last executing test programs: 2m49.697103859s ago: executing program 0 (id=90): openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) pwritev2(0xffffffffffffffff, 0x0, 0x0, 0x7000, 0x0, 0x3) listen(r0, 0xfffffffc) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, &(0x7f00000000c0)="2ef2dd050080000048b844410000000000000f23d00f21f835000000010f23f836362e6726af440f20c0350e000000440f22c0b805000000b9009800000f01d90f01c965470f01c4410f79d226450f01cb660f013b", 0x55}], 0x1, 0x0, 0x0, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000400)={0x0, 0x1802, &(0x7f00000003c0)={&(0x7f00000004c0)={0x30, 0x0, 0x1, 0x70bd2c, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x1c}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}]}, 0x30}, 0x1, 0xff07}, 0x2000000) 2m49.0701058s ago: executing program 0 (id=91): r0 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x80044940, &(0x7f0000001fc0)) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$IMADDTIMER(r0, 0x80044940, &(0x7f00000000c0)=0x14) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r2, 0x0, 0xd}, 0x18) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r4) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(camellia)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c2", 0x17) r6 = accept4(r5, 0x0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003100)=@newtaction={0xacc, 0x30, 0x800, 0x70bd2a, 0x25dfdbfc, {}, [{0x914, 0x1, [@m_ipt={0x278, 0x17, 0x0, 0x0, {{0x8}, {0x1bc, 0x2, 0x0, 0x1, [@TCA_IPT_TARG={0xf1, 0x6, {0x0, 'raw\x00', 0xe, 0xb3, "01df771ed4aa468d466490bb6d3a762752b0276450737133d354ea68c13a92efe99064741e04d8a20e194e30a60295d386bccda0f3007979597e6d03b954a8f914ba7b899f16c20d6d72edd9b6f52db88f3ba2e308499f6252662a51fa4b12868b58f75e27ec9103b8068b9b811e21bd2aa37e31ee1bb8e60ecb8155c8e19ea1c7fdbb9aa819059c61aa86c434a7c8da18ab573d7585bec9c1d4494956d182e7b35a526fd48659ab60beb8f339651c715661a36a876cce3dd7a98863f318caef99752c65346980"}}, @TCA_IPT_TABLE={0x24, 0x1, 'filter\x00'}, @TCA_IPT_HOOK={0x8, 0x2, 0x2}, @TCA_IPT_TABLE={0x24, 0x1, 'nat\x00'}, @TCA_IPT_TABLE={0x24, 0x1, 'mangle\x00'}, @TCA_IPT_TARG={0x3d, 0x6, {0xff3b, 'nat\x00', 0x6a, 0xfff, "ec6c358b1b02688c45d6891b8d39befc710e9c"}}, @TCA_IPT_INDEX={0x8, 0x3, 0x3ff}, @TCA_IPT_HOOK={0x8}]}, {0x95, 0x6, "33c428b1016ea0e62b6c917780554ec63a01a7382016d430730d1158d5469fa35f73d351ec348637d292a8c8699738644c304a14a0ca2e2c1422d9493ae361a88a61e76022334cc9eff1d9b15acf815ab9bf490688724773d3775e92953306fa3923bf0b3eb78ed4c4e43760fb360a12727f0000004fe4c5639595b4ce1706ccb85c9b5872240c31834297cfb06b7eaaa1"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x1}}}}, @m_ipt={0x17c, 0x11, 0x0, 0x0, {{0x8}, {0xf0, 0x2, 0x0, 0x1, [@TCA_IPT_TARG={0xb5, 0x6, {0x7, 'mangle\x00', 0x4, 0x7, "852c07967e4bde8acbdebf709c7f67b435415e9fad5eed399218069c30b3db399d5bdbdffc09aa13d6aef79a3360cf4b7d5e8a92b817394560aba652eb4e4ec31470dd9b8becbf6cad6f3328aec2ac14541a30a5f89f2a6e60534a70c1deccc519f73984d6d2ae8b9fe17278f03e9f60e876c3b1fc1ef49873f24bd44137256bfd0a27e100d2162e3f7b17"}}, @TCA_IPT_HOOK={0x8, 0x2, 0x5}, @TCA_IPT_HOOK={0x8, 0x2, 0x2}, @TCA_IPT_TABLE={0x24, 0x1, 'nat\x00'}]}, {0x65, 0x6, "195244b493b69a109e343c48236a318aa067ccccb2000506f4e63246fce6276de9355aae82ccf014b3a51009a53cc597e7eec180e252560262d28e1340152b8389fc3dcbd1c60cbef5aa738a80d9582b7bf553a33208654c9b7b642eb56b8a9716"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_ipt={0x154, 0x17, 0x0, 0x0, {{0x8}, {0xa4, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x7}, @TCA_IPT_TABLE={0x24, 0x1, 'security\x00'}, @TCA_IPT_TABLE={0x24, 0x1, 'raw\x00'}, @TCA_IPT_TABLE={0x24, 0x1, 'mangle\x00'}, @TCA_IPT_TABLE={0x24, 0x1, 'raw\x00'}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0x89, 0x6, "828d51b8c024f3ba75276291fd744bf1d83ac94c40f59c2d7aabe5cffe85cb1235f3e723c7a0ca6f1a15a0e38afac0bc7115796816162cbc6d09aea501ff36a46772ec7a3aa4d7c60363ff8f0eeda2f3eb8c435fb1d254244779da6c44c5dc30ed21a60df465ec395bc4d898dc7104dc47d809383d1d5431371c66f76842e2571bf73ce597"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x1}}}}, @m_ipt={0x114, 0x3, 0x0, 0x0, {{0x8}, {0x78, 0x2, 0x0, 0x1, [@TCA_IPT_HOOK={0x8, 0x2, 0x1}, @TCA_IPT_TARG={0x69, 0x6, {0x3, 'security\x00', 0x84, 0x8, "cf8102ab12c6b2198a413eaa65607ab7ca51ab206bef3fe70b20aa2e7aacfa341b2d9158773430366e3a48eb70679ab8b9759ebcd3b2636776df09c3eb7702"}}]}, {0x75, 0x6, "1d4af027bf39e92f2bc3b16061477612108c4de6dbb9dbc37f978e20a11849888f1cfa0d69961cc5b133c25b0a606d867918fd28cefd9936cea3c502ba83dbc878d09708660761105b2cb89c15f4eb2ff9ca07aba60aef01aab6097fa30bc52f5c31cbba441df32848abb9344a809a2a4c"}, {0xc}, {0xc, 0x8, {0x2, 0x1}}}}, @m_ipt={0x134, 0x11, 0x0, 0x0, {{0x8}, {0xd8, 0x2, 0x0, 0x1, [@TCA_IPT_TARG={0xd4, 0x6, {0x2, 'mangle\x00', 0x1, 0x1, "26b28bee405c084d7d3004660f6902208128531e54ab5a1819783607be3e2e463fc401b2d641a72c11f6aea69efbc1dac1e8f34f762cbc8ee0231ffeebcb773de1e20df7f65c7029200a9570577fe540733523b10491dc5fda6c0091603360fb1b6019648c7b5ef50f8741b6670963cc5d8533f50c4a2cfbeda3e0ed5070ab41e44997bdda4c34c11413cb846041ef4060b9cb71e527a7dd8e4efb7877f6f37b7cd8648d2d22911f9fbf"}}]}, {0x35, 0x6, "e7ba22f1ebc93a7960461c2acdaf1da6af842571f14f3b0700806b225899f9ba581b6cc401693affa591693a24cad555ae"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_ipt={0x64, 0x20, 0x0, 0x0, {{0x8}, {0x28, 0x2, 0x0, 0x1, [@TCA_IPT_TABLE={0x24, 0x1, 'raw\x00'}]}, {0x15, 0x6, "a0f801aae36e077609a01908bc70dd5a7c"}, {0xc}, {0xc, 0x8, {0x2, 0x2}}}}, @m_ipt={0x11c, 0x20, 0x0, 0x0, {{0x8}, {0x6c, 0x2, 0x0, 0x1, [@TCA_IPT_TARG={0x55, 0x6, {0xfffa, 'nat\x00', 0x4, 0x8, "b112d50939750fa56623826275793a59f694cdc8bda79320bfe1d4c8997abe43daace6790afb2937cfb2e0"}}, @TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_INDEX={0x8, 0x3, 0x6062ae06}]}, {0x89, 0x6, "080f497fef56763eb14339e04d8880b35d4fcb1f3ccd5757021fa31ef38a7d4c8fca4f32d5757fdee1a2aceaaeb6abdad810154a059435c356867b27c8df5015f90bffb81405bdefffef46fede1a8038897bb9fd967f32f04f15a8596894786759dc20093ddbffb2158f5c0591205638b11d518d459f3137f1349ab013b3b5732e45d6b45f"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x97dd299ab8dc81d}}}}]}, {0x44, 0x1, [@m_ipt={0x40, 0x3, 0x0, 0x0, {{0x8}, {0x4}, {0x15, 0x6, "e2ebd2e0185a4d308803e9306ec5d2b0e6"}, {0xc}, {0xc, 0x8, {0x1, 0x3}}}}]}, {0x160, 0x1, [@m_ipt={0xf8, 0x6, 0x0, 0x0, {{0x8}, {0x28, 0x2, 0x0, 0x1, [@TCA_IPT_TABLE={0x24, 0x1, 'raw\x00'}]}, {0xa9, 0x6, "f5fcf6c5d281ac07391f35700b5786a70ee288211391aef6ec3378d7dd4a7c7445b8d3046ec059dd382a214deedda165d8663d562a47b1afb15557c5ceab4960c0442cc36ea1e65aa9650e7ac2c900fbb08da34b73b6b699463a47761daa69afd529deea7f5c97d3f950af23793139f4c0c3cea503bb9a23d2f7677c9bf150e350defce66ec3eccbaabb1e8f7fe7c49b9e91ecca113edb7f81da88a113c1065219a1d6062e"}, {0xc}, {0xc, 0x8, {0x3, 0x1}}}}, @m_ipt={0x64, 0x1a, 0x0, 0x0, {{0x8}, {0x4}, {0x3b, 0x6, "4b6275823d714c9413915317da89818cb9f96e8938cf5d91ef0ce403d55fc9bdc74a0a5b88653980ed0af5c857ee3a0361bfe072c3d9c7"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0xacc}}, 0x4008800) recvmmsg$unix(r6, &(0x7f0000000e00), 0x0, 0x0, 0x0) sendmmsg$inet6(r6, &(0x7f0000004d00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x10) r7 = socket(0x40000000015, 0x5, 0x0) socket$rxrpc(0x21, 0x2, 0x2) r8 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SDTEFACILITIES(r8, 0x8918, 0x0) socket$rxrpc(0x21, 0x2, 0x2) bind$inet6(r7, &(0x7f00000003c0)={0xa, 0x0, 0x0, @mcast1, 0xfffffffd}, 0x1c) sendto$inet(r1, 0x0, 0x0, 0x20000800, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) readv(r0, &(0x7f0000000380)=[{&(0x7f0000000440)=""/162, 0xa2}], 0x1) 2m46.678168469s ago: executing program 0 (id=96): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_DEL(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)={0x50, 0x2, 0x9, 0x801, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFCTH_TUPLE={0x3c, 0x2, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @remote}}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4) 2m46.362484605s ago: executing program 0 (id=99): r0 = syz_io_uring_setup(0x81f, &(0x7f0000000480)={0x0, 0xbc02, 0x10, 0x0, 0x30f}, &(0x7f00000000c0)=0x0, &(0x7f0000000540)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) ioctl$MEDIA_IOC_SETUP_LINK(0xffffffffffffffff, 0xc0347c03, &(0x7f0000000200)={{0x80000000, 0x0, 0xf5a1c2b8e98148d, [0x6, 0x1]}, {0x80000000, 0x0, 0x7, [0xffffffda, 0x9]}, 0x2, [0x5, 0x84000000]}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x50, 0x0, 0x0, 0x0, 0x1}) io_uring_enter(r0, 0x47bc, 0x0, 0x21, 0x0, 0x0) 2m45.636000876s ago: executing program 0 (id=103): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0xcc6a, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet_smc(0x2b, 0x1, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r4 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r4, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r5, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r4, 0xc06864ce, &(0x7f0000000440)={r6, 0x0, 0x0, 0x0, 0x0, [0x0]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000140)={0x3ff, 0x2, 0xb5}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000080)={r7, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r8}) r9 = syz_open_dev$tty20(0xc, 0x4, 0x0) r10 = dup(r9) ioctl$TIOCSTI(r10, 0x5412, &(0x7f0000000100)=0xff) fsconfig$FSCONFIG_CMD_CREATE(r10, 0x6, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r4, 0xc00c642d, &(0x7f0000000040)) close_range(r2, 0xffffffffffffffff, 0x0) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, 0x0) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000c00)={0x0, 0x0, 0x0}, 0x0) 2m39.886673316s ago: executing program 0 (id=120): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000495"], &(0x7f00000003c0)='GPL\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000140)='contention_end\x00', r0}, 0x10) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x80201, 0x0) write$rfkill(r1, &(0x7f0000000000)={0x8, 0x0, 0x3, 0x1}, 0x8) r2 = io_uring_setup(0x6fcb, &(0x7f0000000100)={0x0, 0xcfcd, 0x1, 0x5, 0x327}) io_uring_register$IORING_REGISTER_FILES(r2, 0x2, &(0x7f0000000180)=[0xffffffffffffffff], 0x1) 2m23.198234338s ago: executing program 32 (id=120): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000495"], &(0x7f00000003c0)='GPL\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000140)='contention_end\x00', r0}, 0x10) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x80201, 0x0) write$rfkill(r1, &(0x7f0000000000)={0x8, 0x0, 0x3, 0x1}, 0x8) r2 = io_uring_setup(0x6fcb, &(0x7f0000000100)={0x0, 0xcfcd, 0x1, 0x5, 0x327}) io_uring_register$IORING_REGISTER_FILES(r2, 0x2, &(0x7f0000000180)=[0xffffffffffffffff], 0x1) 2m9.890486389s ago: executing program 3 (id=166): r0 = socket$pppoe(0x18, 0x1, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f00000001c0)=0x1e00) 2m8.807974547s ago: executing program 3 (id=170): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000ffffffffffffaaaaaaaaaabb08001e00002c00000000002f9078ac1e0001e00000"], 0x3e) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000008000000010001000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b708000002001e007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x13, 0x13, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0xffd0}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0}, @generic={0x66, 0x8}, @initr0, @exit, @alu={0x6, 0x0, 0x3, 0xa, 0x0, 0x2}, @printk={@x, {}, {}, {}, {}, {0x5, 0x0, 0xb, 0xa}}]}, &(0x7f0000000000)='GPL\x00', 0x2, 0xff99, &(0x7f0000000340)=""/222, 0x0, 0x8}, 0x78) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x14, 0x20}, [@ldst={0x5}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x48) socketpair(0x18, 0x0, 0x2, 0x0) 2m6.74638322s ago: executing program 3 (id=172): openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x80, &(0x7f0000000280)="cfd87e4d0000", 0x6) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f00000002c0)='sched_switch\x00', r2, 0x0, 0xfffffffffffffffe}, 0xfffffffffffffe9b) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f0000000040), 0x4) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="1200000003000000040000000200000000000000741634c4e6f7368097d740ddb16ff3e172c8499a7270b34faee082646bb4de60eb922b570888e75c898b4ad84167fc618931c7384f66b7f8cb9f05d2c36373602891ee9a1de9c2cb8aac0bb9ba9dc1225feabd8ce20d71d9fa279e97eac3f4de65739b8aaf5940d2953b1444d822c55c54107d84afea006edd107680e4786958cafd8691973d59990dcf0f279863bd48318a91a430e5fa495ac27e507e9590696eb8647806000c38524e6f757db3e8de651f9d81a5e6520f844b5238246a", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000f40), r6) sendmsg$IPVS_CMD_NEW_SERVICE(r6, &(0x7f0000001100)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010067bd7000fbdfdf25010000005c00018014000300fe8000000000000000000000000000bb060001000a00000008000600777272000c0007002e000000050000000800090039000000060002001100000008000b007369700008000800000000000600040001150000"], 0x70}, 0x1, 0x0, 0x0, 0x20004084}, 0x20008800) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0x9, 0x0, 0x0) r8 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r8, 0x0, 0x1, &(0x7f0000000240), 0x4) sendmsg$802154_dgram(r8, &(0x7f00000000c0)={&(0x7f0000000200)={0x24, @long={0x3, 0x3, {0xaaaaaaaaaaaa0302}}}, 0x14, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x20044005}, 0x4000010) socket$inet(0x2b, 0x801, 0x0) 2m5.663700825s ago: executing program 3 (id=174): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6(0xa, 0x3, 0x8000000003c) write$tun(0xffffffffffffffff, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000140)={0xa, 0x0, 0x0, @empty, 0x8}, 0x1c) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x408, 0xd0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x338, 0xffffffff, 0xffffffff, 0x338, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'dvmrp0\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00', {}, {}, 0x0, 0x0, 0x0, 0x30}, 0x0, 0x238, 0x268, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@rt={{0x138}, {0xf, [0xd, 0x4], 0x0, 0x4, 0x6, [@empty, @private0, @loopback, @ipv4={'\x00', '\xff\xff', @loopback}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @mcast2, @empty, @dev={0xfe, 0x80, '\x00', 0x2d}, @mcast2, @mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast1, @loopback, @loopback, @mcast2], 0xa}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x0, 0x200}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x468) sendmsg(r1, &(0x7f00000000c0)={0x0, 0x9588, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0xffd8}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 2m4.763205061s ago: executing program 3 (id=178): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r0 = syz_clone(0x88200200, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) setpgid(0x0, r0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x10) utimes(&(0x7f0000000000)='./file0\x00', 0x0) 2m3.742616048s ago: executing program 3 (id=181): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x9, 