous mode [ 293.813738][ T1800] device veth0_vlan left promiscuous mode [ 295.936315][ T1800] team0 (unregistering): Port device team_slave_1 removed [ 296.131806][ T1800] team0 (unregistering): Port device team_slave_0 removed [ 296.341760][ T1800] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 296.594951][ T1800] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 299.073327][ T1800] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 299.112575][ T1800] bond0 (unregistering): Released all slaves [ 299.359293][T10558] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 299.361610][T10558] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 299.363555][T10558] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 299.365521][T10558] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 299.370231][ T9723] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 299.372803][ T9723] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 299.374830][ T9723] bridge0: port 1(bridge_slave_0) entered blocking state [ 299.376403][ T9723] bridge0: port 1(bridge_slave_0) entered forwarding state [ 299.378352][ T9723] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 299.436266][ T4546] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 299.439230][ T4546] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 299.443350][ T4546] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 299.446589][ T4546] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 299.458526][ T4546] bridge0: port 2(bridge_slave_1) entered blocking state [ 299.460060][ T4546] bridge0: port 2(bridge_slave_1) entered forwarding state [ 299.487903][T10916] netlink: 'syz.6.2340': attribute type 1 has an invalid length. [ 299.551481][ T4546] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 299.557377][ T4546] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 299.638153][ T6811] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 299.644151][ T6811] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 299.651747][ T6811] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 299.661863][ T6811] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 299.677013][ T6811] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 299.679505][ T6811] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 299.685780][T10925] ubi0: attaching mtd0 [ 299.687808][T10925] ubi0: scanning is finished [ 299.688810][T10925] ubi0: empty MTD device detected [ 299.692097][ T6811] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 299.705317][ T6811] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 299.709124][T10549] device veth0_vlan entered promiscuous mode [ 299.731618][ T6811] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 299.733886][ T6811] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 299.736657][ T6811] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 299.747548][ T6811] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 299.752712][ T6811] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 299.767141][T10549] device veth1_vlan entered promiscuous mode [ 299.790402][T10563] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 299.825556][T10925] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 299.827150][T10925] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 299.828692][T10925] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 299.840641][T10925] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 299.842386][T10925] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 299.848280][T10925] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 299.850372][T10925] ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 2218596663 [ 299.854233][T10925] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 299.866694][T10930] ubi0: background thread "ubi_bgt0d" started, PID 10930 [ 299.866711][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 299.870151][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 299.907873][ T6811] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 299.910191][ T6811] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 299.913291][ T6811] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 299.954880][ T6811] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 299.957437][ T6811] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 299.974202][ T6811] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 299.979495][ T6811] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 299.996149][T10549] device veth0_macvtap entered promiscuous mode [ 300.008447][T10549] device veth1_macvtap entered promiscuous mode [ 300.060174][ T6811] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 300.069470][ T6811] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 300.165664][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 300.168115][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 300.170269][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 300.173752][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 300.176131][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 300.192211][T10556] device veth0_vlan entered promiscuous mode [ 300.231151][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 300.233306][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 300.248953][T10549] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 300.270750][T10549] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 300.272903][T10549] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 300.275123][T10549] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 