last executing test programs: 28m14.999638467s ago: executing program 4 (id=177): r0 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = gettid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={r2, r1, 0x0, 0x0, 0x0}, 0x30) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000002a80)={0x1c, 0x24, 0x100, 0x70bd26, 0x25dfdbfd, "", [@nested={0xc, 0x0, 0x0, 0x1, [@nested={0x8, 0xfb, 0x0, 0x1, [@nested={0x4, 0x121}]}]}]}, 0x1c}], 0x1}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r4 = open(&(0x7f0000000300)='.\x00', 0x100000, 0x0) flock(r4, 0x1) r5 = io_uring_setup(0x43d7, &(0x7f00000001c0)={0x0, 0xee94, 0x20, 0x3, 0x1e, 0x0, r4}) recvmmsg$unix(r4, &(0x7f00000028c0)=[{{&(0x7f00000004c0), 0x6e, &(0x7f0000000800)=[{&(0x7f0000000540)=""/104, 0x68}, {&(0x7f00000005c0)}, {&(0x7f0000000600)=""/164, 0xa4}, {&(0x7f00000006c0)=""/24, 0x18}, {&(0x7f0000000700)=""/16, 0x10}, {&(0x7f0000000740)=""/151, 0x97}], 0x6}}, {{&(0x7f0000000880), 0x6e, &(0x7f0000000d80)=[{&(0x7f0000000900)=""/100, 0x64}, {&(0x7f0000000cc0)=""/151, 0x97}], 0x2}}, {{&(0x7f0000000dc0)=@abs, 0x6e, &(0x7f0000001ec0)=[{&(0x7f0000000e40)=""/4096, 0x1000}, {&(0x7f0000001e40)=""/101, 0x65}], 0x2, &(0x7f0000001f00)=[@rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xe0}}, {{0x0, 0x0, &(0x7f0000002500)=[{&(0x7f0000002080)}, {&(0x7f00000020c0)=""/79, 0x4f}, {&(0x7f0000002140)=""/15, 0xf}, {0x0}, {&(0x7f0000002240)=""/155, 0x9b}, {&(0x7f00000023c0)=""/50, 0x32}], 0x6}}, {{&(0x7f00000025c0)=@abs, 0x6e, &(0x7f00000026c0)=[{&(0x7f0000002640)=""/97, 0x61}], 0x1, &(0x7f0000002700)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}}, {{0x0, 0x0, &(0x7f0000002840)=[{&(0x7f0000002740)=""/66, 0x42}, {&(0x7f00000027c0)=""/89, 0x59}], 0x2, &(0x7f0000002880)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}}], 0x6, 0x40000021, &(0x7f0000002a40)) r6 = syz_io_uring_setup(0x8d2, &(0x7f00000000c0)={0x0, 0x0, 0x400, 0x0, 0x0, 0x0, r5}, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f0000000380)={&(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0], &(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000340)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0xa, 0x3, 0x9, 0x9}) r10 = syz_open_dev$dri(&(0x7f0000000280), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(r10, 0xc01064c8, &(0x7f0000000200)={0x2, 0x0, &(0x7f0000000300)=[0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_GETPROPERTY(r10, 0xc04064aa, &(0x7f00000003c0)={&(0x7f0000001280), 0x0, r11, 0x0, '\x00', 0x1ffffffffffffd64}) r12 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(r12, 0xc01064c8, &(0x7f0000000280)={0x1, 0x0, &(0x7f0000000200)=[0x0]}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r12, 0xc02064b9, &(0x7f00000002c0)={0x0, 0x0, 0x0, r13}) ioctl$DRM_IOCTL_MODE_SETCRTC(r1, 0xc06864a2, &(0x7f0000000400)={&(0x7f00000003c0)=[r9, r11], 0x2, 0x0, r13, 0x2d21, 0x1, 0x7c, 0x1, {0x232, 0x2, 0x40, 0xff, 0x400, 0x3, 0x5187, 0x100, 0x0, 0x9, 0x800, 0xfffffffe, 0xfffffff7, 0x0, "66107ce26af3d69a0b9fff5c2ac5bfea35c0cc4f5a6be98fe05348f2a2847231"}}) syz_io_uring_submit(r7, r8, &(0x7f0000000480)=@IORING_OP_ASYNC_CANCEL={0xe, 0x0, 0x0, 0x0, 0x0, 0x12345, 0x0, 0x0, 0x1}) io_uring_enter(r6, 0x47ba, 0x3e80, 0x0, 0x0, 0x0) 28m12.950570264s ago: executing program 4 (id=181): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000009c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000006800010009000000000000000a00000000000000080001000200000004000b"], 0x24}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000b00)=ANY=[@ANYBLOB="200000006900030500000000000000000000000000000000080001000200000085332976db239d4da7601a08be69"], 0x20}}, 0x0) syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) close(0x3) syz_open_dev$midi(&(0x7f0000000000), 0x3, 0x88c02) r3 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0x84c0, 0x0, 0xffffffff, 0x121}, &(0x7f0000000100)=0x0, &(0x7f00000003c0)) r5 = syz_open_procfs(0x0, &(0x7f0000002700)='cmdline\x00') read$FUSE(r5, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) io_uring_enter(r3, 0x47f6, 0x0, 0x0, 0x0, 0x0) 28m7.924415384s ago: executing program 4 (id=188): creat(0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0xc}, 0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1c, &(0x7f00000001c0)=[@in6={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xfffffffb}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000000), &(0x7f0000000040)=0x4) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r1, &(0x7f0000000100)=[{&(0x7f00000004c0)='4', 0x1}], 0x9) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r2, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r2, 0x90004) syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) r3 = accept4(r2, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r3) 28m5.03317028s ago: executing program 4 (id=194): 28m4.048851054s ago: executing program 4 (id=195): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000005000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x18) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x9) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000180), 0x200, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6(0xa, 0x1, 0x8010000000000084) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="b60a0000000000006911b600000000001800000000000000000000000000000095"], &(0x7f0000000000)='GPL\x00'}, 0x94) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) ioctl$USBDEVFS_CONTROL(r2, 0xc0105500, &(0x7f0000000040)={0x0, 0xe, 0x1, 0x7, 0x0, 0x7, 0x0}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000000000066000000004b64ffec850000006d000000c50000000500000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'veth1_to_batadv\x00', 0x0}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000780)={r3, 0xe0, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000540)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa7, &(0x7f0000000b40)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f00000007c0), 0x0, 0x0, 0x91, 0x8, 0x8, &(0x7f0000000840)}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000a80)={0x2, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x41100, 0xa, '\x00', r5, @fallback=0x1d, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000700)={0x1, 0xd, 0x81, 0xf}, 0x10, r6, r4, 0x0, &(0x7f0000000a00), &(0x7f0000000a40)}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0xe, 0x5, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8b, 0x0, 0x0, 0x0, 0x1ff}, [@btf_id={0x18, 0x2, 0x3, 0x0, 0x4}]}, &(0x7f0000000200)='syzkaller\x00', 0x0, 0x5f, &(0x7f0000000300)=""/95, 0x41000, 0x11, '\x00', 0x0, @sk_skb=0x4, 0xffffffffffffffff, 0x8, &(0x7f0000000440)={0x2, 0x5}, 0x8, 0x10, &(0x7f0000000480)={0x3, 0x2, 0x2, 0xfffffffc}, 0x10, r6, r0, 0x3, 0x0, &(0x7f0000000500)=[{0x2, 0x4, 0x1, 0x7}, {0x2, 0x4, 0x2, 0xc}, {0x2, 0x5, 0xf, 0x1}], 0x10, 0xf}, 0x94) openat$vim2m(0xffffffffffffff9c, 0x0, 0x2, 0x0) mbind(&(0x7f00005b4000/0x4000)=nil, 0x100000000004000, 0x0, 0x0, 0x0, 0x2) r7 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) shutdown(r7, 0x0) connect$bt_rfcomm(r7, &(0x7f0000005dc0)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x15}, 0xa) socket$inet_udp(0x2, 0x2, 0x0) 28m0.654510271s ago: executing program 4 (id=203): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x10000, 0x0, &(0x7f0000006680)) mkdirat(0xffffffffffffff9c, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000001000000850000008600000095", @ANYRES16], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) syz_usb_connect$rtl8150(0x0, 0x3f, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) 27m39.540734071s ago: executing program 32 (id=203): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x10000, 0x0, &(0x7f0000006680)) mkdirat(0xffffffffffffff9c, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000001000000850000008600000095", @ANYRES16], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) syz_usb_connect$rtl8150(0x0, 0x3f, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xbda, 0x8150, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) 27m4.099002649s ago: executing program 0 (id=280): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x20000, 0x0) readv(r0, &(0x7f0000000000)=[{&(0x7f0000001300)=""/244, 0xfdef}], 0x1) socket$nl_route(0x10, 0x3, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000), 0x8, &(0x7f0000000300)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000002180)='./file0\x00', 0x0, 0x0) getdents64(r2, &(0x7f0000000500)=""/179, 0xb3) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000001200)={0x0, 0xffffff1e, 0xffffffff, 0x4, 0x16, "001bf100eeff0000a2c2000100000000002000"}) r3 = syz_open_pts(r0, 0x41) r4 = dup3(r3, r0, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={@ifindex, 0xb, 0x1, 0x0, &(0x7f0000000080)=[0x0, 0x0, 0x0], 0x3, 0x0, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0]}, 0x40) r5 = getpid() r6 = syz_pidfd_open(r5, 0x0) process_madvise(r6, &(0x7f0000000040)=[{0x0}, {&(0x7f0000000080)="d3", 0x1}], 0x2, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r4, 0xc018937c, &(0x7f0000000340)={{0x1, 0x1, 0x18, r3, {0x2}}, './file0\x00'}) 27m3.698444548s ago: executing program 0 (id=281): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(0xffffffffffffffff, 0x7cb, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$USBDEVFS_CONTROL(0xffffffffffffffff, 0xc0105500, &(0x7f0000000000)={0x2, 0x3, 0x8, 0x0, 0x0, 0x5, 0x0}) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f00000002c0)={0x2, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @local}}}, 0x108) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) syz_init_net_socket$llc(0x1a, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newtaction={0xb4, 0x30, 0x48b, 0x0, 0x0, {}, [{0xa0, 0x1, [@m_ctinfo={0x48, 0x2, 0x0, 0x0, {{0xb}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CTINFO_ACT={0x18, 0x3f, {0x1, 0x7, 0x7, 0x1, 0x3}}]}, {0x4}, {0xc}, {0xc}}}, @m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{}, @multicast2, @remote}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0xb4}}, 0x980) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000780)={0x2, {{0xa, 0x4e22, 0x1, @mcast2}}}, 0x90) dup3(0xffffffffffffffff, r0, 0xb997b432f7f92ae6) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000800)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000060a0b040000000000000000020000000900010073797a30000000000900020073797a320000000014000000110001"], 0x54}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [], {0x14}}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x800) 27m1.207860829s ago: executing program 0 (id=282): socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$VHOST_VSOCK_SET_GUEST_CID(0xffffffffffffffff, 0x4008af60, 0x0) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x2042, 0x0) ioctl$AUTOFS_IOC_FAIL(r4, 0x4c80, 0x7000000) (fail_nth: 3) 26m59.765368513s ago: executing program 0 (id=286): creat(0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0xc}, 0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1c, &(0x7f00000001c0)=[@in6={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xfffffffb}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000000), &(0x7f0000000040)=0x4) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') writev(r1, &(0x7f0000000100)=[{&(0x7f00000004c0)='4', 0x1}], 0x9) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r2, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r2, 0x90004) r3 = accept4(r2, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r3) 26m57.332983947s ago: executing program 0 (id=290): pipe(&(0x7f00000001c0)) r0 = socket$nl_rdma(0x10, 0x3, 0x14) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000000c0)='syzkaller\x00'}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='contention_end\x00', r2}, 0x10) pipe(0x0) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x7ff, 0x0) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x1c, 0xe) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="00010000031401"], 0x100}, 0x1, 0x0, 0x0, 0x4040024}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x6, 0xf, &(0x7f0000000000)=@ringbuf={{0x18, 0x8}, {{}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1ab92b}, {0x85, 0x0, 0x0, 0x8}, {0x4}}, {{0x5, 0x0, 0x4, 0x9, 0x0, 0x1, 0x2000}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x9}, {0x85, 0x0, 0x0, 0xa4}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) io_uring_enter(0xffffffffffffffff, 0x2219, 0xcf74, 0x16, 0x0, 0x0) 26m55.744885935s ago: executing program 0 (id=293): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000009c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000006800010009000000000000000a00000000000000080001000200000004000b"], 0x24}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000b00)=ANY=[@ANYBLOB="200000006900030500000000000000000000000000000000080001000200000085332976db239d4da7601a08be69"], 0x20}}, 0x0) syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) close(0x3) syz_open_dev$midi(&(0x7f0000000000), 0x3, 0x88c02) r3 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0x84c0, 0x0, 0xffffffff, 0x121}, &(0x7f0000000100)=0x0, &(0x7f00000003c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x9048}}) io_uring_enter(r3, 0x47f6, 0x0, 0x0, 0x0, 0x0) 26m40.421055953s ago: executing program 33 (id=293): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000009c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000006800010009000000000000000a00000000000000080001000200000004000b"], 0x24}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000b00)=ANY=[@ANYBLOB="200000006900030500000000000000000000000000000000080001000200000085332976db239d4da7601a08be69"], 0x20}}, 0x0) syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) close(0x3) syz_open_dev$midi(&(0x7f0000000000), 0x3, 0x88c02) r3 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0x84c0, 0x0, 0xffffffff, 0x121}, &(0x7f0000000100)=0x0, &(0x7f00000003c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x9048}}) io_uring_enter(r3, 0x47f6, 0x0, 0x0, 0x0, 0x0) 26m12.038606898s ago: executing program 2 (id=352): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000040)="4dc07f947163300c", 0x8) 26m11.621000452s ago: executing program 2 (id=353): syz_usb_connect(0x0, 0x172, 0x0, 0x0) io_uring_setup(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x28, 0x80008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='ns\x00') openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = syz_io_uring_setup(0x70ca, &(0x7f0000000080)={0x0, 0x0, 0x10100, 0x3, 0x179}, &(0x7f0000000100), &(0x7f00000007c0)) io_uring_register$IORING_REGISTER_PERSONALITY(r3, 0x9, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000300)='attr/current\x00') writev(r4, &(0x7f00000015c0)=[{0x0}], 0x1) io_uring_enter(r3, 0x4d10, 0x2, 0x2, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, 0x0}, 0x2}], 0x4000000000002f5, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="2c00000068009753d74093eaf656df2500000000000000000c00020001000000060000000800010001"], 0x2c}}, 0x4000) sendmmsg(0xffffffffffffffff, &(0x7f00000092c0), 0x4ff, 0x0) 26m8.241130779s ago: executing program 2 (id=357): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x40000000}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) request_key(&(0x7f0000000000)='logon\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100)='GPL\x00', 0x0) 26m8.101678801s ago: executing program 2 (id=359): r0 = syz_io_uring_setup(0x4f6, &(0x7f0000000380)={0x0, 0x80fd, 0x10, 0x4, 0x139}, &(0x7f0000000300)=0x0, &(0x7f00000002c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) syz_io_uring_submit(r1, r2, &(0x7f00000001c0)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r3, 0x80, &(0x7f00000000c0)=@hci={0x1f, 0xffffffffffffffff, 0x3}, 0x0, 0x0, 0x1}) r4 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000140)=@IORING_OP_TEE={0x21, 0xc, 0x0, @fd_index=0x9, 0x0, 0x0, 0x7, 0x8, 0x0, {0x0, r4, r0}}) io_uring_enter(r0, 0x47bc, 0xf5, 0x0, 0x0, 0x0) 26m6.71931639s ago: executing program 2 (id=362): syz_usb_connect(0x0, 0x36, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x7f}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffeda}, 0x94) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000240)=ANY=[@ANYRES16=r5, @ANYRESHEX, @ANYRES8=0x0, @ANYRES8=r1, @ANYRES8=r4, @ANYBLOB="27ce6d04e5d93f964ce16bdb069cfe3b2a886c003d3e2de71285b63310b3fc212fa78d3486f503e3511870026dfe2ffc8fd2f97e124459cc893e0cd09cb620", @ANYRES64=r3, @ANYRES32=r0], 0x50) syz_open_procfs(r2, &(0x7f00000003c0)='statm\x00') r6 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/sys/net/ipv4/vs/sync_version\x00', 0x2, 0x0) write$cgroup_int(r6, &(0x7f0000000040)=0x3, 0x12) read$FUSE(r6, &(0x7f00000004c0)={0x2020}, 0x2037) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f00000001c0)='ext4_allocate_inode\x00'}, 0x18) syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) socket(0xa, 0x3, 0xff) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x20, r7, 0x9c3fa077fa966179, 0xfffffffd, 0x0, {{0x7e}, {@void, @val={0xc, 0x99, {0x916d, 0x15}}}}}, 0x20}}, 0x4000054) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000000940), 0x0, 0x20, 0x0) 26m3.525246348s ago: executing program 2 (id=366): pipe(&(0x7f0000000000)) fanotify_init(0x200, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) socket$inet6(0xa, 0x3, 0x3c) socket$nl_netfilter(0x10, 0x3, 0xc) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket(0x400000000010, 0x3, 0x0) socket(0x400000000010, 0x3, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001380)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="1b00040000000000140012800c0001006d6163766c616e000400028008000500", @ANYRES32=r0, @ANYBLOB='\b\x00\n\x00', @ANYRES32], 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x4000840) 25m48.191191724s ago: executing program 34 (id=366): pipe(&(0x7f0000000000)) fanotify_init(0x200, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) socket$inet6(0xa, 0x3, 0x3c) socket$nl_netfilter(0x10, 0x3, 0xc) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket(0x400000000010, 0x3, 0x0) socket(0x400000000010, 0x3, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001380)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="1b00040000000000140012800c0001006d6163766c616e000400028008000500", @ANYRES32=r0, @ANYBLOB='\b\x00\n\x00', @ANYRES32], 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x4000840) 24m51.573539352s ago: executing program 1 (id=472): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000005000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x18) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x9) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000180), 0x200, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$inet6(0xa, 0x1, 0x8010000000000084) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="b60a0000000000006911b600000000001800000000000000000000000000000095"], &(0x7f0000000000)='GPL\x00'}, 0x94) r3 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) ioctl$USBDEVFS_CONTROL(r3, 0xc0105500, &(0x7f0000000040)={0x0, 0xe, 0x1, 0x7, 0x0, 0x7, 0x0}) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e21, 0x0, @empty}, 0x1c) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'veth1_to_batadv\x00', 0x0}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000780)={r4, 0xe0, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000540)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa7, &(0x7f0000000b40)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f00000007c0), 0x0, 0x0, 0x91, 0x8, 0x8, &(0x7f0000000840)}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000a80)={0x2, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x41100, 0xa, '\x00', r5, @fallback=0x1d, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000700)={0x1, 0xd, 0x81, 0xf}, 0x10, r6, 0xffffffffffffffff, 0x0, &(0x7f0000000a00), &(0x7f0000000a40)}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0xe, 0x5, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8b, 0x0, 0x0, 0x0, 0x1ff}, [@btf_id={0x18, 0x2, 0x3, 0x0, 0x4}]}, &(0x7f0000000200)='syzkaller\x00', 0x0, 0x5f, &(0x7f0000000300)=""/95, 0x41000, 0x11, '\x00', 0x0, @sk_skb=0x4, 0xffffffffffffffff, 0x8, &(0x7f0000000440)={0x2, 0x5}, 0x8, 0x10, &(0x7f0000000480)={0x3, 0x2, 0x2, 0xfffffffc}, 0x10, r6, r0, 0x3, 0x0, &(0x7f0000000500)=[{0x2, 0x4, 0x1, 0x7}, {0x2, 0x4, 0x2, 0xc}, {0x2, 0x5, 0xf, 0x1}], 0x10, 0xf}, 0x94) openat$vim2m(0xffffffffffffff9c, 0x0, 0x2, 0x0) mbind(&(0x7f00005b4000/0x4000)=nil, 0x100000000004000, 0x0, 0x0, 0x0, 0x2) r7 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) shutdown(r7, 0x0) connect$bt_rfcomm(r7, &(0x7f0000005dc0)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x15}, 0xa) socket$inet_udp(0x2, 0x2, 0x0) 24m49.748946184s ago: executing program 1 (id=474): socket$inet6(0xa, 0x3, 0x4) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r1 = socket$key(0xf, 0x3, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, 0x0, 0x0, 0x2, 0x0) setsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) getsockopt$nfc_llcp(0xffffffffffffffff, 0x118, 0x3, &(0x7f0000000540)=""/181, 0xffffffffffffffce) ioctl$PIO_SCRNMAP(r5, 0x4b52, &(0x7f0000000000)) socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$VT_RESIZE(r5, 0x5609, &(0x7f0000000040)={0x1, 0x7, 0x3}) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f0000000040)='westwood\x00', 0x9) getsockopt$inet6_tcp_buf(r6, 0x6, 0x1a, 0x0, &(0x7f0000000080)) syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB, @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB], 0x0) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="0202000311000000000000000000000005000500000000000a00000000000000fe8000000000000000000000000000bb000000000000000002000100000007000000000b000000000200090000000000000000000000000005000600000000000a00000000000000fe8800000000000000000000000000010000000000000000010018"], 0x88}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000180)='sys_enter\x00', r0}, 0x10) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, &(0x7f00000001c0)='usrquota') chdir(&(0x7f0000000140)='./file1\x00') r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_GETINFO(r7, 0xffffffff80000500, 0x0, &(0x7f00000002c0)) 24m48.715866051s ago: executing program 1 (id=476): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) chroot(&(0x7f0000000480)='./file0\x00') bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0xe22, 0x0, @private1, 0x40000}, 0x1c) r0 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000780)="580000001500add427323b472545b45602117fffffff81000e224e217f000001925aa80020007b00090080007f000001e809000000ff0000f03ac71036000000ffffffff289fffffffe7ee00000058fbf6aabe36ca1c2200", 0x58}], 0x1) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000005000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='sched_switch\x00', r1}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1, 0x0, 0xc}, 0x18) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) process_vm_writev(0x0, &(0x7f0000000500)=[{0x0}, {0xffffffffffffffff}, {0xfffffffffffffffc}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) close(0xffffffffffffffff) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) prlimit64(r2, 0x0, &(0x7f0000000180)={0x8, 0x5}, &(0x7f00000001c0)) sendmsg$NFT_MSG_GETCHAIN(r0, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x652433a1dd8fa8f4}, 0xc, &(0x7f0000000280)={&(0x7f00000005c0)={0xd8, 0x4, 0xa, 0x706, 0x0, 0x0, {0x0, 0x0, 0x7}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x1}, @NFTA_CHAIN_USERDATA={0x6a, 