0x100008b}, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000001640)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f42fc3199f000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80af735ed41793bdf9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14518c9b476fccbd6c712016219848624b87cec2dbc68223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f00001000000000eeff7c5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729eec082830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3abe0fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945ecefa26b8471d424c14283a94395b64645288d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f93c0984b5c2d4523497e4d64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d620100000000000000494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6eba3bd4c440e6e2172e3fcc01b8babb757b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa165099c5ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd231088e570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88c3c44b3b7486f979e8a3174b531f573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb423c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50261a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e48701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867ec92d13a4fa4ae033a09673866cd779a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d93e1fe9b0b4a4a268921738938aa9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9ea81232fbef665f6212f875b2a0000000000000000000000000000002684c2d8eb8cac98930fa6a893ca44c0f64c07a87eb7b05f56ca6c70cb3a0eb328a15fe96a88235155e6d64bd434f641ddf9db2245e47e5904453577895dd81d"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x2e) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000540)='rcu_utilization\x00', r0}, 0x10) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000140)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x6}}, './file1\x00'}) ioctl$VIDIOC_QUERYBUF_DMABUF(0xffffffffffffffff, 0xc0585609, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x9) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x8200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000180), 0x14d802, 0x0) r3 = dup(r2) ftruncate(0xffffffffffffffff, 0x2007ffc) sendfile(r3, 0xffffffffffffffff, 0x0, 0x800000009) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) 1m48.67623883s ago: executing program 33 (id=181): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x9, 0x100008b}, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000001640)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f42fc3199f000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80af735ed41793bdf9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14518c9b476fccbd6c712016219848624b87cec2dbc68223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f00001000000000eeff7c5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729eec082830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3abe0fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945ecefa26b8471d424c14283a94395b64645288d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f93c0984b5c2d4523497e4d64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d620100000000000000494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6eba3bd4c440e6e2172e3fcc01b8babb757b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa165099c5ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd231088e570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88c3c44b3b7486f979e8a3174b531f573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb423c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50261a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e48701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867ec92d13a4fa4ae033a09673866cd779a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d93e1fe9b0b4a4a268921738938aa9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9ea81232fbef665f6212f875b2a0000000000000000000000000000002684c2d8eb8cac98930fa6a893ca44c0f64c07a87eb7b05f56ca6c70cb3a0eb328a15fe96a88235155e6d64bd434f641ddf9db2245e47e5904453577895dd81d"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x2e) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000540)='rcu_utilization\x00', r0}, 0x10) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000140)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x6}}, './file1\x00'}) ioctl$VIDIOC_QUERYBUF_DMABUF(0xffffffffffffffff, 0xc0585609, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x9) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x8200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000180), 0x14d802, 0x0) r3 = dup(r2) ftruncate(0xffffffffffffffff, 0x2007ffc) sendfile(r3, 0xffffffffffffffff, 0x0, 0x800000009) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) 8.988028563s ago: executing program 6 (id=541): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0xcc6a, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet_smc(0x2b, 0x1, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r4 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r4, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r5, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r4, 0xc06864ce, &(0x7f0000000440)={r6, 0x0, 0x0, 0x0, 0x0, [0x0]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000140)={0x3ff, 0x2, 0xb5}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000080)={r7, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r8}) syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f0000000100)=0xff) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r4, 0xc00c642d, &(0x7f0000000040)) close_range(r2, 0xffffffffffffffff, 0x0) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000c00)={0x0, 0x0, 0x0}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) 7.716252792s ago: executing program 2 (id=544): capset(&(0x7f0000000040)={0x20080522}, 0x0) syz_usb_connect(0x3, 0x4f, &(0x7f0000000000)=ANY=[@ANYBLOB="120100005cdd2e106307151088560000000109023d00010000d00009047e0004ffd234000905b74318860809050725018705ee7f09050a000002810bac090504"], 0x0) 6.963888094s ago: executing program 1 (id=549): mknod(0x0, 0x8001420, 0x0) open$dir(0x0, 0x6ec76a2667f068ba, 0x80) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x40}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xf, 0x0, &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f00000001c0)='sched_switch\x00', r3, 0x0, 0x6}, 0x18) r4 = syz_io_uring_setup(0x23c, &(0x7f0000000080)={0x0, 0x0, 0x10100}, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_io_uring_submit(r5, r6, &(0x7f0000000000)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r8, 0x0, &(0x7f0000000240)="352f1938d141676d9b6c59065f664735c08b9d697a645f85b19ba9030648cd046d1f26aad0196458046b81", 0xfffffffffffffe08, 0xebec93e830f96115}) io_uring_enter(r4, 0x7f5f, 0x4000000, 0x0, 0x0, 0x0) shutdown(r7, 0x1) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) 5.961345179s ago: executing program 5 (id=550): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$TCFLSH(0xffffffffffffffff, 0x400455c8, 0x2) socket$inet6_sctp(0xa, 0x801, 0x84) bind$netlink(0xffffffffffffffff, &(0x7f0000000000)={0x10, 0x0, 0x2ddfdbff, 0x2ffffffff}, 0xc) r4 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000000)={0x10, 0x0, 0x2ddfdbff, 0x2ffffffff}, 0xc) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f00000003c0)={0xc}) 5.952062236s ago: executing program 4 (id=551): bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x2c, &(0x7f0000000000)='/proc/sys/\x00et/\x00\x00v4\x00\x00s/\x92ync_\x00le\xf44\x8cm\xa0\x8dN\xd4\xa2\x88\x00\xd1l,'}, 0x30) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f00000000c0)={0x1c, 0x5, 0xd}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000080)=ANY=[@ANYBLOB="01000000000000009802"]) 5.768180286s ago: executing program 1 (id=552): r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) epoll_create(0x7) sendmsg$inet(0xffffffffffffffff, 0x0, 0x40) mmap(&(0x7f000070a000/0x3000)=nil, 0x3000, 0x3000000, 0x11012, r0, 0x1000) 4.712557335s ago: executing program 1 (id=553): bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000300)=ANY=[@ANYBLOB="01000000000000004503"]) 4.681968939s ago: executing program 5 (id=554): openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)={0x54, 0x2, 0x6, 0x101, 0x0, 0x0, {0x1}, [@IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8, 0x13, 0x1, 0x0, 0x40000007}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e23}, @IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x6}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @rand_addr=0x64010102}}]}, @IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}]}, 0x54}, 0x1, 0x0, 0x0, 0x40000010}, 0x4004000) r0 = syz_open_dev$sg(&(0x7f0000001600), 0x0, 0x22c01) setreuid(0x0, 0xee00) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000000c0)=ANY=[@ANYRES64=r0]) 4.51153059s ago: executing program 4 (id=555): mknodat(0xffffffffffffff9c, 0x0, 0x81c0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002000)=""/102400, 0x19000) socket$nl_generic(0x10, 0x3, 0x10) r1 = io_uring_setup(0x30a7, 0x0) io_uring_register$IORING_REGISTER_MEM_REGION(r1, 0x22, &(0x7f0000000280)={0x0}, 0x1) mkdir(0x0, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', 0x0, 0x0, &(0x7f0000000a00)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') r2 = fsopen(&(0x7f0000000000)='hugetlbfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x0) symlinkat(0x0, r3, &(0x7f0000000580)='./file0\x00') connect$unix(r3, &(0x7f0000000080)=@file={0x1, './file0/../file0\x00'}, 0x6e) 4.408148035s ago: executing program 6 (id=556): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r0, 0x0, 0x4048043) r2 = dup(r0) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000180)={0x0, 0x4, 0x10}, 0xc) sendmsg$inet6(r1, &(0x7f0000001bc0)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)="f7", 0x1}], 0x1}, 0x4000) sendmsg$key(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000840)={0x2, 0xd, 0xe, 0x7, 0x3, 0x0, 0x70bd2b, 0x25dfdbfb, [@sadb_x_sec_ctx={0x1, 0x18, 0xf4, 0x80}]}, 0x18}}, 0x4008005) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x8003, 0xbffc, 0xe652, 0x2, 0x4, 0x8, 0xff}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e23, @empty}}, 0x4, 0x1, 0xf06, 0x0, 0xa4, 0x7d, 0x5}, 0x9c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) splice(r3, 0x0, r4, 0x0, 0x4ffe6, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e60, 0xfffffff2, @empty, 0x3}}, 0x1000000, 0x31, 0xffff1896, 0x3, 0x6, 0x0, 0x1b}, 0x9c) 3.973258855s ago: executing program 1 (id=557): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b7030000000000fd850000007300000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000680)='sys_exit\x00', r0}, 0x10) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) 3.860849461s ago: executing program 5 (id=558): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) setsockopt$inet_int(r0, 0x0, 0x17, &(0x7f0000000080)=0x7, 0x4) syz_emit_ethernet(0x2a, 0x0, 0x0) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x298}) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_crypto(0x10, 0x3, 0x15) prlimit64(0x0, 0xe, &(0x7f0000000440)={0x6, 0x8c}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019380)=""/102400, 0x19000) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000180)='rpc_pipefs\x00', 0x1, 0x0) r3 = inotify_init() close(r3) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2) setsockopt$inet6_tcp_int(r4, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x1, 0x4) connect$inet6(r4, 0x0, 0x0) sendmmsg(r4, 0x0, 0x0, 0x4010) umount2(0x0, 0xe) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000280)='./file1\x00', 0x85900) fcntl$lock(r5, 0x5, &(0x7f0000000000)={0x2, 0x5, 0x1000, 0x2}) mount$9p_virtio(0x0, &(0x7f0000000200)='./file1\x00', 0x0, 0x1230004, &(0x7f0000000300)=ANY=[@ANYBLOB='trans=virtio,mmap,access=any,directi']) syz_open_dev$MSR(0x0, 0x2, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000004002, 0x0) 3.760268026s ago: executing program 2 (id=559): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000090000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='tlb_flush\x00', r1}, 0x10) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) ioctl$KVM_RUN(r4, 0xae80, 0x0) syz_clone(0x4021500, 0x0, 0x0, 0x0, 0x0, 0x0) 3.54406378s ago: executing program 1 (id=560): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="700200001300290a000000000000000007000000", @ANYRES32, @ANYBLOB="000000000000000010010c8013000c800ca3488008000000000000000800038064001d800500060000"], 0x270}, 0x1, 0x0, 0x0, 0x20008014}, 0x4) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000040)=ANY=[@ANYBLOB="d0000000", @ANYRES16=r1, @ANYBLOB="010000000000000000000100000008000100000000000400048008000c8004000b800800020001000000a00008801c000780080077144ebb00000800060000000000080005000000030024"], 0xd0}}, 0x0) 3.231810541s ago: executing program 4 (id=561): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x1f, 0x1d, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x6}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r4}}, @snprintf={{}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff8, 0xf1}, {0x5}, {}, {}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x6a}}]}, &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x10, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r5}, 0xc) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000008280), r6) sendmsg$DEVLINK_CMD_SB_POOL_GET(r6, &(0x7f00000084c0)={0x0, 0x0, &(0x7f0000008480)={&(0x7f00000082c0)={0x44, r7, 0x1, 0x70bd26, 0x25dfdbfd, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xfffffffffffffe51, 0xb, 0x8001}, {0x6, 0x11, 0x40}}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000084}, 0x40080) r8 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r8, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r8, 0x0) r9 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r9, &(0x7f0000000080), 0x10) recvmsg$can_bcm(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000280)=""/4096, 0x1000}], 0x1}, 0x20000100) shutdown(r9, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000002900)={0x2020}, 0x2020) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x1) 2.914133661s ago: executing program 1 (id=562): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000380), 0x101040) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000340)=0x400000b4e) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000002000)=""/102400, 0x19000) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x2000000) writev(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}], 0x1) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000300)={{0x0, 0x2}}) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000600), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f00000003c0)={0x9c9, 0x0, 0x0, 'queue1\x00', 0x200000}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0x3}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f00000000c0)={0x0, 0x74, 0x40, 0x0, 0x5}) 2.901671267s ago: executing program 5 (id=563): openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) pwritev2(0xffffffffffffffff, 0x0, 0x0, 0x7000, 0x0, 0x3) listen(r0, 0xfffffffc) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$MPTCP_PM_CMD_DEL_ADDR(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x1802, &(0x7f00000003c0)={&(0x7f00000004c0)={0x30, r4, 0x1, 0x70bd2c, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x1c}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}]}, 0x30}, 0x1, 0xff07}, 0x2000000) 2.312790398s ago: executing program 6 (id=564): r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) epoll_create(0x7) sendmsg$inet(0xffffffffffffffff, 0x0, 0x40) mmap(&(0x7f000070a000/0x3000)=nil, 0x3000, 0x3000000, 0x11012, r0, 0x1000) 2.173048692s ago: executing program 4 (id=565): r0 = syz_open_dev$swradio(&(0x7f0000000440), 0x0, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_create(0x4) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) r6 