last executing test programs: 1m51.649991559s ago: executing program 2 (id=12): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x7, 0x4, 0x6, 0xfffa}, 0x1d, [0x6, 0xc95a, 0xfffffff3, 0x6, 0x7f, 0x2, 0x1, 0x7f, 0x6, 0x4d, 0xfffffff2, 0x5f, 0xa, 0xfffffffa, 0xffff2d33, 0x1dd2, 0x6, 0x7, 0x0, 0x80000000, 0x4, 0x7, 0x3, 0x3c5b, 0x1, 0x24, 0xffffffff, 0xfffffffe, 0x1f461e2c, 0x2, 0xe661, 0x4, 0x3, 0x3, 0x107fff, 0x4c74, 0xfbf5, 0x0, 0xb, 0xa, 0x0, 0x71, 0x7, 0x2000007, 0x103, 0x0, 0x5, 0x3c, 0x91, 0x6, 0x6, 0x3, 0x4, 0x4, 0x8, 0x0, 0x7f, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0xffff, 0x12f, 0x8000, 0x10, 0x8, 0x129432e6, 0xcb, 0xf9, 0xd, 0x2bf, 0x6c9, 0xfffff000, 0xfffffffe, 0x8, 0x0, 0x7, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0xa, 0x4, 0x0, 0x8000, 0x9, 0x400, 0x1, 0x6, 0xfffffffd, 0xff, 0x1005, 0x801, 0x8, 0x4, 0x0, 0x106, 0x2, 0x8, 0x4, 0x9, 0x8, 0x9, 0x6, 0x5, 0x0, 0x1, 0x8000, 0xffff, 0x2, 0x83, 0x9, 0x5, 0x10003, 0x4, 0x1, 0x7, 0xd, 0x9, 0x48c93690, 0x2, 0xff], [0x7, 0x4, 0x0, 0x64e, 0xfffffdfe, 0x7fffffff, 0x8d2, 0x9, 0x387d, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x10000009, 0x3e7, 0xb, 0x5, 0x2, 0x80002, 0xf, 0x8, 0x4, 0x6d01, 0x5, 0x3b, 0x3, 0x200, 0x80, 0x3, 0x4, 0x2, 0x0, 0xa2, 0x7, 0x53cf697b, 0x20005, 0x6, 0x54fe12d2, 0xbf, 0x200, 0x3, 0x400002, 0xfffffff9, 0x0, 0x6, 0x5, 0x0, 0x6, 0xfffffffb, 0x120000, 0x3, 0x6, 0x9, 0x2000008, 0x2], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0x5, 0xce5, 0x1fd, 0x6, 0x5, 0x5, 0x40000003, 0x100, 0x10000, 0x6, 0x7fff, 0x8ffff, 0xa620, 0x2, 0x5, 0x1, 0x5, 0xffffffff, 0x60a7, 0x6, 0x5, 0xffffffff, 0x7ffffffb, 0x5, 0x8, 0xc8, 0x3, 0x3, 0x80ffff, 0x200003, 0x5, 0x80000000, 0x9602, 0xa, 0x2, 0x4, 0x10, 0x1, 0x10000, 0x5, 0x8, 0x2b91, 0xa1f, 0x8, 0x9, 0x1, 0x6c1b, 0x3, 0x8, 0x5, 0xb1c, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x0) r0 = syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x79af, 0x3180, 0x2, 0x40024e}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x40, 0x4007, @fd_index=0x3, 0x6, 0x0, 0x0, 0x2, 0x1}) io_uring_enter(r0, 0x627, 0x4c1, 0x43, 0x0, 0x0) 1m50.140299638s ago: executing program 2 (id=17): socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) setsockopt$bt_rfcomm_RFCOMM_LM(0xffffffffffffffff, 0x12, 0x3, 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) r2 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000240)=r2) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000040)={0x1, r2}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/56, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/70, 0x100000}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000680)) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000000)=0x1) 1m45.250486196s ago: executing program 2 (id=23): r0 = socket$nl_route(0x10, 0x3, 0x0) gettid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) syz_open_dev$video(&(0x7f0000000000), 0xc000, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='ramfs\x00', 0x2014800, 0x0) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) listen(0xffffffffffffffff, 0x267) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x2000000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x13101}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x0) 1m43.374387193s ago: executing program 2 (id=25): r0 = socket$nl_route(0x10, 0x3, 0x0) gettid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) syz_open_dev$video(&(0x7f0000000000), 0xc000, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='ramfs\x00', 0x2014800, 0x0) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) listen(0xffffffffffffffff, 0x267) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x2000000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x13101}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x0) 1m41.580101091s ago: executing program 2 (id=27): socket$inet6(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x15, 0x2, &(0x7f0000000100)=ANY=[@ANYBLOB="611000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x28}, 0x94) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_open_dev$cec(&(0x7f0000000000), 0xffffffffffffffff, 0xc0c00) ioctl$IOC_PR_PREEMPT(r3, 0x40046109, &(0x7f0000000040)={0x20, 0xfffffffffffffffe}) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xf, &(0x7f0000000340)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r5, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x4) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=ANY=[@ANYBLOB="fc0000001900010000000000fcdbdf2500000000000000000000000000000000fe8000000002000000000000000000bb00000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000004000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000001000000000000004400050000000000000000000000000000000000000000022b0000000a000000fe8000000000000000000000000000aa0000000004"], 0xfc}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) bind$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(0xffffffffffffffff, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) fsync(r1) 1m37.373411971s ago: executing program 2 (id=29): r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan1\x00', 0x0}) connect$can_bcm(r0, &(0x7f0000000300)={0x1d, r1}, 0x10) sendmsg$can_bcm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x48}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f00000000c0)={'vxcan1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000004c00)=@newtfilter={0x24, 0x11, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x74, r4, {0x1}}}, 0x24}, 0x1, 0xf0ffffffffffff}, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) 1m22.22139796s ago: executing program 1 (id=42): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) setsockopt$inet6_IPV6_HOPOPTS(0xffffffffffffffff, 0x29, 0x36, &(0x7f0000000380)=ANY=[], 0x8) connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, 0x0, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x80a02, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, 0x0, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) sendmsg$NFC_CMD_GET_TARGET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x14, 0x0, 0x315, 0x70bd29, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0xc8c1}, 0x4000094) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000200)={0x8000, 0x101, 0x4}) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r5, 0xc04064a0, &(0x7f0000000040)={0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0xfffffd52, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR(r4, 0xc01c64a3, &(0x7f0000000280)={0x3, r6, 0x1, 0xffff, 0xa, 0x1ff, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) 1m22.107145528s ago: executing program 32 (id=29): r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan1\x00', 0x0}) connect$can_bcm(r0, &(0x7f0000000300)={0x1d, r1}, 0x10) sendmsg$can_bcm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x48}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f00000000c0)={'vxcan1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000004c00)=@newtfilter={0x24, 0x11, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x74, r4, {0x1}}}, 0x24}, 0x1, 0xf0ffffffffffff}, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) 1m17.832314724s ago: executing program 1 (id=48): socket$inet6(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x15, 