300.277118][T10549] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 300.279399][T10549] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 300.314259][T10549] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 300.330501][T10556] device veth1_vlan entered promiscuous mode [ 300.340430][ T6811] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 300.342928][ T6811] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 300.345229][ T6811] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 300.347460][ T6811] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 300.349237][ T6811] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 300.360293][T10563] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 300.369556][T10549] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 300.373257][T10549] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 300.383512][T10549] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 300.385633][T10549] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 300.387778][T10549] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 300.390108][T10549] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 300.401861][T10549] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 300.413860][ T4495] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 300.416263][ T4495] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 300.419863][ T4495] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 300.482107][T10549] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 300.483925][T10549] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 300.485881][T10549] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 300.489136][T10549] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 300.523963][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 300.526516][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 300.552302][T10556] device veth0_macvtap entered promiscuous mode [ 300.558122][T10556] device veth1_macvtap entered promiscuous mode [ 300.643850][T10556] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 300.646050][T10556] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 300.648050][T10556] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 300.677588][T10556] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 300.679740][T10556] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 300.696558][T10556] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 300.698673][T10556] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 300.715886][T10556] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 300.726005][T10556] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 300.736248][T10966] device hsr0 entered promiscuous mode [ 300.739794][T10966] device hsr0 left promiscuous mode [ 300.881520][ T4546] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 300.883934][ T4546] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 300.887591][ T4546] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 300.892912][ T4546] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 300.918962][T10556] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 300.925239][T10556] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 300.929729][T10556] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 300.936155][T10556] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 300.944258][T10556] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 300.948958][T10556] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 300.954306][T10556] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 300.959002][T10556] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 300.985089][T10556] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 301.013119][ T9634] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 301.015645][ T9634] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 301.032896][ T6811] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 301.034821][ T6811] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 301.041238][ T9634] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 301.050338][T10556] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 301.061038][T10556] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 301.062935][T10556] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 301.064843][T10556] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 301.201782][ T9634] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 301.204162][ T9634] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 301.206787][ T9634] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 301.213997][ T9634] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 301.223296][T10986] binder: 10983:10986 Acquire 1 refcount change on invalid ref 0 ret -22 [ 301.225150][T10986] binder: 10983:10986 unknown command 0 [ 301.226391][T10986] binder: 10983:10986 ioctl c0306201 20000080 returned -22 [ 301.249573][ T9440] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 301.652966][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 301.660295][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 302.082465][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 302.084939][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 302.161727][T10563] device veth0_vlan entered promiscuous mode [ 302.170241][T10563] device veth1_vlan entered promiscuous mode [ 302.352959][T10999] netlink: 24 bytes leftover after parsing attributes in process `syz.6.2353'. [ 302.427385][ T39] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 302.431170][ T39] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 302.472901][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 302.513080][ T9440] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 302.515750][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 302.519433][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 302.523036][T11010] input: syz0 as /devices/virtual/input/input6 [ 302.541581][ T9440] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 302.551326][T10563] device veth0_macvtap entered promiscuous mode [ 302.562655][ T9233] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 302.564814][ T9233] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 302.582543][T10563] device veth1_macvtap entered promiscuous mode [ 302.646846][T10563] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 302.651259][T10563] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 302.656672][T10563] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 302.660206][T10563] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 302.666179][T10563] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 302.668587][T10563] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 302.676508][T10563] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 302.678830][T10563] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 302.684857][T10563] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 302.691113][T10563] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 302.698127][T10563] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 302.708828][ T9440] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 302.711411][ T9440] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 302.713867][ T9440] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 302.725135][T10563] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 302.737108][T10563] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 302.755537][T10563] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 302.768535][T10563] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 302.780971][T10563] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 302.791986][T10563] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 302.802774][T10563] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 302.813793][T10563] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 302.825443][T10563] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 302.837698][T10563] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 302.846900][T10563] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 302.855424][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 302.855678][T11020] netlink: 20 bytes leftover after parsing attributes in process `syz.8.2356'. [ 302.857684][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 302.871078][T10563] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 302.888143][T10563] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 302.896473][T10563] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 302.903869][T10563] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 303.067397][ T4546] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 303.080367][ T4546] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 303.090113][ T4546] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 303.146814][T11034] device hsr0 entered promiscuous mode [ 303.149956][T11034] device hsr0 left promiscuous mode [ 303.369295][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 303.371419][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 303.376348][ T9233] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 304.612846][T11065] 9pnet_fd: Insufficient options for proto=fd [ 305.088259][T11061] netlink: 'syz.9.2365': attribute type 10 has an invalid length. [ 305.170223][T11061] team0: Port device geneve1 added [ 306.186048][ T27] kauditd_printk_skb: 692 callbacks suppressed [ 306.186063][ T27] audit: type=1326 audit(306.160:719): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11106 comm="syz.6.2377" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9bd53b68 code=0x7fc00000 [ 306.823283][ T27] audit: type=1326 audit(306.800:720): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11106 comm="syz.6.2377" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=20 compat=0 ip=0xffff9bd53b68 code=0x7fc00000 [ 306.828896][ T27] audit: type=1326 audit(306.800:721): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11106 comm="syz.6.2377" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9bd53b68 code=0x7fc00000 [ 306.850561][ T27] audit: type=1326 audit(306.820:722): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11106 comm="syz.6.2377" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9bd53b68 code=0x7fc00000 [ 306.865066][ T27] audit: type=1326 audit(306.820:723): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11106 comm="syz.6.2377" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9bd53b68 code=0x7fc00000 [ 306.901042][ T27] audit: type=1326 audit(306.820:724): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11106 comm="syz.6.2377" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9bd53b68 code=0x7fc00000 [ 306.926186][ T27] audit: type=1326 audit(306.820:725): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11106 comm="syz.6.2377" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9bd53b68 code=0x7fc00000 [ 307.320070][ T27] audit: type=1326 audit(306.820:726): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11106 comm="syz.6.2377" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9bd53b68 