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r6, 0xc04064a0, 0x0) r7 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETFB(r7, 0xc01c64ad, &(0x7f0000000080)) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x1000004, 0x13, r7, 0x100000000) setsockopt$inet_int(r5, 0x0, 0x6, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0, r4}, 0x18) memfd_create(0x0, 0x0) r8 = openat$vmci(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r8, 0x7a6, 0x0) socket(0x2, 0x80805, 0x0) timer_create(0x2, &(0x7f0000000480)={0x0, 0x39, 0x0, @thr={0x0, 0x0}}, 0x0) ioctl$VIDIOC_TRY_FMT(r0, 0xc0d05640, &(0x7f0000000000)={0xc, @pix_mp={0x38305343, 0x2, 0x20303159, 0x7, 0x9, [{0x4}, {0x4, 0x8073}, {0x7, 0x7}, {0x6, 0x4}, {0xfffffff9, 0x10000}, {0xffff0000, 0x6}, {0x40008, 0x8}, {0x2, 0x10893a}], 0x66, 0x9, 0x2, 0x0, 0x5}}) 2.124298838s ago: executing program 2 (id=566): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=ANY=[@ANYBLOB="fc0000001900010000000000fddbdf2500000000000000000000000000400000fe8000000000000000000000000000bb0000000000000000020000002b000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000005000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000200000000004400050020010000000000000000000000000000000000022b0000"], 0xfc}}, 0x0) r1 = socket(0x2, 0x3, 0x6) bind$inet(r1, &(0x7f0000000080)={0x2, 0xfffa, @local}, 0x10) sendto$inet(r1, 0x0, 0x17, 0x48890, &(0x7f0000000000)={0x2, 0x4e24, @broadcast}, 0x10) 1.434841645s ago: executing program 5 (id=567): syz_open_dev$MSR(&(0x7f0000000380), 0x0, 0x0) r0 = socket$inet_icmp(0x2, 0x2, 0x1) sendmmsg$inet(r0, &(0x7f0000000440)=[{{&(0x7f0000000200)={0x2, 0x4e22, @local}, 0x10, &(0x7f0000000080)=[{&(0x7f0000000140)='\b\x00\x00\x00(\x00\x00\x00', 0x8}], 0x1}}, {{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000000)='\b\x00\x00\x00', 0x4}], 0x1}}], 0x2, 0x20044090) 1.347097308s ago: executing program 2 (id=568): bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) syz_clone(0x80042000, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)="62673e3aac585475214beadf9d77dbcb95d8528c69ef088cc4994ca2aa45135da59a1c160f6f87da9b704f7bcb2d702da2c2e09b0b2156377fae18e390858a7a364c8b00a7bd3e5486d1ac81a4c1ec243983109b69d641c40f05c23747854cb582eb0356126740a837e94799b440d1bd449dff") openat$sequencer(0xffffffffffffff9c, 0x0, 0x59d040, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000840)) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) r3 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000500)={0x0, 0xfffffffffffffd83, 0xfa00, {0x0, 0x0}}, 0xfdbc) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r3, 0xc0884113, &(0x7f0000000240)={0x1, 0x20, 0x9, 0x10001, 0x0, 0xffffdffffffffffd, 0x7, 0x0, 0xfffffffffffffffd, 0x9, 0xfffffffb, 0x1}) 1.2293898s ago: executing program 4 (id=569): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)={0x54, 0x2, 0x6, 0x101, 0x0, 0x0, {0x1}, [@IPSET_ATTR_DATA={0x28, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8, 0x13, 0x1, 0x0, 0x40000007}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e23}, @IPSET_ATTR_MARKMASK={0x8, 0xb, 0x1, 0x0, 0x6}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @rand_addr=0x64010102}}]}, @IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}]}, 0x54}, 0x1, 0x0, 0x0, 0x40000010}, 0x4004000) r0 = syz_open_dev$sg(&(0x7f0000001600), 0x0, 0x22c01) setreuid(0x0, 0xee00) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000000c0)=ANY=[@ANYRES64=r0]) 1.228402523s ago: executing program 6 (id=570): r0 = bpf$MAP_CREATE(0x0, 0x0, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b7030000000000fd850000007300000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000680)='sys_exit\x00', r1}, 0x10) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) 1.085579349s ago: executing program 5 (id=571): socket(0x10, 0x80002, 0x0) fsetxattr(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/tty/ldiscs\x00', 0x0, 0x0) r3 = syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x59af, 0x3180, 0x8000, 0x40024e}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x40, 0x4007, @fd=r2, 0xffffffffffffffff, &(0x7f0000000580)=""/207, 0xcf, 0x2, 0x1}) io_uring_enter(r3, 0x627, 0x4c1, 0x43, 0x0, 0x30) 948.831859ms ago: executing program 6 (id=572): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="4c00000010004b0400f4ed00000000007a000000", @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800b0001006272696467650000"], 0x4c}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="f80000003e000701feffffff00000000017c0000040042800c00018006000600800a0000d1000280cb00148008000d"], 0xf8}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) 833.22135ms ago: executing program 4 (id=573): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$CAN_RAW_ERR_FILTER(0xffffffffffffffff, 0x65, 0x7, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000600)={&(0x7f0000000580)=[0x0, 0x0], 0x2, 0x180000, 0x0, 0xffffffffffffffff}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000006c0)={'syztnl0\x00', 0x0}) openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) setsockopt$inet_IP_IPSEC_POLICY(r4, 0x0, 0x10, &(0x7f0000000700)={{{@in6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xc}}, @in=@loopback, 0x4e21, 0x100, 0x4e22, 0x7ff, 0xa, 0x80, 0x20, 0x8}, {0x8000000000000000, 0x4, 0x29, 0x1000, 0x4, 0xea1, 0xffff, 0x5}, {0x3, 0x9, 0xad, 0x50}, 0x4, 0x6e6bb3, 0x1, 0x0, 0x2, 0x3}, {{@in=@rand_addr=0x64010102, 0x4d3, 0x2b}, 0xa, @in=@empty, 0x3506, 0x0, 0x1, 0x40, 0x4, 0x80000001, 0x73c}}, 0xe8) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'veth0_to_batadv\x00'}) sendmsg$can_raw(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000005c0)={0x0}}, 0x0) process_vm_writev(r1, &(0x7f0000000300)=[{&(0x7f0000000180)=""/109, 0x6d}], 0x1, &(0x7f0000000480), 0x0, 0x0) 391.388581ms ago: executing program 6 (id=574): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeee, 0x8031, r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, 0x0, 0x0) close(0xffffffffffffffff) r4 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_QBUF(r4, 0xc058565d, &(0x7f0000000200)=@fd={0x0, 0x5, 0x4, 0x10, 0x0, {}, {0x0, 0x0, 0x0, 0x4, 0x0, 0x0, "001500"}, 0x0, 0x2, {}, 0x18603}) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) fanotify_init(0x200, 0x0) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/pm_test', 0x141a82, 0x0) sendfile(r5, r6, 0x0, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 344.695664ms ago: executing program 2 (id=575): r0 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x80044940, &(0x7f0000001fc0)) ioctl$IMADDTIMER(r0, 0x80044940, &(0x7f00000000c0)=0x14) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, 0x0, &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r1, 0x0, 0xd}, 0x18) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) readv(r0, &(0x7f0000000380)=[{&(0x7f0000000440)=""/162, 0xa2}], 0x1) 0s ago: executing program 2 (id=576): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001000000800000", @ANYRES32=0x0, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32=0x0], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x1f, 0x1d, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x6}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}}, @snprintf={{}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff8, 0xf1}, {0x5}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r4}, {}, {0x85, 0x0, 0x0, 0x6a}}]}, &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x10, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x94) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000008280), r5) sendmsg$DEVLINK_CMD_SB_POOL_GET(r5, &(0x7f00000084c0)={0x0, 0x0, &(0x7f0000008480)={&(0x7f00000082c0)={0x44, r6, 0x1, 0x70bd26, 0x25dfdbfd, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xfffffffffffffe51, 0xb, 0x8001}, {0x6, 0x11, 0x40}}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000084}, 0x40080) listen(0xffffffffffffffff, 0x0) r7 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r7, &(0x7f0000000080), 0x10) recvmsg$can_bcm(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000280)=""/4096, 0x1000}], 0x1}, 0x20000100) shutdown(r7, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000002900)={0x2020}, 0x2020) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x1) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.178' (ED25519) to the list of known hosts. [ 73.049956][ T5831] cgroup: Unknown subsys name 'net' [ 73.199491][ T5831] cgroup: Unknown subsys name 'cpuset' [ 73.208020][ T5831] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 74.607932][ T5831] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 77.044176][ T5844] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 77.056601][ T5844] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 77.066351][ T5844] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 77.081127][ T5844] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 77.092255][ T51] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 77.101398][ T5848] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 77.110628][ T5848] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 77.119544][ T5848] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 77.158175][ T5849] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 77.165939][ T5849] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 77.174248][ T5849] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 77.186721][ T5849] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 77.202152][ T5849] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 77.213045][ T5849] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 77.223783][ T5849] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 77.295131][ T5849] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 77.303471][ T5849] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 77.311157][ T5849] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 77.322052][ T5849] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 77.330231][ T5849] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 77.352047][ T5844] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 77.361646][ T5844] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 77.371183][ T51] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 77.380410][ T5852] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 77.388474][ T5852] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 77.815164][ T5850] chnl_net:caif_netlink_parms(): no params data found [ 77.983412][ T5845] chnl_net:caif_netlink_parms(): no params data found [ 78.134190][ T5850] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.143534][ T5850] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.151517][ T5850] bridge_slave_0: entered allmulticast mode [ 78.159425][ T5850] bridge_slave_0: entered promiscuous mode [ 78.173248][ T5850] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.180517][ T5850] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.187749][ T5850] bridge_slave_1: entered allmulticast mode [ 78.195263][ T5850] bridge_slave_1: entered promiscuous mode [ 78.211455][ T5841] chnl_net:caif_netlink_parms(): no params data found [ 78.223014][ T5855] chnl_net:caif_netlink_parms(): no params data found [ 78.288127][ T5850] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.318991][ T5857] chnl_net:caif_netlink_parms(): no params data found [ 78.355013][ T5850] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.364561][ T5845] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.371924][ T5845] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.379528][ T5845] bridge_slave_0: entered allmulticast mode [ 78.386994][ T5845] bridge_slave_0: entered promiscuous mode [ 78.434448][ T5845] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.441801][ T5845] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.449591][ T5845] bridge_slave_1: entered allmulticast mode [ 78.458063][ T5845] bridge_slave_1: entered promiscuous mode [ 78.541775][ T5845] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.562854][ T5850] team0: Port device team_slave_0 added [ 78.577658][ T5845] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.621916][ T5850] team0: Port device team_slave_1 added [ 78.659638][ T5841] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.668883][ T5841] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.676926][ T5841] bridge_slave_0: entered allmulticast mode [ 78.684702][ T5841] bridge_slave_0: entered promiscuous mode [ 78.727034][ T5850] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.733990][ T5850] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.760159][ T5850] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.787941][ T5845] team0: Port device team_slave_0 added [ 78.798235][ T5841] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.805363][ T5841] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.812652][ T5841] bridge_slave_1: entered allmulticast mode [ 78.821528][ T5841] bridge_slave_1: entered promiscuous mode [ 78.847246][ T5855] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.854385][ T5855] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.862449][ T5855] bridge_slave_0: entered allmulticast mode [ 78.871356][ T5855] bridge_slave_0: entered promiscuous mode [ 78.891625][ T5850] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.898856][ T5850] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.930465][ T5850] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.943407][ T5845] team0: Port device team_slave_1 added [ 78.962257][ T5855] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.969508][ T5855] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.976837][ T5855] bridge_slave_1: entered allmulticast mode [ 78.983995][ T5855] bridge_slave_1: entered promiscuous mode [ 79.025274][ T5841] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.048924][ T5857] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.058168][ T5857] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.065473][ T5857] bridge_slave_0: entered allmulticast mode [ 79.073214][ T5857] bridge_slave_0: entered promiscuous mode [ 79.083343][ T5857] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.091280][ T5857] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.098842][ T5857] bridge_slave_1: entered allmulticast mode [ 79.105881][ T5857] bridge_slave_1: entered promiscuous mode [ 79.128281][ T5841] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.182108][ T5845] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.189476][ T5845] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.215703][ T5845] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.237240][ T5852] Bluetooth: hci0: command tx timeout [ 79.246205][ T5852] Bluetooth: hci1: command tx timeout [ 79.258957][ T5855] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.280280][ T5845] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.287478][ T5845] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.313751][ T5845] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.324397][ T5852] Bluetooth: hci2: command tx timeout [ 79.339492][ T5841] team0: Port device team_slave_0 added [ 79.362329][ T5855] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.374241][ T5857] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.388302][ T5857] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.397542][ T5852] Bluetooth: hci3: command tx timeout [ 79.402361][ T5841] team0: Port device team_slave_1 added [ 79.430639][ T5850] hsr_slave_0: entered promiscuous mode [ 79.437117][ T5850] hsr_slave_1: entered promiscuous mode [ 79.476498][ T5852] Bluetooth: hci4: command tx timeout [ 79.496495][ T5841] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.503463][ T5841] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.529401][ T5841] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.582770][ T5845] hsr_slave_0: entered promiscuous mode [ 79.589682][ T5845] hsr_slave_1: entered promiscuous mode [ 79.596168][ T5845] debugfs: 'hsr0' already exists in 'hsr' [ 79.601978][ T5845] Cannot create hsr debugfs directory [ 79.609493][ T5841] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.616502][ T5841] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.642619][ T5841] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.655447][ T5855] team0: Port device team_slave_0 added [ 79.665019][ T5855] team0: Port device team_slave_1 added [ 79.672392][ T5857] team0: Port device team_slave_0 added [ 79.728351][ T5857] team0: Port device team_slave_1 added [ 79.786583][ T5855] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.793634][ T5855] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.820801][ T5855] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.884139][ T5855] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.891975][ T5855] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.918508][ T5855] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.967644][ T5841] hsr_slave_0: entered promiscuous mode [ 79.974201][ T5841] hsr_slave_1: entered promiscuous mode [ 79.980837][ T5841] debugfs: 'hsr0' already exists in 'hsr' [ 79.987273][ T5841] Cannot create hsr debugfs directory [ 79.994418][ T5857] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 80.001646][ T5857] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 80.027947][ T5857] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 80.067981][ T5857] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.075564][ T5857] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 80.102701][ T5857] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.262399][ T5855] hsr_slave_0: entered promiscuous mode [ 80.270032][ T5855] hsr_slave_1: entered promiscuous mode [ 80.276579][ T5855] debugfs: 'hsr0' already exists in 'hsr' [ 80.282713][ T5855] Cannot create hsr debugfs directory [ 80.355117][ T5857] hsr_slave_0: entered promiscuous mode [ 80.361741][ T5857] hsr_slave_1: entered promiscuous mode [ 80.368390][ T5857] debugfs: 'hsr0' already exists in 'hsr' [ 80.374478][ T5857] Cannot create hsr debugfs directory [ 80.608295][ T5850] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 80.653351][ T5850] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 80.664484][ T5850] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 80.709103][ T5850] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 80.804841][ T5845] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 80.829635][ T5845] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 80.844258][ T5845] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 80.857768][ T5845] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 80.932851][ T5841] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 80.953556][ T5841] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 80.979165][ T5841] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 80.990559][ T5841] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 81.093284][ T5857] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 81.111857][ T5857] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 81.122821][ T5857] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 81.158524][ T5857] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 81.251403][ T5855] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 81.265132][ T5855] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 81.279090][ T5855] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 81.304531][ T5850] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.314592][ T5855] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 81.323303][ T5852] Bluetooth: hci1: command tx timeout [ 81.323783][ T5849] Bluetooth: hci0: command tx timeout [ 81.381322][ T5850] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.397795][ T5849] Bluetooth: hci2: command tx timeout [ 81.413531][ T5845] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.444260][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.451721][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.476943][ T5849] Bluetooth: hci3: command tx timeout [ 81.507555][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.514714][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.542155][ T5845] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.556436][ T5849] Bluetooth: hci4: command tx timeout [ 81.609124][ T1002] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.616838][ T1002] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.641483][ T1002] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.648735][ T1002] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.678415][ T5857] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.713709][ T5841] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.744173][ T5850] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 81.809470][ T5857] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.826857][ T5841] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.890856][ T5855] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.920014][ T1104] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.927478][ T1104] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.943370][ T1104] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.950580][ T1104] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.990295][ T1104] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.998647][ T1104] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.074345][ T5855] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.111809][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.119029][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.245632][ T67] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.253010][ T67] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.280467][ T67] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.287717][ T67] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.433465][ T5850] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.595544][ T5845] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.631233][ T5850] veth0_vlan: entered promiscuous mode [ 82.701559][ T5850] veth1_vlan: entered promiscuous mode [ 82.752903][ T5845] veth0_vlan: entered promiscuous mode [ 82.813346][ T5845] veth1_vlan: entered promiscuous mode [ 82.857498][ T5850] veth0_macvtap: entered promiscuous mode [ 82.887161][ T5850] veth1_macvtap: entered promiscuous mode [ 82.943384][ T5850] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 82.968216][ T5841] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.986501][ T5850] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.003027][ T5845] veth0_macvtap: entered promiscuous mode [ 83.060377][ T5845] veth1_macvtap: entered promiscuous mode [ 83.078086][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.104112][ T5857] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.119343][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.128827][ T1113] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.149503][ T5855] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.164875][ T1113] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.183337][ T5845] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.265503][ T5845] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.312998][ T1113] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.331371][ T1113] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.375170][ T1113] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.385717][ T1113] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.397793][ T5849] Bluetooth: hci1: command tx timeout [ 83.399050][ T5852] Bluetooth: hci0: command tx timeout [ 83.441406][ T5855] veth0_vlan: entered promiscuous mode [ 83.454814][ T1113] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.466964][ T5855] veth1_vlan: entered promiscuous mode [ 83.477620][ T5852] Bluetooth: hci2: command tx timeout [ 83.486856][ T1113] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.521060][ T5857] veth0_vlan: entered promiscuous mode [ 83.556854][ T5852] Bluetooth: hci3: command tx timeout [ 83.618999][ T5857] veth1_vlan: entered promiscuous mode [ 83.627170][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.640896][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.649041][ T5852] Bluetooth: hci4: command tx timeout [ 83.649163][ T1002] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.649190][ T1002] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.671491][ T5855] veth0_macvtap: entered promiscuous mode [ 83.721557][ T5855] veth1_macvtap: entered promiscuous mode [ 83.757546][ T67] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.765945][ T67] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.776811][ T5841] veth0_vlan: entered promiscuous mode [ 83.794394][ T5855] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.803497][ T5850] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 83.825354][ T5841] veth1_vlan: entered promiscuous mode [ 83.849054][ T5855] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.872225][ T49] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.888862][ T49] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.908038][ T5857] veth0_macvtap: entered promiscuous mode [ 83.915327][ T49] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.929563][ T49] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.968827][ T5857] veth1_macvtap: entered promiscuous mode [ 84.068624][ T5841] veth0_macvtap: entered promiscuous mode [ 84.095541][ T5962] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2'. [ 84.122825][ T5857] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.131048][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 84.140790][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 84.149849][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 84.190086][ T5841] veth1_macvtap: entered promiscuous mode [ 84.263126][ T5857] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.323293][ T5968] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 84.368808][ T5969] affs: No valid root block on device nullb0 [ 84.387479][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.395453][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.446533][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 84.502059][ T5841] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.594731][ T1002] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.616228][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 84.626486][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 84.636635][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 84.737326][ T1002] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.772949][ T1002] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.827176][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.828005][ T5841] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.835036][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.847578][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 84.939121][ T1002] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.050600][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 85.221867][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.296518][ T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.328106][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.409551][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.492284][ T5985] netlink: 92 bytes leftover after parsing attributes in process `syz.2.12'. [ 85.502381][ T5849] Bluetooth: hci1: command tx timeout [ 85.508773][ T5852] Bluetooth: hci0: command tx timeout [ 85.556408][ T5852] Bluetooth: hci2: command tx timeout [ 85.661099][ T5852] Bluetooth: hci3: command tx timeout [ 85.695817][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.752055][ T5852] Bluetooth: hci4: command tx timeout [ 85.790810][ T5990] o2cb: This node has not been configured. [ 85.797680][ T5990] o2cb: Cluster check failed. Fix errors before retrying. [ 85.804984][ T5990] (syz.0.1,5990,1):user_dlm_register:674 ERROR: status = -22 [ 85.812594][ T5990] (syz.0.1,5990,1):dlmfs_mkdir:438 ERROR: Error -22 could not register domain "file1" [ 86.035510][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.234991][ T5989] netlink: 20 bytes leftover after parsing attributes in process `syz.2.13'. [ 86.236613][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 86.525672][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.545721][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.563601][ T1113] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.587871][ T1113] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.639049][ T927] cfg80211: failed to load regulatory.db [ 87.820045][ T1113] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.340907][ T1113] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.865929][ T6017] overlay: ./file0 is not a directory [ 90.834725][ T6034] netlink: 20 bytes leftover after parsing attributes in process `syz.0.24'. [ 91.632485][ T30] audit: type=1326 audit(1752635405.098:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6035 comm="syz.4.26" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fb0bd98e929 code=0x0 [ 91.865431][ T6044] Zero length message leads to an empty skb [ 92.232990][ T6056] loop6: detected capacity change from 0 to 7 [ 92.671607][ T6056] Dev loop6: unable to read RDB block 7 [ 92.677756][ T6056] loop6: AHDI p1 p2 p3 [ 92.681933][ T6056] loop6: partition table partially beyond EOD, truncated [ 92.690132][ T6056] loop6: p1 start 1601398130 is beyond EOD, truncated [ 92.696975][ T6056] loop6: p2 start 1702059890 is beyond EOD, truncated [ 93.096202][ T30] audit: type=1326 audit(1752635407.168:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6054 comm="syz.0.32" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa0358e929 code=0x7ffc0000 [ 93.118335][ C0] vkms_vblank_simulate: vblank timer overrun [ 93.956040][ T30] audit: type=1326 audit(1752635407.168:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6054 comm="syz.0.32" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa0358e929 code=0x7ffc0000 [ 94.086212][ T30] audit: type=1326 audit(1752635407.168:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6054 comm="syz.0.32" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7ffa0358e929 code=0x7ffc0000 [ 94.435092][ T30] audit: type=1326 audit(1752635407.168:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6054 comm="syz.0.32" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa0358e929 code=0x7ffc0000 [ 94.477061][ T30] audit: type=1326 audit(1752635407.168:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6054 comm="syz.0.32" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa0358e929 code=0x7ffc0000 [ 94.597474][ T30] audit: type=1326 