0x2, &(0x7f0000000100)=ANY=[@ANYBLOB="611000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x28}, 0x94) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_open_dev$cec(&(0x7f0000000000), 0xffffffffffffffff, 0xc0c00) ioctl$IOC_PR_PREEMPT(r3, 0x40046109, &(0x7f0000000040)={0x20, 0xfffffffffffffffe}) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xf, &(0x7f0000000340)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r5, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x4) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=ANY=[@ANYBLOB="fc0000001900010000000000fcdbdf2500000000000000000000000000000000fe8000000002000000000000000000bb00000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000004000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000001000000000000004400050000000000000000000000000000000000000000022b0000000a000000fe8000000000000000000000000000aa0000000004"], 0xfc}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r7, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r7, &(0x7f0000007fc0), 0x800001d, 0x1c) 1m15.59087929s ago: executing program 1 (id=52): r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000400)={0x18, 0x0, {0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 'lo\x00'}}, 0x1e) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x6) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) sendmmsg(r0, &(0x7f00000008c0)=[{{0x0, 0x0, 0x0}}], 0x34000, 0x0) 1m8.869299946s ago: executing program 1 (id=55): socket$nl_route(0x10, 0x3, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) prctl$PR_SET_PDEATHSIG(0x25, 0x2000000000034) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) futex(0x0, 0x6, 0x2, 0x0, 0x0, 0x2) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000280)={'erspan0\x00', 0x0}) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x8) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r3 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/compact_memory\x00', 0x1, 0x0) sendfile(r3, r2, &(0x7f00000000c0)=0x58, 0x8) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00'}) 1m3.951726433s ago: executing program 1 (id=62): syz_open_dev$radio(0x0, 0xffffffffffffffff, 0x2) socket$inet6(0xa, 0x80001, 0x0) open(&(0x7f0000000240)='./file1\x00', 0x145142, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x9}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{0x0}], 0x1) socket$netlink(0x10, 0x3, 0x10) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r1, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000640)={0x28, 0x0, 0x2710}, 0x10) pselect6(0x40, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0xc3ac}, &(0x7f0000000300)={0x0, 0x3938700}, 0x0) 59.153618376s ago: executing program 1 (id=67): write$6lowpan_enable(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x2def, 0x4000, 0x0, 0x0, 0x0) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mbind(&(0x7f00001e7000/0x2000)=nil, 0x2000, 0x8003, &(0x7f0000000000)=0x9, 0x3, 0x2) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps_rollup\x00') madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) userfaultfd(0x1) read$FUSE(r2, &(0x7f0000002800)={0x2020}, 0x2020) 43.600943336s ago: executing program 33 (id=67): write$6lowpan_enable(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x2def, 0x4000, 0x0, 0x0, 0x0) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mbind(&(0x7f00001e7000/0x2000)=nil, 0x2000, 0x8003, &(0x7f0000000000)=0x9, 0x3, 0x2) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps_rollup\x00') madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) userfaultfd(0x1) read$FUSE(r2, &(0x7f0000002800)={0x2020}, 0x2020) 24.861447891s ago: executing program 4 (id=99): write$6lowpan_enable(0xffffffffffffffff, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x2def, 0x4000, 0x0, 0x0, 0x0) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mbind(&(0x7f00001e7000/0x2000)=nil, 0x2000, 0x8003, &(0x7f0000000000)=0x9, 0x3, 0x2) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps_rollup\x00') madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) userfaultfd(0x1) read$FUSE(r2, &(0x7f0000002800)={0x2020}, 0x2020) 17.582680323s ago: executing program 4 (id=110): ioperm(0x2, 0x2, 0x81) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x33, &(0x7f0000000040)={0x3, &(0x7f0000000080)=[{0x5, 0xa0, 0x9, 0x200}, {0x7ff, 0x6, 0xf2, 0x4}, {0x0, 0xfd, 0x4, 0x7ff}]}, 0x10) 11.865303878s ago: executing program 3 (id=115): syz_io_uring_setup(0x9e, &(0x7f0000000640)={0x0, 0x936, 0x0, 0x0, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000580), 0xffffffffffffffff) socket$caif_stream(0x25, 0x1, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = memfd_create(&(0x7f0000000600)='+\x88\xc7s\x00\x00\x942nodev\x00\x00\x8cZ_Pv\x03\xa7\xc1\b\xec\x90Q\x85\x83\xcd\x16\xdcw\'\x8a\xe5N\x8c\x02\x8f\xf5\n\xd1)\xc8\xa5x\x17\f\xbc\xd1.\x8cA\x17\x86\xb7-j!Y\x92\xd9\xc4\r8\xd0\xc9X\xa7\x11\xa3\xf0\x8a*\xbc\x87\xcd\x1fl\xfc\xf3]\xb8\xbd\x02\v<\fl\xa6]\xa5\xfb\x05\xcb\x9c\xe2\xc8\x05\xa5\xa5\xeb\xa9\xef\xe3\xf1b\x81\xec\xac\xb6\x80\xd5\xf5S\x85\x06O\x05\xb8\xa1\x15\xcc\x17\xe8sNe\xd3\xf4\xceM(\xa03\xe1\'\xc2\x9d3\xeb\x1d\x84\xb9\x15S\x95\x95B\xee_\x98\x91)\xe7\xa8+\x8c\xee\x83@q\x16\xcf3\x0f\x81\xa8\xa9`i\x01m:\xcc\x1c\xed<\xcfA3n\xfd\n>\x03\xae\f \xdbH\'\x05\x82\xdbLE\x14\xcdq\x1abcf\xdb8\xe9a\xa8\x00\x00\x00\x00\x00\x00\x8f\x05\x98\x93\xd0\xe6\xacQ&\xff\x01\x00\x00~K-\xa8`d^`&4\x99=\x10\x00$P\xfe\x99\xc1\x17\x17\a\xb4\x1d\xa5P\xfb\x04\xf7\xdc~\x17\x1e\xe6\f\x16\x10_\xfdM\x13\x01\xb3\xd2^\xd3\xe7ndMI)(\x98\xaa<&\xa2b\xff8o\xac\xb3\xb5\f\x82\x1b\x19\xdb\x1c\xfb\xee@\xbf\xdcSkrXj\x81\xf0\xc5\an<0\xdb\x93\x9e\xa8\xe2\xbd\x1c\xbd\xbb\xd6\xaf\xd7t\x90\xb2\xbevq/\v\xff8,4_\x10\x89\xef\xd0\x16\xd8Va\xc9\x99\x9a\x88\xf0\x93\xb8A', 0x1) fcntl$addseals(r3, 0x409, 0x12) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6a72c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="ae", 0x1, 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_SET(r1, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000140)={0x58, r2, 0x1, 0x7fffffff, 0x0, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5, 0x82}}]}, 0x58}}, 0x20000054) 10.814159181s ago: executing program 4 (id=117): syz_open_dev$radio(0x0, 0xffffffffffffffff, 0x2) socket$inet6(0xa, 0x80001, 0x0) open(&(0x7f0000000240)='./file1\x00', 0x145142, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x9}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)}, {0x0}], 0x2) socket$netlink(0x10, 0x3, 0x10) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r1, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000640)={0x28, 0x0, 0x2710}, 0x10) pselect6(0x40, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0xc3ac}, &(0x7f0000000300)={0x0, 0x3938700}, 0x0) 10.634900264s ago: executing program 0 (id=118): socket$nl_route(0x10, 0x3, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18060000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000003000000b703000000000000850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) r1 = socket$kcm(0xa, 0x2, 0x0) sendmsg$inet(r1, &(0x7f0000001940)={&(0x7f00000014c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x30}}, 0x10, &(0x7f00000018c0)=[{&(0x7f0000001500)="a2", 0x1}], 0x1}, 0x8810) ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x5412, &(0x7f00000000c0)=0x13) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x84}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$tipc(0x1e, 0x5, 0x0) listen(r3, 0x0) 10.517312325s ago: executing program 3 (id=119): syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_mr_cache\x00') ptrace(0x10, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) ptrace(0x10, 0x0) ptrace$peeksig(0x4209, 0x0, &(0x7f0000000080), 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x80a02, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f00000001c0)=0x7) pipe2$watch_queue(&(0x7f00000000c0), 0x80) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x20000000000, 0xfffffffffffffffd, 0x0, 0x0, 0x1000001000, 0x49}, 0x0, &(0x7f00000002c0)={0x3ff, 0x7, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) 10.083633849s ago: executing program 0 (id=120): r0 = socket$inet_sctp(0x2, 0x1, 0x84) fsopen(&(0x7f0000000180)='hugetlbfs\x00', 0x0) userfaultfd(0x801) openat$sndtimer(0xffffffffffffff9c, 0x0, 0x40000) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$rdma_cm(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000400)='/sys/power/resume', 0x149a82, 0x8) write$cgroup_int(r2, &(0x7f0000000040)=0x1f00, 0x12) mkdirat(0xffffffffffffff9c, 0x0, 0x88) sendmsg$inet_sctp(r0, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f00000006c0)=[{&(0x7f00000007c0)='N', 0x1}], 0x1, 0x0, 0x0, 0x804c050}, 0x1) 8.925148636s ago: executing program 0 (id=121): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendmmsg$inet(r0, &(0x7f0000000d00)=[{{0x0, 0x1e, &(0x7f0000002c00)=[{&(0x7f0000001500)="b25b365c0254a7c6fc7ea6155a71b613b02d1645aab67271075189c3540c4dd19ebfb3c4acf87f2eeb258e62cc6ae96db360d874500cb86b4185ee533bf708", 0x3f}, {&(0x7f0000002800)="cf", 0x1}, {&(0x7f0000000380)="08e0ac8fb1d99df61d7b518d0a62071e7ec69f658d5a52d7eb7ea31db43f8cf570f335a80860ac4cc240dc149d8468493db8aad089f590d62e0bcb9d1dcee636ee311ee51839b7201745baef82209b2ab741dc5ea481ae9dcebe39b1101a42a8c82de46107541c240ad0d9ee4a9340cffd72aaea692a60993637c81d23a0d0ebbae66f1eb2771df2482c043d8715ae788b56cc91eaa4d6bbdec82d8f91eb822d0b5f3ebd86", 0x1}, {&(0x7f0000000180)="8a", 0x1}, {&(0x7f0000002b40)='-', 0x1}], 0x5}}, {{0x0, 0x0, &(0x7f0000002f00)=[{&(0x7f0000001580)="ce90bfdbcfb8a86a74f6799f98c36e23e210f053830ac8e978a0785884001a7099c4b9016f1a65a57390caf78c272cbf9711f94505dd525af1ff7d013438df5b844226f41b81e58eb73366", 0x4b}, {&(0x7f0000000540)="f2e659a0b00d26c2ee15", 0xa}, {&(0x7f0000002e40)="d4", 0x1}], 0x3}}, {{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000003000)="e1", 0x1}, {&(0x7f00000010c0)="fa", 0x1}, {&(0x7f0000001680)="d8", 0x1}, {&(0x7f0000001600)="f2964dd16e01d56b414499264923beda58d7da0313c1ccafe53965750f25bdaa6b56a87307ec23d48b6f35ce49a813a2bc3cb23fdf42826bdc16788ff466919594de5bf8a1fa5d825947271ade4a95efeb170c", 0xfffffd57}, {&(0x7f0000001340)="b8", 0x1}, {&(0x7f0000000500)="01", 0x1}, {&(0x7f0000000280)="87", 0x1}], 0x7}}, {{0x0, 0x0, &(0x7f0000001540)=[{&(0x7f0000000140), 0x1}, {&(0x7f0000000340)="e4", 0xfffffec2}], 0x2, 0x0, 0xffffff84}}], 0x5f, 0x4000000) setsockopt$sock_int(r0, 0x1, 0x20, &(0x7f0000000000)=0x7fffffff, 0x4) 8.924275206s ago: executing program 4 (id=122): socket$inet6(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x15, 0x2, &(0x7f0000000100)=ANY=[@ANYBLOB="611000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x28}, 0x94) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_open_dev$cec(&(0x7f0000000000), 0xffffffffffffffff, 0xc0c00) ioctl$IOC_PR_PREEMPT(r3, 0x40046109, &(0x7f0000000040)={0x20, 0xfffffffffffffffe}) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xf, &(0x7f0000000340)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r5, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x4) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=ANY=[@ANYBLOB="fc0000001900010000000000fcdbdf2500000000000000000000000000000000fe8000000002000000000000000000bb00000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000004000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000001000000000000004400050000000000000000000000000000000000000000022b0000000a000000fe8000000000000000000000000000aa0000000004"], 0xfc}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r6, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r6, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r6, &(0x7f0000007fc0), 0x800001d, 0x1c) 8.842463893s ago: executing program 3 (id=123): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r0 = gettid() timer_create(0xb, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000000080)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = syz_open_dev$cec(&(0x7f0000000240), 0x0, 0x2182) ioctl$CEC_RECEIVE(r1, 0xc0386106, &(0x7f0000000040)={0x0, 0x7, 0x1, 0xfffffffd, 0x5, 0x9, "3000000502000000000000000400", 0x0, 0x0, 0x4a, 0x8, 0x0, 0x4, 0xe}) 7.289473724s ago: executing program 0 (id=124): r0 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000380)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r1, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r0, 0x3ba0, &(0x7f0000000180)={0x48, 0xa, r2}) 7.288625992s ago: executing program 3 (id=125): socket(0x400000000010, 0x3, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r4, 0x0, 0x0) connect$inet6(r4, 0x0, 0x0) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='maps\x00') ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0xc0686611, &(0x7f0000000180)={0x67, 0x0, 0x18, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) 7.280795901s ago: executing program 4 (id=126): ioperm(0x0, 0x100, 0x7) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x33, &(0x7f0000000040)={0x3, &(0x7f0000000080)=[{0x5, 0xa0, 0x9, 0x200}, {0x7ff, 0x6, 0xf2, 0x4}, {0x0, 0xfd, 0x4, 0x7ff}]}, 0x10) 6.746910852s ago: executing program 0 (id=127): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000001800ff0f0000000000000000850000006d000000850000000800000095"], &(0x7f0000000080)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffbfbb}, 0x94) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) kcmp(0x0, 0x0, 0x6, r0, r1) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000040)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffcffffff, 0x20031, 0xffffffffffffffff, 0xbe9f5000) r5 = userfaultfd(0x80001) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x2e8}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r6 = socket$packet(0x11, 0x2, 0x300) ioctl$SIOCGSTAMPNS(r6, 0x8907, 0x0) read(r6, &(0x7f0000000000)=""/143, 0x8f) 5.800695297s ago: executing program 3 (id=128): mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000003c0)='./cgroup\x00', &(0x7f0000000080)='hfs\x00', 0x8000, 0x0) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r0, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000340)="b9cd14c222ee", 0x4b}], 0x1}}], 0x1, 0x20008000) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket(0xa, 0x3, 0xff) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8000}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$MRT_INIT(0xffffffffffffffff, 0x0, 0xc8, &(0x7f0000003d40), 0x4) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000140), 0x40000, 0x0) syz_emit_ethernet(0x2a, &(0x7f00000004c0)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaaaa08004510001c00aa1101907800000000022a5f517cbc18332565b2cf096bfe82c89aa5cea54c77be044e9515f1660c00298db05b45f0f2fc756fd153008cf9e2552ac8fc6cbe25bff102b5a343d811eb7521dc0e77bf7f3c4de0178ff3e84e5e63c7ac"], 