0xc, "ebd0eb924b675a1b2f7d9cd8d7c502cf997e49e8ce97a6a553e7ff1254b2f149b181e3fc4d8158c623d30fe41c887ca9f46679830e42f739880fa2d956545cb80476d245a3063ac4eda97b0f83ab03eb766f1398fd517943282d03491018f32aa67df372dadd"}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_HOOK={0x2c, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x2d6076be}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x1d88e9ee}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_HOOK_HOOKNUM={0x8}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x768c8959}]}]}, 0xd8}, 0x1, 0x0, 0x0, 0x44014}, 0x80) gettid() timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x22081) 24m46.645010749s ago: executing program 1 (id=478): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f00000001c0)=[{0x0, 0x9, 0x8, 0x1ff}]}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) syz_clone3(0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = syz_io_uring_setup(0x8d2, &(0x7f00000000c0)={0x0, 0x0, 0x3010, 0x0, 0x39d}, &(0x7f0000000040)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r1, 0x47ba, 0x3e80, 0x0, 0x0, 0x0) r4 = socket$kcm(0x10, 0x2, 0x10) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@updpolicy={0xb8, 0x19, 0x10, 0x70bd28, 0x25dfdbff, {{@in6=@private1, @in6=@mcast1, 0x4e24, 0xffd7, 0x4e24, 0x101, 0xa, 0xa0, 0x20, 0x3b}, {0x1, 0x4, 0x4, 0x400, 0x1, 0x0, 0x6, 0x8}, {0xc, 0x80000001, 0x3, 0x1}, 0x10c5b677, 0x6e6bbf, 0x1, 0x1, 0x3, 0x1}}, 0xb8}, 0x1, 0x0, 0x0, 0xc0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x18, 0x30, 0x53b, 0x0, 0x0, {0x9}, [{0x4}]}, 0x18}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000040)=@RTM_NEWMDB={0x38, 0x54, 0x1, 0x1, 0x0, {}, [@MDBA_SET_ENTRY={0x20, 0x1, {0x0, 0x1, 0x0, 0x3, {@ip4=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x86dd}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003f000b05d25a806c8c6394f90324fc60100002000a000300053582c137153e3704020180fc0b09000c", 0x2d}], 0x1}, 0x0) syz_emit_vhci(0x0, 0xd) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, 0x0, 0xc000) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x488c0}, 0xc000) bind$inet(r5, 0x0, 0x0) r8 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r8, 0x800442d3, &(0x7f0000000280)={0x1400, 0x2, 0x2, @remote, 'veth1_to_batadv\x00'}) sendto$inet(r5, 0x0, 0x0, 0x200007fd, 0x0, 0x0) r9 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r9, 0xaf01, 0x0) 24m44.794267829s ago: executing program 1 (id=480): r0 = socket$inet6(0xa, 0x2, 0x0) syz_usb_connect(0x0, 0x172, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000e6bef1403c419681e01f0000000109026001010000000009049a0000020600000724060000ba4f05240004000d240f"], 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x28, 0x80008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='ns\x00') openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = syz_io_uring_setup(0x70ca, &(0x7f0000000080)={0x0, 0x0, 0x10100, 0x3, 0x179}, &(0x7f0000000100), 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000300)='attr/current\x00') io_uring_enter(r4, 0x4d10, 0x2, 0x2, 0x0, 0x0) connect$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) recvmmsg(r0, 0x0, 0x0, 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="2c00000068009753d74093eaf656df2500000000000000000c00020001000000060000000800010001"], 0x2c}}, 0x4000) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 24m41.59240004s ago: executing program 1 (id=484): r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000440)={@initdev={0xfe, 0x88, '\x00', 0x2, 0x0}, 0x9, 0x1, 0x3, 0x0, 0x8, 0xe}, 0x20) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = socket(0x18, 0x1, 0x0) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x82) writev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)="4ee87a0ea5a9b5ade7d40d498daac4228bb932e5cbcc4a2fbc922151", 0x1c}], 0x1) r4 = syz_io_uring_setup(0x834, &(0x7f0000000180)={0x0, 0x516d, 0x80, 0x4, 0x3ce}, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_CONNECT={0x10, 0x40, 0x0, r2, 0x0, 0x0}) io_uring_enter(r4, 0x3516, 0x0, 0x0, 0x0, 0x0) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000300)={'batadv_slave_1\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r2, &(0x7f0000000400)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x4c, r7, 0x100, 0x70bd27, 0x25dfdbff, {}, [@HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_team\x00'}]}, @HEADER={0x4}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20004050}, 0x20000800) ioctl(r1, 0x8b32, &(0x7f0000000040)) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') pwritev2(r1, &(0x7f00000001c0)=[{&(0x7f0000000200)="858b0c407ac24f2cd329aca1c2f1fd92d2282c99866dab68638d5523d33429fe2a18b137f09cac00fdb374beda7664357a4e8ad044bbc40dab8f7dbca7affa2b", 0x40}], 0x1, 0x2, 0xfffffff8, 0x1) sendmsg$TIPC_NL_MON_SET(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="0100000000000000000009000000240004"], 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r10 = userfaultfd(0x801) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, 0x0, 0x0}, 0x94) bpf$ENABLE_STATS(0x20, &(0x7f0000000040)={0x2}, 0x75) ioctl$UFFDIO_API(r10, 0xc018aa3f, &(0x7f0000000600)) capget(&(0x7f0000feaff9)={0x19980330}, 0x0) ioctl$UFFDIO_REGISTER(r10, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r10, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000800000/0x800000)=nil, &(0x7f00002b3000/0x2000)=nil, 0x800000}) syz_open_dev$MSR(&(0x7f00000000c0), 0xfffffffffffffff9, 0x0) 24m26.471122271s ago: executing program 35 (id=484): r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000440)={@initdev={0xfe, 0x88, '\x00', 0x2, 0x0}, 0x9, 0x1, 0x3, 0x0, 0x8, 0xe}, 0x20) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = socket(0x18, 0x1, 0x0) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x82) writev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)="4ee87a0ea5a9b5ade7d40d498daac4228bb932e5cbcc4a2fbc922151", 0x1c}], 0x1) r4 = syz_io_uring_setup(0x834, &(0x7f0000000180)={0x0, 0x516d, 0x80, 0x4, 0x3ce}, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_CONNECT={0x10, 0x40, 0x0, r2, 0x0, 0x0}) io_uring_enter(r4, 0x3516, 0x0, 0x0, 0x0, 0x0) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000300)={'batadv_slave_1\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r2, &(0x7f0000000400)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x4c, r7, 0x100, 0x70bd27, 0x25dfdbff, {}, [@HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_team\x00'}]}, @HEADER={0x4}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20004050}, 0x20000800) ioctl(r1, 0x8b32, &(0x7f0000000040)) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') pwritev2(r1, &(0x7f00000001c0)=[{&(0x7f0000000200)="858b0c407ac24f2cd329aca1c2f1fd92d2282c99866dab68638d5523d33429fe2a18b137f09cac00fdb374beda7664357a4e8ad044bbc40dab8f7dbca7affa2b", 0x40}], 0x1, 0x2, 0xfffffff8, 0x1) sendmsg$TIPC_NL_MON_SET(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="0100000000000000000009000000240004"], 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r10 = userfaultfd(0x801) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, 0x0, 0x0}, 0x94) bpf$ENABLE_STATS(0x20, &(0x7f0000000040)={0x2}, 0x75) ioctl$UFFDIO_API(r10, 0xc018aa3f, &(0x7f0000000600)) capget(&(0x7f0000feaff9)={0x19980330}, 0x0) ioctl$UFFDIO_REGISTER(r10, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r10, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000800000/0x800000)=nil, &(0x7f00002b3000/0x2000)=nil, 0x800000}) syz_open_dev$MSR(&(0x7f00000000c0), 0xfffffffffffffff9, 0x0) 19m18.927327747s ago: executing program 6 (id=806): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="fc0000001900674c0000000000000000e0000001000000000000000000000000e000000200000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000040000000000000000000000000000000000000000000000000000100"/69], 0xfc}}, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) sendmmsg$inet6(r2, &(0x7f00000066c0)=[{{&(0x7f00000019c0)={0xa, 0x0, 0x0, @mcast1}, 0x1c, 0x0}}], 0x1, 0x5efe) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="100000001d0001"], 0x10}}, 0x0) 19m18.659779621s ago: executing program 6 (id=809): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) unshare(0x22020400) syz_io_uring_setup(0xcd9, &(0x7f0000000200)={0x0, 0x4661, 0x400, 0x0, 0x234}, &(0x7f0000000340)=0x0, &(0x7f0000000300)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000480)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000380)=@IORING_OP_RENAMEAT={0x23, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='./file0\x00'}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) bpf$LINK_GET_FD_BY_ID(0x1e, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x9, 0x1, 0x56d, 0x5}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000600), &(0x7f0000001f80), 0xfffffffb, r4}, 0x38) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000200), &(0x7f00000004c0), 0x1000, r4, 0x0, 0x11000000}, 0x38) 19m11.808728756s ago: executing program 6 (id=825): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000040)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x6}) 19m10.793118481s ago: executing program 6 (id=828): openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000240)) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r1}, 0x10) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000400)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000000000)={0x2, 0x24e23, @loopback}, 0x10) ppoll(&(0x7f0000000500)=[{r0}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x7fffffff, 0x7, 0x4, 0x9, 0x800, 0x8, 0x4}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x8, 0x3f9a, 0x0, 0x10001, 0x400000}, 0x0, 0x0) 19m9.484079018s ago: executing program 6 (id=833): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x87) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x4, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000001d7118ae000000000095"], &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$9p_rdma(&(0x7f0000000240), &(0x7f0000000140)='./file0\x00', &(0x7f0000001400), 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB='trans=rdma,port=0x0000000000000000,obj_role=trans=rdma,,fu']) connect$inet6(r0, &(0x7f0000000500)={0xa, 0xfffd, 0x0, @loopback, 0x5}, 0x1c) readlink(&(0x7f0000000240)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000001200)=""/4096, 0x1000) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000040)=0x92, 0x4) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000440), 0x10057) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000080)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4c, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000a80)='kfree\x00', r2, 0x0, 0x6}, 0x18) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = creat(&(0x7f0000000580)='./file1\x00', 0x0) r5 = fanotify_init(0xf00, 0x1) fanotify_mark(r5, 0x105, 0x40009975, r4, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)=ANY=[@ANYBLOB="140000001000030000000000000000000024000a20000000000a1f000000000000000000010000000900010073797a300000000058000000030a0104000000000000000001000000090003803d2175fbe782c2002c00048008000240172af2e40800014000000003080002401c791e7108000240423930ce08000140000000030900010073797a300000000088000000060a010400000000000000000100000008000b400000000014000480100001800b0001006e756d67656e00000900010073797a30000000004c0004804800018008000100666962003c000280080003400000000c08000140000000020800014000000030080002400000000308000140000000120800034000000000080003400000000a", @ANYRES8=r4, @ANYRESHEX=r4, @ANYRES64=0x0], 0x122}, 0x1, 0x0, 0x0, 0x880}, 0x20000000) sendfile(r0, r1, &(0x7f0000000000)=0x5, 0x20001) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080), 0x8002, 0x0) 19m8.629312816s ago: executing program 6 (id=835): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) unshare(0x22020400) syz_io_uring_setup(0xcd9, &(0x7f0000000200)={0x0, 0x4661, 0x400, 0x0, 0x234}, &(0x7f0000000340)=0x0, &(0x7f0000000300)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000480)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000380)=@IORING_OP_RENAMEAT={0x23, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='./file0\x00'}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) bpf$LINK_GET_FD_BY_ID(0x1e, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x9, 0x1, 0x56d, 0x5}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000600), &(0x7f0000001f80), 0xfffffffb, r4}, 0x38) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000200), &(0x7f00000004c0), 0x1000, r4, 0x0, 0x11000000}, 0x38) 18m49.96671722s ago: executing program 36 (id=835): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) unshare(0x22020400) syz_io_uring_setup(0xcd9, &(0x7f0000000200)={0x0, 0x4661, 0x400, 0x0, 0x234}, &(0x7f0000000340)=0x0, &(0x7f0000000300)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000480)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000380)=@IORING_OP_RENAMEAT={0x23, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='./file0\x00'}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) bpf$LINK_GET_FD_BY_ID(0x1e, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x9, 0x1, 0x56d, 0x5}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000600), &(0x7f0000001f80), 0xfffffffb, r4}, 0x38) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000200), &(0x7f00000004c0), 0x1000, r4, 0x0, 0x11000000}, 0x38) 18m23.231682776s ago: executing program 3 (id=896): socket$inet6(0xa, 0x3, 0x4) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r1 = socket$key(0xf, 0x3, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) getsockopt$nfc_llcp(0xffffffffffffffff, 0x118, 0x3, &(0x7f0000000540)=""/181, 0xffffffffffffffce) ioctl$PIO_SCRNMAP(r5, 0x4b52, &(0x7f0000000000)) socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$VT_RESIZE(r5, 0x5609, &(0x7f0000000040)={0x1, 0x7, 0x3}) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f0000000040)='westwood\x00', 0x9) getsockopt$inet6_tcp_buf(r6, 0x6, 0x1a, 0x0, &(0x7f0000000080)) syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB, @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB], 0x0) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="0202000311000000000000000000000005000500000000000a00000000000000fe8000000000000000000000000000bb000000000000000002000100000007000000000b000000000200090000000000000000000000000005000600000000000a00000000000000fe880000000000000000000000000001000000"], 0x88}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000180)='sys_enter\x00', r0}, 0x10) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, &(0x7f00000001c0)='usrquota') chdir(&(0x7f0000000140)='./file1\x00') r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_GETINFO(r7, 0xffffffff80000500, 0x0, &(0x7f00000002c0)) 18m21.648730069s ago: executing program 3 (id=900): r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) keyctl$chown(0x4, r0, 0xee00, 0xee01) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000200)={0x7ff, 0x363, {}, {0xee00}, 0x81, 0x610}) keyctl$get_persistent(0x16, r1, r0) keyctl$read(0xb, r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x61d80000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r5 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='./binderfs/binder-control\x00', 0x0, 0x0) ioctl$BINDER_CTL_ADD(r5, 0xc1086201, 0x0) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$inet6_icmp(0xa, 0x2, 0x3a) setsockopt$inet6_int(r6, 0x29, 0x4b, &(0x7f0000000000)=0x1, 0x4) bind$inet6(r6, &(0x7f00000001c0)={0xa, 0x4e20, 0x20000002, @remote, 0xe}, 0x1c) r7 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000240)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1e7d, 0x2d50, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x5, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x33, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0xc, 0x0, 0x7}}}}}]}}]}}, 0x0) syz_usb_control_io(r7, 0x0, 0x0) syz_usb_control_io(r7, &(0x7f00000003c0)={0x2c, &(0x7f0000001300)=ANY=[], 0x0, 0x0, 0x0, 0x0}, 0x0) r8 = socket$can_raw(0x1d, 0x3, 0x1) recvmsg$can_raw(r8, &(0x7f0000000cc0)={&(0x7f00000005c0)=@ax25={{}, [@netrom, @default, @default, @remote, @remote, @default, @remote, @bcast]}, 0x80, &(0x7f0000000bc0)=[{&(0x7f0000000200)}, {&(0x7f0000000740)=""/222, 0xde}, {&(0x7f0000000840)=""/93, 0x5d}, {&(0x7f0000000640)=""/36, 0x24}, {&(0x7f00000008c0)=""/253, 0xfd}, {&(0x7f00000009c0)=""/210, 0xd2}, {&(0x7f0000000ac0)=""/45, 0x2d}, {&(0x7f0000000b00)=""/141, 0x8d}], 0x8, &(0x7f0000000c40)=""/89, 0x59}, 0x40000040) syz_usb_connect$cdc_ncm(0x1, 0x8f, &(0x7f0000000000)=ANY=[@ANYBLOB="12011003020000402505a1a440000102030109027d0002014040070904000001020d00000a24060001809a59c72d05240007000d240f01060000000300c7000306241a0400340c240707040006000800b8b6102407fd7f00610e07000000ff078b000905810308000008350904010000020d00000904010102020d000009058202200004810409050302ff03061004"], &(0x7f0000000500)={0xa, &(0x7f00000000c0)={0xa, 0x6, 0x300, 0x0, 0x7f, 0x1, 0xff, 0x1}, 0x82, &(0x7f0000000100)={0x5, 0xf, 0x82, 0x2, [@ptm_cap={0x3}, @generic={0x7a, 0x10, 0x1, "fb6b12ae0d24b2e86a02838fd7b5e0034a75eabec4ec856ab9e6e9326b99202753e188fe304fe45ab0abda0a69711c449f480657bf6bc973f8f0a128624e5bfa2135ce5d66a4678d7ee703fd7129f8e57061c70482430303a514222ba0745bfe7f64cabf6cadcccc35c964e9116254af85637bc7adc2c5"}]}, 0x9, [{0x39, &(0x7f00000001c0)=ANY=[@ANYRESHEX=r7]}, {0xb0, &(0x7f0000000680)=@string={0xb0, 0x3, "19ef3690825d366734da631c2eccf46baedad7a88e863bf66f987a9609a7c78c17bd26a703f56ef36625c436123a76b43ea5083b41e5641932ce0016742bd7b0ec0a76aeb3859eb75624bb768c219199d9dd0d7050d0eca48bf800e24b79ac042521add26b3d93548cf552f0a0f273220faa734955aba3c218f9a3ae3f6ab87d5cd80face696f776871cc22b07f3e14b00b1ce65d2903d58d18e096ecb0e42c54a5ceb11897baef32051ae42071d"}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x406}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x446}}, {0x60, &(0x7f0000000300)=@string={0x60, 0x3, "843ca1e9d97ccb0fcc0eb1c53ec7665970a206068d3bb0ece8730bfaa7387a24a87045772e63bb37655f2c2e105dcf9c3f444b99c21a06dbbee4cacccffcd0f7188a6e3d987e3be5285b9714399c4b575f707f13192e6fb310827d9ac44f"}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x1404}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x2009}}, {0x67, &(0x7f0000000440)=@string={0x67, 0x3, "f5829a229081a4e85a9016ad077088133f84edab478f9cbf8a783c09aaf669f1798c37fc6f7880c928fc39de93b740c2a201136c3dd464a10eff6122244b83c6249852876ff9bff39d7f481582be51f7ee60e60dfceb33bf956c4410ba534e568dce8417b0"}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x2c01}}]}) syz_usb_control_io$hid(r7, 0x0, 0x0) r9 = syz_open_dev$hiddev(&(0x7f0000000d00), 0x4, 0x140) ioctl$HIDIOCGUSAGE(r9, 0xc018480b, &(0x7f0000000d40)={0x2, 0x100, 0xfdc, 0x7f, 0xf58, 0x7ff}) 18m10.224912965s ago: executing program 3 (id=915): syz_usb_connect$uac1(0x0, 0x94, &(0x7f0000000200)=ANY=[@ANYBLOB], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x15) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB2(0xffffffffffffffff, 0xc06864b8, 0x0) r0 = socket$inet6(0xa, 0x80803, 0x83) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@private1, @in6=@private0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xae}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@mcast2, 0x0, 0x32}, 0x0, @in=@multicast1, 0x4000, 0x0, 0x0, 0x0, 0x9}}, 0xe8) r1 = socket$inet_udp(0x2, 0x2, 0x0) fsopen(0x0, 0x0) syz_open_dev$dri(0x0, 0x1ff, 0x0) setsockopt$inet_buf(r1, 0x0, 0x8008000000010, &(0x7f0000005e40)="17000000020001000003d68c5ee17688a2003208020300ecff3f0200000300000a000000009afc5ad9485bbb6a880000d6c8db0000dba67e060180000a0000f10607bdff59100ac45761407a681f009cee4a5acb3da400001fb700674f19b44e09f9315033bf79ac2dff060115003901000000000000ea000000000000000009ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e000"/184, 0xb8) 18m7.161395248s ago: executing program 3 (id=924): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x80383, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00, 0x23, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = fsopen(&(0x7f0000000100)='ecryptfs\x00', 0x0) r6 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r6, 0x80044940, &(0x7f0000001fc0)) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000006"], 0x48) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_open_procfs$namespace(0x0, 0xfffffffffffffffe) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, 0x0}, 0x48) r8 = fcntl$dupfd(r1, 0x406, r4) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x209ac05cbfa5cf9e, 0x0, 0x0, &(0x7f00000000c0)='GPL\x00', 0x3, 0x0, 0x0, 0x41000, 0x18, '\x00', 0x0, @fallback=0x29, r8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xebfb}, 0x94) close_range(r5, 0xffffffffffffffff, 0x0) 18m5.547328671s ago: executing program 3 (id=926): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_PROTOCOL(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x1, 0x6, 0x101, 0x0, 0x0, {0x1, 0x0, 0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x4008000}, 0x4040) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) r3 = accept$alg(r2, 0x0, 0x0) sendmsg$alg(r3, 0x0, 0x0) write$binfmt_script(r3, &(0x7f0000000600), 0xfec8) recvmmsg(r3, &(0x7f00000008c0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}}, {{&(0x7f00000006c0), 0x80, &(0x7f0000000840), 0x0, &(0x7f0000000880)=""/24, 0x18}}], 0x2, 0x89, &(0x7f0000008000)={0x0, 0x989680}) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x500, 0x0) gettid() sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e21, 0x2, @remote, 0x9}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0x4e, 0x0, 0x0) 18m4.472841667s ago: executing program 5 (id=928): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="fc0000001900674c0000000000000000e0000001000000000000000000000000e000000200000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000400000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000044000500"/129], 0xfc}}, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) sendmmsg$inet6(r2, &(0x7f00000066c0)=[{{&(0x7f00000019c0)={0xa, 0x0, 0x0, @mcast1}, 0x1c, 0x0}}], 0x1, 0x5efe) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="100000001d0001"], 0x10}}, 0x0) 18m4.311795888s ago: executing program 5 (id=929): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000900)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x80383, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00, 0x23, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = fsopen(&(0x7f0000000100)='ecryptfs\x00', 0x0) r6 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r6, 0x80044940, &(0x7f0000001fc0)) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000006"], 0x48) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000500)='signal_generate\x00', r8}, 0x18) syz_open_procfs$namespace(0x0, 0xfffffffffffffffe) fcntl$dupfd(r1, 0x406, r4) readv(r6, 0x0, 0x0) close_range(r5, 0xffffffffffffffff, 0x0) 18m2.809964748s ago: executing program 3 (id=934): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xf2, 0x30, 0x39, 0x20, 0x2c42, 0x1202, 0x8540, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xc, 0x2, 0x2, 0xc1, 0x7f, 0xc, 0x0, [], [{{0x9, 0x5, 0x2, 0x2, 0x200, 0x2}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) r1 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1, 0x0, 0x2}) ioctl$vim2m_VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000240)=@mmap={0x1, 0x2, 0x4, 0x100000, 0x9, {}, {0x2, 0x2, 0x4, 0xc0, 0x0, 0xf0, "18a6fc23"}, 0x1, 0x1, {}, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r1, 0x40045612, &(0x7f0000000080)=0x2) close_range(r1, r1, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x8916, &(0x7f00000020c0)={@ipv4={'\x00', '\xff\xff', @empty}, 0x80, r4}) ioctl$sock_inet6_SIOCDIFADDR(r2, 0x8936, &(0x7f0000000140)={@loopback, 0x80, r4}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000500)={0x44, &(0x7f0000000180)={0x40, 0x12, 0x1, "b4"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 18m2.809216274s ago: executing program 5 (id=935): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0}, 0x18) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000340)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x0, 