audit(1752635407.178:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6054 comm="syz.0.32" exe="/root/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7ffa0358d58a code=0x7ffc0000 [ 96.927848][ T30] audit: type=1326 audit(1752635407.178:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6054 comm="syz.0.32" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7ffa035c11e5 code=0x7ffc0000 [ 97.071606][ T30] audit: type=1326 audit(1752635407.378:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6054 comm="syz.0.32" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa0358e929 code=0x7ffc0000 [ 97.113467][ T6085] netlink: 20 bytes leftover after parsing attributes in process `syz.2.39'. [ 97.148844][ T30] audit: type=1326 audit(1752635407.378:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6054 comm="syz.0.32" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa0358e929 code=0x7ffc0000 [ 97.242349][ T30] audit: type=1326 audit(1752635407.388:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6054 comm="syz.0.32" exe="/root/syz-executor" sig=0 arch=c000003e syscall=254 compat=0 ip=0x7ffa0358e929 code=0x7ffc0000 [ 97.328177][ T30] audit: type=1326 audit(1752635407.388:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6054 comm="syz.0.32" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa0358e929 code=0x7ffc0000 [ 97.352797][ T30] audit: type=1326 audit(1752635407.388:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6054 comm="syz.0.32" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa0358e929 code=0x7ffc0000 [ 97.425128][ T6092] netlink: 8 bytes leftover after parsing attributes in process `syz.2.42'. [ 97.521118][ T30] audit: type=1326 audit(1752635407.388:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6054 comm="syz.0.32" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7ffa0358e929 code=0x7ffc0000 [ 97.556281][ T30] audit: type=1326 audit(1752635407.388:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6054 comm="syz.0.32" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa0358e929 code=0x7ffc0000 [ 97.766873][ T30] audit: type=1326 audit(1752635407.398:17): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6054 comm="syz.0.32" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ffa0358e929 code=0x7ffc0000 [ 98.516904][ T30] audit: type=1326 audit(1752635407.398:18): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6054 comm="syz.0.32" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7ffa0358e929 code=0x7ffc0000 [ 99.650922][ T6116] netlink: 44 bytes leftover after parsing attributes in process `syz.2.48'. [ 100.296597][ T10] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 100.542570][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 101.248854][ T10] usb 4-1: config 0 has no interfaces? [ 101.258061][ T10] usb 4-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 101.377125][ T10] usb 4-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 101.396359][ T10] usb 4-1: Product: syz [ 101.402035][ T10] usb 4-1: SerialNumber: syz [ 101.852638][ T6128] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 102.229744][ T10] usb 4-1: config 0 descriptor?? [ 103.473183][ T6135] netlink: 20 bytes leftover after parsing attributes in process `syz.0.55'. [ 103.496170][ T10] usb 4-1: USB disconnect, device number 2 [ 103.743208][ T5852] Bluetooth: unknown link type 108 [ 103.748921][ T5852] Bluetooth: hci0: connection err: -111 [ 103.837963][ T6145] loop6: detected capacity change from 0 to 7 [ 104.336440][ T6145] Dev loop6: unable to read RDB block 7 [ 104.342114][ T6145] loop6: AHDI p1 p2 p3 [ 104.346346][ T6145] loop6: partition table partially beyond EOD, truncated [ 104.353596][ T6145] loop6: p1 start 1601398130 is beyond EOD, truncated [ 104.360590][ T6145] loop6: p2 start 1702059890 is beyond EOD, truncated [ 105.054869][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 105.061497][ T30] audit: type=1800 audit(1752635419.098:21): pid=6158 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.62" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 107.031770][ T6171] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 108.346237][ T6189] Illegal XDP return value 4294967274 on prog (id 24) dev N/A, expect packet loss! [ 109.416781][ T5905] IPVS: starting estimator thread 0... [ 109.527380][ T6196] IPVS: using max 28 ests per chain, 67200 per kthread [ 109.606533][ T927] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 110.196209][ T927] usb 3-1: Using ep0 maxpacket: 16 [ 110.215445][ T927] usb 3-1: config 0 has no interfaces? [ 110.242356][ T927] usb 3-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 110.278790][ T927] usb 3-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 110.293175][ T927] usb 3-1: Product: syz [ 110.305368][ T6204] netlink: 152 bytes leftover after parsing attributes in process `syz.0.78'. [ 110.315245][ T927] usb 3-1: SerialNumber: syz [ 110.322309][ T6204] tipc: Started in network mode [ 110.328801][ T927] usb 3-1: config 0 descriptor?? [ 110.339152][ T6204] tipc: Node identity fe80000000000000000000000000002a, cluster identity 4711 [ 110.351497][ T6204] tipc: Enabling of bearer rejected, failed to enable media [ 111.052998][ T927] usb 3-1: USB disconnect, device number 2 [ 113.879951][ T10] IPVS: starting estimator thread 0... [ 114.047341][ T6240] IPVS: using max 25 ests per chain, 60000 per kthread [ 114.522871][ T6251] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 117.482202][ T6270] tipc: Started in network mode [ 117.525551][ T6276] netlink: 'syz.0.96': attribute type 2 has an invalid length. [ 117.543874][ T6276] netlink: 'syz.0.96': attribute type 1 has an invalid length. [ 117.561759][ T6270] tipc: Node identity 420c4b189297, cluster identity 4711 [ 117.607211][ T6270] tipc: Enabled bearer , priority 0 [ 117.644886][ T6277] syzkaller0: entered promiscuous mode [ 117.668403][ T6277] syzkaller0: entered allmulticast mode [ 117.722992][ T6270] tipc: Resetting bearer [ 117.886454][ T6269] tipc: Resetting bearer [ 118.168141][ T6269] tipc: Disabling bearer [ 118.700925][ T6298] loop6: detected capacity change from 0 to 7 [ 119.348772][ T5958] IPVS: starting estimator thread 0... [ 119.357178][ T6298] Dev loop6: unable to read RDB block 7 [ 119.362781][ T6298] loop6: AHDI p1 p2 p3 [ 119.367060][ T6298] loop6: partition table partially beyond EOD, truncated [ 119.374478][ T6298] loop6: p1 start 1601398130 is beyond EOD, truncated [ 119.381691][ T6298] loop6: p2 start 1702059890 is beyond EOD, truncated [ 119.538203][ T6302] IPVS: using max 36 ests per chain, 86400 per kthread [ 120.948404][ T6315] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 124.952600][ T6360] loop6: detected capacity change from 0 to 7 [ 125.074374][ T6360] Dev loop6: unable to read RDB block 7 [ 125.080274][ T6360] loop6: AHDI p1 p2 p3 [ 125.084659][ T6360] loop6: partition table partially beyond EOD, truncated [ 125.094249][ T6360] loop6: p1 start 1601398130 is beyond EOD, truncated [ 125.101837][ T6360] loop6: p2 start 1702059890 is beyond EOD, truncated [ 125.895748][ T6356] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 125.905003][ T30] audit: type=1326 audit(1752635439.958:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6365 comm="syz.1.122" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00a9d8e929 code=0x7ffc0000 [ 127.172553][ T30] audit: type=1326 audit(1752635439.958:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6365 comm="syz.1.122" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00a9d8e929 code=0x7ffc0000 [ 127.177777][ T6356] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 127.212503][ T30] audit: type=1326 audit(1752635439.958:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6365 comm="syz.1.122" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f00a9d8e929 code=0x7ffc0000 [ 127.426189][ T30] audit: type=1326 audit(1752635439.958:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6365 comm="syz.1.122" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00a9d8e929 code=0x7ffc0000 [ 127.575232][ T6382] netlink: 16 bytes leftover after parsing attributes in process `syz.2.124'. [ 128.177950][ T5852] Bluetooth: hci0: command 0x0c1a tx timeout [ 128.986109][ T30] audit: type=1326 audit(1752635439.958:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6365 comm="syz.1.122" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00a9d8e929 code=0x7ffc0000 [ 130.099750][ T30] audit: type=1326 audit(1752635439.958:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6365 comm="syz.1.122" exe="/root/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7f00a9d8d58a code=0x7ffc0000 [ 131.259354][ T30] audit: type=1326 audit(1752635439.958:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6365 comm="syz.1.122" exe="/root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f00a9dc11e5 code=0x7ffc0000 [ 131.281626][ T30] audit: type=1326 audit(1752635440.158:29): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6365 comm="syz.1.122" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00a9d8e929 code=0x7ffc0000 [ 131.303770][ T30] audit: type=1326 audit(1752635440.158:30): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6365 comm="syz.1.122" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00a9d8e929 code=0x7ffc0000 [ 131.326367][ T30] audit: type=1326 audit(1752635440.158:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6365 comm="syz.1.122" exe="/root/syz-executor" sig=0 arch=c000003e syscall=254 compat=0 ip=0x7f00a9d8e929 code=0x7ffc0000 [ 131.796426][ T30] audit: type=1326 audit(1752635440.158:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6365 comm="syz.1.122" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00a9d8e929 code=0x7ffc0000 [ 131.887415][ T30] audit: type=1326 audit(1752635440.158:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6365 comm="syz.1.122" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00a9d8e929 code=0x7ffc0000 [ 131.910185][ T30] audit: type=1326 audit(1752635440.158:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6365 comm="syz.1.122" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f00a9d8e929 code=0x7ffc0000 [ 131.967115][ T30] audit: type=1326 audit(1752635440.158:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6365 comm="syz.1.122" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00a9d8e929 code=0x7ffc0000 [ 132.088893][ T6356] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 132.095338][ T6356] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 132.148424][ T30] audit: type=1326 audit(1752635440.158:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6365 comm="syz.1.122" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f00a9d8e929 code=0x7ffc0000 [ 132.182265][ T30] audit: type=1326 audit(1752635440.158:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6365 comm="syz.1.122" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f00a9d8e929 code=0x7ffc0000 [ 132.997204][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.004238][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.379753][ T6356] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 133.406069][ T6356] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 134.300179][ T6392] sctp: failed to load transform for md5: -2 [ 134.474855][ T6356] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 134.606617][ T10] IPVS: starting estimator thread 0... [ 134.855138][ T6356] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 135.355636][ T6420] IPVS: using max 30 ests per chain, 72000 per kthread [ 135.464969][ T6356] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 135.475387][ T6356] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 137.534148][ T6444] capability: warning: `syz.4.137' uses deprecated v2 capabilities in a way that may be insecure [ 137.579157][ T6444] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 141.311584][ T6457] netlink: 16 bytes leftover after parsing attributes in process `syz.1.139'. [ 143.855683][ T6482] netlink: 16 bytes leftover after parsing attributes in process `syz.2.146'. [ 145.832938][ T5849] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 145.844534][ T5849] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 145.869918][ T5849] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 145.886572][ T5849] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 145.897889][ T5849] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 145.957489][ T6499] loop1: detected capacity change from 0 to 1024 [ 145.971034][ T6499] ======================================================= [ 145.971034][ T6499] WARNING: The mand mount option has been deprecated and [ 145.971034][ T6499] and is ignored by this kernel. Remove the mand [ 145.971034][ T6499] option from the mount to silence this warning. [ 145.971034][ T6499] ======================================================= [ 146.008949][ T5852] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 146.020088][ T5852] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 146.116337][ T5852] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 146.125418][ T5852] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 146.134328][ T5852] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 146.328785][ T6499] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 146.363785][ T6499] ext4 filesystem being mounted at /32/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 146.438636][ T6499] EXT4-fs error (device loop1): ext4_map_blocks:814: inode #15: block 3: comm syz.1.149: lblock 3 mapped to illegal pblock 3 (length 13) [ 146.518518][ T6499] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 13 with error 117 [ 146.626210][ T6499] EXT4-fs (loop1): This should not happen!! Data will be lost [ 146.626210][ T6499] [ 146.737672][ T6498] EXT4-fs error (device loop1): ext4_map_blocks:778: inode #15: block 3: comm syz.1.149: lblock 3 mapped to illegal pblock 3 (length 1) [ 147.389153][ T6498] EXT4-fs error (device loop1): ext4_map_blocks:778: inode #15: block 3: comm syz.1.149: lblock 3 mapped to illegal pblock 3 (length 1) [ 147.480408][ T6514] EXT4-fs error (device loop1): ext4_map_blocks:778: inode #15: block 3: comm syz.1.149: lblock 3 mapped to illegal pblock 3 (length 1) [ 147.568447][ T6514] EXT4-fs error (device loop1): ext4_map_blocks:778: inode #15: block 3: comm syz.1.149: lblock 3 mapped to illegal pblock 3 (length 1) [ 147.588451][ T6498] EXT4-fs error (device loop1): ext4_map_blocks:778: inode #15: block 3: comm syz.1.149: lblock 3 mapped to illegal pblock 3 (length 1) [ 147.703579][ T6514] EXT4-fs error (device loop1): ext4_map_blocks:778: inode #15: block 3: comm syz.1.149: lblock 3 mapped to illegal pblock 3 (length 1) [ 147.743823][ T6498] EXT4-fs error (device loop1): ext4_map_blocks:778: inode #15: block 3: comm syz.1.149: lblock 3 mapped to illegal pblock 3 (length 1) [ 147.847332][ T6514] EXT4-fs error (device loop1): ext4_map_blocks:778: inode #15: block 3: comm syz.1.149: lblock 3 mapped to illegal pblock 3 (length 1) [ 148.182657][ T6498] EXT4-fs error (device loop1): ext4_map_blocks:778: inode #15: block 3: comm syz.1.149: lblock 3 mapped to illegal pblock 3 (length 1) [ 148.207042][ T5849] Bluetooth: hci5: command tx timeout [ 148.352933][ T5929] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 148.605211][ T5929] usb 3-1: Using ep0 maxpacket: 16 [ 149.411830][ T5929] usb 3-1: config 0 has no interfaces? [ 