code=0x7fc00000 [ 307.357279][ T27] audit: type=1326 audit(306.820:727): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11106 comm="syz.6.2377" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9bd53b68 code=0x7fc00000 [ 307.387748][ T27] audit: type=1326 audit(306.820:728): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11106 comm="syz.6.2377" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9bd53b68 code=0x7fc00000 [ 307.682818][T11139] binder: 11134:11139 got transaction to invalid handle, 1 [ 307.690209][T11139] binder: 11139:11134 cannot find target node [ 307.698598][T11139] binder: 11134:11139 transaction call to 0:0 failed 40/29201/-22, size 88-24 line 3054 [ 308.279474][T11151] netlink: 16 bytes leftover after parsing attributes in process `syz.9.2386'. [ 308.467482][ T4349] binder: undelivered TRANSACTION_ERROR: 29201 [ 308.469558][T11135] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 308.490985][T11135] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 308.492805][T11135] Bluetooth: hci1: Suspend notifier action (1) failed: -4 [ 308.494695][T11135] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 308.495985][T11135] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 308.497252][T11135] Bluetooth: hci5: Suspend notifier action (1) failed: -4 [ 308.498782][T11135] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 308.500124][T11135] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 308.527521][T11135] Bluetooth: hci6: Suspend notifier action (1) failed: -4 [ 308.529212][T11135] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 308.532420][T11135] Bluetooth: hci7: Opcode 0x0406 failed: -4 [ 308.533806][T11135] Bluetooth: hci7: Suspend notifier action (1) failed: -4 [ 308.540225][T11135] Bluetooth: hci8: Opcode 0x0c1a failed: -4 [ 308.541687][T11135] Bluetooth: hci8: Opcode 0x0406 failed: -4 [ 308.542893][T11135] Bluetooth: hci8: Suspend notifier action (1) failed: -4 [ 308.708766][T11167] binder: 11166:11167 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 308.721850][T11167] binder: 11167 RLIMIT_NICE not set [ 308.761461][T11173] binder: 11166:11173 tried to acquire reference to desc 0, got 1 instead [ 308.766902][T11173] binder: 11166:11173 got reply transaction with no transaction stack [ 308.768681][T11173] binder: 11166:11173 transaction reply to 0:0 failed 47/29201/-71, size 0-0 line 2955 [ 308.778640][T11167] binder: 11167 RLIMIT_NICE not set [ 308.802900][ T4349] binder: release 11166:11167 transaction 46 in, still active [ 308.804608][ T4349] binder: send failed reply for transaction 46 to 11166:11173 [ 308.807292][ T4349] binder: undelivered TRANSACTION_ERROR: 29201 [ 308.866213][ T4349] binder: undelivered TRANSACTION_COMPLETE [ 308.867437][ T4349] binder: undelivered TRANSACTION_ERROR: 29189 [ 309.282637][T11196] netlink: 16 bytes leftover after parsing attributes in process `syz.8.2399'. [ 309.470905][ T4302] Bluetooth: hci5: unexpected event for opcode 0x0c25 [ 309.780572][ T4302] Bluetooth: hci1: command 0x0c1a tx timeout [ 309.794319][T11224] nvme_fabrics: unknown parameter or missing value '' in ctrl creation request [ 310.004937][T11235] netlink: 16 bytes leftover after parsing attributes in process `syz.8.2413'. [ 310.263378][ T2061] ieee802154 phy0 wpan0: encryption failed: -22 [ 310.266621][ T2061] ieee802154 phy1 wpan1: encryption failed: -22 [ 310.542534][ T4308] Bluetooth: hci6: command 0x0c1a tx timeout [ 310.606836][ T4302] Bluetooth: hci7: command 0x0c1a tx timeout [ 310.614798][ T4308] Bluetooth: hci8: command 0x0c1a tx timeout [ 311.122772][T11244] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 311.124773][T11244] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 311.211899][T11248] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2416'. [ 311.215797][T11248] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2416'. [ 311.364386][ T27] kauditd_printk_skb: 62 callbacks suppressed [ 311.364399][ T27] audit: type=1326 audit(311.340:791): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11251 comm="syz.9.2417" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffa7353b68 code=0x7ffc0000 [ 311.385322][ T27] audit: type=1326 audit(311.360:792): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11251 comm="syz.9.2417" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=218 compat=0 ip=0xffffa7353b68 code=0x7ffc0000 [ 311.408761][ T27] audit: type=1326 audit(311.370:793): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11251 comm="syz.9.2417" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffa7353b68 code=0x7ffc0000 [ 311.438567][ T27] audit: type=1326 audit(311.370:794): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11251 comm="syz.9.2417" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffa7353b68 code=0x7ffc0000 [ 311.531793][T11260] netlink: 68 bytes leftover after parsing attributes in process `syz.9.2419'. [ 311.539180][ T27] audit: type=1326 audit(311.510:795): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11254 comm="syz.0.2418" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffb2b53b68 code=0x7fc00000 [ 311.860597][ T4302] Bluetooth: hci1: command 0x0406 tx timeout [ 312.027211][T11279] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2424'. [ 312.232722][T11292] tipc: Started in network mode [ 312.233839][T11292] tipc: Node identity ce19945b16d9, cluster identity 4711 [ 312.235478][T11292] tipc: Enabled bearer , priority 0 [ 312.276588][T11292] device syzkaller0 entered promiscuous mode [ 312.278499][T11292] tipc: Resetting bearer [ 312.294635][ T27] audit: type=1326 audit(312.270:796): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11254 comm="syz.0.2418" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=20 compat=0 ip=0xffffb2b53b68 code=0x7fc00000 [ 312.299430][ T27] audit: type=1326 audit(312.270:797): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11254 comm="syz.0.2418" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffb2b53b68 code=0x7fc00000 [ 312.339928][ T27] audit: type=1326 audit(312.270:798): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11254 comm="syz.0.2418" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffb2b53b68 code=0x7fc00000 [ 312.350125][ T27] audit: type=1326 audit(312.270:799): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11254 comm="syz.0.2418" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffb2b53b68 code=0x7fc00000 [ 312.372564][ T27] audit: type=1326 audit(312.270:800): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11254 comm="syz.0.2418" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffb2b53b68 code=0x7fc00000 [ 312.399044][T11291] tipc: Resetting bearer [ 312.409104][T11299] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 312.421152][T11299] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 312.438761][T11298] netlink: 68 bytes leftover after parsing attributes in process `syz.8.2430'. [ 312.590783][ T4308] Bluetooth: hci6: command 0x0406 tx timeout [ 312.660607][ T4302] Bluetooth: hci7: command 0x0406 tx timeout [ 312.662163][ T4302] Bluetooth: hci8: command 0x0406 tx timeout [ 313.054974][T11314] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 313.059657][T11314] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 313.169706][T11318] binder: 11317:11318 tried to acquire reference to desc 0, got 1 instead [ 313.239859][T11319] binder: 11317:11319 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 313.240660][ T4346] tipc: Node number set to 3636499547 [ 313.242822][T11319] binder: 11319 RLIMIT_NICE not set [ 313.245121][T11319] binder: 11319 RLIMIT_NICE not set [ 313.246220][T11319] binder: send failed reply for transaction 52 to 11317:11318 [ 313.249635][T11319] binder: 11317:11319 ioctl c0306201 20000180 returned -14 [ 313.312870][T11321] netlink: 16 bytes leftover after parsing attributes in process `syz.9.2437'. [ 315.332053][T11341] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 315.334743][T11341] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 324.273523][T11291] tipc: Disabling bearer [ 324.290806][T11355] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2446'. [ 324.300740][T11361] netlink: 'syz.9.2449': attribute type 1 has an invalid length. [ 324.302357][T11361] netlink: 'syz.9.2449': attribute type 2 has an invalid length. [ 324.422389][T11369] tmpfs: Bad value for 'mpol' [ 324.461575][T11370] process 'syz.4.2452' launched './file1' with NULL argv: empty string added [ 324.728498][T11388] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 324.767560][T11388] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 324.952745][T11395] netlink: 'syz.8.2456': attribute type 10 has an invalid length. [ 325.032770][T11395] team0: Port device netdevsim0 added [ 325.045695][T11398] netlink: 'syz.8.2456': attribute type 10 has an invalid length. [ 325.118975][T11398] team0: Port device netdevsim0 removed [ 325.128421][T11398] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 325.545004][T11414] binder: 11411:11414 ERROR: BC_REGISTER_LOOPER called without request [ 325.546859][T11414] binder: 11411:11414 BC_FREE_BUFFER u0000000020ffd000 no match [ 325.548604][T11414] binder: 11411:11414 Release 1 refcount change on invalid ref 0 ret -22 [ 325.560572][T11414] binder: 11411:11414 BC_INCREFS_DONE u0000000000000003 no match [ 325.562639][T11418] netlink: 68 bytes leftover after parsing attributes in process `syz.0.2462'. [ 325.571341][T11414] binder: 11414 RLIMIT_NICE not set [ 325.760409][T11428] batman_adv: batadv0: Adding interface: ip6gretap1 [ 325.761995][T11428] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 325.804153][T11428] batman_adv: batadv0: Interface activated: ip6gretap1 [ 326.640605][T11451] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 326.668512][T11451] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 327.233103][T11468] netlink: 68 bytes leftover after parsing attributes in process `syz.9.2475'. [ 328.627212][T11488] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2480'. [ 328.629050][T11488] device macsec0 entered promiscuous mode [ 329.069713][T11517] netlink: 68 bytes leftover after parsing attributes in process `syz.8.2487'. [ 333.117523][ T27] kauditd_printk_skb: 99 callbacks suppressed [ 333.117538][ T27] audit: type=1326 audit(333.090:900): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11590 comm="syz.4.2503" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff95953b68 code=0x7fc00000 [ 333.145525][T11599] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2504'. [ 333.147589][T11599] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2504'. [ 333.154626][T11599] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2504'. [ 333.162315][T11599] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2504'. [ 334.239193][ T27] audit: type=1326 audit(334.210:901): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11590 comm="syz.4.2503" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=20 compat=0 ip=0xffff95953b68 code=0x7fc00000 [ 334.270424][ T27] audit: type=1326 audit(334.240:902): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11590 