0x0) 2.543505587s ago: executing program 4 (id=129): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x10) sendmmsg$inet(r0, 0x0, 0x0, 0xc044) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00'}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000480)=@abs={0x0, 0x0, 0x8004e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='tracefs\x00', 0x0, 0x0) 1.141282479s ago: executing program 3 (id=130): socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x1) sched_setaffinity(0x0, 0xfffffffffffffdc5, &(0x7f00000002c0)=0x800002) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) pwritev2(0xffffffffffffffff, 0x0, 0x0, 0x5412, 0x0, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'macvlan0\x00'}) socket$nl_route(0x10, 0x3, 0x0) 0s ago: executing program 0 (id=131): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) socket$nl_route(0x10, 0x3, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) sendmmsg$inet(r1, &(0x7f0000000c40)=[{{&(0x7f0000000040)={0x2, 0x0, @multicast2}, 0x23, 0x0}}], 0x3284b164842c97f7, 0x8014) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.225' (ED25519) to the list of known hosts. [ 90.512780][ T5787] cgroup: Unknown subsys name 'net' [ 90.753649][ T5787] cgroup: Unknown subsys name 'cpuset' [ 90.788312][ T5787] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 92.115541][ T993] cfg80211: failed to load regulatory.db [ 92.880903][ T5787] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 95.991904][ T5801] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 96.006160][ T5118] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 96.011382][ T5118] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 96.013124][ T5807] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 96.014109][ T5807] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 96.017298][ T5807] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 96.019406][ T5807] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 96.020067][ T5807] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 96.024921][ T5118] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 96.026746][ T5118] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 96.168648][ T5806] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 96.174969][ T5806] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 96.175874][ T5806] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 96.178908][ T5806] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 96.181998][ T5806] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 96.276841][ T5807] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 96.285828][ T5807] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 96.295436][ T5807] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 96.309938][ T5807] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 96.314476][ T5807] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 96.352621][ T5806] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 96.357324][ T5806] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 96.359806][ T5806] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 96.361416][ T5806] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 96.363251][ T5806] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 97.361003][ T5804] chnl_net:caif_netlink_parms(): no params data found [ 97.419640][ T5800] chnl_net:caif_netlink_parms(): no params data found [ 97.442322][ T5803] chnl_net:caif_netlink_parms(): no params data found [ 97.631794][ T5811] chnl_net:caif_netlink_parms(): no params data found [ 97.861323][ T5813] chnl_net:caif_netlink_parms(): no params data found [ 98.189167][ T5806] Bluetooth: hci0: command tx timeout [ 98.197704][ T5806] Bluetooth: hci1: command tx timeout [ 98.268742][ T5806] Bluetooth: hci2: command tx timeout [ 98.428799][ T5806] Bluetooth: hci4: command tx timeout [ 98.429733][ T5806] Bluetooth: hci3: command tx timeout [ 98.471938][ T5804] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.472658][ T5804] bridge0: port 1(bridge_slave_0) entered disabled state [ 98.473141][ T5804] bridge_slave_0: entered allmulticast mode [ 98.475240][ T5804] bridge_slave_0: entered promiscuous mode [ 98.579642][ T5800] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.579735][ T5800] bridge0: port 1(bridge_slave_0) entered disabled state [ 98.579897][ T5800] bridge_slave_0: entered allmulticast mode [ 98.582076][ T5800] bridge_slave_0: entered promiscuous mode [ 98.600048][ T5804] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.600234][ T5804] bridge0: port 2(bridge_slave_1) entered disabled state [ 98.600886][ T5804] bridge_slave_1: entered allmulticast mode [ 98.604323][ T5804] bridge_slave_1: entered promiscuous mode [ 98.610134][ T5803] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.610246][ T5803] bridge0: port 1(bridge_slave_0) entered disabled state [ 98.610839][ T5803] bridge_slave_0: entered allmulticast mode [ 98.613758][ T5803] bridge_slave_0: entered promiscuous mode [ 98.688897][ T5800] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.689059][ T5800] bridge0: port 2(bridge_slave_1) entered disabled state [ 98.689200][ T5800] bridge_slave_1: entered allmulticast mode [ 98.691416][ T5800] bridge_slave_1: entered promiscuous mode [ 98.800985][ T5803] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.801118][ T5803] bridge0: port 2(bridge_slave_1) entered disabled state [ 98.801336][ T5803] bridge_slave_1: entered allmulticast mode [ 98.804409][ T5803] bridge_slave_1: entered promiscuous mode [ 99.158825][ T5811] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.159139][ T5811] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.159331][ T5811] bridge_slave_0: entered allmulticast mode [ 99.161560][ T5811] bridge_slave_0: entered promiscuous mode [ 99.332951][ T5804] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 99.408687][ T5811] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.408820][ T5811] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.409308][ T5811] bridge_slave_1: entered allmulticast mode [ 99.411572][ T5811] bridge_slave_1: entered promiscuous mode [ 99.415903][ T5800] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 99.501730][ T5804] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 99.505006][ T5803] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 99.582019][ T5800] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 99.582320][ T5813] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.582436][ T5813] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.582593][ T5813] bridge_slave_0: entered allmulticast mode [ 99.584576][ T5813] bridge_slave_0: entered promiscuous mode [ 99.661221][ T5803] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 99.998764][ T5813] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.998881][ T5813] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.999050][ T5813] bridge_slave_1: entered allmulticast mode [ 100.000960][ T5813] bridge_slave_1: entered promiscuous mode [ 100.193600][ T5811] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.267781][ T5806] Bluetooth: hci1: command tx timeout [ 100.267800][ T5807] Bluetooth: hci0: command tx timeout [ 100.348008][ T5806] Bluetooth: hci2: command tx timeout [ 100.371247][ T5804] team0: Port device team_slave_0 added [ 100.443017][ T5811] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.445205][ T5800] team0: Port device team_slave_0 added [ 100.507864][ T5806] Bluetooth: hci4: command tx timeout [ 100.518401][ T5806] Bluetooth: hci3: command tx timeout [ 100.531464][ T5804] team0: Port device team_slave_1 added [ 100.533609][ T5803] team0: Port device team_slave_0 added [ 100.640662][ T5800] team0: Port device team_slave_1 added [ 100.644073][ T5813] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.720359][ T5803] team0: Port device team_slave_1 added [ 100.870973][ T5813] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 101.300499][ T5811] team0: Port device team_slave_0 added [ 101.479574][ T5804] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.479588][ T5804] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.479607][ T5804] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.570365][ T5811] team0: Port device team_slave_1 added [ 101.571434][ T5800] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.571446][ T5800] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.571464][ T5800] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.659568][ T5804] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.659586][ T5804] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.659614][ T5804] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.660851][ T5803] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.660863][ T5803] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.660882][ T5803] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.769356][ T5800] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.769370][ T5800] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.769390][ T5800] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.771721][ T5813] team0: Port device team_slave_0 added [ 101.785849][ T5803] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.785869][ T5803] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.785901][ T5803] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.937765][ T5813] team0: Port device team_slave_1 added [ 101.951883][ T5811] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.951904][ T5811] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.951934][ T5811] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 102.032990][ T5811] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 102.033003][ T5811] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.033022][ T5811] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 102.340194][ T5813] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 102.340211][ T5813] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.340240][ T5813] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 102.357513][ T5806] Bluetooth: hci0: command tx timeout [ 102.357551][ T5806] Bluetooth: hci1: command tx timeout [ 102.427746][ T5807] Bluetooth: hci2: command tx timeout [ 102.589167][ T5806] Bluetooth: hci3: command tx timeout [ 102.589280][ T5807] Bluetooth: hci4: command tx timeout [ 102.594314][ T5813] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 102.594327][ T5813] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 102.594349][ T5813] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 102.608176][ T5804] hsr_slave_0: entered promiscuous mode [ 102.610365][ T5804] hsr_slave_1: entered promiscuous mode [ 102.715045][ T5800] hsr_slave_0: entered promiscuous mode [ 102.716122][ T5800] hsr_slave_1: entered promiscuous mode [ 102.716925][ T5800] debugfs: 'hsr0' already exists in 'hsr' [ 102.717016][ T5800] Cannot create hsr debugfs directory [ 102.743983][ T5803] hsr_slave_0: entered promiscuous mode [ 102.745082][ T5803] hsr_slave_1: entered promiscuous mode [ 102.745759][ T5803] debugfs: 'hsr0' already exists in 'hsr' [ 102.745780][ T5803] Cannot create hsr debugfs directory [ 102.996373][ T5811] hsr_slave_0: entered promiscuous mode [ 102.997364][ T5811] hsr_slave_1: entered promiscuous mode [ 102.999435][ T5811] debugfs: 'hsr0' already exists in 'hsr' [ 102.999467][ T5811] Cannot create hsr debugfs directory [ 103.591589][ T5813] hsr_slave_0: entered promiscuous mode [ 103.592702][ T5813] hsr_slave_1: entered promiscuous mode [ 103.593715][ T5813] debugfs: 'hsr0' already exists in 'hsr' [ 103.593741][ T5813] Cannot create hsr debugfs directory [ 104.427884][ T5806] Bluetooth: hci0: command tx timeout [ 104.427934][ T5807] Bluetooth: hci1: command tx timeout [ 104.507634][ T5807] Bluetooth: hci2: command tx timeout [ 104.667870][ T5807] Bluetooth: hci4: command tx timeout [ 104.667901][ T5807] Bluetooth: hci3: command tx timeout [ 104.942065][ T5804] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 104.985408][ T5804] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 105.034274][ T5804] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 105.088425][ T5804] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 105.223897][ T5803] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 105.263990][ T5803] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 105.283349][ T5803] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 105.343177][ T5803] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 105.467281][ T5800] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 105.509186][ T5800] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 105.561242][ T5800] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 105.616802][ T5800] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 105.754599][ T5813] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 105.800682][ T5813] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 105.849334][ T5813] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 105.900923][ T5813] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 106.063055][ T5811] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 106.103091][ T5811] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 106.140809][ T5804] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.141869][ T5811] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 106.175627][ T5811] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 106.287262][ T5804] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.324937][ T5803] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.334242][ T1339] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.335146][ T1339] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.383752][ T71] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.383904][ T71] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.449659][ T5803] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.476628][ T5800] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.503302][ T3590] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.503456][ T3590] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.550617][ T3590] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.550744][ T3590] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.595227][ T5800] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.633871][ T5813] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.646587][ T3590] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.646737][ T3590] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.692271][ T3590] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.692494][ T3590] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.763250][ T5813] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.805346][ T5811] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.830804][ T71] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.830937][ T71] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.885346][ T1166] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.885489][ T1166] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.953200][ T5811] 8021q: adding VLAN 0 to HW filter on device team0 [ 107.000290][ T68] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.000548][ T68] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.087891][ T1339] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.088042][ T1339] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.281010][ T5804] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.479726][ T5803] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.629088][ T5804] veth0_vlan: entered promiscuous mode [ 107.685243][ T5800] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.705393][ T5804] veth1_vlan: entered promiscuous mode [ 107.795489][ T5803] veth0_vlan: entered promiscuous mode [ 107.861805][ T5803] veth1_vlan: entered promiscuous mode [ 107.897257][ T5804] veth0_macvtap: entered promiscuous mode [ 107.934655][ T5813] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.935773][ T5804] veth1_macvtap: entered promiscuous mode [ 107.969599][ T5800] veth0_vlan: entered promiscuous mode [ 107.980426][ T5811] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.045687][ T5800] veth1_vlan: entered promiscuous mode [ 108.071110][ T5804] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 108.106460][ T5803] veth0_macvtap: entered promiscuous mode [ 108.125040][ T5804] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 108.144974][ T5803] veth1_macvtap: entered promiscuous mode [ 108.217998][ T1339] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.226713][ T1339] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.263642][ T1339] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.286735][ T1339] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.323247][ T5803] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 108.420302][ T5803] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 108.421086][ T5800] veth0_macvtap: entered promiscuous mode [ 108.422472][ T5811] veth0_vlan: entered promiscuous mode [ 108.572004][ T5800] veth1_macvtap: entered promiscuous mode [ 108.595226][ T3590] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.622103][ T3590] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.637357][ T3590] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.653095][ T5811] veth1_vlan: entered promiscuous mode [ 108.661596][ T3590] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.802975][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.803000][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 108.846505][ T5800] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 108.923724][ T5800] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 109.014158][ T3590] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.027709][ T3590] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.028468][ T5813] veth0_vlan: entered promiscuous mode [ 109.032205][ T1149] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.032225][ T1149] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.044834][ T3590] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.099722][ T3590] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.129127][ T5811] veth0_macvtap: entered promiscuous mode [ 109.131576][ T68] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.131597][ T68] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.202103][ T5813] veth1_vlan: entered promiscuous mode [ 109.225871][ T5811] veth1_macvtap: entered promiscuous mode [ 109.383280][ T71] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.383304][ T71] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.495450][ T5811] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.616318][ T68] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.616342][ T68] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.624852][ T5813] veth0_macvtap: entered promiscuous mode [ 109.654775][ T5813] veth1_macvtap: entered promiscuous mode [ 109.746847][ T71] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.746870][ T71] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.899157][ T5813] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.914816][ T5811] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 109.950363][ T5813] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.879427][ T68] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.884107][ T68] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.925384][ T68] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.958419][ T68] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.961321][ T68] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.019400][ T68] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.020597][ T68] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.021479][ T68] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.347266][ T5928] Zero length message leads to an empty skb [ 113.723303][ T5937] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 117.150571][ T3590] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 117.150608][ T3590] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 118.150501][ T1339] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 118.150526][ T1339] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 118.341542][ T3590] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 118.341565][ T3590] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 118.606323][ T1249] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 118.606346][ T1249] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 120.796786][ T5979] netlink: 'syz.1.19': attribute type 8 has an invalid length. [ 122.382084][ T5986] ip6erspan0: entered promiscuous mode [ 124.202073][ T6003] ip6erspan0: entered promiscuous mode [ 125.435653][ T38] audit: type=1326 audit(1760910357.540:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6004 comm="syz.1.24" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f851308efc9 code=0x0 [ 128.634508][ C1] vkms_vblank_simulate: vblank timer overrun [ 129.765527][ C1] vkms_vblank_simulate: vblank timer overrun [ 129.794478][ C1] vkms_vblank_simulate: vblank timer overrun [ 129.797631][ T6015] syz.3.26 (6015) used greatest stack depth: 17792 bytes left [ 129.882823][ C1] vkms_vblank_simulate: vblank timer overrun [ 130.162814][ C1] vkms_vblank_simulate: vblank timer overrun [ 130.183332][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 130.183379][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 130.183417][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 130.183456][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 130.183494][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 130.183532][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 