149.426150][ T5929] usb 3-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 149.446039][ T5929] usb 3-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 149.454783][ T5929] usb 3-1: Product: syz [ 149.464714][ T5929] usb 3-1: SerialNumber: syz [ 149.561392][ T5929] usb 3-1: config 0 descriptor?? [ 149.624084][ T6489] chnl_net:caif_netlink_parms(): no params data found [ 149.639492][ T5850] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 150.358253][ T5849] Bluetooth: hci5: command tx timeout [ 151.380779][ T5846] usb 3-1: USB disconnect, device number 3 [ 152.322994][ T6489] bridge0: port 1(bridge_slave_0) entered blocking state [ 152.381805][ T6489] bridge0: port 1(bridge_slave_0) entered disabled state [ 152.465366][ T5849] Bluetooth: hci5: command tx timeout [ 152.517840][ T6489] bridge_slave_0: entered allmulticast mode [ 152.520418][ T6571] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 152.576950][ T6489] bridge_slave_0: entered promiscuous mode [ 152.757307][ T6489] bridge0: port 2(bridge_slave_1) entered blocking state [ 152.764491][ T6489] bridge0: port 2(bridge_slave_1) entered disabled state [ 152.903516][ T6489] bridge_slave_1: entered allmulticast mode [ 153.315617][ T6489] bridge_slave_1: entered promiscuous mode [ 154.337087][ T6489] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 154.351684][ T6489] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 154.478895][ T6489] team0: Port device team_slave_0 added [ 154.487777][ T6598] loop1: detected capacity change from 0 to 1024 [ 154.491237][ T6489] team0: Port device team_slave_1 added [ 154.568730][ T6598] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 154.597451][ T5849] Bluetooth: hci5: command tx timeout [ 154.605095][ T6598] ext4 filesystem being mounted at /35/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 154.634246][ T6489] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 154.721267][ T6598] EXT4-fs error (device loop1): ext4_map_blocks:814: inode #15: block 3: comm syz.1.167: lblock 3 mapped to illegal pblock 3 (length 13) [ 154.738853][ T6489] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 154.781754][ T6489] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 154.781882][ T6598] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 13 with error 117 [ 154.794710][ T6489] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 154.811941][ T6489] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 154.839244][ T6489] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 154.872692][ T6598] EXT4-fs (loop1): This should not happen!! Data will be lost [ 154.872692][ T6598] [ 154.951015][ T6607] EXT4-fs error (device loop1): ext4_map_blocks:778: inode #15: block 3: comm syz.1.167: lblock 3 mapped to illegal pblock 3 (length 1) [ 154.984933][ T6595] EXT4-fs error (device loop1): ext4_map_blocks:778: inode #15: block 3: comm syz.1.167: lblock 3 mapped to illegal pblock 3 (length 1) [ 155.197711][ T6607] EXT4-fs error (device loop1): ext4_map_blocks:778: inode #15: block 3: comm syz.1.167: lblock 3 mapped to illegal pblock 3 (length 1) [ 155.892958][ T6595] EXT4-fs error (device loop1): ext4_map_blocks:778: inode #15: block 3: comm syz.1.167: lblock 3 mapped to illegal pblock 3 (length 1) [ 155.973541][ T6607] EXT4-fs error (device loop1): ext4_map_blocks:778: inode #15: block 3: comm syz.1.167: lblock 3 mapped to illegal pblock 3 (length 1) [ 156.153933][ T6595] EXT4-fs error (device loop1): ext4_map_blocks:778: inode #15: block 3: comm syz.1.167: lblock 3 mapped to illegal pblock 3 (length 1) [ 157.102609][ T6489] hsr_slave_0: entered promiscuous mode [ 157.109528][ T6489] hsr_slave_1: entered promiscuous mode [ 157.115894][ T6489] debugfs: 'hsr0' already exists in 'hsr' [ 157.121754][ T6489] Cannot create hsr debugfs directory [ 157.280332][ T6607] EXT4-fs error (device loop1): ext4_map_blocks:778: inode #15: block 3: comm syz.1.167: lblock 3 mapped to illegal pblock 3 (length 1) [ 157.341500][ T6607] EXT4-fs error (device loop1): ext4_map_blocks:778: inode #15: block 3: comm syz.1.167: lblock 3 mapped to illegal pblock 3 (length 1) [ 158.304749][ T6604] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1220: group 0, block bitmap and bg descriptor inconsistent: 21 vs 268369941 free clusters [ 158.482188][ T5850] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 159.425469][ T6489] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 159.481877][ T6489] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 159.551337][ T6489] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 160.169505][ T6489] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 160.652454][ T6489] 8021q: adding VLAN 0 to HW filter on device bond0 [ 161.327679][ T6678] block device autoloading is deprecated and will be removed. [ 161.518240][ T6489] 8021q: adding VLAN 0 to HW filter on device team0 [ 161.829478][ T1113] bridge0: port 1(bridge_slave_0) entered blocking state [ 161.836997][ T1113] bridge0: port 1(bridge_slave_0) entered forwarding state [ 161.989980][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 161.997178][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 162.303817][ T6695] loop4: detected capacity change from 0 to 1024 [ 162.414028][ T6695] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 162.493297][ T6695] ext4 filesystem being mounted at /36/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 162.551413][ T6695] EXT4-fs error (device loop4): ext4_map_blocks:814: inode #15: block 3: comm syz.4.185: lblock 3 mapped to illegal pblock 3 (length 13) [ 162.582973][ T6489] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 162.603305][ T6695] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 13 with error 117 [ 162.652121][ T6695] EXT4-fs (loop4): This should not happen!! Data will be lost [ 162.652121][ T6695] [ 162.693293][ T6710] EXT4-fs error (device loop4): ext4_map_blocks:778: inode #15: block 3: comm syz.4.185: lblock 3 mapped to illegal pblock 3 (length 1) [ 162.732664][ T6693] EXT4-fs error (device loop4): ext4_map_blocks:778: inode #15: block 3: comm syz.4.185: lblock 3 mapped to illegal pblock 3 (length 1) [ 162.767477][ T6710] EXT4-fs error (device loop4): ext4_map_blocks:778: inode #15: block 3: comm syz.4.185: lblock 3 mapped to illegal pblock 3 (length 1) [ 162.844643][ T6693] EXT4-fs error (device loop4): ext4_map_blocks:778: inode #15: block 3: comm syz.4.185: lblock 3 mapped to illegal pblock 3 (length 1) [ 162.875133][ T6710] EXT4-fs error (device loop4): ext4_map_blocks:778: inode #15: block 3: comm syz.4.185: lblock 3 mapped to illegal pblock 3 (length 1) [ 162.890628][ T6693] EXT4-fs error (device loop4): ext4_map_blocks:778: inode #15: block 3: comm syz.4.185: lblock 3 mapped to illegal pblock 3 (length 1) [ 162.913629][ T6693] EXT4-fs error (device loop4): ext4_map_blocks:778: inode #15: block 3: comm syz.4.185: lblock 3 mapped to illegal pblock 3 (length 1) [ 162.999710][ T6710] EXT4-fs error (device loop4): ext4_map_blocks:778: inode #15: block 3: comm syz.4.185: lblock 3 mapped to illegal pblock 3 (length 1) [ 163.265335][ T6693] EXT4-fs error (device loop4): ext4_map_blocks:778: inode #15: block 3: comm syz.4.185: lblock 3 mapped to illegal pblock 3 (length 1) [ 163.606630][ T6727] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 163.875666][ T6489] veth0_vlan: entered promiscuous mode [ 163.893276][ T6489] veth1_vlan: entered promiscuous mode [ 164.196912][ T6736] netlink: 16 bytes leftover after parsing attributes in process `syz.2.193'. [ 164.412521][ T6489] veth0_macvtap: entered promiscuous mode [ 164.431407][ T6489] veth1_macvtap: entered promiscuous mode [ 164.443229][ T5841] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 164.451995][ T6489] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 164.478782][ T6489] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 164.515077][ T67] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 164.534141][ T67] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 164.571399][ T6362] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 164.894320][ T6362] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 165.348133][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 165.373453][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 165.593998][ T5978] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 165.802974][ T5978] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 168.390221][ T6782] overlayfs: overlapping lowerdir path [ 169.367858][ T24] IPVS: starting estimator thread 0... [ 169.624581][ T6801] IPVS: using max 25 ests per chain, 60000 per kthread [ 169.782669][ T6796] delete_channel: no stack [ 171.510718][ T6820] vxcan0: tx drop: invalid da for name 0x0000000000000003 [ 171.883460][ T6826] netlink: 16 bytes leftover after parsing attributes in process `syz.2.218'. [ 172.713787][ T6830] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 172.740326][ C0] vkms_vblank_simulate: vblank timer overrun [ 172.746792][ T6830] CIFS mount error: No usable UNC path provided in device string! [ 172.746792][ T6830] [ 172.759131][ T6830] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 173.357141][ T6837] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 176.206907][ T6873] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 179.693210][ T6912] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 179.931860][ T5852] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 180.009687][ T5852] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 180.018607][ T5852] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 180.028082][ T5852] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 180.035809][ T5852] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 180.702664][ T1113] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 181.257938][ T1113] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 181.589634][ T6939] netlink: 16 bytes leftover after parsing attributes in process `syz.2.254'. [ 181.676753][ T6940] loop5: detected capacity change from 0 to 1024 [ 181.704365][ T6940] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 181.763730][ T6940] ext4 filesystem being mounted at /12/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 181.804489][ T6940] EXT4-fs error (device loop5): ext4_map_blocks:814: inode #15: block 3: comm syz.5.252: lblock 3 mapped to illegal pblock 3 (length 13) [ 181.819789][ T1113] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 181.851889][ T6940] EXT4-fs (loop5): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 13 with error 117 [ 181.895575][ T6940] EXT4-fs (loop5): This should not happen!! Data will be lost [ 181.895575][ T6940] [ 181.971414][ T6937] EXT4-fs error (device loop5): ext4_map_blocks:778: inode #15: block 3: comm syz.5.252: lblock 3 mapped to illegal pblock 3 (length 1) [ 182.010560][ T1113] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.033109][ T6937] EXT4-fs error (device loop5): ext4_map_blocks:778: inode #15: block 3: comm syz.5.252: lblock 3 mapped to illegal pblock 3 (length 1) [ 182.053090][ T6937] EXT4-fs error (device loop5): ext4_map_blocks:778: inode #15: block 3: comm syz.5.252: lblock 3 mapped to illegal pblock 3 (length 1) [ 182.086349][ T6937] EXT4-fs error (device loop5): ext4_map_blocks:778: inode #15: block 3: comm syz.5.252: lblock 3 mapped to illegal pblock 3 (length 1) [ 182.122591][ T6937] EXT4-fs error (device loop5): ext4_map_blocks:778: inode #15: block 3: comm syz.5.252: lblock 3 mapped to illegal pblock 3 (length 1) [ 182.126189][ T6947] EXT4-fs error (device loop5): ext4_mb_generate_buddy:1220: group 0, block bitmap and bg descriptor inconsistent: 21 vs 268369941 free clusters [ 182.144418][ T6918] chnl_net:caif_netlink_parms(): no params data found [ 182.182706][ T6949] EXT4-fs error (device loop5): ext4_map_blocks:778: inode #15: block 3: comm syz.5.252: lblock 3 mapped to illegal pblock 3 (length 1) [ 182.196335][ T5852] Bluetooth: hci3: command tx timeout [ 182.286634][ T6952] netlink: 28 bytes leftover after parsing attributes in process `syz.2.256'. [ 182.295692][ T6952] netlink: 28 bytes leftover after parsing attributes in process `syz.2.256'. [ 182.306402][ T6937] EXT4-fs error (device loop5): ext4_map_blocks:778: inode #15: block 3: comm syz.5.252: lblock 3 mapped to illegal pblock 3 (length 1) [ 182.363455][ T6940] EXT4-fs error (device loop5): ext4_map_blocks:778: inode #15: block 3: comm syz.5.252: lblock 3 mapped to illegal pblock 3 (length 1) [ 182.400568][ T6958] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 183.437808][ T6489] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 183.752452][ T6918] bridge0: port 1(bridge_slave_0) entered blocking state [ 183.795735][ T6918] bridge0: port 1(bridge_slave_0) entered disabled state [ 183.823746][ T6918] bridge_slave_0: entered allmulticast mode [ 183.861520][ T6918] bridge_slave_0: entered promiscuous mode [ 183.901681][ T6968] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 183.919861][ T6918] bridge0: port 2(bridge_slave_1) entered blocking state [ 183.942849][ T6918] bridge0: port 2(bridge_slave_1) entered disabled state [ 183.986439][ T6918] bridge_slave_1: entered allmulticast mode [ 183.994374][ T6918] bridge_slave_1: entered promiscuous mode [ 184.277334][ T5852] Bluetooth: hci3: command tx timeout [ 184.318751][ T6918] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 184.493173][ T6918] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 184.505529][ T1113] bridge_slave_1: left allmulticast mode [ 184.517108][ T1113] bridge_slave_1: left promiscuous mode [ 184.556773][ T1113] bridge0: port 2(bridge_slave_1) entered disabled state [ 184.889581][ T1113] bridge_slave_0: left allmulticast mode [ 184.956029][ T1113] bridge_slave_0: left promiscuous mode [ 184.961836][ T1113] bridge0: port 1(bridge_slave_0) entered disabled state [ 185.459955][ T7003] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 186.356866][ T5852] Bluetooth: hci3: command tx timeout [ 187.058215][ T30] kauditd_printk_skb: 2 callbacks suppressed [ 187.058251][ T30] audit: type=1326 audit(1752635501.168:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7014 comm="syz.4.273" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb0bd98e929 code=0x0 [ 188.607800][ T5852] Bluetooth: hci3: command tx timeout [ 189.239315][ T7051] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 190.925072][ T1113] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 190.939492][ T1113] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 190.958636][ T1113] bond0 (unregistering): Released all slaves [ 191.348006][ T1113] tipc: Left network mode [ 191.357273][ T6918] team0: Port device team_slave_0 added [ 191.404075][ T6918] team0: Port device team_slave_1 added [ 192.306856][ T6918] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 192.321765][ T6918] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 192.356737][ T6918] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 192.457684][ T6918] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 192.467537][ T6918] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 192.487520][ T7086] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 192.496215][ T6918] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 192.703117][ T6918] hsr_slave_0: entered promiscuous mode [ 192.723057][ T6918] hsr_slave_1: entered promiscuous mode [ 192.747488][ T6918] debugfs: 'hsr0' already exists in 'hsr' [ 192.765911][ T6918] Cannot create hsr debugfs directory [ 193.053494][ T7093] netlink: 16 bytes leftover after parsing attributes in process `syz.2.293'. [ 193.261167][ T5905] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 193.726017][ T5905] usb 5-1: Using ep0 maxpacket: 16 [ 193.735830][ T5905] usb 5-1: config 0 has no interfaces? [ 193.782663][ T5905] usb 5-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 193.816661][ T5905] usb 5-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 193.840844][ T5905] usb 5-1: Product: syz [ 193.845088][ T5905] usb 5-1: SerialNumber: syz [ 194.077391][ T5905] usb 5-1: config 0 descriptor?? [ 194.416960][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.426701][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.814099][ T5846] usb 5-1: USB disconnect, device number 2 [ 195.052705][ T1113] hsr_slave_0: left promiscuous mode [ 195.120215][ T7124] netlink: 16 bytes leftover after parsing attributes in process `syz.1.300'. [ 195.594767][ T1113] hsr_slave_1: left promiscuous mode [ 195.615012][ T1113] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 195.633558][ T1113] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 195.738541][ T1113] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 195.785378][ T1113] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 195.819578][ T7133] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 195.902067][ T1113] veth1_macvtap: left promiscuous mode [ 195.915090][ T1113] veth0_macvtap: left promiscuous mode [ 196.030639][ T1113] veth1_vlan: left promiscuous mode [ 196.038085][ T1113] veth0_vlan: left promiscuous mode [ 197.520361][ T30] audit: type=1326 audit(1752635511.588:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7153 comm="syz.2.312" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f6930b8e929 code=0x0 [ 198.455697][ T7165] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 198.715841][ T1113] team0 (unregistering): Port device team_slave_1 removed [ 198.756415][ T927] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 198.789086][ T1113] team0 (unregistering): Port device team_slave_0 removed [ 198.928871][ T927] usb 3-1: Using ep0 maxpacket: 16 [ 198.944475][ T927] usb 3-1: config 0 has no interfaces? [ 198.954926][ T927] usb 3-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 198.965897][ T927] usb 3-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 198.974262][ T927] usb 3-1: Product: syz [ 198.984388][ T927] usb 3-1: SerialNumber: syz [ 199.008821][ T927] usb 3-1: config 0 descriptor?? [ 199.282393][ T5846] usb 3-1: USB disconnect, device number 4 [ 201.369506][ T6918] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 201.608351][ T6918] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 201.707067][ T7193] random: crng reseeded on system resumption [ 201.773182][ T7193] Restarting kernel threads ... [ 201.779498][ T7193] Done restarting kernel threads. [ 202.168595][ T6918] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 202.256410][ T7196] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 202.376440][ T6918] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 202.717314][ T1113] IPVS: stop unused estimator thread 0... [ 203.405794][ T6918] 8021q: adding VLAN 0 to HW filter on device bond0 [ 203.517947][ T6918] 8021q: adding VLAN 0 to HW filter on device team0 [ 203.565710][ T6402] bridge0: port 1(bridge_slave_0) entered blocking state [ 203.573275][ T6402] bridge0: port 1(bridge_slave_0) entered forwarding state [ 203.584996][ T6402] bridge0: port 2(bridge_slave_1) entered blocking state [ 203.592215][ T6402] bridge0: port 2(bridge_slave_1) entered forwarding state [ 203.720114][ T5846] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 203.909759][ T5846] usb 3-1: Using ep0 maxpacket: 16 [ 203.929898][ T5846] usb 3-1: config 0 has no interfaces? [ 203.951056][ T5846] usb 3-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 203.980692][ T5846] usb 3-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 203.999905][ T5846] usb 3-1: Product: syz [ 204.007874][ T5846] usb 3-1: SerialNumber: syz [ 204.036435][ T5846] usb 3-1: config 0 descriptor?? [ 204.309770][ T6918] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 204.323704][ T5905] usb 3-1: USB disconnect, device number 5 [ 204.346281][ T5846] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 204.966857][ T5846] usb 6-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 204.998467][ T7256] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 205.016168][ T5846] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 205.055255][ T5846] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 205.092768][ T5846] usb 6-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 205.197551][ T5846] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 205.274366][ T5846] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 205.773064][ T5846] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 205.977366][ T5846] usb 6-1: invalid MIDI out EP 0 [ 206.336653][ T927] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 206.412867][ T5846] snd-usb-audio 6-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 206.494867][ T5846] usb 6-1: USB disconnect, device number 2 [ 206.530983][ T927] usb 3-1: config 0 has an invalid interface number: 106 but max is 0 [ 206.578860][ T927] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 206.640592][ T927] usb 3-1: config 0 has no interface number 0 [ 206.660054][ T927] usb 3-1: config 0 interface 106 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 6 [ 206.716109][ T927] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=df.bb [ 206.725197][ T927] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 206.762379][ T6918] veth0_vlan: entered promiscuous mode [ 206.793678][ T927] usb 3-1: config 0 descriptor?? [ 206.822075][ T6918] veth1_vlan: entered promiscuous mode [ 206.978253][ T6918] veth0_macvtap: entered promiscuous mode [ 207.241523][ T6918] veth1_macvtap: entered promiscuous mode [ 207.399754][ T6918] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 207.488071][ T6918] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 207.585837][ T6402] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 207.620150][ T6402] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 207.760167][ T6402] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 207.783900][ T6402] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 207.805333][ T6316] usb 3-1: Failed to submit usb control message: -71 [ 207.828319][ T6316] usb 3-1: unable to send the bmi data to the device: -71 [ 207.861879][ T6316] usb 3-1: unable to get target info from device [ 207.874019][ T6316] usb 3-1: could not get target info (-71) [ 207.889978][ T6316] usb 3-1: could not probe fw (-71) [ 207.956088][ T927] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 207.974422][ T927] usb 3-1: USB disconnect, device number 6 [ 208.891450][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 208.934686][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 209.084174][ T7314] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 209.324012][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 209.342437][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 210.338302][ T7327] No such timeout policy "syz0" [ 215.710698][ T7359] loop2: detected capacity change from 0 to 1024 [ 215.816903][ T7359] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 215.886235][ T7359] ext4 filesystem being mounted at /89/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 216.384989][ T5845] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 219.204616][ T7410] mmap: syz.4.371 (7410) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 219.637661][ T7417] loop2: detected capacity change from 0 to 1024 [ 220.257757][ T7417] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 220.332239][ T7417] ext4 filesystem being mounted at /91/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 221.303769][ T5845] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 223.802691][ T7467] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 226.778976][ T7503] loop4: detected capacity change from 0 to 1024 [ 226.924302][ T7503] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 226.956353][ T7503] ext4 filesystem being mounted at /78/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 228.186332][ T7507] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1220: group 0, block bitmap and bg descriptor inconsistent: 21 vs 268369941 free clusters [ 230.038834][ T5841] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 232.113607][ T7542] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 232.659304][ T7534] sctp: failed to load transform for md5: -2 [ 232.678910][ T7548] program syz.2.404 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 234.072754][ T7571] tty tty22: ldisc open failed (-12), clearing slot 21 [ 236.622055][ T7597] program syz.4.416 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 236.907032][ T7602] netlink: 20 bytes leftover after parsing attributes in process `syz.5.418'. [ 240.856218][ T7667] netlink: 20 bytes leftover after parsing attributes in process `syz.1.434'. [ 241.409670][ T7672] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 244.097168][ T7719] netlink: 20 bytes leftover after parsing attributes in process `syz.4.446'. [ 244.883490][ T7724] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 248.806695][ T7768] netlink: 20 bytes leftover after parsing attributes in process `syz.4.457'. [ 249.399019][ T7778] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 249.557488][ T7782] netlink: 16 bytes leftover after parsing attributes in process `syz.1.462'. [ 249.577522][ T7782] netlink: 16 bytes leftover after parsing attributes in process `syz.1.462'. [ 250.661879][ T7793] delete_channel: no stack [ 253.680079][ T7835] netlink: 20 bytes leftover after parsing attributes in process `syz.2.473'. [ 255.530751][ T7859] team_slave_0: entered allmulticast mode [ 255.914846][ T1303] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.935237][ T1303] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.968321][ T1303] aoe: packet could not be sent on ipvlan1. consider increasing tx_queue_len [ 257.838908][ T7894] netlink: 20 bytes leftover after parsing attributes in process `syz.4.490'. [ 261.365389][ T7939] loop6: detected capacity change from 0 to 7 [ 261.509421][ T7939] Dev loop6: unable to read RDB block 7 [ 261.515138][ T7939] loop6: AHDI p1 p2 p3 [ 261.519475][ T7939] loop6: partition table partially beyond EOD, truncated [ 261.526802][ T7939] loop6: p1 start 1601398130 is beyond EOD, truncated [ 261.534203][ T7939] loop6: p2 start 1702059890 is beyond EOD, truncated [ 262.421908][ T7950] netlink: 20 bytes leftover after parsing attributes in process `syz.2.502'. [ 263.207348][ T7959] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 267.636206][ T8008] netlink: 20 bytes leftover after parsing attributes in process `syz.1.516'. [ 270.952861][ T8054] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 272.801314][ T8082] netlink: 16 bytes leftover after parsing attributes in process `syz.4.534'. [ 273.242416][ T5852] Bluetooth: hci5: command 0x0406 tx timeout [ 273.691430][ T8090] Bluetooth: hci4: Frame reassembly failed (-84) [ 275.717329][ T5852] Bluetooth: hci4: command 0x1003 tx timeout [ 275.724638][ T5849] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 276.746501][ T9] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 276.957037][ T9] usb 3-1: Using ep0 maxpacket: 16 [ 276.996972][ T9] usb 3-1: config 0 has an invalid interface number: 126 but max is 0 [ 277.430966][ T8152] netlink: 16 bytes leftover after parsing attributes in process `syz.5.547'. [ 277.979386][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 277.990370][ T9] usb 3-1: config 0 has no interface number 0 [ 277.996537][ T9] usb 3-1: config 0 interface 126 altsetting 0 has an endpoint descriptor with address 0xB7, changing to 0x87 [ 278.008229][ T9] usb 3-1: config 0 interface 126 altsetting 0 endpoint 0x87 has invalid maxpacket 34328, setting to 1024 [ 278.019585][ T9] usb 3-1: config 0 interface 126 altsetting 0 endpoint 0xA has invalid maxpacket 512, setting to 64 [ 278.207517][ T9] usb 3-1: config 0 interface 126 altsetting 0 endpoint 0x4 has invalid maxpacket 2053, setting to 1024 [ 278.270731][ T9] usb 3-1: config 0 interface 126 altsetting 0 bulk endpoint 0x4 has invalid maxpacket 1024 [ 278.292777][ T9] usb 3-1: config 0 interface 126 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 278.486663][ T9] usb 3-1: New USB device found, idVendor=0763, idProduct=1015, bcdDevice=56.88 [ 278.505997][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 278.527883][ T9] usb 3-1: config 0 descriptor?? [ 278.714763][ T8133] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 279.127959][ T8133] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 279.325191][ T9] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 279.530734][ T8172] program syz.5.554 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 279.552535][ T9] usb 3-1: USB disconnect, device number 7 [ 280.887226][ T8194] netlink: 'syz.1.560': attribute type 3 has an invalid length. [ 280.919308][ T8194] netlink: 'syz.1.560': attribute type 6 has an invalid length. [ 281.164325][ T8198] netlink: 16 bytes leftover after parsing attributes in process `syz.4.561'. [ 283.015504][ T8226] program syz.4.569 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 283.346832][ T8235] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 284.044875][ T8246] [ 284.047252][ T8246] ====================================================== [ 284.054263][ T8246] WARNING: possible circular locking dependency detected [ 284.061279][ T8246] 6.16.0-rc6-next-20250714-syzkaller #0 Not tainted [ 284.067872][ T8246] ------------------------------------------------------ [ 284.074881][ T8246] syz.6.574/8246 is trying to acquire lock: [ 284.080758][ T8246] ffff88807d480088 (&of->mutex){+.+.}-{4:4}, at: kernfs_seq_start+0x55/0x3c0 [ 284.089575][ T8246] [ 284.089575][ T8246] but task is already holding lock: [ 284.096931][ T8246] ffff88805bfb0d58 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xb7/0xe10 [ 284.105306][ T8246] [ 284.105306][ T8246] which lock already depends on the new lock. [ 284.105306][ T8246] [ 284.115713][ T8246] [ 284.115713][ T8246] the existing dependency chain (in reverse order) is: [ 284.125165][ T8246] [ 284.125165][ T8246] -> #3 (&p->lock){+.+.}-{4:4}: [ 284.132217][ T8246] lock_acquire+0x120/0x360 [ 284.137246][ T8246] __mutex_lock+0x182/0xe80 [ 284.142280][ T8246] seq_read_iter+0xb7/0xe10 [ 284.147306][ T8246] copy_splice_read+0x54f/0x9b0 [ 284.152686][ T8246] splice_file_to_pipe+0x273/0x440 [ 284.158326][ T8246] do_sendfile+0x475/0x7e0 [ 284.163359][ T8246] __se_sys_sendfile64+0x13e/0x190 [ 284.169004][ T8246] do_syscall_64+0xfa/0x3b0 [ 284.174035][ T8246] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 284.180543][ T8246] [ 284.180543][ T8246] -> #2 (&pipe->mutex){+.+.