comm="syz.4.2503" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff95953b68 code=0x7fc00000 [ 334.275533][ T27] audit: type=1326 audit(334.250:903): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11590 comm="syz.4.2503" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff95953b68 code=0x7fc00000 [ 334.290677][ T27] audit: type=1326 audit(334.250:904): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11590 comm="syz.4.2503" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff95953b68 code=0x7fc00000 [ 334.295328][ T27] audit: type=1326 audit(334.250:905): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11590 comm="syz.4.2503" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff95953b68 code=0x7fc00000 [ 334.299863][ T27] audit: type=1326 audit(334.250:906): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11590 comm="syz.4.2503" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff95953b68 code=0x7fc00000 [ 334.389401][ T27] audit: type=1326 audit(334.250:907): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11590 comm="syz.4.2503" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff95953b68 code=0x7fc00000 [ 334.409005][ T27] audit: type=1326 audit(334.250:908): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11590 comm="syz.4.2503" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff95953b68 code=0x7fc00000 [ 334.428538][ T27] audit: type=1326 audit(334.280:909): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11590 comm="syz.4.2503" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff95953b68 code=0x7fc00000 [ 334.558160][T11623] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 334.560241][T11623] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 334.687684][T11630] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 334.695938][T11630] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 336.504649][ T4308] Bluetooth: hci8: command 0x0405 tx timeout [ 337.759387][T11672] binder: BINDER_SET_CONTEXT_MGR already set [ 337.800836][T11672] binder: 11671:11672 ioctl 4018620d 20000040 returned -16 [ 338.585480][ T4302] Bluetooth: hci8: command 0x0405 tx timeout [ 340.255816][T11759] binder: BINDER_SET_CONTEXT_MGR already set [ 340.257233][T11759] binder: 11758:11759 ioctl 4018620d 20000040 returned -16 [ 340.677177][ T4308] Bluetooth: hci8: command 0x0405 tx timeout [ 340.809164][T11772] netlink: 277 bytes leftover after parsing attributes in process `syz.6.2539'. [ 341.524230][T11781] netlink: 104 bytes leftover after parsing attributes in process `syz.0.2543'. [ 341.944935][T11800] binder: BINDER_SET_CONTEXT_MGR already set [ 341.946279][T11800] binder: 11799:11800 ioctl 4018620d 20000040 returned -16 [ 342.816648][T11807] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 342.818830][T11807] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 343.873681][T11837] binder: 11835:11837 ioctl c0306201 0 returned -14 [ 343.878258][T11837] binder: 11835:11837 got transaction to invalid handle, 1 [ 343.881492][T11837] binder: 11837:11835 cannot find target node [ 343.882757][T11837] binder: 11835:11837 transaction call to 0:0 failed 60/29201/-22, size 0-0 line 3054 [ 343.885422][ T4348] binder: undelivered TRANSACTION_ERROR: 29201 [ 344.605153][T11838] could not allocate digest TFM handle sha384-avx [ 344.747084][T11847] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 344.749123][T11847] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 345.883854][T11871] Illegal XDP return value 2262616320 on prog (id 45) dev N/A, expect packet loss! [ 346.182844][T11885] binder: 11883:11885 ioctl c0306201 0 returned -14 [ 346.189926][T11885] binder: 11883:11885 got transaction to invalid handle, 1 [ 346.195447][T11885] binder: 11885:11883 cannot find target node [ 346.199212][T11885] binder: 11883:11885 transaction call to 0:0 failed 64/29201/-22, size 0-0 line 3054 [ 346.205506][ T4894] binder: undelivered TRANSACTION_ERROR: 29201 [ 347.191259][T11898] could not allocate digest TFM handle sha384-avx [ 347.411742][T11912] 9pnet_fd: Insufficient options for proto=fd [ 347.428680][T11913] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 347.458463][T11913] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 347.736858][T11924] Cannot find del_set index 1 as target [ 349.047434][T11945] binder: 11944:11945 ioctl c0306201 0 returned -14 [ 349.065775][T11945] binder: 11944:11945 got transaction to invalid handle, 1 [ 349.067476][T11945] binder: 11945:11944 cannot find target node [ 349.068824][T11945] binder: 11944:11945 transaction call to 0:0 failed 68/29201/-22, size 0-0 line 3054 [ 349.088746][ T4346] binder: undelivered TRANSACTION_ERROR: 29201 [ 350.097257][T11965] could not allocate digest TFM handle sha384-avx [ 351.577444][T12000] binder: 11999:12000 got transaction to invalid handle, 1 [ 351.589302][T12000] binder: 12000:11999 cannot find target node [ 351.591649][T12000] binder: 11999:12000 transaction call to 0:0 failed 72/29201/-22, size 0-0 line 3054 [ 351.755608][ T24] binder: undelivered TRANSACTION_ERROR: 29201 [ 352.518569][T12022] netlink: 'syz.4.2601': attribute type 8 has an invalid length. [ 352.568675][T12022] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2601'. [ 353.740663][T12036] could not allocate digest TFM handle sha384-avx [ 354.373478][T12048] netlink: 424 bytes leftover after parsing attributes in process `syz.4.2606'. [ 354.828531][T12069] binder: 12067:12069 got transaction to invalid handle, 1 [ 354.835671][T12069] binder: 12069:12067 cannot find target node [ 354.840934][T12069] binder: 