130.183570][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 130.183608][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 130.183645][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 130.183689][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 130.764077][ C1] vkms_vblank_simulate: vblank timer overrun [ 131.030086][ C1] vkms_vblank_simulate: vblank timer overrun [ 131.379788][ T6026] ip6erspan0: entered promiscuous mode [ 131.480823][ C1] vkms_vblank_simulate: vblank timer overrun [ 131.969307][ T6033] netlink: 4 bytes leftover after parsing attributes in process `syz.2.29'. [ 132.018396][ C1] vkms_vblank_simulate: vblank timer overrun [ 142.019702][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 142.019779][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 144.459696][ T6080] netlink: 'syz.4.39': attribute type 8 has an invalid length. [ 150.541989][ C1] vkms_vblank_simulate: vblank timer overrun [ 150.564028][ T5806] Bluetooth: hci4: link tx timeout [ 150.564321][ T5806] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 150.686440][ T5807] Bluetooth: hci4: link tx timeout [ 150.686462][ T5807] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 150.911917][ C1] vkms_vblank_simulate: vblank timer overrun [ 151.315268][ C1] vkms_vblank_simulate: vblank timer overrun [ 152.538906][ C1] vkms_vblank_simulate: vblank timer overrun [ 152.669083][ T5807] Bluetooth: hci4: command 0x0406 tx timeout [ 152.770411][ C1] vkms_vblank_simulate: vblank timer overrun [ 152.807607][ T5118] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 152.811974][ T5118] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 152.834017][ T5118] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 152.835854][ T5118] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 152.836946][ T5118] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 153.229046][ C1] vkms_vblank_simulate: vblank timer overrun [ 159.047001][ T6113] chnl_net:caif_netlink_parms(): no params data found [ 159.137501][ T5806] Bluetooth: hci5: command tx timeout [ 161.159753][ T5806] Bluetooth: hci5: command tx timeout [ 162.449900][ T6151] ip6erspan0: entered promiscuous mode [ 163.229584][ T5806] Bluetooth: hci5: command tx timeout [ 165.315087][ T5806] Bluetooth: hci5: command tx timeout [ 165.541179][ C1] vkms_vblank_simulate: vblank timer overrun [ 167.871744][ C1] vkms_vblank_simulate: vblank timer overrun [ 169.097216][ C1] vkms_vblank_simulate: vblank timer overrun [ 169.136786][ C1] vkms_vblank_simulate: vblank timer overrun [ 169.614656][ C1] vkms_vblank_simulate: vblank timer overrun [ 172.081848][ C1] vkms_vblank_simulate: vblank timer overrun [ 172.761427][ T993] usb 5-1: new low-speed USB device number 2 using dummy_hcd [ 172.887658][ T5790] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 172.930024][ T6113] bridge0: port 1(bridge_slave_0) entered blocking state [ 172.930121][ T6113] bridge0: port 1(bridge_slave_0) entered disabled state [ 172.930308][ T6113] bridge_slave_0: entered allmulticast mode [ 172.938314][ T6113] bridge_slave_0: entered promiscuous mode [ 172.986247][ T993] usb 5-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 172.986278][ T993] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 173.022025][ T993] usb 5-1: config 0 descriptor?? [ 173.057593][ T5790] usb 4-1: Using ep0 maxpacket: 16 [ 173.062677][ T5790] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 173.090153][ T5790] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 173.090179][ T5790] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 173.090193][ T5790] usb 4-1: Product: syz [ 173.090203][ T5790] usb 4-1: Manufacturer: syz [ 173.090214][ T5790] usb 4-1: SerialNumber: syz [ 173.132693][ T5790] usb 4-1: config 0 descriptor?? [ 173.295602][ T993] asix 5-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 173.339104][ T1149] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 173.507844][ T6113] bridge0: port 2(bridge_slave_1) entered blocking state [ 173.507978][ T6113] bridge0: port 2(bridge_slave_1) entered disabled state [ 173.508240][ T6113] bridge_slave_1: entered allmulticast mode [ 173.516381][ T6113] bridge_slave_1: entered promiscuous mode [ 174.042220][ T1149] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 174.104514][ T6113] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 174.121782][ T6113] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 174.629743][ T1149] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 174.675186][ T6113] team0: Port device team_slave_0 added [ 174.732911][ T993] asix 5-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 174.732943][ T993] asix 5-1:0.0 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 [ 174.734751][ T993] asix 5-1:0.0: probe with driver asix failed with error -71 [ 174.773684][ T993] usb 5-1: USB disconnect, device number 2 [ 174.844616][ T6113] team0: Port device team_slave_1 added [ 175.287233][ C1] vkms_vblank_simulate: vblank timer overrun [ 175.553653][ T6211] netlink: 'syz.0.71': attribute type 8 has an invalid length. [ 175.858821][ C1] vkms_vblank_simulate: vblank timer overrun [ 176.296169][ C1] vkms_vblank_simulate: vblank timer overrun [ 176.383695][ T1149] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 176.778212][ C1] vkms_vblank_simulate: vblank timer overrun [ 177.184445][ T5908] usb 4-1: USB disconnect, device number 2 [ 177.473872][ T6113] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 177.473890][ T6113] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 177.473919][ T6113] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 177.542042][ T6113] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 177.542057][ T6113] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 177.542076][ T6113] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 178.260390][ T6224] netlink: 'syz.3.74': attribute type 8 has an invalid length. [ 179.489259][ T6113] hsr_slave_0: entered promiscuous mode [ 179.519332][ T6113] hsr_slave_1: entered promiscuous mode [ 179.667654][ T6113] debugfs: 'hsr0' already exists in 'hsr' [ 179.667708][ T6113] Cannot create hsr debugfs directory [ 183.014088][ C1] vkms_vblank_simulate: vblank timer overrun [ 188.855394][ T5807] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 188.862971][ T5807] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 188.863989][ T5807] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 188.865444][ T5807] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 188.866235][ T5807] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 192.658579][ T5807] Bluetooth: hci2: command tx timeout [ 195.050975][ T5807] Bluetooth: hci2: command tx timeout [ 196.210965][ T1149] bridge_slave_1: left allmulticast mode [ 196.211127][ T1149] bridge_slave_1: left promiscuous mode [ 196.234652][ T1149] bridge0: port 2(bridge_slave_1) entered disabled state [ 196.434487][ T1149] bridge_slave_0: left allmulticast mode [ 196.435211][ T1149] bridge_slave_0: left promiscuous mode [ 196.436386][ T1149] bridge0: port 1(bridge_slave_0) entered disabled state [ 197.087199][ T5806] Bluetooth: hci2: command tx timeout [ 199.173947][ T5807] Bluetooth: hci2: command tx timeout [ 202.174025][ C0] vkms_vblank_simulate: vblank timer overrun [ 203.034558][ C0] vkms_vblank_simulate: vblank timer overrun [ 203.289987][ C0] vkms_vblank_simulate: vblank timer overrun [ 203.519870][ C0] vkms_vblank_simulate: vblank timer overrun [ 203.886526][ C0] vkms_vblank_simulate: vblank timer overrun [ 204.312850][ C0] vkms_vblank_simulate: vblank timer overrun [ 204.647767][ C0] vkms_vblank_simulate: vblank timer overrun [ 204.790147][ T1320] ieee802154 phy0 wpan0: encryption failed: -22 [ 204.790223][ T1320] ieee802154 phy1 wpan1: encryption failed: -22 [ 205.934735][ C0] vkms_vblank_simulate: vblank timer overrun [ 206.231813][ C0] vkms_vblank_simulate: vblank timer overrun [ 207.839348][ T6331] Bluetooth: MGMT ver 1.23 [ 209.471214][ T1149] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 209.478907][ T5806] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 209.501026][ T5806] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 209.510092][ T5806] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 209.511878][ T5806] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 209.513932][ T5806] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 209.575386][ T1149] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 209.620661][ T1149] bond0 (unregistering): Released all slaves [ 211.634356][ T5806] Bluetooth: hci1: command tx timeout [ 213.770551][ T5806] Bluetooth: hci1: command tx timeout [ 216.523779][ T5806] Bluetooth: hci1: command tx timeout [ 217.966341][ T38] audit: type=1326 audit(1760910450.100:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6389 comm="syz.3.119" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f09d164efc9 code=0x0 [ 219.121590][ T5807] Bluetooth: hci1: command tx timeout [ 224.740305][ T5118] Bluetooth: hci0: command 0x0406 tx timeout [ 224.748756][ T5118] Bluetooth: hci3: command 0x0406 tx timeout [ 228.676529][ C1] ------------[ cut here ]------------ [ 228.676555][ C1] WARNING: CPU: 1 PID: 29 at kernel/time/timer.c:1785 __run_timer_base+0x777/0x970 [ 228.676611][ C1] Modules linked in: [ 228.676648][ C1] CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 228.676672][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 228.676688][ C1] RIP: 0010:__run_timer_base+0x777/0x970 [ 228.676720][ C1] Code: 26 4d 85 e4 74 7d e8 f8 f5 12 00 e9 48 fe ff ff e8 ee f5 12 00 48 8b 5c 24 28 43 80 7c 3d 00 00 75 d4 eb da e8 da f5 12 00 90 <0f> 0b 90 48 8b 44 24 40 42 80 3c 38 00 48 8b 5c 24 28 74 a9 48 89 [ 228.676737][ C1] RSP: 0018:ffffc90000a3f9a0 EFLAGS: 00010046 [ 228.676754][ C1] RAX: ffffffff81ac1736 RBX: 0000000000000000 RCX: ffff88801c2e1e00 [ 228.676768][ C1] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000100 [ 228.676781][ C1] RBP: ffffc90000a3fb10 R08: 0000000000000000 R09: 0000000000000100 [ 228.676794][ C1] R10: dffffc0000000000 R11: fffffbfff1deea2f R12: ffff88805cf16010 [ 228.676809][ C1] R13: 1ffff92000147f4c R14: ffffc90000a3fa60 R15: dffffc0000000000 [ 228.676824][ C1] FS: 0000000000000000(0000) GS:ffff888126cc8000(0000) knlGS:0000000000000000 [ 228.676841][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 228.676855][ C1] CR2: 0000564b3a16b660 CR3: 000000000d5a6000 CR4: 00000000003526f0 [ 228.676873][ C1] Call Trace: [ 228.676886][ C1] [ 228.676913][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 228.676964][ C1] run_timer_softirq+0xb7/0x180 [ 228.676984][ C1] handle_softirqs+0x22f/0x710 [ 228.677025][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 228.677066][ C1] run_ktimerd+0xcf/0x190 [ 228.677087][ C1] ? __pfx_run_ktimerd+0x10/0x10 [ 228.677105][ C1] ? schedule+0x91/0x360 [ 228.677143][ C1] ? smpboot_thread_fn+0x4d/0xa60 [ 228.677170][ C1] smpboot_thread_fn+0x542/0xa60 [ 228.677190][ C1] ? smpboot_thread_fn+0x4d/0xa60 [ 228.677218][ C1] kthread+0x711/0x8a0 [ 228.677244][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 228.677263][ C1] ? __pfx_kthread+0x10/0x10 [ 228.677283][ C1] ? rt_spin_unlock+0x150/0x200 [ 228.677313][ C1] ? rt_spin_unlock+0x161/0x200 [ 228.677336][ C1] ? __pfx_kthread+0x10/0x10 [ 228.677367][ C1] ret_from_fork+0x4bc/0x870 [ 228.677402][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 228.677443][ C1] ? __switch_to_asm+0x39/0x70 [ 228.677469][ C1] ? __switch_to_asm+0x33/0x70 [ 228.677493][ C1] ? __pfx_kthread+0x10/0x10 [ 228.677517][ C1] ret_from_fork_asm+0x1a/0x30 [ 228.677561][ C1] [ 228.677579][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 228.677596][ C1] CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 228.677633][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 228.677643][ C1] Call Trace: [ 228.677652][ C1] [ 228.677659][ C1] dump_stack_lvl+0x99/0x250 [ 228.677702][ C1] ? __asan_memcpy+0x40/0x70 [ 228.677731][ C1] ? __pfx_dump_stack_lvl+0x10/0x10 [ 228.677755][ C1] ? __pfx__printk+0x10/0x10 [ 228.677793][ C1] vpanic+0x237/0x6d0 [ 228.677813][ C1] ? __pfx_vpanic+0x10/0x10 [ 228.677843][ C1] panic+0xb9/0xc0 [ 228.677862][ C1] ? __pfx_panic+0x10/0x10 [ 228.677896][ C1] __warn+0x31b/0x4b0 [ 228.677915][ C1] ? __run_timer_base+0x777/0x970 [ 228.677948][ C1] ? __run_timer_base+0x777/0x970 [ 228.677978][ C1] report_bug+0x2be/0x4f0 [ 228.678007][ C1] ? __run_timer_base+0x777/0x970 [ 228.678037][ C1] ? __run_timer_base+0x777/0x970 [ 228.678066][ C1] ? __run_timer_base+0x779/0x970 [ 228.678096][ C1] handle_bug+0x84/0x160 [ 228.678119][ C1] exc_invalid_op+0x1a/0x50 [ 228.678141][ C1] asm_exc_invalid_op+0x1a/0x20 [ 228.678166][ C1] RIP: 0010:__run_timer_base+0x777/0x970 [ 228.678197][ C1] Code: 26 4d 85 e4 74 7d e8 f8 f5 12 00 e9 48 fe ff ff e8 ee f5 12 00 48 8b 5c 24 28 43 80 7c 3d 00 00 75 d4 eb da e8 da f5 12 00 90 <0f> 0b 90 48 8b 44 24 40 42 80 3c 38 00 48 8b 5c 24 28 74 a9 48 89 [ 228.678214][ C1] RSP: 0018:ffffc90000a3f9a0 EFLAGS: 00010046 [ 228.678232][ C1] RAX: ffffffff81ac1736 RBX: 0000000000000000 RCX: ffff88801c2e1e00 [ 228.678247][ C1] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000100 [ 228.678260][ C1] RBP: ffffc90000a3fb10 R08: 0000000000000000 R09: 0000000000000100 [ 228.678274][ C1] R10: dffffc0000000000 R11: fffffbfff1deea2f R12: ffff88805cf16010 [ 228.678289][ C1] R13: 1ffff92000147f4c R14: ffffc90000a3fa60 R15: dffffc0000000000 [ 228.678313][ C1] ? __run_timer_base+0x776/0x970 [ 228.678369][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 228.678417][ C1] run_timer_softirq+0xb7/0x180 [ 228.678437][ C1] handle_softirqs+0x22f/0x710 [ 228.678478][ C1] ? __pfx_handle_softirqs+0x10/0x10 [ 228.678519][ C1] run_ktimerd+0xcf/0x190 [ 228.678540][ C1] ? __pfx_run_ktimerd+0x10/0x10 [ 228.678559][ C1] ? schedule+0x91/0x360 [ 228.678596][ C1] ? smpboot_thread_fn+0x4d/0xa60 [ 228.678614][ C1] smpboot_thread_fn+0x542/0xa60 [ 228.678635][ C1] ? smpboot_thread_fn+0x4d/0xa60 [ 228.678662][ C1] kthread+0x711/0x8a0 [ 228.678689][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 228.678708][ C1] ? __pfx_kthread+0x10/0x10 [ 228.678728][ C1] ? rt_spin_unlock+0x150/0x200 [ 228.678758][ C1] ? rt_spin_unlock+0x161/0x200 [ 228.678781][ C1] ? __pfx_kthread+0x10/0x10 [ 228.678806][ C1] ret_from_fork+0x4bc/0x870 [ 228.678838][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 228.678876][ C1] ? __switch_to_asm+0x39/0x70 [ 228.678901][ C1] ? __switch_to_asm+0x33/0x70 [ 228.678927][ C1] ? __pfx_kthread+0x10/0x10 [ 228.678952][ C1] ret_from_fork_asm+0x1a/0x30 [ 228.678996][ C1] [ 228.679150][ C1] Kernel Offset: disabled