0x0, 0xbfdfffbc}, &(0x7f00000000c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x0, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x85c3}}) io_uring_enter(r2, 0x32d7, 0x0, 0x46, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=@base={0x1, 0x3, 0x9fd, 0x84, 0x105}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0xffffffffffffffff, 0x0, &(0x7f0000001700), &(0x7f0000000380), 0x800, r5}, 0x38) 17m55.294512325s ago: executing program 5 (id=944): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000000000000000ea04850000005000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x18) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x9) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$iommufd(0xffffffffffffff9c, 0x0, 0x200, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r1 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$inet6(0xa, 0x1, 0x8010000000000084) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="b60a0000000000006911b600000000001800000000000000000000000000000095"], &(0x7f0000000000)='GPL\x00'}, 0x94) r3 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) ioctl$USBDEVFS_CONTROL(r3, 0xc0105500, &(0x7f0000000040)={0x0, 0xe, 0x1, 0x7, 0x0, 0x7, 0x0}) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e21, 0x0, @empty}, 0x1c) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000000000066000000004b64ffec850000006d000000c50000000500000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'veth1_to_batadv\x00', 0x0}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000780)={r4, 0xe0, &(0x7f0000000880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000540)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa7, &(0x7f0000000b40)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f00000007c0), 0x0, 0x0, 0x91, 0x8, 0x8, &(0x7f0000000840)}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000a80)={0x2, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x41100, 0xa, '\x00', r6, @fallback=0x1d, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000700)={0x1, 0xd, 0x81, 0xf}, 0x10, r7, r5, 0x0, &(0x7f0000000a00), &(0x7f0000000a40)}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0xe, 0x5, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8b, 0x0, 0x0, 0x0, 0x1ff}, [@btf_id={0x18, 0x2, 0x3, 0x0, 0x4}]}, &(0x7f0000000200)='syzkaller\x00', 0x0, 0x5f, &(0x7f0000000300)=""/95, 0x41000, 0x11, '\x00', 0x0, @sk_skb=0x4, 0xffffffffffffffff, 0x8, &(0x7f0000000440)={0x2, 0x5}, 0x8, 0x10, &(0x7f0000000480)={0x3, 0x2, 0x2, 0xfffffffc}, 0x10, r7, r0, 0x3, 0x0, &(0x7f0000000500)=[{0x2, 0x4, 0x1, 0x7}, {0x2, 0x4, 0x2, 0xc}, {0x2, 0x5, 0xf, 0x1}], 0x10, 0xf}, 0x94) openat$vim2m(0xffffffffffffff9c, 0x0, 0x2, 0x0) mbind(&(0x7f00005b4000/0x4000)=nil, 0x100000000004000, 0x0, 0x0, 0x0, 0x2) r8 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) shutdown(r8, 0x0) connect$bt_rfcomm(r8, &(0x7f0000005dc0)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x15}, 0xa) socket$inet_udp(0x2, 0x2, 0x0) 17m55.077660385s ago: executing program 5 (id=946): socket$inet6(0xa, 0x3, 0x4) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r1 = socket$key(0xf, 0x3, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) getsockopt$nfc_llcp(0xffffffffffffffff, 0x118, 0x3, &(0x7f0000000540)=""/181, 0xffffffffffffffce) ioctl$PIO_SCRNMAP(r5, 0x4b52, &(0x7f0000000000)) socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$VT_RESIZE(r5, 0x5609, &(0x7f0000000040)={0x1, 0x7, 0x3}) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f0000000040)='westwood\x00', 0x9) getsockopt$inet6_tcp_buf(r6, 0x6, 0x1a, 0x0, &(0x7f0000000080)) syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB, @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB], 0x0) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="0202000311000000000000000000000005000500000000000a00000000000000fe8000000000000000000000000000bb000000000000000002000100000007000000000b000000000200090000000000000000000000000005000600000000000a00000000000000fe88000000000000000000000000000100000000000000"], 0x88}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000180)='sys_enter\x00', r0}, 0x10) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, &(0x7f00000001c0)='usrquota') chdir(&(0x7f0000000140)='./file1\x00') r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) quotactl_fd$Q_GETINFO(r7, 0xffffffff80000500, 0x0, &(0x7f00000002c0)) 17m53.628928859s ago: executing program 5 (id=947): bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) (async) bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f00000002c0)={0x8400001e}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000001a000111"], 0x30}}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000001a000111"], 0x30}}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) r3 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r3, &(0x7f00000065c0)={0x0, 0x0, &(0x7f0000006580)={&(0x7f0000006080)={0x28, 0x14, 0x211, 0x0, 0x25dfdbfc, {0x28}, [@INET_DIAG_REQ_BYTECODE={0xfffffffffffffd68, 0xfa, "4ac2411e47060aefadfa617ab9"}]}, 0x28}}, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, r2, 0x9a974000) mremap(&(0x7f00003ef000/0x3000)=nil, 0x3000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) (async) mremap(&(0x7f00003ef000/0x3000)=nil, 0x3000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) socket$inet6(0xa, 0x2, 0x0) madvise(&(0x7f000042f000/0x800000)=nil, 0x800000, 0x15) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000100), 0x4) (async) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000100), 0x4) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) (async) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a48000000030a010200000000000000000a0000050900030073797a30000000000900010073797a3100000000080007006e6174001400048008000140000000030800024054dd5e54140000001100010000000000000000000100000abbd0cee8022382"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) close(0x3) (async) close(0x3) 17m46.846647077s ago: executing program 37 (id=934): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xf2, 0x30, 0x39, 0x20, 0x2c42, 0x1202, 0x8540, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xc, 0x2, 0x2, 0xc1, 0x7f, 0xc, 0x0, [], [{{0x9, 0x5, 0x2, 0x2, 0x200, 0x2}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) r1 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1, 0x0, 0x2}) ioctl$vim2m_VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000240)=@mmap={0x1, 0x2, 0x4, 0x100000, 0x9, {}, {0x2, 0x2, 0x4, 0xc0, 0x0, 0xf0, "18a6fc23"}, 0x1, 0x1, {}, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r1, 0x40045612, &(0x7f0000000080)=0x2) close_range(r1, r1, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x8916, &(0x7f00000020c0)={@ipv4={'\x00', '\xff\xff', @empty}, 0x80, r4}) ioctl$sock_inet6_SIOCDIFADDR(r2, 0x8936, &(0x7f0000000140)={@loopback, 0x80, r4}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000500)={0x44, &(0x7f0000000180)={0x40, 0x12, 0x1, "b4"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 17m37.02802507s ago: executing program 38 (id=947): bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) (async) bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f00000002c0)={0x8400001e}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000001a000111"], 0x30}}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000001a000111"], 0x30}}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) r3 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r3, &(0x7f00000065c0)={0x0, 0x0, &(0x7f0000006580)={&(0x7f0000006080)={0x28, 0x14, 0x211, 0x0, 0x25dfdbfc, {0x28}, [@INET_DIAG_REQ_BYTECODE={0xfffffffffffffd68, 0xfa, "4ac2411e47060aefadfa617ab9"}]}, 0x28}}, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, r2, 0x9a974000) mremap(&(0x7f00003ef000/0x3000)=nil, 0x3000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) (async) mremap(&(0x7f00003ef000/0x3000)=nil, 0x3000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) socket$inet6(0xa, 0x2, 0x0) madvise(&(0x7f000042f000/0x800000)=nil, 0x800000, 0x15) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000100), 0x4) (async) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000100), 0x4) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) (async) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a48000000030a010200000000000000000a0000050900030073797a30000000000900010073797a3100000000080007006e6174001400048008000140000000030800024054dd5e54140000001100010000000000000000000100000abbd0cee8022382"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) close(0x3) (async) close(0x3) 5m19.89279811s ago: executing program 7 (id=1883): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, 0x0, 0x0) r1 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000000)=0xffffffffffffffff, 0x4) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, r1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r2, 0x0, 0xd}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8d}, 0x0) epoll_create1(0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x4) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='mountinfo\x00') sendfile(r4, r4, 0x0, 0x2000007ff) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x3, 0x4, 0x4, 0x12}, 0x50) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) ioctl$UI_DEV_CREATE(r4, 0x5501) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_GET(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=ANY=[@ANYBLOB="20000000010701010000000000000000000000070c0007800800014000000008"], 0x20}, 0x1, 0x0, 0x0, 0x4000800}, 0x4) sendto$inet6(r5, &(0x7f0000000240)="d3aa4b68854c7a4b23c40ab215ec518a50d1f072aac9ae601a8ab9ac35bbb74a1feb2974ed33643891e627fb7e03d04b5d38d84c75ca800872ffa47061cdf26781dc031309155e03ccc61f873a83a14f9b3faf533a2c093f9b8d5305943072be10a71406eb7f41d14e18ec57a1f43e86f0e286578d0db26efc", 0x79, 0x4008891, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x2}, 0x1c) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f0000002300)="00e7a0633e8438bafa888b9b02144af32e296a0a01dc194d649b6fa26d6d5e63bac4a04baeeb8aacb22c6eec461b67db6a737737c6d2687acb00572f92e3fdb5d0cb2f11121c557a943020200755bcab77b39c406b733239e2bb1175b9322ba39dc7d67da8f77aed1714dae2e6c24c3ea96be9d151c6ab7b3c54bbe507b8b2461fb4be8dc90042184af6d48f8ace16abb5e3fc943cf61cdb75624a259bdb5f7829b9775820f85f2d1a6ee6c6c2af4fd41ab8a41ecb2612abf13cd2c6f9f3e6db505e4bbe68cc000cf5fa6d5636191a4b366ab59af52132a3f9678d4ed1bd577bacffb3b52850804005eebf3dfa4763168ff30490a11acdbbf4c3312a45f30139f6b72b1e7cdec185006bb30e0e8fa88da2cefc718cae7e9830f7ca101e4e23c6bd16bfacf4a9927fb13af4b79c86ab999beda4ad396abdda354a42fb4ef21d6749175dc21a0cf9191aa4f90d274b50370a580ad8dcd166d2b06c0d8b071973c3fde30f7e2bc371a51ca5866bf8b24eaac75bf482dd4436b214ff62d32e20df223b0b680ede28b3a49e66e330a8a3ecace0db9855d235d5ff23765e742d1a739c2ac8743f4c62664a3b347279da55a1a5b16e1e2828b584a013577d50f890e3894d9e8d6bfccdfb2b70221f12a7fac24b7a8818edce72b65f622c77bf1312771a2c0d805ec9a25c536c91868762032255be78903b77b2c1a773a03996fabba69214e76f5df6df0375b592692a2c3c86c75a3be56fe598ddaea0b9901d20db7e43e128e04e5509283f833c24c625887288459db5727210ba9a301fb8c934dd1d8dca68039fe5b2e1a8d7cdfc6d875e5851098100c3cd42544ed90bb55b58d20a501fabbc485d148c615a3b070fa0520da2ed68ee115a4411d5418b47f3d95616096f67a7a36d68f1e8df82eca8ef96fb4a96b3422fe046a37ea5f5967513a559bd770fecab7228b0692f439765c9e9c6ea4fc608e0b27f9b49064daa2bac06f83f6d87ebc61fa3a29bb5ed39641245ce8cf43770df32a84838802b0827ca5a40e2003915e2ed108a005637bb028d29bd2cfd28a1bd55e67ed1b6b7b72163c27c4b0e36d1b134d6dfdb165a66fb46498fc04bb8053b84098af5b18758631d1318d625a6fa4d3ce5a4d3a90e10c6363a26b5ae96c2d56f87ad21a6118af6847d041f88f852ddc3f250c088ef5cb31198f3ac81cff9a5bab26ed56c09f8416188974e08349f7da28fc754b98c1ac4ea0060ac1e1b1c49f7dbadbc59254b265dc418cab9ac14e2bbecc4c3103543e37984efb1f61315e10d2b422732217d3a9b0cfe4561f3765d3bda60be239e02bdc164dd631582e8c87dd8fa60d63dcf9e7f3dadc4ce5e4433a42425b8ee8cb8a2defab0bf9b6109c90b5655b79b18c06884f2670a985d454e08e54de69f645cb0cbb70620bd988ee717c310ae77b4abe81c01c6e7f47268ee20bc30b9062830917705682eba2c5ef966b877f33294aa5f8b29d3dd5ed92302087f34fa18d19a005de05f925e3e93c8c0f24507ff20cd23d9ae5452c32ff58c78ccdb1ab32c98edfaa6d2c3971934ca8f849ac360c286566eb72b0793f12cef84bd282368d533247ee750f18aeda484167f3d680e4aaa3aa0694441d4ff6a71531f1a30f87eeb71afd04c5d686e1f86f27586f4e2c8ff77c09612ba1af9b3fb93efd31af42f8e0498f35d07c662b743a08f2839cad8f95b90cbb4fc0ed2ca45dd093a549cde4c6ff08ce09a2cbc6f9f78b6f96643357f92f8f403202742057731fd3e343a87c0affe803cfdbddb8c2694ab63f2dc35da705624747e30a943000fc82c40f10e1975d2e2ec15aefd531b6dbc053606b054dc976f44d5b5a5f37e9c08532ce16cf8bca55ab6c814ceb855ab50b8b52620f8645a9dc25fcb732080d84bf39c3ebb235b4d96da527b64ec4b72f69e91d16a4efcaf76f2e1f968ca68a06f60b01ec7becc9ffd7877c0992cb0f80fb3daabc039513896bd7697843be06aba53e7761e11e075c61ef2d897d4d9f90041c14283746feeb3f0d456ba4be27843350fe43e7c1110b4439489139f6dae01c43f23ec71f08d3042663c65e059d368e4e2c6e49de45bf078d3182a1bc1208bc59379e705aa3309579947409f2a8b3d79099c8619f916e7a6fa333d2312a274247156b8c25cbcfcc59ef13339c700f56a8691dff39bd4338789001872c0d90929037dc0ad99b380a6ba73f331f73f9274f4c2bf5233d7482edf37bf6ffed4f2c0ee44a1d57cae0d644f25591dc03bf837571a82d0c31b61be7ff85a5b3843e8f96a50eaa43f5c137ecfc4e4530d08a2afa4ba02fcc50117a4ad0d5862302017639344c82749f673dbd650e49b35302d0acbab45c0973198291bb42b4cfcd3b0c272074341ea8eca19e122cd234da6d41bf5eedb706e16c17687ed8b84db67130796d26b94eac83bbcd785b603242bd6252c155711efd7dd22cc54e1eaf6d910d0f22c701f3d4da0314dd2829c6ee13bbcbd126558b47b8066bf0766c792a012315bd29bfeda8f28a2c1f4e638b701758e19a0e5bd5b4f19048b00a877d956292e345f8a3a8367892f955bcb5e50ca145ec5e2c9309e25941bd277e393aaad38f9b72a42514b27da6856223c37a1fc1327fa760551d3fdeb0b222ab180b16c9eea138cf4f327e88fdfee293c5b6b007028eb796a60772148282dcd17ffc1c90ed8b6540ede933545ed5a5301d6ff39734444ff3d85cda4ac3befa5083a4685e9e231eba4a91a35f4f7f48fd5ac2447c64c010e2a9f8e80691c95460e1995444466ec5f3cd71fe509a26ff0b7f3254bc8c3255e903834e841b37c70b267fb33deb0d1ed4ea84a869453ba508fc255b12cf847103d5195046c930ae4a75c956f22fcfe4186d547686b54bd7a534940d5d62216994eac0e8ed3bd2bd59354e6b9c6b5b10511d54a8b928040f1e1024a423b0cf519fc6e9673df5c48c0778c7edb8fa8d8ace77463a77d2d6313160e1ee72742953e433b6732ced59c93464fd91520847db238610ed0c289fc55647881a7d6257cf28090c75a6f19df079cfd35742a74a5ab270314f7c8039c20ff0f3f543d029b75a741b5dc6425241ac2ffabf1f96288e6d4ba34da09fb6049c2c8753fbd41fdb4bc68c57bf374ef4feb0df00c41319debb26afba2ff39e1799a1c2137f4e920ee5b02d93789b6b0c853e8143dae5b08ee85da2ea7c31803610ce797293ea95c16ade6dae2afb008e59d8b9505737f008b5227df5f1e4eb5d707f502698a17ead9b1f5ec09dff34248ff2fb153dc6df4812e39754a4baa42e1d8b77fbddef3ca091701ac28ae5fd422dbd8db5b122d3965383abc37a52d2fca5ce56eba974dba3d059cefe40e3c35c9daa8ae31198214303c1dcb90d58fc983ccfd504fa43925636f94b128d44e8aa5cd3ecfabd50a84062d03f7508a0575ab65ecc749d3ef566fdbc529a8139b7a7fb3a9bd784df52cddc6f2699044ba47615163fbbe19f3d88d38a8b71fe52b2611ca74341429d1cef1a7e350545be29d2caa560e60352cab074c298c44ca2c07f9795ce52f10aa3e2fcdef371f24e309b19e52218881f25a4674527edbe3b3bd0b9b536d810c6f9500c0c81bcfd9a440dd91c1d35c52758d2b2ae1a8497bb394c4f09d3947cf777727b0d1daf5ac4fe4fa3c247a791702cb84b96321b7fec81bf549d4eb5d6dafe019b26187417c68b064e4308908535a3e77b6cd3e28caaf12d726f15590b7958e40134d045a38cbb689131a7e85532f1c63dd4bac9e4d00645cd7b2b71704563f3738b92044a8153f6ba717800ab7cb238175c376d7add2c5ec38e4c856f1ab9c3ee33f6ca6d576ae908dd290e4bae23470182e253765e04e8eb02a791c4396a511ef467879a9e2818b8a4b1b0b39a6c44e816e3ebf6e3be93929dfcb38d5dad7d20b60215447674d0608b8b02331ac20e57083cb9b4449fecbb149441aea0ad82f00a82d87d743fc80d410922bc20923516885440f43c9f32beb81ce148def6140952583a7825c2d2fe012d52d30ef66d32a8a0864ac5c1737e2506228d41ff0515ee80be4cf012927dde0fd2a07cac68eff8c4437f2844d4df07936fd8753e5909f962c5c767f8719cc295bdfa8a16f3f36ff56e34d7b14b6b8c46d5af248b04a9c5396f84990e23d145670950bce5f5638e5e2cea37c371a4483729338f1305cbb32fa1c05dd9d21d2a69e5fa3abe9a2dad2237be20b4088393c04aa66cf13718de4bffac72f641a8c017a1d5568fa15a6a06e4dc833874ec95af6f115bdadf15179bfc8c4e3e64f26f1299e282c4ab397340934efc1e601afc630fe195e8ae7d8da1310568cab4f2fad085d0ec39710d8b7c812b3fd55c6f50925bcfc90fbcb35b8daa0f1e1f69d82fae2034039f7ad6921694ed48a55a68bc541e6d86f1e33c261a92d48b50eb58a03d8e31b2f6564a4ddc3ee988d0dc47b4b610a9a9dcb87571b5c1edb3362df0ec3d58872157e0f7247dfa8100b4478b705702a5620c9201010f40232327550db333e845dbecd6aadbd0a94c064862b1100b4dd45ece811b8c0275e3753e11b4bcd8bc5ed7668e72afa5bc5cc17b4c313273755f532ecfdefdf2d5c47999453a3b7c158d98332f0bd3a820cfb2c8c3bcd43197e7395a032cec6e41662079f2f654965aebc393e22b5c8516d9b8ad01e33ee481a4ac46a2df304dadeaa9e5274d340aaebe14dcea315fe1279f1a41a5c7aa8c94bf4b3d48757503171f53488e01210145e62c0de7c39737848dbdb1b207d4d33b8de180b020e8a76b1b521905e5e3ce97292f8558fb68efdee774681bfffcf1dc3eef35f660dd1659a32950de2d50e762313beee330d9c2a9fe8ce5e4e61ddd86378d3551335f6ef62053d3b248a8c33a11abdf3f3aa1975a15f4a6957a13d5b12a44d0f2b52b9a2d996e98c630c0f2abca80c7ae89efcf81ae284a0d19582cb1319d207077e5657d245533181ed6e07e0f7647123fc46c37bd75b4f4d181112b4a08acdcf445332cb9dde69a0923dd9244dd2ecd818b19588939922e3b2d8dd9d9fed95fa55b0e4564b38aca2c4d24eebc634664400177fbdeaeb278bb1d8eb11baf4be5c87d4f8d9a855bfa75df4c51fb4eec87a27c59df9a47d82523b08022a1c0fb22ff6f93c3d2cc22a4111a6ec5be428cba33617be65739c2240248f3a02d01ddf2d6aca9e537a2296b16d082d2b868504371dd5e41898885b03ebfaca73b40e8924ece83c1c80de6ce14943e1199c6f81bf359f44c3ed5ae3c6eacb730b1039f0b6555347bd566dfff45a7a2176420ab2b40916a73b66a3ad07af6e1ac5597393d203fa1ad34d4564af956a0a3e2997e27a4e5eff67dd89cce8875d995e00c1858234f149f6ad4cac2b8056966f726df57b8c4ee8f22f23097ba1471b1f1036e3a499400fccdb75b56eb13e9eca1407d5bff4b075b06d00fcbfcafc28431eb33156232e73c6577e3eca437330c494ede57b9609e1f40634918dea767338b5542197410cdc000143ace89ca0b7bf645b3267f74767d7c7fce05d2f59c137204e56bfa711f66903c511f681cf7a1b4f9fc0f42b7c438ff8957e1059375321df5b0c5c884f46d94c21686e1300582d34928bc398653118f79bfeea2e7cfbbf31a7718f4aab50fae57db94203d43e060365c9a7455241be03d82dffc3783d0f6aa170c0866eb0dad07485831526922d8348a7a16e2e9903a2ac93c58c6dce83127fab17703ec004a519ae5675baffb31bf4b52f9ca992a84017a44d68dc693abd829947342f277fdcbc87168bcc03c32b8b1e81a1915af2517c464af07d52b79d1b0e53164c82ba049f81e92ed1dc20a88fd72e9ce7aa4b22a7cc57dc5527d14f62bc29cfc9d57ed26fd523cac39ac00ba12d3a49d694709924275fc0793d56acf9558818dc9eb210749fa5307d45886b879257d627cee0542b51c2ce6ce134100efb47c92456ece5b73cdc051f570810a8d534222649eb56cf73a377162b753de6c282bcd4a25dda21dd10901bd8dfe8fd4ba8a70811c39707beded23dd60f23e2933372e3a6bce099899b07f0a4c4956fd98e956a8649622c77717de099463c0c6c9389ab4a1ae10f8ddd086d876af2943ee0b6b402ae5f89e09922e8c510ec0caa0a83e366e916400bfec88a52ab457037a35ddc6a8e2289c33684a5915c37bf5d227cbc65a737b52bdcb4fbbb7b4e7f965db116b46044d0870846c730dce12e120b1fe6dd5798ced24cad72c59a3f44de4978b8bc05a1dbeb766be6e2abf6ef46c67a58a370e54e92d89e5f44525e82b94a388d8d0cb20c3469a258c1633c9dddb6854aee255f93f59435ff317622f6899250aa185c207644275278580c5d32401741fe264a2e03b80f442ed58fd0704ebac923ac6a5abb7f0c695252f82e3fbcf2b99d721589a8fe3fad4d5926aee3d7bfafb6739e525faae3d25b12841fa2cc61dddc44d36acb9a8b72d60ecdd9c8cf04f9bac341b5e0f9bc59042db8126324888b07afe72b18cce36d61eec975b6b4ef5dc4a16ac14440cf770599bd4db630bd110eb63a03a80cd95c16d314a4de60cc5115bf0754cb7ab84a827ecefafa96069c721a5979f227fdc2467b4cd1975dafb5b28e1d6f3c1c3a2816ad831dd98c1378a03798c128f176426eaa0e361571e758d54bf4ec2c988355f016e16d6cd5cf97bb4891ab33f5623b7e796af313cc7a9e2f9510cd2bead1ea5dd080d9de1f595b2629ebccf69a0feaed3963ae8a6c89edd66fbf6e566379898185828925f8669668d6bddff961b08aaedbbe7fc196931a887ec740da6bcdab8f826a34aa2aa1e406a258558f3baf022a64222df4d6ee8726c79ba3dd6e11a19e4b4bb49b4a8cd99c189e6392f08ad731e415b65d0ccb919dca46efe9f79e21437111ab09e926d3038182044ae047bf1cc92e2d2644c528985719667a1a8abaf65d0f211172ea789b2fa016e1a88325d1ed706239da4dbb9e2079e3598b4ae5885667587ba1e0921c9ba55d7a3be4c47bc2f2f3547ce9efe32e5a22855f761bd4cbe1cd9337eda4bd7d82a918084d7e116b656104ca87e64b1b8c62323c3c296c5b5b98051feb607b872edf9f789744aff710c4b7279711182bcac6b76c05f5cd982f52f451e7e29046550e012e01d8cdd3e305427030f4247488c9136303084c12175c5c781cdd08aede5a356ea0ccdd05a460be3c7b4bfd62c3ce9ab68e285a36c1546d0b18edad71f69f5bedb340772e1bbb035514b085067259e39f59dc292a12557350c66904b253efee29a5eb7a6920f583c899dc46a1d3e2af2db3a3d1a0e8d1f98722a16c6cc1e401058d60c8c436d8f1166ba53bdde5810f9d0288528affd486c266546a864c92af3df8abd451cc1e0d6bfea534865cea9d49b3ea5e390fa823118df8a61e31022f5fbb8ceee870bf2e60890263c4d14e24d053d0fddf665ff80a66fa00a5957f8a30fe82a4b82cf2f6b4d49def98f66bfcdaa0aef13314e950ca9f3849b1edf3b82eaf74a0dbcf45c3dba9bd2d853281a78484f1efaf4150da1207ec3cb61fbcbf759f8182b7052b28d7164b73197b0a440759fe9d5ddf827f1897a174e82fb968a9a07c61bee44bc1f7f9ee5c6de04c02d57735c5fab741b36aec7c8642e56cba932a08b8e8a9d3eb066a4ee7cbf22e5abbd4346de59eca1f24ad9f7f9ff7621e5f30dd08f4cddda8e80e496908109f5212a72bab1378d1237def07bdda4178719975346c68405de15153031fb17535894e5e3c1de6fdd507333f0226b78ba7cae509cfb48d6735ede9392650bf85ac1db919b1e9fe0a823119d8253204dbb2f7a8f524be6d419f3a45c5051a7a88ef0bd41586d90c11a894d647f03895f671a6e19f1c70e32668653aba8366a3d372522f49844081a9637db080663ab02f4a8af502955d5411461b62f85308c91852f8fb9f0bdddd500b4a133791d3a2f91a82dc4b09f5ad2196a9172ab0cd3fafe7266e9f6d159110d99ca8da8a34b17be17a04ad4509a9fffab1e45e10f10e0cf9cfbd9c761ad044064c07e473fdc626289cfb88b13a11455c069b70aa02426d9119ac878a14c9483be9c0d5bcbb5fa76c8d06531f59c7cf7c26372e750e2f332418ca769e5e7fbeb3ada7bb58b573a0635e2e3ad9a53ddb809ea01086a3fa993ad57e89da6f9c5e61bd0f8ba69212a386b2aa1ae17520d7fb989dbe14021885eb50fa3048aebd42c861a09a308b660d382c0480ead8a52a1e14927c7c77957f94bb59ccfd557f8c4a7af23360a298a603d20ebc386db041d8c306b3e32b0bff541bdec5ff75c3b40950815cf9f89d48a382f67e44c409d046c01fb1262aca0df6f5238a3c3c09977261494f7361ba326815d6e23f49e4d6d4b54665081067332265fff59cf54af9da0db9d19bc611cbcb6e6f3f1e2e1ffb6cdd6253578d78d06a2ff5f9250f1994c5749e3ce49231fbd63bba28e948f9150933e3ae31299babaa41043b181a100882e613b4b4b8f49ceeb742d22f860853a9b917f5a323a8a1fb1f3363a7be4407fba44b408f259b5db79a055b92ce3d7a0649cc59f4afa2b1f69959d5c6f5eef1fa7987a47bee4491f685c52e9db1ee1a231ab5a4bae1019c97868a409dd0d57b32525394a233023c4a7ac429808bbcb57a34b41883202744c3bdebc0a637773273f19c2be6e806bef7fc1002846db762ee4e16867773808c5477987d5851d5b1641d070feabc203cb3d7943ffb206272fcac1bccb616352d85975f5a22c0f247548535ad9fb83fb2be17689453f10691143c060cd964df63c3c70e7b1cfc7e2b468015f327f9869353477bfeeed330b03ddd9e4e0a2441182244da283d7a59d2b2b20e6de3e3a47c26aeef4944c1190bba674523a6c3c4ed6bac53b9edffcb0e9fb19d8bf36949d03ef6a7e59eb903a00d9614f642d1932c766421906f5b177963c71e881453560e3ffcec792e8dc46b1832a8fcb2ab2268a9c1fb648d1c6fa1c8cbd50d5a2d8264fbc6c063e6daac5519d362da389dcd3d12c8039f991de91e728abf5bab95c3aef66dd8cc36c60e73cb10afb02eff6df20ff12c59b142b07fc48fe94612de80b8b958f78256fd7cf3c6f79a83867f3bb5f70da392957badadecefdf7b6e4ebd39ff945397c7d302ca0a5a3918d8abb893cd9cdd680916a50fe19699ff0476ad82e6ba46523f26ccc5eb65313c1df1077c8876d2b73bf86ba311862d12b0c557a92ef827197121512e87f817167d4b17c7e225a48b3f8fbbf4187438e0e9b78e905cdbeb72e80dfb37ec0104f5186b39b4ff34f0cdf4b74dc915acd3f98874cd6a67308d0ad9697121ac477550b1affe004f433705933f9647522be65cb5a7471120ec942aeb956f195be0c1783102cf7d842f2968222ae1a7fa6513f200d3fa85d71724956ed697f0673ee3b40a4d46ba4850439ec125b708ed52b52b9f72906477d520c90a9f5dd49a7a33a328137a183f439895532b78ae451a8c3db789bc862fbc37241d523027e1a008629c969380f6eb55f9cf3f0675bca6851f00df6aaf90de9f62d5c179945ef81d1073850301f97e379ea415d830e3f3751cf83e2dba541cb6cdd89e6b674f2c53e329e5f3dd418d534ada6469a5b3bca5b7cfbdfdd6df4abaf77d4520d0311e801145c91b52586a56086e663841b702f52cef9fff8cfb7b33dfa125688ba6b4fadd1dca8defaf4259ca85323b23d3bbb45933562c25af3e8d7bc6ad4a50ae974f8d207994b3bd74a6812ab6a40fcaf96bb4e17bd20d742b14c72226caef3e0f5c56c4930071e9f9a894f18650fbb785c6f707605c86b634c9722c8690cf3a954f68d7c2db3a257339ade67a41259f6f878dd0ab7876deffa77f6f00819282a8f4c4da84c6cf4f335cd0410770a2b1a1fbb3f85f4489eeceb78bbfddb2d1866c57b41f6ed179a0bc3750a486403d23473f2feef43ebc5af1018d9c20089e277d77fb9c34f425c8f8af4c49864b57572fa8c232e61ef37194251a1ddc2f73ffecd57e638751cb72bcb2c40d22540166ca1e8588f24b010c9fbd962e3a2c23a7e93f131df61b8703ce326ed80cc87912d3c6aaa27574bbe8d65bcaecd660c31cead132a44b1d0e4a53cacc0b82a263c4e7783944af0af08ea9e68e8e25ed9111cfef841f1b2fd24164f9097f70efe09b1109e5cb91fe68a2760381fd63a7fd422dd578a60661abc9ee3a5db1c2cde2fb21f2040f1ed3fc27b99e254256949d0560e8b98fa028fca50768caa951a87bf8969af498d50a9ee773c9caa7d9f7d8e1955506013f198cda316d79b177e59f233b98f727afd2494fc18642f0015adab756ea6742690c7d00f28655b915ce4eb8b3ba2e8559ba23e1ff1ccc9f79ae2df85f924459c56715dec78ef4592352eb1a850cd65ecd36e1a9121e888586b7b2fa84da920b8cf44480433e61ab076b10171c0537524bb170a4b99b0b0c437418a665b7ef909652b6483b20362e557c1480c2a2a0efa221fc59054a48122b52d38245f9bd026001635be5b155f5c766a59306fbde231fa72b4d74449a2fe8fb969496ee26af5881adaafb4189b439877ab8f78709cfd32c10ea576a010bfc137b7a4aae137ea3d29070ce3bc8dbe6655e967115ca3461ad9d28b9cf8af07441e68a54ec5e889846f3978f07ba51f7d5af5da78c5c675dc5d0c1a4a399ff4247203573a46fb903eaf7bc886e6cbd3126fa4a3fe3bb13bbdfea7da871f6563aa750f6ad7895b34b2809563dcf5ed30f1c60cef4138aa49d4f55e396534ed10cf4d857723a2b442f47d79de162c30ec6c4daf939b4c88649494e3682d1da81b4a5928d8e18a16c46707a685305e592589acb484e28e9d5af89c44b6e563d125ec97c0155410527406d94b90bc9576a662db99da1cb82b04d610d02187ce08f22ea0e8fd31919d53fa6aaf980e31ca7f8610e695a41919c24136a8406c62d5f15fca36507002b54ece17664b5247583ad60d863f283f3c288946139575dcaedc978762e85f534e56334ef0221c34ffae054ddf79339b8f08701e9699b11041df8f518dd33203363c8098fbefb01555bcc2542422777b38d8dff11b15aadb0c251ce2c5b32f8735b3cb784f2e5731b48feb5a0e791a1106abdea0f7d1f087737cbe7fdf523fa14c9be2a2987511004c5b7ac1814ef6961db16799698242452c469a07c30e4a1f73193c74a41bdd88aef50035e4648bc9dfa276951798420a45e4085932bdb9381af3cc4678bd962af616549e4020d2c9fd25e2117a6d8934fde2218273d7833d60ea492e251417a27e7fb32012a940a6b6487af4b64958bf05f1b1107732149d227eeda5ca5a43cf583dc297d66072a1acd75e93a7caefd36a0d581e21d5cb08654c4ecef46ebac5391546e0b7d2a6418548d8f816446bcf237f676e873e6bae9107234abe5ab24c53ea472ad10653cef068fd9f4e729fc0d526e489f8df13af5575f1e70e0ec22899728b0659d70fc2dd509d9df3ec170638f89e540f4d3f02aa9b1b1819f84da596e0d7b45a5818061728f8eeccd2bea0f460dd7e18cb95f2364c50e351f0690e184eb63ebbb14a0b4b2117e44f3b2b3", 