12067:12069 transaction call to 0:0 failed 76/29201/-22, size 0-0 line 3054 [ 354.848504][ T4348] binder: undelivered TRANSACTION_ERROR: 29201 [ 356.951066][T12100] could not allocate digest TFM handle sha384-avx [ 357.083575][T12109] binder: 12108:12109 got transaction to invalid handle, 1 [ 357.093807][T12109] binder: 12109:12108 cannot find target node [ 357.098415][T12109] binder: 12108:12109 transaction call to 0:0 failed 80/29201/-22, size 0-0 line 3054 [ 357.118896][ T4349] binder: undelivered TRANSACTION_ERROR: 29201 [ 357.735685][T12121] netlink: 424 bytes leftover after parsing attributes in process `syz.0.2621'. [ 358.376730][T12127] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 358.378771][T12127] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 358.468561][T12140] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 358.478093][T12140] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 360.077064][T12176] binder: 12174:12176 got transaction to invalid handle, 1 [ 360.078861][T12176] binder: 12176:12174 cannot find target node [ 360.097123][T12176] binder: 12174:12176 transaction call to 0:0 failed 84/29201/-22, size 0-0 line 3054 [ 360.109943][ T14] binder: undelivered TRANSACTION_ERROR: 29201 [ 360.174143][T12161] could not allocate digest TFM handle sha384-avx [ 362.115616][ T51] block nbd0: Attempted send on invalid socket [ 362.117436][ T51] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 362.121723][T12224] MINIX-fs: unable to read superblock [ 362.406518][T12233] binder: 12232:12233 got transaction to invalid handle, 1 [ 362.423036][T12233] binder: 12233:12232 cannot find target node [ 362.429676][T12233] binder: 12232:12233 transaction call to 0:0 failed 88/29201/-22, size 0-0 line 3054 [ 362.583414][ T4349] binder: undelivered TRANSACTION_ERROR: 29201 [ 362.810996][T12235] could not allocate digest TFM handle sha384-avx [ 363.000053][T12261] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 363.020844][T12261] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 363.023958][ T4308] Bluetooth: hci1: ISO packet for unknown connection handle 0 [ 363.995768][T12283] binder: 12282:12283 got transaction to invalid handle, 1 [ 364.005091][T12283] binder: 12283:12282 cannot find target node [ 364.006340][T12283] binder: 12282:12283 transaction call to 0:0 failed 92/29201/-22, size 0-0 line 3054 [ 364.021959][ T4379] binder: undelivered TRANSACTION_ERROR: 29201 [ 365.171282][T12296] could not allocate digest TFM handle sha384-avx [ 365.377114][T12326] device bridge0 entered promiscuous mode [ 365.719622][T12342] binder: 12337:12342 unknown command 0 [ 365.752543][T12342] binder: 12337:12342 ioctl c0306201 20000080 returned -22 [ 366.006755][T12342] binder: 12337:12342 got transaction to invalid handle, 1 [ 366.023321][T12342] binder: 12342:12337 cannot find target node [ 366.032811][T12342] binder: 12337:12342 transaction call to 0:0 failed 95/29201/-22, size 0-0 line 3054 [ 366.060945][ T4346] binder: undelivered TRANSACTION_ERROR: 29201 [ 366.433823][T12359] netlink: 16 bytes leftover after parsing attributes in process `syz.8.2677'. [ 366.528579][T12356] sctp: [Deprecated]: syz.9.2675 (pid 12356) Use of int in max_burst socket option. [ 366.528579][T12356] Use struct sctp_assoc_value instead [ 366.585652][T12356] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 366.587528][T12356] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 366.980060][T12388] binder: 12387:12388 unknown command 0 [ 366.986753][T12388] binder: 12387:12388 ioctl c0306201 20000080 returned -22 [ 366.994854][T12388] binder: 12387:12388 got transaction to invalid handle, 1 [ 366.996436][T12388] binder: 12388:12387 cannot find target node [ 366.997927][T12388] binder: 12387:12388 transaction call to 0:0 failed 98/29201/-22, size 0-0 line 3054 [ 367.008572][ T4346] binder: undelivered TRANSACTION_ERROR: 29201 [ 368.590469][ C1] sched: RT throttling activated [ 368.936082][T12409] netlink: 16 bytes leftover after parsing attributes in process `syz.8.2688'. [ 369.456653][ T27] kauditd_printk_skb: 6 callbacks suppressed [ 369.456666][ T27] audit: type=1326 audit(369.430:916): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12420 comm="syz.6.2690" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9bd53b68 code=0x7fc00000 [ 369.556974][ C1] TCP: request_sock_TCP: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 369.736108][T12441] [ 369.736662][T12441] ====================================================== [ 369.738203][T12441] WARNING: possible circular locking dependency detected [ 369.739878][T12441] 6.1.121-syzkaller #0 Tainted: G W [ 369.741316][T12441] ------------------------------------------------------ [ 369.742857][T12441] syz.8.2692/12441 is trying to acquire lock: [ 369.744192][T12441] ffff0000e46f8910 ((work_completion)(&new_smc->smc_listen_work)){+.+.}-{0:0}, at: __flush_work+0xd0/0x1c0 [ 369.746692][T12441] [ 369.746692][T12441] but task is already holding lock: [ 369.748329][T12441] ffff0000cda88130 (sk_lock-AF_SMC/1){+.+.}-{0:0}, at: smc_release+0x1e8/0x528 [ 369.750207][T12441] [ 369.750207][T12441] which lock already depends on the new lock. [ 369.750207][T12441] [ 369.752387][T12441] [ 369.752387][T12441] the existing dependency chain (in reverse order) is: [ 369.754281][T12441] [ 369.754281][T12441] -> #1 (sk_lock-AF_SMC/1){+.+.