}-{4:4}: [ 284.187923][ T8246] lock_acquire+0x120/0x360 [ 284.192937][ T8246] __mutex_lock+0x182/0xe80 [ 284.198054][ T8246] anon_pipe_write+0x16a/0x1360 [ 284.203417][ T8246] __kernel_write_iter+0x3ec/0x860 [ 284.209037][ T8246] __kernel_write+0xef/0x150 [ 284.214133][ T8246] autofs_notify_daemon+0x748/0xe50 [ 284.219930][ T8246] autofs_wait+0x11dc/0x1870 [ 284.225038][ T8246] autofs_mount_wait+0x16b/0x330 [ 284.230500][ T8246] autofs_d_automount+0x393/0x720 [ 284.236073][ T8246] __traverse_mounts+0x308/0x5b0 [ 284.241611][ T8246] step_into+0x534/0xf30 [ 284.246362][ T8246] path_openat+0x1bc6/0x3830 [ 284.251568][ T8246] do_filp_open+0x1fa/0x410 [ 284.256577][ T8246] do_sys_openat2+0x121/0x1c0 [ 284.261760][ T8246] __x64_sys_openat+0x138/0x170 [ 284.267116][ T8246] do_syscall_64+0xfa/0x3b0 [ 284.272125][ T8246] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 284.278521][ T8246] [ 284.278521][ T8246] -> #1 (&sbi->pipe_mutex){+.+.}-{4:4}: [ 284.286249][ T8246] lock_acquire+0x120/0x360 [ 284.291273][ T8246] __mutex_lock+0x182/0xe80 [ 284.296342][ T8246] autofs_notify_daemon+0x735/0xe50 [ 284.302103][ T8246] autofs_wait+0x11dc/0x1870 [ 284.307220][ T8246] autofs_mount_wait+0x16b/0x330 [ 284.312809][ T8246] autofs_d_automount+0x393/0x720 [ 284.318534][ T8246] __traverse_mounts+0x308/0x5b0 [ 284.323992][ T8246] step_into+0x534/0xf30 [ 284.329276][ T8246] path_lookupat+0x163/0x430 [ 284.334500][ T8246] filename_lookup+0x212/0x570 [ 284.339854][ T8246] kern_path+0x35/0x50 [ 284.344456][ T8246] lookup_bdev+0xc0/0x280 [ 284.349291][ T8246] resume_store+0x169/0x460 [ 284.354303][ T8246] kernfs_fop_write_iter+0x375/0x4f0 [ 284.360094][ T8246] vfs_write+0x548/0xa90 [ 284.364843][ T8246] ksys_write+0x145/0x250 [ 284.369679][ T8246] do_syscall_64+0xfa/0x3b0 [ 284.374692][ T8246] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 284.381262][ T8246] [ 284.381262][ T8246] -> #0 (&of->mutex){+.+.}-{4:4}: [ 284.388544][ T8246] validate_chain+0xb9b/0x2140 [ 284.393829][ T8246] __lock_acquire+0xab9/0xd20 [ 284.399008][ T8246] lock_acquire+0x120/0x360 [ 284.404032][ T8246] __mutex_lock+0x182/0xe80 [ 284.409044][ T8246] kernfs_seq_start+0x55/0x3c0 [ 284.414315][ T8246] seq_read_iter+0x3f2/0xe10 [ 284.419410][ T8246] copy_splice_read+0x54f/0x9b0 [ 284.424766][ T8246] splice_file_to_pipe+0x273/0x440 [ 284.430384][ T8246] do_sendfile+0x475/0x7e0 [ 284.435392][ T8246] __se_sys_sendfile64+0x13e/0x190 [ 284.441011][ T8246] do_syscall_64+0xfa/0x3b0 [ 284.446020][ T8246] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 284.452417][ T8246] [ 284.452417][ T8246] other info that might help us debug this: [ 284.452417][ T8246] [ 284.462662][ T8246] Chain exists of: [ 284.462662][ T8246] &of->mutex --> &pipe->mutex --> &p->lock [ 284.462662][ T8246] [ 284.474380][ T8246] Possible unsafe locking scenario: [ 284.474380][ T8246] [ 284.481822][ T8246] CPU0 CPU1 [ 284.487169][ T8246] ---- ---- [ 284.492603][ T8246] lock(&p->lock); [ 284.496401][ T8246] lock(&pipe->mutex); [ 284.503078][ T8246] lock(&p->lock); [ 284.509610][ T8246] lock(&of->mutex); [ 284.513664][ T8246] [ 284.513664][ T8246] *** DEADLOCK *** [ 284.513664][ T8246] [ 284.521880][ T8246] 2 locks held by syz.6.574/8246: [ 284.526887][ T8246] #0: ffff888031b47468 (&pipe->mutex){+.+.}-{4:4}, at: splice_file_to_pipe+0x2e/0x440 [ 284.536547][ T8246] #1: ffff88805bfb0d58 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xb7/0xe10 [ 284.545334][ T8246] [ 284.545334][ T8246] stack backtrace: [ 284.551227][ T8246] CPU: 1 UID: 0 PID: 8246 Comm: syz.6.574 Not tainted 6.16.0-rc6-next-20250714-syzkaller #0 PREEMPT(full) [ 284.551244][ T8246] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 284.551257][ T8246] Call Trace: [ 284.551264][ T8246] [ 284.551271][ T8246] dump_stack_lvl+0x189/0x250 [ 284.551291][ T8246] ? __pfx_dump_stack_lvl+0x10/0x10 [ 284.551304][ T8246] ? __pfx__printk+0x10/0x10 [ 284.551321][ T8246] ? print_lock_name+0xde/0x100 [ 284.551338][ T8246] print_circular_bug+0x2ee/0x310 [ 284.551355][ T8246] check_noncircular+0x134/0x160 [ 284.551371][ T8246] validate_chain+0xb9b/0x2140 [ 284.551386][ T8246] ? rcu_is_watching+0x15/0xb0 [ 284.551399][ T8246] ? trace_sched_exit_tp+0x38/0x120 [ 284.551416][ T8246] ? __schedule+0x1713/0x4d00 [ 284.551430][ T8246] ? look_up_lock_class+0x74/0x170 [ 284.551446][ T8246] ? register_lock_class+0x51/0x320 [ 284.551466][ T8246] __lock_acquire+0xab9/0xd20 [ 284.551479][ T8246] ? kernfs_seq_start+0x55/0x3c0 [ 284.551495][ T8246] lock_acquire+0x120/0x360 [ 284.551505][ T8246] ? kernfs_seq_start+0x55/0x3c0 [ 284.551525][ T8246] __mutex_lock+0x182/0xe80 [ 284.551540][ T8246] ? kernfs_seq_start+0x55/0x3c0 [ 284.551556][ T8246] ? rcu_is_watching+0x15/0xb0 [ 284.551568][ T8246] ? trace_irq_disable+0x37/0x110 [ 284.551584][ T8246] ? preempt_schedule_irq+0xde/0x150 [ 284.551598][ T8246] ? __pfx_preempt_schedule_irq+0x10/0x10 [ 284.551612][ T8246] ? kernfs_seq_start+0x55/0x3c0 [ 284.551629][ T8246] ? __pfx___mutex_lock+0x10/0x10 [ 284.551644][ T8246] ? irqentry_exit+0x74/0x90 [ 284.551662][ T8246] ? __pfx_kernfs_seq_start+0x10/0x10 [ 284.551678][ T8246] kernfs_seq_start+0x55/0x3c0 [ 284.551695][ T8246] seq_read_iter+0x3f2/0xe10 [ 284.551712][ T8246] ? __pfx_kernfs_fop_read_iter+0x10/0x10 [ 284.551731][ T8246] copy_splice_read+0x54f/0x9b0 [ 284.551751][ T8246] ? __pfx_copy_splice_read+0x10/0x10 [ 284.551769][ T8246] ? __sanitizer_cov_trace_const_cmp4+0x83/0x90 [ 284.551789][ T8246] ? __pfx_copy_splice_read+0x10/0x10 [ 284.551804][ T8246] splice_file_to_pipe+0x273/0x440 [ 284.551823][ T8246] do_sendfile+0x475/0x7e0 [ 284.551834][ T8246] ? rcu_is_watching+0x15/0xb0 [ 284.551849][ T8246] ? __pfx_do_sendfile+0x10/0x10 [ 284.551864][ T8246] ? preempt_schedule_irq+0xde/0x150 [ 284.551879][ T8246] ? __pfx_preempt_schedule_irq+0x10/0x10 [ 284.551896][ T8246] __se_sys_sendfile64+0x13e/0x190 [ 284.551915][ T8246] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 284.551933][ T8246] ? __secure_computing+0xe2/0x2a0 [ 284.551948][ T8246] do_syscall_64+0xfa/0x3b0 [ 284.551965][ T8246] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 284.551977][ T8246] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 284.551989][ T8246] ? clear_bhb_loop+0x60/0xb0 [ 284.552003][ T8246] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 284.552015][ T8246] RIP: 0033:0x7f533838e929 [ 284.552032][ T8246] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 284.552043][ T8246] RSP: 002b:00007f53391bd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 284.552057][ T8246] RAX: ffffffffffffffda RBX: 00007f53385b6160 RCX: 00007f533838e929 [ 284.552066][ T8246] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 0000000000000000 [ 284.552073][ T8246] RBP: 00007f5338410b39 R08: 0000000000000000 R09: 0000000000000000 [ 284.552081][ T8246] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000000 [ 284.552088][ T8246] R13: 0000000000000000 R14: 00007f53385b6160 R15: 00007fff873c7a48 [ 284.552102][ T8246] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 285.905448][ T6401] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 286.103303][ T6401] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 286.192820][ T6401] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 286.242179][ T6401] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 286.349393][ T6401] bridge_slave_1: left allmulticast mode [ 286.355077][ T6401] bridge_slave_1: left promiscuous mode [ 286.367132][ T6401] bridge0: port 2(bridge_slave_1) entered disabled state [ 286.376798][ T6401] bridge_slave_0: left allmulticast mode [ 286.382476][ T6401] bridge_slave_0: left promiscuous mode [ 286.388844][ T6401] bridge0: port 1(bridge_slave_0) entered disabled state [ 286.491599][ T6401] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 286.504299][ T6401] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 286.513947][ T6401] bond0 (unregistering): Released all slaves [ 286.709723][ T6401] hsr_slave_0: left promiscuous mode [ 286.715528][ T6401] hsr_slave_1: left promiscuous mode [ 286.722935][ T6401] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 286.731618][ T6401] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 286.739889][ T6401] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 286.747690][ T6401] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 286.758414][ T6401] veth1_macvtap: left promiscuous mode [ 286.764024][ T6401] veth0_macvtap: left promiscuous mode [ 286.769908][ T6401] veth1_vlan: left promiscuous mode [ 286.775205][ T6401] veth0_vlan: left promiscuous mode [ 286.914773][ T6401] team0 (unregistering): Port device team_slave_1 removed [ 286.935052][ T6401] team0 (unregistering): Port device team_slave_0 removed [ 287.292367][ T6401] IPVS: stop unused estimator thread 0... [ 287.368213][ T6401] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 287.415529][ T6401] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 287.483972][ T6401] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 287.541912][ T6401] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 287.621649][ T6401] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 287.660906][ T6401] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 287.714032][ T6401] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 287.761187][ T6401] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 287.838033][ T6401] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 287.880618][ T6401] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 287.920804][ T6401] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 287.962278][ T6401] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 288.054655][ T6401] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 288.137840][ T6401] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 288.195650][ T6401] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 288.244183][ T6401] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 288.338253][ T6401] bridge_slave_1: left allmulticast mode [ 288.343928][ T6401] bridge_slave_1: left promiscuous mode [ 288.351038][ T6401] bridge0: port 2(bridge_slave_1) entered disabled state [ 288.360955][ T6401] bridge_slave_0: left allmulticast mode [ 288.366878][ T6401] bridge_slave_0: left promiscuous mode [ 288.372571][ T6401] bridge0: port 1(bridge_slave_0) entered disabled state [ 288.383449][ T6401] bridge_slave_1: left allmulticast mode [ 288.389317][ T6401] bridge_slave_1: left promiscuous mode [ 288.395003][ T6401] bridge0: port 2(bridge_slave_1) entered disabled state [ 288.411162][ T6401] bridge_slave_0: left allmulticast mode [ 288.417382][ T6401] bridge_slave_0: left promiscuous mode [ 288.423068][ T6401] bridge0: port 1(bridge_slave_0) entered disabled state [ 288.431979][ T6401] bridge_slave_1: left allmulticast mode [ 288.437696][ T6401] bridge_slave_1: left promiscuous mode [ 288.443324][ T6401] bridge0: port 2(bridge_slave_1) entered disabled state [ 288.451644][ T6401] bridge_slave_0: left allmulticast mode [ 288.457503][ T6401] bridge_slave_0: left promiscuous mode [ 288.463141][ T6401] bridge0: port 1(bridge_slave_0) entered disabled state [ 288.472572][ T6401] bridge_slave_1: left allmulticast mode [ 288.478588][ T6401] bridge_slave_1: left promiscuous mode [ 288.484230][ T6401] bridge0: port 2(bridge_slave_1) entered disabled state [ 288.492570][ T6401] bridge_slave_0: left allmulticast mode [ 288.498782][ T6401] bridge_slave_0: left promiscuous mode [ 288.504402][ T6401] bridge0: port 1(bridge_slave_0) entered disabled state [ 288.620649][ T6401] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 288.632166][ T6401] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 288.641917][ T6401] bond0 (unregistering): Released all slaves [ 288.731584][ T6401] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 288.741334][ T6401] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 288.750823][ T6401] bond0 (unregistering): Released all slaves [ 288.813941][ T6401] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 288.824221][ T6401] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 288.834499][ T6401] bond0 (unregistering): Released all slaves [ 288.899950][ T6401] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 288.909584][ T6401] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 288.918973][ T6401] bond0 (unregistering): Released all slaves [ 289.463833][ T6401] hsr_slave_0: left promiscuous mode [ 289.470947][ T6401] hsr_slave_1: left promiscuous mode [ 289.477728][ T6401] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 289.485119][ T6401] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 289.496286][ T6401] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 289.503770][ T6401] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 289.515565][ T6401] hsr_slave_0: left promiscuous mode [ 289.522447][ T6401] hsr_slave_1: left promiscuous mode [ 289.529756][ T6401] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 289.538406][ T6401] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 289.548220][ T6401] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 289.555609][ T6401] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 289.568607][ T6401] hsr_slave_0: left promiscuous mode [ 289.574419][ T6401] hsr_slave_1: left promiscuous mode [ 289.580330][ T6401] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 289.589765][ T6401] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 289.597544][ T6401] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 289.604929][ T6401] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 289.615465][ T6401] hsr_slave_0: left promiscuous mode [ 289.622106][ T6401] hsr_slave_1: left promiscuous mode [ 289.628667][ T6401] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 289.636566][ T6401] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 289.644245][ T6401] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 289.651701][ T6401] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 289.673261][ T6401] veth1_macvtap: left promiscuous mode [ 289.678917][ T6401] veth0_macvtap: left promiscuous mode [ 289.684486][ T6401] veth1_vlan: left promiscuous mode [ 289.692172][ T6401] veth0_vlan: left promiscuous mode [ 289.698404][ T6401] veth1_macvtap: left promiscuous mode [ 289.703924][ T6401] veth0_macvtap: left promiscuous mode [ 289.709625][ T6401] veth1_vlan: left promiscuous mode [ 289.714886][ T6401] veth0_vlan: left promiscuous mode [ 289.721177][ T6401] veth1_macvtap: left promiscuous mode [ 289.728158][ T6401] veth0_macvtap: left promiscuous mode [ 289.733730][ T6401] veth1_vlan: left promiscuous mode [ 289.739365][ T6401] veth0_vlan: left promiscuous mode [ 289.745520][ T6401] veth1_macvtap: left promiscuous mode [ 289.752732][ T6401] veth0_macvtap: left promiscuous mode [ 289.758884][ T6401] veth1_vlan: left promiscuous mode [ 289.764179][ T6401] veth0_vlan: left promiscuous mode [ 289.984923][ T6401] team0 (unregistering): Port device team_slave_1 removed [ 290.005485][ T6401] team0 (unregistering): Port device team_slave_0 removed [ 290.144006][ T6401] team0 (unregistering): Port device team_slave_1 removed [ 290.154687][ T6401] team0 (unregistering): Port device team_slave_0 removed [ 290.294886][ T6401] team0 (unregistering): Port device team_slave_1 removed [ 290.318779][ T6401] team0 (unregistering): Port device team_slave_0 removed [ 290.441796][ T6401] team0 (unregistering): Port device team_slave_1 removed [ 290.461802][ T6401] team0 (unregistering): Port device team_slave_0 removed [ 291.284670][ T6401] IPVS: stop unused estimator thread 0... [ 291.292291][ T6401] IPVS: stop unused estimator thread 0... [ 291.301968][ T6401] IPVS: stop unused estimator thread 0...