0x2000, 0x0) rt_sigprocmask(0x0, &(0x7f000078b000)={[0xfffffffffffffffd]}, 0x0, 0x8) r7 = getpid() r8 = gettid() rt_tgsigqueueinfo(r7, r8, 0xb, &(0x7f0000000080)={0x0, 0x0, 0x3}) signalfd(0xffffffffffffffff, &(0x7f00007aeff8)={[0xfffffffffffffffc]}, 0x8) read(r1, &(0x7f0000000740)=""/377, 0x179) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000001200)={0x50, 0x0, 0x0, {0x7, 0x2b, 0x0, 0x0, 0x0, 0xc5ca, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x50) setsockopt$inet_sctp6_SCTP_EVENTS(r5, 0x84, 0xb, &(0x7f00000000c0)={0xb, 0x2, 0xfe, 0x2, 0x6, 0x4, 0x3, 0x0, 0x0, 0x0, 0x3, 0x0, 0xff, 0x5}, 0xe) 5m18.211824968s ago: executing program 7 (id=1884): socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB="ff0700"/20, @ANYRES32=0x0, @ANYBLOB="00000000e6ffefffffffffff000000000000000000"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b70200000000009f7f00000000000000b7000000000000009500000000000000"], &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r4}, 0x18) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0xe, 0x4, 0x4, 0xa, 0x4}, 0x3f) io_uring_setup(0x4a86, &(0x7f0000000300)={0x0, 0x4178, 0x40, 0x8001002, 0x3d7}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) 5m16.962033408s ago: executing program 7 (id=1886): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0xe7a4}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000001000)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000002100)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002180)='blkio.bfq.io_merged\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, r1, 0x0) ftruncate(r1, 0xc17a) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000080)=0x9, 0x8, 0x2) mbind(&(0x7f00005f7000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x2, 0x0) ioctl$TIOCGWINSZ(r1, 0x5413, &(0x7f00000001c0)) creat(&(0x7f00000002c0)='./file0\x00', 0x109) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, 0x0, &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) shmat(0x0, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffcfff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r6 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r6, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000200040010000800014004000000", 0x58}], 0x1) truncate(&(0x7f0000000180)='./file0\x00', 0x8fff5) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r2, 0x0, 0x30, 0x0, @val=@uprobe_multi={0x0, &(0x7f0000000000)=[0x6], 0x0, 0x0, 0x1}}, 0x40) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) 5m15.705738083s ago: executing program 7 (id=1888): openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) r0 = socket$isdn_base(0x22, 0x3, 0x0) bind$isdn_base(r0, &(0x7f0000000040)={0x22, 0x20, 0x9, 0x8, 0xea}, 0x6) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f00000001c0)={0x1ff, 0x0, 0x0, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000100)=ANY=[@ANYBLOB="0100000000000000014d564b0000000001"]) mprotect(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0xa) 5m15.586273511s ago: executing program 7 (id=1889): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001c00)=@newtaction={0x4c, 0x1e, 0x109, 0x102, 0x25dfdbfc, {}, [{0x38, 0x1, [@m_mirred={0x34, 0x8, 0x0, 0x0, {{0xb, 0x9}, {0x4}, {0x6, 0x6, "ab24"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x4c}, 0x1, 0x2b1e}, 0x2000c000) (fail_nth: 4) 5m14.63696652s ago: executing program 7 (id=1890): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f00000001c0), 0x103a02, 0x0) ioctl$RTC_SET_TIME(r1, 0x4024700a, &(0x7f0000000640)={0x32, 0x4000020, 0x7, 0x418, 0x9, 0x98da, 0x4, 0x3d}) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000380), 0x101040) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r2, 0x54a2) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'ip6_vti0\x00', 0x0}) r4 = open(&(0x7f0000000180)='./bus\x00', 0x14507e, 0x0) r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r5}, &(0x7f0000000280), &(0x7f00000002c0)=r4}, 0x20) pipe(&(0x7f00000011c0)={0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r7, &(0x7f0000000140)={0x2, 0x0, @local}, 0x10) connect$inet(r7, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r6, 0x0, r7, 0x0, 0x2000000002ffff, 0x0) socket$nl_sock_diag(0x10, 0x3, 0x4) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x200003, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@bloom_filter={0x1e, 0x3, 0x7, 0x6, 0x40002, r4, 0x5, '\x00', r3, r6, 0x3, 0x0, 0x0, 0x3}, 0x50) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x36, &(0x7f0000000580)={&(0x7f0000000240)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x10000000, 0x0, {0x0, 0x0, 0x0, r3, {0xffee}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_STAB={0x4}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x40010) 4m59.288976465s ago: executing program 39 (id=1890): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f00000001c0), 0x103a02, 0x0) ioctl$RTC_SET_TIME(r1, 0x4024700a, &(0x7f0000000640)={0x32, 0x4000020, 0x7, 0x418, 0x9, 0x98da, 0x4, 0x3d}) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000380), 0x101040) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r2, 0x54a2) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'ip6_vti0\x00', 0x0}) r4 = open(&(0x7f0000000180)='./bus\x00', 0x14507e, 0x0) r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r5}, &(0x7f0000000280), &(0x7f00000002c0)=r4}, 0x20) pipe(&(0x7f00000011c0)={0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r7, &(0x7f0000000140)={0x2, 0x0, @local}, 0x10) connect$inet(r7, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r6, 0x0, r7, 0x0, 0x2000000002ffff, 0x0) socket$nl_sock_diag(0x10, 0x3, 0x4) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x200003, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@bloom_filter={0x1e, 0x3, 0x7, 0x6, 0x40002, r4, 0x5, '\x00', r3, r6, 0x3, 0x0, 0x0, 0x3}, 0x50) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x36, &(0x7f0000000580)={&(0x7f0000000240)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x10000000, 0x0, {0x0, 0x0, 0x0, r3, {0xffee}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_STAB={0x4}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x40010) 27.052697203s ago: executing program 8 (id=2140): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x69703000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14, 0x10, 0x1, 0x2000000}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELCHAIN={0x4c, 0x5, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x2000}, [@NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x20, 0x4, 0x0, 0x1, [@NFTA_HOOK_DEV={0x14, 0x3, 'veth1_macvtap\x00'}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x5}]}]}], {0x14}}, 0xc0}}, 0x0) 25.528883214s ago: executing program 8 (id=2141): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000080)=0xa0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000000)={@my=0x0}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x5, &(0x7f0000000000)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x23}, @call={0x85, 0x0, 0x0, 0xa0}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x43, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7fff}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x40001e0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, 0x0) syz_open_dev$loop(0x0, 0x47ffffa, 0x60500) getcwd(0x0, 0x0) r4 = epoll_create(0x3ff) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r0, &(0x7f0000000180)={0x20000008}) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r0, 0x7ab, &(0x7f0000000280)={0x0}) 22.492136566s ago: executing program 8 (id=2142): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002b80)=ANY=[@ANYBLOB="680000000206030000000000000000000000007c05000500030000003c000780180001801400024000000000000000000000000000000001080009400000040005001500a7000000080013400000010008000940000006b00500050002000000050004002000000027da7143903de8d869aedb28055124b67897850e122127d2804ae233c60651b31fea20adad33c0"], 0x68}}, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000002000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x104}, 0x94) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r0, 0x0, 0xd}, 0x18) sched_setscheduler(0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = syz_io_uring_setup(0x10d2, &(0x7f0000000540)={0x0, 0x7734, 0x80, 0x0, 0x34f}, &(0x7f0000000600)=0x0, &(0x7f00000005c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, 0x0, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_RECVMSG={0xa, 0x4, 0x1cd83f7c25e05491, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x103, 0x1}) io_uring_enter(r2, 0x47bc, 0x0, 0x2, 0x0, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r6 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) flock(r1, 0x5) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000480)={0x4, r5}) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000002dc0)={0x6, 0xf, &(0x7f0000002c40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}, {}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r9, 0x0, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) r10 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), 0xffffffffffffffff) recvmmsg(r6, &(0x7f0000000140)=[{{0x0, 0x0, &(0x7f0000002a80)=[{&(0x7f0000000340)=""/242, 0xf2}, {&(0x7f0000000880)=""/253, 0xfd}, {&(0x7f0000000780)=""/147, 0x93}, {&(0x7f0000000980)=""/4096, 0x1000}, {&(0x7f0000001980)=""/4096, 0x1000}, {&(0x7f0000000100)=""/27, 0x1b}, {&(0x7f0000002980)=""/124, 0x7c}, {&(0x7f0000002a00)=""/84, 0x54}], 0x8, &(0x7f0000002b00)=""/86, 0x56}, 0x1ff}], 0x1, 0x2, &(0x7f0000000280)={0x77359400}) sendmsg$L2TP_CMD_SESSION_GET(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000300)={0x30, r10, 0x801, 0x70bd29, 0x0, {0x7}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x9}, @L2TP_ATTR_IFNAME={0x14}]}, 0x30}}, 0x0) sendmmsg$inet(r6, &(0x7f0000003940)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4000004) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000)=0x2eb4, 0x2000007ff) r11 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r11, &(0x7f0000000240)="d3aa4b68854c7a4b23c40ab215ec518a50d1f072aac9ae601a8ab9ac35bbb74a1feb2974ed33643891", 0x29, 0x4008891, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x2}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r11, 0x84, 0xb, &(0x7f00000000c0)={0xb, 0x2, 0xfe, 0x2, 0x6, 0x4, 0x3, 0x0, 0x0, 0x0, 0x3, 0xb, 0xff, 0x5}, 0xe) shutdown(r11, 0x1) recvmmsg(r11, &(0x7f0000000840)=[{{0x0, 0x0, 0x0}}], 0x414, 0x0, 0x0) 20.707481872s ago: executing program 8 (id=2143): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1181}) bpf$PROG_LOAD(0x5, &(0x7f00000029c0)={0x14, 0x0, &(0x7f0000000080), &(0x7f0000000240)='GPL\x00', 0x7, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x80000001}, 0x94) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000640)={0x10, 0x0, &(0x7f0000000380)=[@request_death={0x400c6313}], 0x0, 0x0, 0x0}) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x2000001, 0x6031, 0xffffffffffffffff, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000000)=@arm64={0x8, 0x5, 0x2, '\x00', 0x2}) 19.591321477s ago: executing program 8 (id=2144): openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x4, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) syz_emit_ethernet(0x3a, &(0x7f0000000500)=ANY=[], 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0xfffffffffffffffe) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r1 = socket(0x11, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="4c0000001000010025bd7000fddbdf2500000000", @ANYRES32=r4, @ANYBLOB="10080400895504002c001280110001006272696467655f736c6176650000000014000580050028"], 0x4c}, 0x1, 0x0, 0x0, 0x200404c1}, 0x4040010) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x15, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) keyctl$dh_compute(0x17, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) setresgid(0x0, 0xee01, 0xffffffffffffffff) r5 = gettid() rt_sigtimedwait(&(0x7f0000000040)={[0xffffffff]}, 0x0, 0x0, 0x8) timer_create(0x2, &(0x7f0000000180)={0x0, 0x4, 0x4, @tid=r5}, &(0x7f0000000140)) timer_settime(0x0, 0xe54aef35e9c2845d, &(0x7f000006b000)={{}, {0x0, 0x9}}, 0x0) openat(0xffffffffffffff9c, 0x0, 0x250942, 0x1cd) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r6, 0x8982, 0x0) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000240)={0x0, @remote, @remote}, 0x0) 16.6886777s ago: executing program 8 (id=2145): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/custom1\x00', 0x802, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$MAP_CREATE(0x0, 0x0, 0x50) semctl$IPC_STAT(0x0, 0x0, 0x2, 0x0) mount$afs(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000200)=ANY=[]) renameat2(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0xffffffffffffff9c, 0x0, 0x2) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) bind$can_j1939(r1, 0x0, 0x0) sendmmsg(r1, &(0x7f0000003e00)=[{{&(0x7f00000002c0)=@can={0x1d, r2}, 0x80, 0x0}}], 0x1, 0x8084) socket$nl_netfilter(0x10, 0x3, 0xc) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000002080)={0xfc, {"a2336848149e516d4b5e071887f70e09d038e7ff7fc6e5539b0d500a8b089b3f383563030890e0879b0a71c6e70a9b334a959b669a242f0a0af3988f7ef319520100ffe8d178708c523c921b1b3e31070d0773090acd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9903f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928d28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f2730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b81305c038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849cd9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484539ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1f93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb8843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b2804563407308c58c89d9e99c81769177e6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463373b4b87c9050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e080000007ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e3933ed07c2b8081c128ad2706f48261ff07000000000000613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59500000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) ioctl$VIDIOC_SUBSCRIBE_EVENT(0xffffffffffffffff, 0x4020565a, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x3c}}, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) writev(r4, &(0x7f0000000200)=[{&(0x7f00000000c0)='X', 0x8030000}], 0x1) r5 = syz_open_dev$usbmon(&(0x7f0000000240), 0x8, 0x0) ioctl$MON_IOCT_RING_SIZE(r5, 0x9204, 0xc397e) add_key$user(&(0x7f0000000000), &(0x7f0000000100)={'syz', 0x2}, &(0x7f0000000080)="01", 0x1, 0xffffffffffffffff) add_key$user(&(0x7f0000000140), &(0x7f0000002840)={'syz', 0x0}, &(0x7f0000002880)="f40fc24077021c9b084c60ffc26f26db12b9e78d629870bb26edb4a5e1cc0942ed8c58ca4fe84b94a0e31ea64089ee9ca1efb52945ffebbfea11dd3d0df936a10285eccab940ab5c96cb5d81dac1ad2243d878dde6cfd6ea08d5abcb00bb35436929ddabce530b63fab525337057438cf64a506d54d5c83e3e593d1d53ad0e6a44168fe8cfc6ad98b653d80636e4ddc1f2ab58762b3494250b9557f5b606a43e50874c90143034142cd5f7bd9b4dd876b97b7feb", 0xb4, 0xfffffffffffffffb) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000040)="4dc07f947163300c", 0x8) 0s ago: executing program 40 (id=2145): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/custom1\x00', 0x802, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$MAP_CREATE(0x0, 0x0, 0x50) semctl$IPC_STAT(0x0, 0x0, 0x2, 0x0) mount$afs(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000200)=ANY=[]) renameat2(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0xffffffffffffff9c, 0x0, 0x2) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) bind$can_j1939(r1, 0x0, 0x0) sendmmsg(r1, &(0x7f0000003e00)=[{{&(0x7f00000002c0)=@can={0x1d, r2}, 0x80, 0x0}}], 0x1, 0x8084) socket$nl_netfilter(0x10, 0x3, 0xc) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000002080)={0xfc, {"a2336848149e516d4b5e071887f70e09d038e7ff7fc6e5539b0d500a8b089b3f383563030890e0879b0a71c6e70a9b334a959b669a242f0a0af3988f7ef319520100ffe8d178708c523c921b1b3e31070d0773090acd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9903f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928d28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f2730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b81305c038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849cd9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484539ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1f93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb8843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b2804563407308c58c89d9e99c81769177e6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463373b4b87c9050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e080000007ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e3933ed07c2b8081c128ad2706f48261ff07000000000000613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59500000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) ioctl$VIDIOC_SUBSCRIBE_EVENT(0xffffffffffffffff, 0x4020565a, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x3c}}, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) writev(r4, &(0x7f0000000200)=[{&(0x7f00000000c0)='X', 0x8030000}], 0x1) r5 = syz_open_dev$usbmon(&(0x7f0000000240), 0x8, 0x0) ioctl$MON_IOCT_RING_SIZE(r5, 0x9204, 0xc397e) add_key$user(&(0x7f0000000000), &(0x7f0000000100)={'syz', 0x2}, &(0x7f0000000080)="01", 0x1, 0xffffffffffffffff) add_key$user(&(0x7f0000000140), &(0x7f0000002840)={'syz', 0x0}, &(0x7f0000002880)="f40fc24077021c9b084c60ffc26f26db12b9e78d629870bb26edb4a5e1cc0942ed8c58ca4fe84b94a0e31ea64089ee9ca1efb52945ffebbfea11dd3d0df936a10285eccab940ab5c96cb5d81dac1ad2243d878dde6cfd6ea08d5abcb00bb35436929ddabce530b63fab525337057438cf64a506d54d5c83e3e593d1d53ad0e6a44168fe8cfc6ad98b653d80636e4ddc1f2ab58762b3494250b9557f5b606a43e50874c90143034142cd5f7bd9b4dd876b97b7feb", 0xb4, 0xfffffffffffffffb) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000040)="4dc07f947163300c", 0x8) kernel console output (not intermixed with test programs): er 107 [ 1637.818764][T15644] udevd[15644]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1638.088413][T15415] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1638.109329][T15423] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1638.114064][T15479] bridge0: port 1(bridge_slave_0) entered blocking state [ 1638.114204][T15479] bridge0: port 1(bridge_slave_0) entered disabled state [ 1638.114797][T15479] bridge_slave_0: entered allmulticast mode [ 1638.122126][T15479] bridge_slave_0: entered promiscuous mode [ 1638.134633][T15415] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1638.153481][T15423] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1638.276454][T15479] bridge0: port 2(bridge_slave_1) entered blocking state [ 1638.276605][T15479] bridge0: port 2(bridge_slave_1) entered disabled state [ 1638.276855][T15479] bridge_slave_1: entered allmulticast mode [ 1638.279862][T15479] bridge_slave_1: entered promiscuous mode [ 1638.507479][T15662] Invalid logical block size (8192) [ 1639.323320][T15415] team0: Port device team_slave_0 added [ 1639.326327][T15669] FAULT_INJECTION: forcing a failure. [ 1639.326327][T15669] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1639.326359][T15669] CPU: 0 UID: 0 PID: 15669 Comm: syz.8.1928 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1639.326380][T15669] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1639.326392][T15669] Call Trace: [ 1639.326399][T15669] [ 1639.326408][T15669] dump_stack_lvl+0x189/0x250 [ 1639.326435][T15669] ? __pfx____ratelimit+0x10/0x10 [ 1639.326460][T15669] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1639.326483][T15669] ? __pfx__printk+0x10/0x10 [ 1639.326515][T15669] should_fail_ex+0x46c/0x600 [ 1639.326544][T15669] _copy_to_user+0x31/0xb0 [ 1639.326569][T15669] video_usercopy+0xeb2/0x14f0 [ 1639.326598][T15669] ? __pfx___video_do_ioctl+0x10/0x10 [ 1639.326616][T15669] ? __pfx_video_usercopy+0x10/0x10 [ 1639.326632][T15669] ? smack_file_ioctl+0x2ac/0x340 [ 1639.326668][T15669] ? __fget_files+0x2a/0x420 [ 1639.326690][T15669] ? __fget_files+0x3a6/0x420 [ 1639.326716][T15669] v4l2_ioctl+0x190/0x1e0 [ 1639.326743][T15669] ? __pfx_v4l2_ioctl+0x10/0x10 [ 1639.326765][T15669] __se_sys_ioctl+0xff/0x170 [ 1639.326787][T15669] do_syscall_64+0xfa/0x3b0 [ 1639.326803][T15669] ? lockdep_hardirqs_on+0x9c/0x150 [ 1639.326827][T15669] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1639.326844][T15669] ? clear_bhb_loop+0x60/0xb0 [ 1639.326867][T15669] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1639.326883][T15669] RIP: 0033:0x7ff31ff2ec29 [ 1639.326900][T15669] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1639.326916][T15669] RSP: 002b:00007ff31e18e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1639.326936][T15669] RAX: ffffffffffffffda RBX: 00007ff320175fa0 RCX: 00007ff31ff2ec29 [ 1639.326950][T15669] RDX: 00002000000000c0 RSI: 00000000c0405602 RDI: 0000000000000003 [ 1639.326962][T15669] RBP: 00007ff31e18e090 R08: 0000000000000000 R09: 0000000000000000 [ 1639.326975][T15669] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1639.326986][T15669] R13: 00007ff320176038 R14: 00007ff320175fa0 R15: 00007fffff11c718 [ 1639.327016][T15669] [ 1639.327049][T15423] team0: Port device team_slave_0 added [ 