}-{0:0}: [ 369.755971][T12441] lock_sock_nested+0x78/0x138 [ 369.757179][T12441] smc_listen_out+0x114/0x3c4 [ 369.758332][T12441] smc_listen_work+0x1e4/0x1038 [ 369.759581][T12441] process_one_work+0x7ac/0x1404 [ 369.760775][T12441] worker_thread+0x8e4/0xfec [ 369.761940][T12441] kthread+0x250/0x2d8 [ 369.762907][T12441] ret_from_fork+0x10/0x20 [ 369.763954][T12441] [ 369.763954][T12441] -> #0 ((work_completion)(&new_smc->smc_listen_work)){+.+.}-{0:0}: [ 369.766091][T12441] __lock_acquire+0x3338/0x7680 [ 369.767307][T12441] lock_acquire+0x26c/0x7cc [ 369.768505][T12441] __flush_work+0xf8/0x1c0 [ 369.769619][T12441] __cancel_work_timer+0x3ec/0x548 [ 369.770820][T12441] cancel_work_sync+0x24/0x38 [ 369.772020][T12441] smc_clcsock_release+0x64/0xec [ 369.773266][T12441] __smc_release+0x55c/0x700 [ 369.774358][T12441] smc_close_non_accepted+0xd8/0x260 [ 369.775470][T12441] smc_close_active+0x9bc/0xd20 [ 369.776719][T12441] __smc_release+0xa0/0x700 [ 369.777805][T12441] smc_release+0x260/0x528 [ 369.778823][T12441] sock_close+0xb8/0x1fc [ 369.779826][T12441] __fput+0x1c8/0x7c8 [ 369.780810][T12441] ____fput+0x20/0x30 [ 369.781899][T12441] task_work_run+0x240/0x2f0 [ 369.783045][T12441] do_notify_resume+0x2080/0x2cb8 [ 369.784181][T12441] el0_svc+0x9c/0x168 [ 369.785076][T12441] el0t_64_sync_handler+0x84/0xf0 [ 369.786295][T12441] el0t_64_sync+0x18c/0x190 [ 369.787378][T12441] [ 369.787378][T12441] other info that might help us debug this: [ 369.787378][T12441] [ 369.789641][T12441] Possible unsafe locking scenario: [ 369.789641][T12441] [ 369.791255][T12441] CPU0 CPU1 [ 369.792476][T12441] ---- ---- [ 369.793571][T12441] lock(sk_lock-AF_SMC/1); [ 369.794442][T12441] lock((work_completion)(&new_smc->smc_listen_work)); [ 369.796544][T12441] lock(sk_lock-AF_SMC/1); [ 369.798097][T12441] lock((work_completion)(&new_smc->smc_listen_work)); [ 369.799563][T12441] [ 369.799563][T12441] *** DEADLOCK *** [ 369.799563][T12441] [ 369.801279][T12441] 2 locks held by syz.8.2692/12441: [ 369.802463][T12441] #0: ffff0000e2b0be10 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: sock_close+0x80/0x1fc [ 369.804667][T12441] #1: ffff0000cda88130 (sk_lock-AF_SMC/1){+.+.}-{0:0}, at: smc_release+0x1e8/0x528 [ 369.806739][T12441] [ 369.806739][T12441] stack backtrace: [ 369.808091][T12441] CPU: 1 PID: 12441 Comm: syz.8.2692 Tainted: G W 6.1.121-syzkaller #0 [ 369.810077][T12441] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 369.812306][T12441] Call trace: [ 369.812994][T12441] dump_backtrace+0x1c8/0x1f4 [ 369.814078][T12441] show_stack+0x2c/0x3c [ 369.814966][T12441] dump_stack_lvl+0x108/0x170 [ 369.815982][T12441] dump_stack+0x1c/0x58 [ 369.816866][T12441] print_circular_bug+0x150/0x1b8 [ 369.817963][T12441] check_noncircular+0x2cc/0x378 [ 369.819032][T12441] __lock_acquire+0x3338/0x7680 [ 369.820132][T12441] lock_acquire+0x26c/0x7cc [ 369.821186][T12441] __flush_work+0xf8/0x1c0 [ 369.822206][T12441] __cancel_work_timer+0x3ec/0x548 [ 369.823332][T12441] cancel_work_sync+0x24/0x38 [ 369.824256][T12441] smc_clcsock_release+0x64/0xec [ 369.825268][T12441] __smc_release+0x55c/0x700 [ 369.826212][T12441] smc_close_non_accepted+0xd8/0x260 [ 369.827377][T12441] smc_close_active+0x9bc/0xd20 [ 369.828412][T12441] __smc_release+0xa0/0x700 [ 369.829413][T12441] smc_release+0x260/0x528 [ 369.830274][T12441] sock_close+0xb8/0x1fc [ 369.831136][T12441] __fput+0x1c8/0x7c8 [ 369.831942][T12441] ____fput+0x20/0x30 [ 369.832830][T12441] task_work_run+0x240/0x2f0 [ 369.833814][T12441] do_notify_resume+0x2080/0x2cb8 [ 369.834852][T12441] el0_svc+0x9c/0x168 [ 369.835716][T12441] el0t_64_sync_handler+0x84/0xf0 [ 369.836686][T12441] el0t_64_sync+0x18c/0x190 [ 369.837746][ C1] vkms_vblank_simulate: vblank timer overrun [ 370.174641][ T27] audit: type=1326 audit(370.150:917): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12420 comm="syz.6.2690" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=20 compat=0 ip=0xffff9bd53b68 code=0x7fc00000 [ 370.178973][ T27] audit: type=1326 audit(370.150:918): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12420 comm="syz.6.2690" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9bd53b68 code=0x7fc00000 [ 370.194488][ T27] audit: type=1326 audit(370.150:919): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12420 comm="syz.6.2690" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9bd53b68 code=0x7fc00000 [ 370.200187][ T27] audit: type=1326 audit(370.150:920): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12420 comm="syz.6.2690" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9bd53b68 code=0x7fc00000 [ 370.208750][ T27] audit: type=1326 audit(370.150:921): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12420 comm="syz.6.2690" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9bd53b68 code=0x7fc00000 [ 370.216357][ T27] audit: type=1326 audit(370.150:922): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12420 comm="syz.6.2690" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9bd53b68 code=0x7fc00000 [ 370.225245][ T27] audit: type=1326 audit(370.150:923): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12420 comm="syz.6.2690" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9bd53b68 code=0x7fc00000 [ 370.229817][ T27] audit: type=1326 audit(370.150:924): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12420 comm="syz.6.2690" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9bd53b68 code=0x7fc00000 [ 370.236372][ T27] audit: type=1326 audit(370.150:925): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12420 comm="syz.6.2690" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff9bd53b68 code=0x7fc00000 [ 371.701330][ T2061] ieee802154 phy0 wpan0: encryption failed: -22 [ 371.702665][ T2061] ieee802154 phy1 wpan1: encryption failed: -22