1639.445180][T15479] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1639.466092][T15415] team0: Port device team_slave_1 added [ 1639.485671][T15423] team0: Port device team_slave_1 added [ 1639.652365][ T5907] usb 9-1: new high-speed USB device number 108 using dummy_hcd [ 1639.677548][T15479] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1640.891024][T15681] Invalid source name [ 1640.891043][T15681] UBIFS error (pid: 15681): cannot open "./file0", error -22 [ 1641.392377][T15570] bridge0: port 1(bridge_slave_0) entered blocking state [ 1641.392524][T15570] bridge0: port 1(bridge_slave_0) entered disabled state [ 1641.392791][T15570] bridge_slave_0: entered allmulticast mode [ 1641.396423][T15570] bridge_slave_0: entered promiscuous mode [ 1641.432116][ T5907] usb 9-1: new full-speed USB device number 109 using dummy_hcd [ 1641.505095][T15423] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1641.505112][T15423] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1641.505138][T15423] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1641.507737][T15415] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1641.507751][T15415] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1641.507776][T15415] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1641.584494][ T5907] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1641.584521][ T5907] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1641.587780][ T5907] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1641.587808][ T5907] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1641.587828][ T5907] usb 9-1: Product: syz [ 1641.587843][ T5907] usb 9-1: Manufacturer: syz [ 1641.587857][ T5907] usb 9-1: SerialNumber: syz [ 1641.768158][T15570] bridge0: port 2(bridge_slave_1) entered blocking state [ 1641.768484][T15570] bridge0: port 2(bridge_slave_1) entered disabled state [ 1641.768843][T15570] bridge_slave_1: entered allmulticast mode [ 1641.780528][T15570] bridge_slave_1: entered promiscuous mode [ 1641.788330][T15479] team0: Port device team_slave_0 added [ 1641.796505][T15423] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1641.796522][T15423] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1641.796933][T15423] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1641.803935][T15415] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1641.803951][T15415] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1641.803975][T15415] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1641.843872][ T5907] usb 9-1: 0:2 : does not exist [ 1641.855003][ T5907] usb 9-1: 5:0: failed to get current value for ch 0 (-22) [ 1641.902517][ T5907] usb 9-1: USB disconnect, device number 109 [ 1642.007917][T15644] udevd[15644]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1642.146695][T15479] team0: Port device team_slave_1 added [ 1642.447308][T15570] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1642.630338][T15570] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1642.631070][T15479] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1642.631082][T15479] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1642.631106][T15479] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1643.068413][T15479] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1643.068428][T15479] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1643.068453][T15479] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1643.411592][T15423] hsr_slave_0: entered promiscuous mode [ 1643.413866][T15423] hsr_slave_1: entered promiscuous mode [ 1643.651661][T15415] hsr_slave_0: entered promiscuous mode [ 1643.655771][T15415] hsr_slave_1: entered promiscuous mode [ 1643.656840][T15415] debugfs: 'hsr0' already exists in 'hsr' [ 1643.656864][T15415] Cannot create hsr debugfs directory [ 1643.758186][T15570] team0: Port device team_slave_0 added [ 1643.866387][T15570] team0: Port device team_slave_1 added [ 1645.351300][T15696] FAULT_INJECTION: forcing a failure. [ 1645.351300][T15696] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1645.351335][T15696] CPU: 0 UID: 0 PID: 15696 Comm: syz.8.1935 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1645.351358][T15696] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1645.351369][T15696] Call Trace: [ 1645.351377][T15696] [ 1645.351386][T15696] dump_stack_lvl+0x189/0x250 [ 1645.351415][T15696] ? __pfx____ratelimit+0x10/0x10 [ 1645.351442][T15696] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1645.351466][T15696] ? __pfx__printk+0x10/0x10 [ 1645.351500][T15696] should_fail_ex+0x46c/0x600 [ 1645.351530][T15696] _copy_from_user+0x2d/0xb0 [ 1645.351554][T15696] bpf_test_init+0xf8/0x170 [ 1645.351581][T15696] bpf_prog_test_run_xdp+0x37c/0x1000 [ 1645.351622][T15696] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1645.351651][T15696] ? __fget_files+0x2a/0x420 [ 1645.351680][T15696] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 1645.351705][T15696] bpf_prog_test_run+0x2ca/0x340 [ 1645.351735][T15696] __sys_bpf+0x581/0x870 [ 1645.351754][T15696] ? __pfx___sys_bpf+0x10/0x10 [ 1645.351784][T15696] ? ksys_write+0x230/0x260 [ 1645.351806][T15696] ? __pfx_ksys_write+0x10/0x10 [ 1645.351823][T15696] ? rcu_is_watching+0x15/0xb0 [ 1645.351852][T15696] __x64_sys_bpf+0x7c/0x90 [ 1645.351871][T15696] do_syscall_64+0xfa/0x3b0 [ 1645.351886][T15696] ? lockdep_hardirqs_on+0x9c/0x150 [ 1645.351909][T15696] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1645.351928][T15696] ? clear_bhb_loop+0x60/0xb0 [ 1645.351950][T15696] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1645.351968][T15696] RIP: 0033:0x7ff31ff2ec29 [ 1645.351985][T15696] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1645.352001][T15696] RSP: 002b:00007ff31e18e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1645.352021][T15696] RAX: ffffffffffffffda RBX: 00007ff320175fa0 RCX: 00007ff31ff2ec29 [ 1645.352036][T15696] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 1645.352048][T15696] RBP: 00007ff31e18e090 R08: 0000000000000000 R09: 0000000000000000 [ 1645.352061][T15696] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1645.352071][T15696] R13: 00007ff320176038 R14: 00007ff320175fa0 R15: 00007fffff11c718 [ 1645.352102][T15696] [ 1646.818132][T15479] hsr_slave_0: entered promiscuous mode [ 1646.831497][T15479] hsr_slave_1: entered promiscuous mode [ 1646.842192][T15479] debugfs: 'hsr0' already exists in 'hsr' [ 1646.842221][T15479] Cannot create hsr debugfs directory [ 1646.968278][T15570] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1646.968289][T15570] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1646.968303][T15570] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1647.091706][T15570] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1647.091722][T15570] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1647.092731][T15570] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1647.123177][ T1238] usb 9-1: new high-speed USB device number 110 using dummy_hcd [ 1647.281975][ T1238] usb 9-1: Using ep0 maxpacket: 32 [ 1647.284463][ T1238] usb 9-1: config 0 has an invalid interface number: 132 but max is 0 [ 1647.284489][ T1238] usb 9-1: config 0 has no interface number 0 [ 1647.284537][ T1238] usb 9-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1647.288892][ T1238] usb 9-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 1647.288921][ T1238] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1647.288942][ T1238] usb 9-1: Product: syz [ 1647.288956][ T1238] usb 9-1: Manufacturer: syz [ 1647.288972][ T1238] usb 9-1: SerialNumber: syz [ 1647.303660][ T1238] usb 9-1: config 0 descriptor?? [ 1647.327514][ T1238] em28xx 9-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 1647.327565][ T1238] em28xx 9-1:0.132: Video interface 132 found: [ 1648.648369][ T1238] em28xx 9-1:0.132: unknown em28xx chip ID (0) [ 1648.740839][ T1238] em28xx 9-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5) [ 1648.740889][ T1238] em28xx 9-1:0.132: board has no eeprom [ 1648.812176][ T1238] em28xx 9-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 1648.812219][ T1238] em28xx 9-1:0.132: analog set to bulk mode. [ 1648.815611][ T5928] em28xx 9-1:0.132: Registering V4L2 extension [ 1649.188623][ T5928] em28xx 9-1:0.132: failed to trigger read from i2c address 0x4a (error=-5) [ 1649.190005][ T5928] em28xx 9-1:0.132: failed to trigger read from i2c address 0x48 (error=-5) [ 1649.190453][ T5928] em28xx 9-1:0.132: failed to trigger read from i2c address 0x42 (error=-5) [ 1649.191512][ T5928] em28xx 9-1:0.132: failed to trigger read from i2c address 0x40 (error=-5) [ 1649.384126][T15570] hsr_slave_0: entered promiscuous mode [ 1649.388125][T15570] hsr_slave_1: entered promiscuous mode [ 1649.394442][T15570] debugfs: 'hsr0' already exists in 'hsr' [ 1649.394472][T15570] Cannot create hsr debugfs directory [ 1649.466824][ T5928] em28xx 9-1:0.132: failed to trigger read from i2c address 0x84 (error=-5) [ 1649.480883][ T5928] em28xx 9-1:0.132: failed to trigger read from i2c address 0x86 (error=-5) [ 1649.491249][ T5928] em28xx 9-1:0.132: failed to trigger read from i2c address 0x94 (error=-5) [ 1649.500682][ T5928] em28xx 9-1:0.132: failed to trigger read from i2c address 0x96 (error=-5) [ 1649.704007][T11963] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1649.720199][T11963] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1649.752458][ T5848] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1649.752578][ T5928] em28xx 9-1:0.132: failed to trigger read from i2c address 0xc0 (error=-5) [ 1649.777902][ T5848] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1649.781376][ T5848] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1649.807198][ T5928] em28xx 9-1:0.132: failed to trigger read from i2c address 0xc2 (error=-5) [ 1649.811374][ T5928] em28xx 9-1:0.132: failed to trigger read from i2c address 0xc4 (error=-5) [ 1649.832303][ T5928] em28xx 9-1:0.132: failed to trigger read from i2c address 0xc6 (error=-5) [ 1649.833888][ T5928] em28xx 9-1:0.132: failed to trigger read from i2c address 0xc8 (error=-5) [ 1649.864906][ T5928] em28xx 9-1:0.132: Config register raw data: 0xfffffffb [ 1649.867744][ T5928] em28xx 9-1:0.132: AC97 chip type couldn't be determined [ 1649.867771][ T5928] em28xx 9-1:0.132: No AC97 audio processor [ 1649.984236][ T5928] usb 9-1: Decoder not found [ 1649.984255][ T5928] em28xx 9-1:0.132: failed to create media graph [ 1649.984319][ T5928] em28xx 9-1:0.132: V4L2 device video103 deregistered [ 1650.046010][ T5928] em28xx 9-1:0.132: Remote control support is not available for this card. [ 1651.013665][T10445] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1651.091554][ T5848] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1651.124212][ T5848] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1651.129338][ T5848] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1651.148699][ T5848] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1651.151379][ T10] usb 9-1: USB disconnect, device number 110 [ 1651.153831][ T10] em28xx 9-1:0.132: Disconnecting em28xx [ 1651.154447][ T10] em28xx 9-1:0.132: Closing input extension [ 1651.177231][ T5848] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1651.446691][ T10] em28xx 9-1:0.132: Freeing device [ 1651.760826][T10445] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1651.832211][ T10] usb 9-1: new high-speed USB device number 111 using dummy_hcd [ 1651.891958][T14260] Bluetooth: hci0: command tx timeout [ 1651.982369][ T10] usb 9-1: Using ep0 maxpacket: 32 [ 1651.985620][ T10] usb 9-1: config 0 has an invalid interface number: 1 but max is 0 [ 1651.985647][ T10] usb 9-1: config 0 has no interface number 0 [ 1651.985698][ T10] usb 9-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1651.985724][ T10] usb 9-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1651.985763][ T10] usb 9-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1651.985787][ T10] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1651.991212][ T10] usb 9-1: config 0 descriptor?? [ 1652.177592][T10445] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1652.466648][ T10] ft260 0003:0403:6030.0005: unknown main item tag 0x0 [ 1652.466686][ T10] ft260 0003:0403:6030.0005: unknown main item tag 0x0 [ 1652.727933][ T10] ft260 0003:0403:6030.0005: failed to retrieve chip version [ 1652.728428][ T10] ft260 0003:0403:6030.0005: probe with driver ft260 failed with error -71 [ 1652.789115][ T10] usb 9-1: USB disconnect, device number 111 [ 1652.850106][T10445] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1653.347959][T14260] Bluetooth: hci3: command tx timeout [ 1653.983120][T14260] Bluetooth: hci0: command tx timeout [ 1655.493093][T14260] Bluetooth: hci3: command tx timeout [ 1656.052027][T14260] Bluetooth: hci0: command tx timeout [ 1656.130090][T10445] bridge_slave_1: left allmulticast mode [ 1656.130125][T10445] bridge_slave_1: left promiscuous mode [ 1656.130391][T10445] bridge0: port 2(bridge_slave_1) entered disabled state [ 1656.245162][T10445] bridge_slave_0: left allmulticast mode [ 1656.245197][T10445] bridge_slave_0: left promiscuous mode [ 1656.245480][T10445] bridge0: port 1(bridge_slave_0) entered disabled state [ 1656.326564][T10445] bridge_slave_1: left allmulticast mode [ 1656.326598][T10445] bridge_slave_1: left promiscuous mode [ 1656.326853][T10445] bridge0: port 2(bridge_slave_1) entered disabled state [ 1656.382872][T10445] bridge_slave_0: left allmulticast mode [ 1656.382895][T10445] bridge_slave_0: left promiscuous mode [ 1656.383069][T10445] bridge0: port 1(bridge_slave_0) entered disabled state [ 1656.383337][ T5928] usb 9-1: new high-speed USB device number 112 using dummy_hcd [ 1656.455610][T10445] bridge_slave_1: left allmulticast mode [ 1656.455634][T10445] bridge_slave_1: left promiscuous mode [ 1656.455798][T10445] bridge0: port 2(bridge_slave_1) entered disabled state [ 1656.513250][T10445] bridge_slave_0: left allmulticast mode [ 1656.513285][T10445] bridge_slave_0: left promiscuous mode [ 1656.513466][T10445] bridge0: port 1(bridge_slave_0) entered disabled state [ 1656.531994][ T5928] usb 9-1: Using ep0 maxpacket: 32 [ 1656.535557][ T5928] usb 9-1: config 0 has an invalid interface number: 51 but max is 0 [ 1656.535584][ T5928] usb 9-1: config 0 has no interface number 0 [ 1656.535633][ T5928] usb 9-1: config 0 interface 51 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1656.540214][ T5928] usb 9-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1656.540243][ T5928] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1656.540263][ T5928] usb 9-1: Product: syz [ 1656.540277][ T5928] usb 9-1: Manufacturer: syz [ 1656.540291][ T5928] usb 9-1: SerialNumber: syz [ 1656.560202][ T5928] usb 9-1: config 0 descriptor?? [ 1656.582252][ T5928] quatech2 9-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1656.676020][T10445] bridge_slave_1: left allmulticast mode [ 1656.676046][T10445] bridge_slave_1: left promiscuous mode [ 1656.676276][T10445] bridge0: port 2(bridge_slave_1) entered disabled state [ 1656.743362][T10445] bridge_slave_0: left allmulticast mode [ 1656.743386][T10445] bridge_slave_0: left promiscuous mode [ 1656.743617][T10445] bridge0: port 1(bridge_slave_0) entered disabled state [ 1657.182740][T15742] netlink: 5128 bytes leftover after parsing attributes in process `syz.8.1942'. [ 1657.183536][T15742] netlink: 5128 bytes leftover after parsing attributes in process `syz.8.1942'. [ 1657.183576][T15742] netlink: 640 bytes leftover after parsing attributes in process `syz.8.1942'. [ 1657.576582][T14260] Bluetooth: hci3: command tx timeout [ 1658.132015][T14260] Bluetooth: hci0: command tx timeout [ 1658.803870][T10445] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1658.903317][T10445] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1658.997988][T10445] bond0 (unregistering): Released all slaves [ 1659.273481][ T5928] usb 9-1: qt2_attach - failed to power on unit: -71 [ 1659.273647][ T5928] quatech2 9-1:0.51: probe with driver quatech2 failed with error -71 [ 1659.328097][ T5928] usb 9-1: USB disconnect, device number 112 [ 1659.652000][T14260] Bluetooth: hci3: command tx timeout [ 1659.684232][T10445] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1659.764059][T10445] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1659.810201][ T5848] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1659.823345][ T5928] usb 9-1: new high-speed USB device number 113 using dummy_hcd [ 1659.825579][ T5848] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1659.838367][ T5848] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1659.852673][ T5848] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1659.855288][ T5848] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1659.912985][T10445] bond0 (unregistering): Released all slaves [ 1659.991955][ T5928] usb 9-1: Using ep0 maxpacket: 32 [ 1659.995501][ T5928] usb 9-1: config 0 has an invalid interface number: 51 but max is 0 [ 1659.995530][ T5928] usb 9-1: config 0 has no interface number 0 [ 1659.995576][ T5928] usb 9-1: config 0 interface 51 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1660.012408][ T5928] usb 9-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1660.012438][ T5928] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1660.012459][ T5928] usb 9-1: Product: syz [ 1660.012473][ T5928] usb 9-1: Manufacturer: syz [ 1660.012487][ T5928] usb 9-1: SerialNumber: syz [ 1660.057467][ T5928] usb 9-1: config 0 descriptor?? [ 1660.061315][ T5928] quatech2 9-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1660.695998][T15751] netlink: 5128 bytes leftover after parsing attributes in process `syz.8.1944'. [ 1660.696801][T15751] netlink: 5128 bytes leftover after parsing attributes in process `syz.8.1944'. [ 1660.696842][T15751] netlink: 640 bytes leftover after parsing attributes in process `syz.8.1944'. [ 1661.999529][T14260] Bluetooth: hci4: command tx timeout [ 1662.585386][ T5928] usb 9-1: qt2_attach - failed to power on unit: -71 [ 1662.585573][ T5928] quatech2 9-1:0.51: probe with driver quatech2 failed with error -71 [ 1662.598199][ T5928] usb 9-1: USB disconnect, device number 113 [ 1663.061946][ T10] usb 9-1: new high-speed USB device number 114 using dummy_hcd [ 1663.231976][ T10] usb 9-1: Using ep0 maxpacket: 16 [ 1663.236408][ T10] usb 9-1: config 0 has an invalid interface number: 41 but max is 0 [ 1663.236435][ T10] usb 9-1: config 0 has no interface number 0 [ 1663.236466][ T10] usb 9-1: config 0 interface 41 has no altsetting 0 [ 1663.239546][ T10] usb 9-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 1663.239575][ T10] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1663.239594][ T10] usb 9-1: Product: syz [ 1663.239610][ T10] usb 9-1: Manufacturer: syz [ 1663.239625][ T10] usb 9-1: SerialNumber: syz [ 1663.245457][ T10] usb 9-1: config 0 descriptor?? [ 1663.352038][ T10] CoreChips 9-1:0.41: probe with driver CoreChips failed with error -22 [ 1663.694199][T10445] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1663.773651][T10445] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1663.796962][T10445] bond0 (unregistering): Released all slaves [ 1664.051849][T14260] Bluetooth: hci4: command tx timeout [ 1664.094404][T10445] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1664.204238][T10445] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1664.276450][T10445] bond0 (unregistering): Released all slaves [ 1664.388919][T15753] geneve2: entered promiscuous mode [ 1664.388950][T15753] geneve2: entered allmulticast mode [ 1665.307620][T15715] chnl_net:caif_netlink_parms(): no params data found [ 1665.315281][T10445] tipc: Left network mode [ 1665.382737][T15719] chnl_net:caif_netlink_parms(): no params data found [ 1666.055826][ T5929] usb 9-1: USB disconnect, device number 114 [ 1666.151244][T14260] Bluetooth: hci4: command tx timeout [ 1667.647765][T15715] bridge0: port 1(bridge_slave_0) entered blocking state [ 1667.649162][T15715] bridge0: port 1(bridge_slave_0) entered disabled state [ 1667.649394][T15715] bridge_slave_0: entered allmulticast mode [ 1667.676091][T15715] bridge_slave_0: entered promiscuous mode [ 1667.837283][T15715] bridge0: port 2(bridge_slave_1) entered blocking state [ 1667.837449][T15715] bridge0: port 2(bridge_slave_1) entered disabled state [ 1667.837704][T15715] bridge_slave_1: entered allmulticast mode [ 1667.840558][T15715] bridge_slave_1: entered promiscuous mode [ 1667.858127][T15719] bridge0: port 1(bridge_slave_0) entered blocking state [ 1667.858263][T15719] bridge0: port 1(bridge_slave_0) entered disabled state [ 1667.858521][T15719] bridge_slave_0: entered allmulticast mode [ 1667.861163][T15719] bridge_slave_0: entered promiscuous mode [ 1668.037312][T15719] bridge0: port 2(bridge_slave_1) entered blocking state [ 1668.037419][T15719] bridge0: port 2(bridge_slave_1) entered disabled state [ 1668.037621][T15719] bridge_slave_1: entered allmulticast mode [ 1668.039262][T15719] bridge_slave_1: entered promiscuous mode [ 1668.162025][ T1238] usb 9-1: new high-speed USB device number 115 using dummy_hcd [ 1668.211967][T14260] Bluetooth: hci4: command tx timeout [ 1668.291533][T15715] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1668.311976][ T1238] usb 9-1: Using ep0 maxpacket: 16 [ 1668.316590][ T1238] usb 9-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1668.316624][ T1238] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1668.316644][ T1238] usb 9-1: Product: syz [ 1668.316658][ T1238] usb 9-1: Manufacturer: syz [ 1668.316672][ T1238] usb 9-1: SerialNumber: syz [ 1668.368140][ T1238] r8152-cfgselector 9-1: Unknown version 0x0000 [ 1668.368172][ T1238] r8152-cfgselector 9-1: config 0 descriptor?? [ 1668.524682][T15715] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1668.530529][T15719] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1668.772460][T10445] hsr_slave_0: left promiscuous mode [ 1668.792098][T10445] hsr_slave_1: left promiscuous mode [ 1668.793090][T10445] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1668.842945][T10445] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1668.939400][ T1322] ieee802154 phy0 wpan0: encryption failed: -22 [ 1668.939477][ T1322] ieee802154 phy1 wpan1: encryption failed: -22 [ 1669.032161][T10445] hsr_slave_0: left promiscuous mode [ 1669.072157][T10445] hsr_slave_1: left promiscuous mode [ 1669.073396][T10445] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1669.096054][T10445] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1669.252140][T10445] hsr_slave_0: left promiscuous mode [ 1669.274765][T10445] hsr_slave_1: left promiscuous mode [ 1669.276684][T10445] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1669.276714][T10445] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1669.334393][T10445] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1669.334427][T10445] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1669.422063][T10445] hsr_slave_0: left promiscuous mode [ 1669.462241][T10445] hsr_slave_1: left promiscuous mode [ 1669.463279][T10445] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1669.493933][T10445] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1669.652366][T10445] veth1_macvtap: left promiscuous mode [ 1669.652507][T10445] veth0_macvtap: left promiscuous mode [ 1669.652821][T10445] veth1_vlan: left promiscuous mode [ 1669.653031][T10445] veth0_vlan: left promiscuous mode [ 1670.862627][T10445] team0 (unregistering): Port device team_slave_1 removed [ 1670.944598][ T1238] r8152-cfgselector 9-1: USB disconnect, device number 115 [ 1672.087049][T10445] team0 (unregistering): Port device team_slave_0 removed [ 1675.082508][T10445] team0 (unregistering): Port device team_slave_1 removed [ 1676.190587][T10445] team0 (unregistering): Port device team_slave_0 removed [ 1679.422092][ T1238] usb 9-1: new full-speed USB device number 116 using dummy_hcd [ 1679.619605][ T1238] usb 9-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x41, changing to 0x1 [ 1679.619641][ T1238] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x1 has an invalid bInterval 0, changing to 4 [ 1679.623491][ T1238] usb 9-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 1679.623521][ T1238] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1679.623541][ T1238] usb 9-1: Product: syz [ 1679.623555][ T1238] usb 9-1: Manufacturer: syz [ 1679.623571][ T1238] usb 9-1: SerialNumber: syz [ 1679.629778][ T1238] usb 9-1: config 0 descriptor?? [ 1679.635916][ T1238] streamzap 9-1:0.0: streamzap_probe: endpoint doesn't match input device 0201 [ 1680.101882][ T8745] usb 9-1: USB disconnect, device number 116 [ 1680.579305][ T5848] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1680.638258][ T5848] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1680.639720][ T5848] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1680.640908][ T5848] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1680.652509][ T5848] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1682.415702][T10445] team0 (unregistering): Port device team_slave_1 removed [ 1682.702050][T14260] Bluetooth: hci5: command tx timeout [ 1682.732415][T10445] team0 (unregistering): Port device team_slave_0 removed [ 1684.771914][T14260] Bluetooth: hci5: command tx timeout [ 1686.652688][T10445] team0 (unregistering): Port device team_slave_1 removed [ 1686.816182][T10445] team0 (unregistering): Port device team_slave_0 removed [ 1686.870929][T14260] Bluetooth: hci5: command tx timeout [ 1687.530236][T15719] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1687.810581][T15715] team0: Port device team_slave_0 added [ 1688.050730][T15715] team0: Port device team_slave_1 added [ 1688.088979][T15719] team0: Port device team_slave_0 added [ 1688.300364][T15719] team0: Port device team_slave_1 added [ 1689.110432][T14260] Bluetooth: hci5: command tx timeout [ 1690.030691][T15715] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1690.030708][T15715] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1690.030734][T15715] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1690.821608][T15715] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1690.821626][T15715] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1690.821653][T15715] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1691.077888][T15719] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1691.077905][T15719] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1691.077931][T15719] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1691.643616][T15719] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1691.643634][T15719] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1691.643661][T15719] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1692.544878][T15715] hsr_slave_0: entered promiscuous mode [ 1692.551462][T15715] hsr_slave_1: entered promiscuous mode [ 1692.574559][T15715] debugfs: 'hsr0' already exists in 'hsr' [ 1692.574587][T15715] Cannot create hsr debugfs directory [ 1692.693965][T15748] chnl_net:caif_netlink_parms(): no params data found [ 1692.773404][T15719] hsr_slave_0: entered promiscuous mode [ 1692.774862][T15719] hsr_slave_1: entered promiscuous mode [ 1692.775823][T15719] debugfs: 'hsr0' already exists in 'hsr' [ 1692.775847][T15719] Cannot create hsr debugfs directory [ 1694.336774][T15856] netlink: 'syz.8.1970': attribute type 7 has an invalid length. [ 1694.336820][T15856] netlink: 'syz.8.1970': attribute type 8 has an invalid length. [ 1696.538591][T15748] bridge0: port 1(bridge_slave_0) entered blocking state [ 1696.538722][T15748] bridge0: port 1(bridge_slave_0) entered disabled state [ 1696.538905][T15748] bridge_slave_0: entered allmulticast mode [ 1696.541314][T15748] bridge_slave_0: entered promiscuous mode [ 1696.564873][T15748] bridge0: port 2(bridge_slave_1) entered blocking state [ 1696.565078][T15748] bridge0: port 2(bridge_slave_1) entered disabled state [ 1696.565271][T15748] bridge_slave_1: entered allmulticast mode [ 1696.567754][T15748] bridge_slave_1: entered promiscuous mode [ 1698.192052][T15748] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1698.738862][T15748] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1698.991941][ T8745] usb 9-1: new high-speed USB device number 117 using dummy_hcd [ 1699.105072][T15748] team0: Port device team_slave_0 added [ 1699.123371][T15818] chnl_net:caif_netlink_parms(): no params data found [ 1699.141465][T15748] team0: Port device team_slave_1 added [ 1699.147564][ T8745] usb 9-1: Using ep0 maxpacket: 8 [ 1699.163128][ T8745] usb 9-1: config index 0 descriptor too short (expected 30, got 18) [ 1699.170860][ T8745] usb 9-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 1699.170897][ T8745] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1699.170918][ T8745] usb 9-1: Product: syz [ 1699.170932][ T8745] usb 9-1: Manufacturer: syz [ 1699.170947][ T8745] usb 9-1: SerialNumber: syz [ 1699.218086][ T8745] usb 9-1: config 0 descriptor?? [ 1699.235824][ T8745] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 1699.235920][ T8745] usb 9-1: setting power ON [ 1699.235947][ T8745] dvb-usb: bulk message failed: -22 (2/0) [ 1699.266286][ T8745] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1699.275358][ T8745] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 1699.275419][ T8745] usb 9-1: media controller created [ 1699.329813][ T8745] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1699.372504][ T8745] usb 9-1: selecting invalid altsetting 6 [ 1699.372529][ T8745] usb 9-1: digital interface selection failed (-22) [ 1699.372547][ T8745] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 1699.381621][ T8745] usb 9-1: setting power OFF [ 1699.381643][ T8745] dvb-usb: bulk message failed: -22 (2/0) [ 1699.381659][ T8745] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 1699.381672][ T8745] (NULL device *): no alternate interface [ 1699.433172][T15877] dvb-usb: bulk message failed: -22 (3/0) [ 1699.433194][T15877] cxusb: i2c wr: len=80 is too big! [ 1699.433194][T15877] [ 1699.934753][T15748] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1699.934769][T15748] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1699.934795][T15748] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1700.027891][T15748] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1700.027908][T15748] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1700.027934][T15748] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1700.662169][T15818] bridge0: port 1(bridge_slave_0) entered blocking state [ 1700.662317][T15818] bridge0: port 1(bridge_slave_0) entered disabled state [ 1700.662594][T15818] bridge_slave_0: entered allmulticast mode [ 1700.665433][T15818] bridge_slave_0: entered promiscuous mode [ 1700.762958][T15818] bridge0: port 2(bridge_slave_1) entered blocking state [ 1700.763726][T15818] bridge0: port 2(bridge_slave_1) entered disabled state [ 1700.763991][T15818] bridge_slave_1: entered allmulticast mode [ 1700.769441][T15818] bridge_slave_1: entered promiscuous mode [ 1700.912990][T15748] hsr_slave_0: entered promiscuous mode [ 1700.914610][T15748] hsr_slave_1: entered promiscuous mode [ 1700.915481][T15748] debugfs: 'hsr0' already exists in 'hsr' [ 1700.915503][T15748] Cannot create hsr debugfs directory [ 1701.059498][T15818] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1701.248225][T15818] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1701.420873][ T8745] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 1701.466605][ T8745] usb 9-1: USB disconnect, device number 117 [ 1703.865890][T15818] team0: Port device team_slave_0 added [ 1704.034235][T15818] team0: Port device team_slave_1 added [ 1704.554579][T15715] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 1704.633308][T15818] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1704.633324][T15818] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1704.633345][T15818] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1704.783037][T15715] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 1705.392683][T15818] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1705.392735][T15818] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1705.392809][T15818] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1705.424982][T15715] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 1706.011331][T15715] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 1706.358029][ C1] vkms_vblank_simulate: vblank timer overrun [ 1706.537301][ C1] vkms_vblank_simulate: vblank timer overrun [ 1707.187278][ C1] vkms_vblank_simulate: vblank timer overrun [ 1707.621988][ T5907] usb 9-1: new full-speed USB device number 118 using dummy_hcd [ 1707.721074][T15818] hsr_slave_0: entered promiscuous mode [ 1707.723085][T15818] hsr_slave_1: entered promiscuous mode [ 1707.724057][T15818] debugfs: 'hsr0' already exists in 'hsr' [ 1707.724093][T15818] Cannot create hsr debugfs directory [ 1707.783508][ T5907] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1707.783537][ T5907] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1707.788575][ T5907] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1707.788606][ T5907] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1707.788627][ T5907] usb 9-1: Product: syz [ 1707.788641][ T5907] usb 9-1: Manufacturer: syz [ 1707.788656][ T5907] usb 9-1: SerialNumber: syz [ 1708.027128][T15719] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1708.045280][ T5907] usb 9-1: 0:2 : does not exist [ 1708.059587][ T5907] usb 9-1: 5:0: failed to get current value for ch 0 (-22) [ 1708.111425][ T5907] usb 9-1: USB disconnect, device number 118 [ 1708.120050][T15719] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1708.208487][T15824] udevd[15824]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1708.498706][T15719] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1708.626624][T15719] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1709.619819][ T3707] bridge_slave_1: left allmulticast mode [ 1709.619860][ T3707] bridge_slave_1: left promiscuous mode [ 1709.620117][ T3707] bridge0: port 2(bridge_slave_1) entered disabled state [ 1709.703777][ T3707] bridge_slave_0: left allmulticast mode [ 1709.703811][ T3707] bridge_slave_0: left promiscuous mode [ 1709.704087][ T3707] bridge0: port 1(bridge_slave_0) entered disabled state [ 1709.807269][ T3707] bridge_slave_1: left allmulticast mode [ 1709.807305][ T3707] bridge_slave_1: left promiscuous mode [ 1709.807611][ T3707] bridge0: port 2(bridge_slave_1) entered disabled state [ 1709.873797][ T3707] bridge_slave_0: left allmulticast mode [ 1709.873831][ T3707] bridge_slave_0: left promiscuous mode [ 1709.874090][ T3707] bridge0: port 1(bridge_slave_0) entered disabled state [ 1709.949066][ T3707] bridge_slave_1: left allmulticast mode [ 1709.949090][ T3707] bridge_slave_1: left promiscuous mode [ 1709.949247][ T3707] bridge0: port 2(bridge_slave_1) entered disabled state [ 1710.013480][ T3707] bridge_slave_0: left allmulticast mode [ 1710.013515][ T3707] bridge_slave_0: left promiscuous mode [ 1710.013772][ T3707] bridge0: port 1(bridge_slave_0) entered disabled state [ 1710.086760][ T3707] bridge_slave_1: left allmulticast mode [ 1710.086795][ T3707] bridge_slave_1: left promiscuous mode [ 1710.087103][ T3707] bridge0: port 2(bridge_slave_1) entered disabled state [ 1710.158244][ T3707] bridge_slave_0: left allmulticast mode [ 1710.158268][ T3707] bridge_slave_0: left promiscuous mode [ 1710.158438][ T3707] bridge0: port 1(bridge_slave_0) entered disabled state [ 1710.652524][ T3707] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1710.745514][ T3707] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1710.812510][ T3707] bond0 (unregistering): Released all slaves [ 1710.918358][ T5848] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1710.949897][ T5848] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1710.961018][ T5848] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1711.004341][ T5848] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1711.005225][ T5848] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1711.272944][ T3707] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1711.352769][ T3707] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1711.416927][ T3707] bond0 (unregistering): Released all slaves [ 1711.694376][ T3707] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1711.785503][ T3707] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1711.845993][ T3707] bond0 (unregistering): Released all slaves [ 1712.018363][T15941] 9pnet_fd: Insufficient options for proto=fd [ 1712.222755][ T3707] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1712.334370][ T3707] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1712.384584][T14260] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1712.389074][T14260] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1712.418729][T14260] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1712.431433][T14260] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1712.472701][T14260] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1712.479390][ T3707] bond0 (unregistering): Released all slaves [ 1713.075901][T15941] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1991'. [ 1713.091912][T15945] Bluetooth: hci0: command tx timeout [ 1713.354620][T15947] fuse: Unknown parameter '' [ 1714.643649][T15945] Bluetooth: hci2: command tx timeout [ 1714.932700][T15748] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1715.171897][T15945] Bluetooth: hci0: command tx timeout [ 1715.437149][T15748] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1715.566449][T15748] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1715.930567][T15748] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1716.378157][ T3707] hsr_slave_0: left promiscuous mode [ 1716.424001][ T3707] hsr_slave_1: left promiscuous mode [ 1716.425006][ T3707] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1716.479477][ T3707] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1716.631996][ T3707] hsr_slave_0: left promiscuous mode [ 1716.652855][ T3707] hsr_slave_1: left promiscuous mode [ 1716.653517][ T3707] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1716.697979][T15945] Bluetooth: hci2: command tx timeout [ 1716.719981][ T3707] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1716.832154][ T3707] hsr_slave_0: left promiscuous mode [ 1716.873064][ T3707] hsr_slave_1: left promiscuous mode [ 1716.876263][ T3707] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1716.895353][ T3707] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1717.012229][ T3707] hsr_slave_0: left promiscuous mode [ 1717.055168][ T3707] hsr_slave_1: left promiscuous mode [ 1717.056118][ T3707] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1717.103984][ T3707] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1717.251942][T15945] Bluetooth: hci0: command tx timeout [ 1717.522398][ C1] vkms_vblank_simulate: vblank timer overrun [ 1717.635809][T15974] netlink: 5128 bytes leftover after parsing attributes in process `syz.8.1997'. [ 1717.635913][T15974] netlink: 5128 bytes leftover after parsing attributes in process `syz.8.1997'. [ 1717.635929][T15974] netlink: 640 bytes leftover after parsing attributes in process `syz.8.1997'. [ 1718.069816][ C1] vkms_vblank_simulate: vblank timer overrun [ 1718.420212][ C1] vkms_vblank_simulate: vblank timer overrun [ 1718.689795][ C1] vkms_vblank_simulate: vblank timer overrun [ 1718.756636][ T3707] team0 (unregistering): Port device team_slave_1 removed [ 1718.771932][T15945] Bluetooth: hci2: command tx timeout [ 1718.904269][ T3707] team0 (unregistering): Port device team_slave_0 removed [ 1719.014025][ C1] vkms_vblank_simulate: vblank timer overrun [ 1719.088201][ C1] vkms_vblank_simulate: vblank timer overrun [ 1719.342062][T15945] Bluetooth: hci0: command tx timeout [ 1719.968454][ C1] vkms_vblank_simulate: vblank timer overrun [ 1720.184870][ C1] vkms_vblank_simulate: vblank timer overrun [ 1720.387963][ C1] vkms_vblank_simulate: vblank timer overrun [ 1720.508539][ T3707] team0 (unregistering): Port device team_slave_1 removed [ 1720.663453][ T3707] team0 (unregistering): Port device team_slave_0 removed [ 1720.852061][T15945] Bluetooth: hci2: command tx timeout [ 1721.190890][ C1] vkms_vblank_simulate: vblank timer overrun [ 1722.291181][T11963] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1722.323361][T11963] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1722.324818][T11963] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1722.328340][T11963] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1722.329056][T11963] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1723.897197][ T3707] team0 (unregistering): Port device team_slave_1 removed [ 1724.043705][ T3707] team0 (unregistering): Port device team_slave_0 removed [ 1724.465123][T15945] Bluetooth: hci3: command tx timeout [ 1725.263144][ T3707] team0 (unregistering): Port device team_slave_1 removed [ 1725.406299][ T3707] team0 (unregistering): Port device team_slave_0 removed [ 1726.577655][T15945] Bluetooth: hci3: command tx timeout [ 1726.962455][T15996] openvswitch: netlink: Missing key (keys=1040, expected=2000) [ 1727.662187][ T10] usb 9-1: new high-speed USB device number 119 using dummy_hcd [ 1727.746824][T15937] chnl_net:caif_netlink_parms(): no params data found [ 1727.829818][ T10] usb 9-1: Using ep0 maxpacket: 16 [ 1727.845396][ T10] usb 9-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 1727.845427][ T10] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1727.845448][ T10] usb 9-1: Product: syz [ 1727.845462][ T10] usb 9-1: Manufacturer: syz [ 1727.845477][ T10] usb 9-1: SerialNumber: syz [ 1727.853855][ T10] usb 9-1: config 0 descriptor?? [ 1728.270576][ T10] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 1728.306749][ T10] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1728.307787][ T10] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 1728.307845][ T10] usb 9-1: media controller created [ 1728.374857][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1728.611919][T15945] Bluetooth: hci3: command tx timeout [ 1728.614719][T15943] chnl_net:caif_netlink_parms(): no params data found [ 1728.775132][ T10] zl10353_read_register: readreg error (reg=127, ret==0) [ 1728.775196][ T10] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 1728.775211][ T10] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 1728.795412][ T10] usb 9-1: USB disconnect, device number 119 [ 1729.050887][ T10] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 1729.920657][T16020] netlink: 5128 bytes leftover after parsing attributes in process `syz.8.2004'. [ 1729.920770][T16020] netlink: 5128 bytes leftover after parsing attributes in process `syz.8.2004'. [ 1729.920787][T16020] netlink: 640 bytes leftover after parsing attributes in process `syz.8.2004'. [ 1730.008979][T15818] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1730.388597][ T1322] ieee802154 phy0 wpan0: encryption failed: -22 [ 1730.388674][ T1322] ieee802154 phy1 wpan1: encryption failed: -22 [ 1730.652126][T15818] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1730.692153][T15945] Bluetooth: hci3: command tx timeout [ 1730.732321][T15937] bridge0: port 1(bridge_slave_0) entered blocking state [ 1730.732614][T15937] bridge0: port 1(bridge_slave_0) entered disabled state [ 1730.733032][T15937] bridge_slave_0: entered allmulticast mode [ 1730.736092][T15937] bridge_slave_0: entered promiscuous mode [ 1730.840695][T15818] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1730.929108][T15937] bridge0: port 2(bridge_slave_1) entered blocking state [ 1730.929257][T15937] bridge0: port 2(bridge_slave_1) entered disabled state [ 1730.929516][T15937] bridge_slave_1: entered allmulticast mode [ 1730.939937][T15937] bridge_slave_1: entered promiscuous mode [ 1731.094034][T15818] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1731.648983][T15943] bridge0: port 1(bridge_slave_0) entered blocking state [ 1731.649134][T15943] bridge0: port 1(bridge_slave_0) entered disabled state [ 1731.649400][T15943] bridge_slave_0: entered allmulticast mode [ 1731.660468][T15943] bridge_slave_0: entered promiscuous mode [ 1731.679179][T15937] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1731.833776][T15943] bridge0: port 2(bridge_slave_1) entered blocking state [ 1731.833931][T15943] bridge0: port 2(bridge_slave_1) entered disabled state [ 1731.834230][T15943] bridge_slave_1: entered allmulticast mode [ 1731.837567][T15943] bridge_slave_1: entered promiscuous mode [ 1731.878285][T15937] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1732.878758][T15943] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1732.916221][T15937] team0: Port device team_slave_0 added [ 1732.937809][T15943] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1733.005566][T15937] team0: Port device team_slave_1 added [ 1733.023787][T15981] chnl_net:caif_netlink_parms(): no params data found [ 1733.292171][ T5928] usb 9-1: new full-speed USB device number 120 using dummy_hcd [ 1733.515954][ T5928] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1733.516728][ T5928] usb 9-1: not running at top speed; connect to a high speed hub [ 1733.518316][ T5928] usb 9-1: config 6 has an invalid interface number: 179 but max is 0 [ 1733.518341][ T5928] usb 9-1: config 6 has no interface number 0 [ 1733.518375][ T5928] usb 9-1: config 6 interface 179 has no altsetting 0 [ 1733.521602][ T5928] usb 9-1: New USB device found, idVendor=061d, idProduct=c120, bcdDevice= 2.18 [ 1733.521629][ T5928] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1733.521649][ T5928] usb 9-1: Product: syz [ 1733.521664][ T5928] usb 9-1: Manufacturer: syz [ 1733.521679][ T5928] usb 9-1: SerialNumber: syz [ 1733.753117][ T5928] quatech2 9-1:6.179: Quatech 2nd gen USB to Serial Driver converter detected [ 1733.758956][T15943] team0: Port device team_slave_0 added [ 1733.772135][ T5928] usb 9-1: qt2_attach - failed to power on unit: -71 [ 1733.772272][ T5928] quatech2 9-1:6.179: probe with driver quatech2 failed with error -71 [ 1733.792982][T15937] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1733.792997][T15937] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1733.793024][T15937] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1733.794214][ T5928] usb 9-1: USB disconnect, device number 120 [ 1733.935714][T15943] team0: Port device team_slave_1 added [ 1733.937192][T15937] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1733.937206][T15937] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1733.937232][T15937] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1734.388951][T16088] netlink: 212376 bytes leftover after parsing attributes in process `syz.8.2007'. [ 1734.413367][T15943] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1734.413385][T15943] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1734.413412][T15943] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1735.203120][T15943] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1735.203138][T15943] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1735.203176][T15943] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1736.340129][T15937] hsr_slave_0: entered promiscuous mode [ 1736.341485][T15937] hsr_slave_1: entered promiscuous mode [ 1736.414155][T15981] bridge0: port 1(bridge_slave_0) entered blocking state [ 1736.414297][T15981] bridge0: port 1(bridge_slave_0) entered disabled state [ 1736.414536][T15981] bridge_slave_0: entered allmulticast mode [ 1736.422695][T15981] bridge_slave_0: entered promiscuous mode [ 1736.443346][T15981] bridge0: port 2(bridge_slave_1) entered blocking state [ 1736.443481][T15981] bridge0: port 2(bridge_slave_1) entered disabled state [ 1736.444055][T15981] bridge_slave_1: entered allmulticast mode [ 1736.472324][T15981] bridge_slave_1: entered promiscuous mode [ 1738.132746][T15981] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1738.181205][T15943] hsr_slave_0: entered promiscuous mode [ 1738.182969][T15943] hsr_slave_1: entered promiscuous mode [ 1738.183880][T15943] debugfs: 'hsr0' already exists in 'hsr' [ 1738.183905][T15943] Cannot create hsr debugfs directory [ 1738.339861][T15981] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1738.826260][T15981] team0: Port device team_slave_0 added [ 1739.024931][T15981] team0: Port device team_slave_1 added [ 1739.262220][ T10] usb 9-1: new full-speed USB device number 121 using dummy_hcd [ 1739.425152][ T10] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1739.425896][ T10] usb 9-1: not running at top speed; connect to a high speed hub [ 1739.427447][ T10] usb 9-1: config 8 has an invalid interface number: 24 but max is 0 [ 1739.427471][ T10] usb 9-1: config 8 has an invalid descriptor of length 0, skipping remainder of the config [ 1739.427490][ T10] usb 9-1: config 8 has no interface number 0 [ 1739.427534][ T10] usb 9-1: config 8 interface 24 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1739.427568][ T10] usb 9-1: config 8 interface 24 has no altsetting 0 [ 1739.453569][ T10] usb 9-1: New USB device found, idVendor=10cf, idProduct=5503, bcdDevice=75.af [ 1739.453599][ T10] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1739.453619][ T10] usb 9-1: Product: syz [ 1739.453633][ T10] usb 9-1: Manufacturer: syz [ 1739.453647][ T10] usb 9-1: SerialNumber: syz [ 1739.789019][ T10] vmk80xx 9-1:8.24: driver 'vmk80xx' failed to auto-configure device. [ 1739.821994][ T10] usb 9-1: USB disconnect, device number 121 [ 1740.025318][T15981] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1740.025336][T15981] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1740.025362][T15981] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1740.257328][T15981] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1740.257346][T15981] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1740.257373][T15981] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1742.230222][T11963] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1742.266098][T11963] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1742.269054][T11963] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1742.294137][T11963] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1742.309515][T11963] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1744.378523][T11963] Bluetooth: hci4: command tx timeout [ 1744.732879][T15981] hsr_slave_0: entered promiscuous mode [ 1744.736487][T15981] hsr_slave_1: entered promiscuous mode [ 1744.745739][T15981] debugfs: 'hsr0' already exists in 'hsr' [ 1744.745767][T15981] Cannot create hsr debugfs directory [ 1746.312222][ T10] usb 9-1: new full-speed USB device number 122 using dummy_hcd [ 1746.457175][T11963] Bluetooth: hci4: command tx timeout [ 1746.478670][ T10] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1746.478699][ T10] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1746.492383][ T10] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1746.492414][ T10] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1746.492434][ T10] usb 9-1: Product: syz [ 1746.492449][ T10] usb 9-1: Manufacturer: syz [ 1746.492463][ T10] usb 9-1: SerialNumber: syz [ 1746.755424][ T10] usb 9-1: 0:2 : does not exist [ 1746.768454][ T10] usb 9-1: 5:0: failed to get current value for ch 0 (-22) [ 1746.882928][ T10] usb 9-1: USB disconnect, device number 122 [ 1747.006800][T16163] udevd[16163]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1747.882106][ T6987] usb 9-1: new high-speed USB device number 123 using dummy_hcd [ 1748.055962][ T6987] usb 9-1: Using ep0 maxpacket: 32 [ 1748.061026][ T6987] usb 9-1: config 0 has an invalid interface number: 51 but max is 0 [ 1748.061053][ T6987] usb 9-1: config 0 has no interface number 0 [ 1748.096129][ T6987] usb 9-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1748.096160][ T6987] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1748.096180][ T6987] usb 9-1: Product: syz [ 1748.096195][ T6987] usb 9-1: Manufacturer: syz [ 1748.096210][ T6987] usb 9-1: SerialNumber: syz [ 1748.143585][ T6987] usb 9-1: config 0 descriptor?? [ 1748.147908][ T6987] quatech2 9-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1748.532022][T11963] Bluetooth: hci4: command tx timeout [ 1748.773741][ T6987] usb 9-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 1748.814838][ T6987] usb 9-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 1749.572456][T16189] chnl_net:caif_netlink_parms(): no params data found [ 1750.197437][ T3707] bridge_slave_1: left allmulticast mode [ 1750.197478][ T3707] bridge_slave_1: left promiscuous mode [ 1750.197735][ T3707] bridge0: port 2(bridge_slave_1) entered disabled state [ 1750.314043][ T3707] bridge_slave_0: left allmulticast mode [ 1750.314075][ T3707] bridge_slave_0: left promiscuous mode [ 1750.314334][ T3707] bridge0: port 1(bridge_slave_0) entered disabled state [ 1750.389756][ T3707] bridge_slave_1: left allmulticast mode [ 1750.389880][ T3707] bridge_slave_1: left promiscuous mode [ 1750.390254][ T3707] bridge0: port 2(bridge_slave_1) entered disabled state [ 1750.454462][ T3707] bridge_slave_0: left allmulticast mode [ 1750.454495][ T3707] bridge_slave_0: left promiscuous mode [ 1750.454926][ T3707] bridge0: port 1(bridge_slave_0) entered disabled state [ 1750.519188][ T3707] bridge_slave_1: left allmulticast mode [ 1750.519222][ T3707] bridge_slave_1: left promiscuous mode [ 1750.519689][ T3707] bridge0: port 2(bridge_slave_1) entered disabled state [ 1750.577018][ T3707] bridge_slave_0: left allmulticast mode [ 1750.577052][ T3707] bridge_slave_0: left promiscuous mode [ 1750.577809][ T3707] bridge0: port 1(bridge_slave_0) entered disabled state [ 1750.611928][T11963] Bluetooth: hci4: command tx timeout [ 1750.816871][ C1] usb 9-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 1750.823950][ T5928] usb 9-1: USB disconnect, device number 123 [ 1750.843054][ T5928] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 1750.863963][ T5928] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 1750.864979][ T5928] quatech2 9-1:0.51: device disconnected [ 1751.416046][ T3707] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1751.536074][ T3707] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1751.666910][ T3707] bond0 (unregistering): Released all slaves [ 1752.245725][ T3707] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1752.337556][ T3707] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1752.401227][ T3707] bond0 (unregistering): Released all slaves [ 1752.882904][ T3707] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1752.976375][ T3707] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1753.104438][ T3707] bond0 (unregistering): Released all slaves [ 1753.696795][T16189] bridge0: port 1(bridge_slave_0) entered blocking state [ 1753.696942][T16189] bridge0: port 1(bridge_slave_0) entered disabled state [ 1753.697205][T16189] bridge_slave_0: entered allmulticast mode [ 1753.879083][T16189] bridge_slave_0: entered promiscuous mode [ 1753.908431][T16189] bridge0: port 2(bridge_slave_1) entered blocking state [ 1753.909027][T16189] bridge0: port 2(bridge_slave_1) entered disabled state [ 1753.910601][T16189] bridge_slave_1: entered allmulticast mode [ 1753.968882][T16189] bridge_slave_1: entered promiscuous mode [ 1754.675059][T16189] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1755.083268][ T3707] hsr_slave_0: left promiscuous mode [ 1755.163566][ T3707] hsr_slave_1: left promiscuous mode [ 1755.164687][ T3707] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1755.223080][ T3707] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1755.624863][ T3707] hsr_slave_0: left promiscuous mode [ 1755.680895][ T3707] hsr_slave_1: left promiscuous mode [ 1755.682332][ T3707] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1755.713181][ T3707] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1755.872606][ T3707] hsr_slave_0: left promiscuous mode [ 1755.902087][ T3707] hsr_slave_1: left promiscuous mode [ 1755.903180][ T3707] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1755.944378][ T3707] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1756.872887][ T3707] team0 (unregistering): Port device team_slave_1 removed [ 1757.049720][ T3707] team0 (unregistering): Port device team_slave_0 removed [ 1758.517166][ T3707] team0 (unregistering): Port device team_slave_1 removed [ 1758.702884][ T3707] team0 (unregistering): Port device team_slave_0 removed [ 1760.211083][ T3707] team0 (unregistering): Port device team_slave_1 removed [ 1760.384597][ T3707] team0 (unregistering): Port device team_slave_0 removed [ 1761.275707][T16189] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1761.729211][T16189] team0: Port device team_slave_0 added [ 1761.754783][T16189] team0: Port device team_slave_1 added [ 1762.210027][T15937] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 1762.331056][T16189] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1762.331073][T16189] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1762.331100][T16189] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1762.331677][T15937] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 1762.747793][T16189] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1762.747810][T16189] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1762.747837][T16189] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1762.748785][T15937] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 1762.865282][T15937] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 1764.323752][T16189] hsr_slave_0: entered promiscuous mode [ 1764.325233][T16189] hsr_slave_1: entered promiscuous mode [ 1764.344949][T16189] debugfs: 'hsr0' already exists in 'hsr' [ 1764.344979][T16189] Cannot create hsr debugfs directory [ 1766.706544][T15943] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1766.808800][T15943] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1766.917237][T15943] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1766.982483][T15943] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1767.464754][T15937] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1767.742477][T15981] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1767.802640][T15981] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1768.269700][T15981] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1768.355482][T15937] 8021q: adding VLAN 0 to HW filter on device team0 [ 1768.363426][T15981] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1768.683583][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 1768.683807][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1768.787701][ T163] bridge0: port 2(bridge_slave_1) entered blocking state [ 1768.787949][ T163] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1769.104724][T16413] FAULT_INJECTION: forcing a failure. [ 1769.104724][T16413] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1769.104759][T16413] CPU: 0 UID: 0 PID: 16413 Comm: syz.8.2041 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1769.104781][T16413] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1769.104793][T16413] Call Trace: [ 1769.104801][T16413] [ 1769.104810][T16413] dump_stack_lvl+0x189/0x250 [ 1769.104839][T16413] ? __pfx____ratelimit+0x10/0x10 [ 1769.104865][T16413] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1769.104890][T16413] ? __pfx__printk+0x10/0x10 [ 1769.104925][T16413] should_fail_ex+0x46c/0x600 [ 1769.104956][T16413] _copy_to_user+0x31/0xb0 [ 1769.104981][T16413] simple_read_from_buffer+0xe1/0x170 [ 1769.105009][T16413] proc_fail_nth_read+0x1b6/0x220 [ 1769.105033][T16413] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1769.105055][T16413] ? rw_verify_area+0x2ac/0x4e0 [ 1769.105076][T16413] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1769.105097][T16413] vfs_read+0x206/0xa30 [ 1769.105127][T16413] ? __pfx_vfs_read+0x10/0x10 [ 1769.105145][T16413] ? try_to_take_rt_mutex+0x7fd/0xac0 [ 1769.105177][T16413] ? mutex_lock_nested+0x154/0x1d0 [ 1769.105196][T16413] ? fdget_pos+0x253/0x320 [ 1769.105229][T16413] ksys_read+0x14b/0x260 [ 1769.105253][T16413] ? __pfx_ksys_read+0x10/0x10 [ 1769.105271][T16413] ? rcu_is_watching+0x15/0xb0 [ 1769.105302][T16413] ? do_syscall_64+0xbe/0x3b0 [ 1769.105325][T16413] do_syscall_64+0xfa/0x3b0 [ 1769.105341][T16413] ? lockdep_hardirqs_on+0x9c/0x150 [ 1769.105365][T16413] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1769.105384][T16413] ? clear_bhb_loop+0x60/0xb0 [ 1769.105406][T16413] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1769.105424][T16413] RIP: 0033:0x7ff31ff2d63c [ 1769.105441][T16413] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1769.105455][T16413] RSP: 002b:00007ff31e18e030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1769.105475][T16413] RAX: ffffffffffffffda RBX: 00007ff320175fa0 RCX: 00007ff31ff2d63c [ 1769.105490][T16413] RDX: 000000000000000f RSI: 00007ff31e18e0a0 RDI: 0000000000000004 [ 1769.105502][T16413] RBP: 00007ff31e18e090 R08: 0000000000000000 R09: 0000000000000000 [ 1769.105514][T16413] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1769.105525][T16413] R13: 00007ff320176038 R14: 00007ff320175fa0 R15: 00007fffff11c718 [ 1769.105556][T16413] [ 1771.378445][T15943] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1771.427204][T15943] 8021q: adding VLAN 0 to HW filter on device team0 [ 1771.484927][ T9598] bridge0: port 1(bridge_slave_0) entered blocking state [ 1771.485140][ T9598] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1771.507984][ T3707] bridge_slave_1: left allmulticast mode [ 1771.508020][ T3707] bridge_slave_1: left promiscuous mode [ 1771.508282][ T3707] bridge0: port 2(bridge_slave_1) entered disabled state [ 1771.604507][ T3707] bridge_slave_0: left allmulticast mode [ 1771.604530][ T3707] bridge_slave_0: left promiscuous mode [ 1771.604715][ T3707] bridge0: port 1(bridge_slave_0) entered disabled state [ 1772.993663][T15945] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1772.997971][T15945] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1773.016893][T15945] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1773.047401][T15945] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1773.048995][T15945] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1773.190408][ T3707] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1773.264247][ T3707] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1773.326380][ T3707] bond0 (unregistering): Released all slaves [ 1773.399044][ T9598] bridge0: port 2(bridge_slave_1) entered blocking state [ 1773.399205][ T9598] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1773.540644][T15981] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1774.211980][ T3707] hsr_slave_0: left promiscuous mode [ 1774.261988][ T3707] hsr_slave_1: left promiscuous mode [ 1774.263149][ T3707] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1774.302855][ T3707] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1774.467501][T11963] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1774.499195][T11963] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1774.500737][T11963] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1774.503202][T11963] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1774.504702][T11963] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1774.656500][T16431] netlink: 'syz.8.2044': attribute type 13 has an invalid length. [ 1775.172081][T15945] Bluetooth: hci0: command tx timeout [ 1775.374350][ T3707] team0 (unregistering): Port device team_slave_1 removed [ 1775.542868][ T3707] team0 (unregistering): Port device team_slave_0 removed [ 1776.369440][T16441] netlink: 'syz.8.2047': attribute type 10 has an invalid length. [ 1776.611980][T15945] Bluetooth: hci2: command tx timeout [ 1776.877227][T16441] 8021q: adding VLAN 0 to HW filter on device team0 [ 1776.879738][T16441] bond0: (slave team0): Enslaving as an active interface with an up link [ 1777.007005][T15981] 8021q: adding VLAN 0 to HW filter on device team0 [ 1777.211073][T16189] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1777.273781][ T9598] bridge0: port 1(bridge_slave_0) entered blocking state [ 1777.274521][ T9598] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1777.329485][T15945] Bluetooth: hci0: command tx timeout [ 1777.356070][T16189] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1778.070344][T16189] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1778.368037][T16189] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1778.418985][ T9598] bridge0: port 2(bridge_slave_1) entered blocking state [ 1778.419181][ T9598] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1779.259289][T15945] Bluetooth: hci2: command tx timeout [ 1779.343316][T15945] Bluetooth: hci0: command tx timeout [ 1780.129418][T16425] chnl_net:caif_netlink_parms(): no params data found [ 1780.753160][T16428] chnl_net:caif_netlink_parms(): no params data found [ 1781.332003][T15945] Bluetooth: hci2: command tx timeout [ 1781.412014][T15945] Bluetooth: hci0: command tx timeout [ 1781.494330][T16425] bridge0: port 1(bridge_slave_0) entered blocking state [ 1781.494591][T16425] bridge0: port 1(bridge_slave_0) entered disabled state [ 1781.494835][T16425] bridge_slave_0: entered allmulticast mode [ 1781.541930][T16425] bridge_slave_0: entered promiscuous mode [ 1782.080873][T16425] bridge0: port 2(bridge_slave_1) entered blocking state [ 1782.081047][T16425] bridge0: port 2(bridge_slave_1) entered disabled state [ 1782.081239][T16425] bridge_slave_1: entered allmulticast mode [ 1782.108065][T16425] bridge_slave_1: entered promiscuous mode [ 1783.412011][T15945] Bluetooth: hci2: command tx timeout [ 1783.899069][T11963] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1783.913621][T11963] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1783.918795][T11963] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1783.920920][T11963] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1783.932770][T11963] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1784.060694][T16425] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1784.208799][T16425] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1784.209354][T16428] bridge0: port 1(bridge_slave_0) entered blocking state [ 1784.209497][T16428] bridge0: port 1(bridge_slave_0) entered disabled state [ 1784.209677][T16428] bridge_slave_0: entered allmulticast mode [ 1784.252268][T16428] bridge_slave_0: entered promiscuous mode [ 1784.382861][T16428] bridge0: port 2(bridge_slave_1) entered blocking state [ 1784.383007][T16428] bridge0: port 2(bridge_slave_1) entered disabled state [ 1784.383228][T16428] bridge_slave_1: entered allmulticast mode [ 1784.386493][T16428] bridge_slave_1: entered promiscuous mode [ 1785.020711][T16425] team0: Port device team_slave_0 added [ 1785.124776][T16425] team0: Port device team_slave_1 added [ 1785.536121][T16428] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1785.873412][T16428] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1786.053058][T11963] Bluetooth: hci3: command tx timeout [ 1786.071065][T16425] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1786.071080][T16425] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1786.071106][T16425] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1786.211083][T16425] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1786.211100][T16425] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1786.211127][T16425] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1786.237991][T16428] team0: Port device team_slave_0 added [ 1786.301536][T16428] team0: Port device team_slave_1 added [ 1787.866585][T16428] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1787.866603][T16428] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1787.866629][T16428] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1787.906687][T16189] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1788.131975][T15945] Bluetooth: hci3: command tx timeout [ 1788.168375][T16428] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1788.168392][T16428] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1788.168417][T16428] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1788.239419][T16425] hsr_slave_0: entered promiscuous mode [ 1788.240821][T16425] hsr_slave_1: entered promiscuous mode [ 1788.256348][ T37] kauditd_printk_skb: 1 callbacks suppressed [ 1788.256363][ T37] audit: type=1326 audit(1758442387.327:313): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16506 comm="syz.8.2059" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7ff31fecae09 code=0x7ffc0000 [ 1788.257713][T16425] debugfs: 'hsr0' already exists in 'hsr' [ 1788.257743][T16425] Cannot create hsr debugfs directory [ 1788.266504][ T37] audit: type=1326 audit(1758442387.337:314): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16506 comm="syz.8.2059" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7ff31fecae09 code=0x7ffc0000 [ 1788.266880][ T37] audit: type=1326 audit(1758442387.337:315): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16506 comm="syz.8.2059" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7ff31fecae09 code=0x7ffc0000 [ 1788.267206][ T37] audit: type=1326 audit(1758442387.337:316): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16506 comm="syz.8.2059" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7ff31fecae09 code=0x7ffc0000 [ 1788.267970][ T37] audit: type=1326 audit(1758442387.337:317): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16506 comm="syz.8.2059" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7ff31fecae09 code=0x7ffc0000 [ 1788.268295][ T37] audit: type=1326 audit(1758442387.337:318): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16506 comm="syz.8.2059" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7ff31fecae09 code=0x7ffc0000 [ 1788.268575][ T37] audit: type=1326 audit(1758442387.337:319): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16506 comm="syz.8.2059" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7ff31fecae09 code=0x7ffc0000 [ 1788.268957][ T37] audit: type=1326 audit(1758442387.337:320): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16506 comm="syz.8.2059" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7ff31fecae09 code=0x7ffc0000 [ 1788.269351][ T37] audit: type=1326 audit(1758442387.337:321): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16506 comm="syz.8.2059" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7ff31fecae09 code=0x7ffc0000 [ 1788.269745][ T37] audit: type=1326 audit(1758442387.337:322): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=16506 comm="syz.8.2059" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7ff31fecae09 code=0x7ffc0000 [ 1789.615392][T16428] hsr_slave_0: entered promiscuous mode [ 1789.616740][T16428] hsr_slave_1: entered promiscuous mode [ 1789.617636][T16428] debugfs: 'hsr0' already exists in 'hsr' [ 1789.617661][T16428] Cannot create hsr debugfs directory [ 1789.694621][T16189] 8021q: adding VLAN 0 to HW filter on device team0 [ 1790.211901][T15945] Bluetooth: hci3: command tx timeout [ 1790.609554][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 1790.609817][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1790.712041][T12901] usb 9-1: new high-speed USB device number 124 using dummy_hcd [ 1791.856944][ T1322] ieee802154 phy0 wpan0: encryption failed: -22 [ 1791.857019][ T1322] ieee802154 phy1 wpan1: encryption failed: -22 [ 1792.292162][T15945] Bluetooth: hci3: command tx timeout [ 1792.371063][ T9598] bridge0: port 2(bridge_slave_1) entered blocking state [ 1792.373843][ T9598] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1792.682440][T16482] chnl_net:caif_netlink_parms(): no params data found [ 1793.663016][T16534] netlink: 52 bytes leftover after parsing attributes in process `syz.8.2066'. [ 1793.748805][T16534] IPv6: NLM_F_CREATE should be specified when creating new route [ 1793.749305][T16534] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1793.749315][T16534] IPv6: NLM_F_CREATE should be set when creating new route [ 1794.173196][T16482] bridge0: port 1(bridge_slave_0) entered blocking state [ 1794.173308][T16482] bridge0: port 1(bridge_slave_0) entered disabled state [ 1794.173457][T16482] bridge_slave_0: entered allmulticast mode [ 1794.182722][T16482] bridge_slave_0: entered promiscuous mode [ 1794.297209][T16482] bridge0: port 2(bridge_slave_1) entered blocking state [ 1794.297290][T16482] bridge0: port 2(bridge_slave_1) entered disabled state [ 1794.297468][T16482] bridge_slave_1: entered allmulticast mode [ 1794.300292][T16482] bridge_slave_1: entered promiscuous mode [ 1794.335502][ T3707] bridge_slave_1: left allmulticast mode [ 1794.335533][ T3707] bridge_slave_1: left promiscuous mode [ 1794.335796][ T3707] bridge0: port 2(bridge_slave_1) entered disabled state [ 1794.424472][ T3707] bridge_slave_0: left allmulticast mode [ 1794.424506][ T3707] bridge_slave_0: left promiscuous mode [ 1794.424821][ T3707] bridge0: port 1(bridge_slave_0) entered disabled state [ 1794.766358][ T3707] bridge_slave_1: left allmulticast mode [ 1794.766394][ T3707] bridge_slave_1: left promiscuous mode [ 1794.766688][ T3707] bridge0: port 2(bridge_slave_1) entered disabled state [ 1795.641326][ T3707] bridge_slave_0: left allmulticast mode [ 1795.641361][ T3707] bridge_slave_0: left promiscuous mode [ 1795.641624][ T3707] bridge0: port 1(bridge_slave_0) entered disabled state [ 1795.923492][T12423] usb 9-1: new full-speed USB device number 125 using dummy_hcd [ 1796.114910][T12423] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1796.114938][T12423] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1796.119063][T12423] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1796.119093][T12423] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1796.119113][T12423] usb 9-1: Product: syz [ 1796.119127][T12423] usb 9-1: Manufacturer: syz [ 1796.119142][T12423] usb 9-1: SerialNumber: syz [ 1796.377368][T12423] usb 9-1: 0:2 : does not exist [ 1796.384051][T12423] usb 9-1: 5:0: failed to get current value for ch 0 (-22) [ 1796.462930][T12423] usb 9-1: USB disconnect, device number 125 [ 1796.534690][T16418] udevd[16418]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1798.332454][T16556] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2071'. [ 1799.912742][ T3707] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1799.994364][ T3707] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1800.021907][ T8745] usb 9-1: new high-speed USB device number 126 using dummy_hcd [ 1800.061590][ T3707] bond0 (unregistering): Released all slaves [ 1800.177204][ T8745] usb 9-1: Using ep0 maxpacket: 32 [ 1800.179712][ T8745] usb 9-1: config 0 has an invalid interface number: 12 but max is 0 [ 1800.179739][ T8745] usb 9-1: config 0 has no interface number 0 [ 1800.179773][ T8745] usb 9-1: config 0 interface 12 has no altsetting 0 [ 1800.209827][ T8745] usb 9-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 1800.209856][ T8745] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1800.209877][ T8745] usb 9-1: Product: syz [ 1800.209892][ T8745] usb 9-1: Manufacturer: syz [ 1800.209907][ T8745] usb 9-1: SerialNumber: syz [ 1800.255096][ T8745] usb 9-1: config 0 descriptor?? [ 1800.260563][ T8745] f81534 9-1:0.12: required endpoints missing [ 1800.468326][T12423] usb 9-1: USB disconnect, device number 126 [ 1801.309693][T11963] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1801.327631][T11963] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1801.329158][T11963] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1801.331147][T11963] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1801.332910][T11963] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1803.412077][T11963] Bluetooth: hci5: command tx timeout [ 1804.125701][ T3707] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1804.235752][ T3707] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1804.306006][ T3707] bond0 (unregistering): Released all slaves [ 1805.165917][T16482] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1805.414853][T16482] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1805.495270][T11963] Bluetooth: hci5: command tx timeout [ 1805.868548][ T3707] hsr_slave_0: left promiscuous mode [ 1805.979954][ T3707] hsr_slave_1: left promiscuous mode [ 1805.980904][ T3707] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1806.004368][ T3707] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1806.184567][ T3707] hsr_slave_0: left promiscuous mode [ 1806.202163][ T3707] hsr_slave_1: left promiscuous mode [ 1806.202764][ T3707] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1806.254152][ T3707] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1807.412535][ T3707] team0 (unregistering): Port device team_slave_1 removed [ 1807.743723][T11963] Bluetooth: hci5: command tx timeout [ 1807.782657][ T3707] team0 (unregistering): Port device team_slave_0 removed [ 1807.963892][T16588] ubi31: attaching mtd0 [ 1808.050242][T16588] ubi31: scanning is finished [ 1808.050316][T16588] ubi31: empty MTD device detected [ 1808.850665][T16588] ubi31 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt31d", error -4 [ 1809.771923][T16597] netlink: 16186 bytes leftover after parsing attributes in process `syz.8.2080'. [ 1810.146896][T11963] Bluetooth: hci5: command tx timeout [ 1812.512692][ T3707] team0 (unregistering): Port device team_slave_1 removed [ 1812.662770][ T3707] team0 (unregistering): Port device team_slave_0 removed [ 1814.674428][T16596] veth1_to_bond: entered allmulticast mode [ 1814.750060][T16596] veth1_to_bond: left allmulticast mode [ 1815.458364][T16482] team0: Port device team_slave_0 added [ 1815.595307][T16482] team0: Port device team_slave_1 added [ 1816.672132][T16482] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1816.672150][T16482] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1816.672173][T16482] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1816.747724][T16482] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1816.747741][T16482] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1816.747768][T16482] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1816.762376][T16609] random: crng reseeded on system resumption [ 1818.557264][T16482] hsr_slave_0: entered promiscuous mode [ 1818.558641][T16482] hsr_slave_1: entered promiscuous mode [ 1818.972054][ T31] usb 9-1: new full-speed USB device number 127 using dummy_hcd [ 1819.195305][ T31] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1819.197879][ T31] usb 9-1: unable to read config index 0 descriptor/start: -71 [ 1819.197917][ T31] usb 9-1: can't read configurations, error -71 [ 1819.872200][T16565] chnl_net:caif_netlink_parms(): no params data found [ 1820.253673][T16425] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 1820.301941][ T31] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 1820.452585][ T31] usb 9-1: Using ep0 maxpacket: 32 [ 1820.458070][ T31] usb 9-1: config 0 has an invalid interface number: 51 but max is 0 [ 1820.458099][ T31] usb 9-1: config 0 has no interface number 0 [ 1820.460623][ T31] usb 9-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1820.460651][ T31] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1820.460666][ T31] usb 9-1: Product: syz [ 1820.460674][ T31] usb 9-1: Manufacturer: syz [ 1820.460682][ T31] usb 9-1: SerialNumber: syz [ 1820.518578][ T31] usb 9-1: config 0 descriptor?? [ 1820.527125][T16425] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 1820.530315][ T31] quatech2 9-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1820.690847][T16565] bridge0: port 1(bridge_slave_0) entered blocking state [ 1820.690974][T16565] bridge0: port 1(bridge_slave_0) entered disabled state [ 1820.691221][T16565] bridge_slave_0: entered allmulticast mode [ 1820.726970][T16565] bridge_slave_0: entered promiscuous mode [ 1820.738081][T16425] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 1821.017409][ T31] usb 9-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 1821.051981][ T31] usb 9-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 1821.123943][T16565] bridge0: port 2(bridge_slave_1) entered blocking state [ 1821.124082][T16565] bridge0: port 2(bridge_slave_1) entered disabled state [ 1821.124340][T16565] bridge_slave_1: entered allmulticast mode [ 1821.148962][T16565] bridge_slave_1: entered promiscuous mode [ 1821.158393][T16425] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 1821.389602][ C1] usb 9-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 1821.390303][ T31] usb 9-1: USB disconnect, device number 2 [ 1821.417313][ T31] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 1821.436164][ T31] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 1821.437148][ T31] quatech2 9-1:0.51: device disconnected [ 1821.793213][T16565] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1822.234716][T16565] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1823.331615][T16565] team0: Port device team_slave_0 added [ 1823.374641][T16428] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1823.423808][T16565] team0: Port device team_slave_1 added [ 1823.471198][T16428] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1823.708347][T16645] netlink: 56 bytes leftover after parsing attributes in process `syz.8.2090'. [ 1823.708506][T16645] netlink: 24 bytes leftover after parsing attributes in process `syz.8.2090'. [ 1824.095129][T16428] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1824.350742][T16428] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1824.593501][T16565] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1824.593518][T16565] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1824.593545][T16565] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1824.626336][T16565] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1824.626354][T16565] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1824.626381][T16565] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1824.982051][ T5921] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 1825.132581][ T5921] usb 9-1: Using ep0 maxpacket: 32 [ 1825.135259][ T5921] usb 9-1: config 0 has an invalid interface number: 132 but max is 0 [ 1825.135286][ T5921] usb 9-1: config 0 has no interface number 0 [ 1825.135337][ T5921] usb 9-1: config 0 interface 132 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1825.138495][ T5921] usb 9-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 1825.138523][ T5921] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1825.138544][ T5921] usb 9-1: Product: syz [ 1825.138558][ T5921] usb 9-1: Manufacturer: syz [ 1825.138573][ T5921] usb 9-1: SerialNumber: syz [ 1825.151052][ T5921] usb 9-1: config 0 descriptor?? [ 1825.834931][T16656] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1826.490976][T16565] hsr_slave_0: entered promiscuous mode [ 1826.493114][T16565] hsr_slave_1: entered promiscuous mode [ 1826.494005][T16565] debugfs: 'hsr0' already exists in 'hsr' [ 1826.494029][T16565] Cannot create hsr debugfs directory [ 1826.909399][ T3707] bridge_slave_1: left allmulticast mode [ 1826.909434][ T3707] bridge_slave_1: left promiscuous mode [ 1826.909742][ T3707] bridge0: port 2(bridge_slave_1) entered disabled state [ 1826.973868][ T3707] bridge_slave_0: left allmulticast mode [ 1826.973903][ T3707] bridge_slave_0: left promiscuous mode [ 1826.974166][ T3707] bridge0: port 1(bridge_slave_0) entered disabled state [ 1827.044005][ T3707] bridge_slave_1: left allmulticast mode [ 1827.044040][ T3707] bridge_slave_1: left promiscuous mode [ 1827.044298][ T3707] bridge0: port 2(bridge_slave_1) entered disabled state [ 1827.109419][ T3707] bridge_slave_0: left allmulticast mode [ 1827.109455][ T3707] bridge_slave_0: left promiscuous mode [ 1827.109800][ T3707] bridge0: port 1(bridge_slave_0) entered disabled state [ 1827.871823][T12901] usb 9-1: USB disconnect, device number 3 [ 1832.483767][ T3707] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1832.550057][ T3707] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1832.608215][ T3707] bond0 (unregistering): Released all slaves [ 1834.682925][ T3707] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1835.011707][ T3707] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1835.533169][ T3707] bond0 (unregistering): Released all slaves [ 1835.635965][T15945] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1835.699900][T15945] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1835.725360][T15945] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1835.774640][T15945] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1835.775475][T15945] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1837.844664][T11963] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1837.873356][T11963] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1837.875826][T11963] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1837.877060][T11963] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1837.909011][T11963] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1837.963842][T11963] Bluetooth: hci4: command tx timeout [ 1839.972369][T11963] Bluetooth: hci0: command tx timeout [ 1840.079571][T11963] Bluetooth: hci4: command tx timeout [ 1841.072959][T16482] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1841.252084][ T3707] hsr_slave_0: left promiscuous mode [ 1841.302158][ T3707] hsr_slave_1: left promiscuous mode [ 1841.303173][ T3707] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1841.343540][ T3707] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1841.490170][ T3707] hsr_slave_0: left promiscuous mode [ 1841.506965][ T3707] hsr_slave_1: left promiscuous mode [ 1841.508689][ T3707] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1841.543173][ T3707] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1842.052110][T11963] Bluetooth: hci0: command tx timeout [ 1842.132533][T11963] Bluetooth: hci4: command tx timeout [ 1843.912800][ T3707] team0 (unregistering): Port device team_slave_1 removed [ 1844.131963][T11963] Bluetooth: hci0: command tx timeout [ 1844.212218][T11963] Bluetooth: hci4: command tx timeout [ 1844.272449][ T3707] team0 (unregistering): Port device team_slave_0 removed [ 1846.112287][T16721] No source specified [ 1846.230075][T11963] Bluetooth: hci0: command tx timeout [ 1846.493451][T11963] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1846.500553][T11963] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1846.586230][T11963] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1846.604291][T11963] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1846.608382][T11963] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1848.960125][T11963] Bluetooth: hci2: command tx timeout [ 1851.345531][T11963] Bluetooth: hci2: command tx timeout [ 1851.692359][ T5921] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 1851.901791][ T5921] usb 9-1: Using ep0 maxpacket: 32 [ 1851.904801][ T5921] usb 9-1: config 0 has an invalid interface number: 51 but max is 0 [ 1851.904827][ T5921] usb 9-1: config 0 has no interface number 0 [ 1851.907297][ T5921] usb 9-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1851.907324][ T5921] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1851.907344][ T5921] usb 9-1: Product: syz [ 1851.907359][ T5921] usb 9-1: Manufacturer: syz [ 1851.907373][ T5921] usb 9-1: SerialNumber: syz [ 1851.913039][ T5921] usb 9-1: config 0 descriptor?? [ 1851.984397][ T5921] quatech2 9-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1852.515496][ T5921] usb 9-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 1852.531805][ T5921] usb 9-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 1853.023837][ T3707] team0 (unregistering): Port device team_slave_1 removed [ 1853.258594][ T1322] ieee802154 phy0 wpan0: encryption failed: -22 [ 1853.258676][ T1322] ieee802154 phy1 wpan1: encryption failed: -22 [ 1853.412180][T11963] Bluetooth: hci2: command tx timeout [ 1853.472721][ T3707] team0 (unregistering): Port device team_slave_0 removed [ 1854.491352][ C0] usb 9-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 1854.582002][ T1238] usb 9-1: USB disconnect, device number 4 [ 1854.594011][ T1238] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 1854.634027][ T1238] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 1854.634989][ T1238] quatech2 9-1:0.51: device disconnected [ 1855.506004][T11963] Bluetooth: hci2: command tx timeout [ 1859.004145][T16764] netlink: 5128 bytes leftover after parsing attributes in process `syz.8.2115'. [ 1859.004928][T16764] netlink: 5128 bytes leftover after parsing attributes in process `syz.8.2115'. [ 1859.004968][T16764] netlink: 640 bytes leftover after parsing attributes in process `syz.8.2115'. [ 1860.063353][T16482] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1861.898732][T16678] chnl_net:caif_netlink_parms(): no params data found [ 1862.062267][ T5907] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 1862.227676][ T5907] usb 9-1: Using ep0 maxpacket: 32 [ 1862.231179][ T5907] usb 9-1: config 0 has an invalid interface number: 51 but max is 0 [ 1862.231205][ T5907] usb 9-1: config 0 has no interface number 0 [ 1862.255919][ T5907] usb 9-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1862.255949][ T5907] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1862.255969][ T5907] usb 9-1: Product: syz [ 1862.255982][ T5907] usb 9-1: Manufacturer: syz [ 1862.255996][ T5907] usb 9-1: SerialNumber: syz [ 1862.296546][ T5907] usb 9-1: config 0 descriptor?? [ 1862.317796][ T5907] quatech2 9-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1862.872575][ T5907] usb 9-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 1862.910983][ T5907] usb 9-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 1863.353855][T15945] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1863.375004][T15945] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1863.379764][T15945] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1863.387647][T15945] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1863.388862][T15945] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1864.168235][T16678] bridge0: port 1(bridge_slave_0) entered blocking state [ 1864.168376][T16678] bridge0: port 1(bridge_slave_0) entered disabled state [ 1864.168623][T16678] bridge_slave_0: entered allmulticast mode [ 1864.171217][T16678] bridge_slave_0: entered promiscuous mode [ 1864.180663][T16693] chnl_net:caif_netlink_parms(): no params data found [ 1864.202165][T16724] chnl_net:caif_netlink_parms(): no params data found [ 1864.233148][T16678] bridge0: port 2(bridge_slave_1) entered blocking state [ 1864.233347][T16678] bridge0: port 2(bridge_slave_1) entered disabled state [ 1864.233551][T16678] bridge_slave_1: entered allmulticast mode [ 1864.240010][T16678] bridge_slave_1: entered promiscuous mode [ 1864.906390][ C0] usb 9-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 1864.908955][ T5907] usb 9-1: USB disconnect, device number 5 [ 1864.956868][T16678] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1864.962355][ T5907] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 1864.973169][ T5907] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 1864.974241][ T5907] quatech2 9-1:0.51: device disconnected [ 1865.068421][T16678] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1865.585877][T11963] Bluetooth: hci3: command tx timeout [ 1866.704193][T16801] No source specified [ 1866.903793][T16678] team0: Port device team_slave_0 added [ 1867.127743][T16678] team0: Port device team_slave_1 added [ 1867.150943][T16693] bridge0: port 1(bridge_slave_0) entered blocking state [ 1867.151024][T16693] bridge0: port 1(bridge_slave_0) entered disabled state [ 1867.151211][T16693] bridge_slave_0: entered allmulticast mode [ 1867.153745][T16693] bridge_slave_0: entered promiscuous mode [ 1867.171078][T16724] bridge0: port 1(bridge_slave_0) entered blocking state [ 1867.171214][T16724] bridge0: port 1(bridge_slave_0) entered disabled state [ 1867.171497][T16724] bridge_slave_0: entered allmulticast mode [ 1867.175795][T16724] bridge_slave_0: entered promiscuous mode [ 1867.304644][T16693] bridge0: port 2(bridge_slave_1) entered blocking state [ 1867.304721][T16693] bridge0: port 2(bridge_slave_1) entered disabled state [ 1867.304861][T16693] bridge_slave_1: entered allmulticast mode [ 1867.306464][T16693] bridge_slave_1: entered promiscuous mode [ 1867.310008][T16724] bridge0: port 2(bridge_slave_1) entered blocking state [ 1867.310095][T16724] bridge0: port 2(bridge_slave_1) entered disabled state [ 1867.310274][T16724] bridge_slave_1: entered allmulticast mode [ 1867.368595][T16724] bridge_slave_1: entered promiscuous mode [ 1867.682365][T11963] Bluetooth: hci3: command tx timeout [ 1868.167954][T16678] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1868.167965][T16678] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1868.167979][T16678] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1868.536760][T16693] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1868.541097][T16678] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1868.541114][T16678] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1868.541146][T16678] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1868.545481][T16724] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1868.716224][T16724] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1868.740513][T16693] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1870.179532][T11963] Bluetooth: hci3: command tx timeout [ 1871.142766][T16724] team0: Port device team_slave_0 added [ 1871.160057][T16693] team0: Port device team_slave_0 added [ 1871.494766][T16829] kernel profiling enabled (shift: 34) [ 1871.494782][T16829] profiling shift: 34 too large [ 1871.524333][T16724] team0: Port device team_slave_1 added [ 1871.534131][T16693] team0: Port device team_slave_1 added [ 1871.600909][T16678] hsr_slave_0: entered promiscuous mode [ 1871.608350][T16678] hsr_slave_1: entered promiscuous mode [ 1871.618383][T16678] debugfs: 'hsr0' already exists in 'hsr' [ 1871.618410][T16678] Cannot create hsr debugfs directory [ 1871.732234][ T1238] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 1871.891940][ T1238] usb 9-1: Using ep0 maxpacket: 16 [ 1871.895358][ T1238] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1871.897655][ T1238] usb 9-1: New USB device found, idVendor=045e, idProduct=0721, bcdDevice=9c.25 [ 1871.897682][ T1238] usb 9-1: New USB device strings: Mfr=0, Product=251, SerialNumber=3 [ 1871.897703][ T1238] usb 9-1: Product: syz [ 1871.897717][ T1238] usb 9-1: SerialNumber: syz [ 1871.946632][ T1238] usb 9-1: config 0 descriptor?? [ 1871.960354][ T1238] usb 9-1: Found UVC 0.00 device syz (045e:0721) [ 1871.960395][ T1238] usb 9-1: No valid video chain found. [ 1872.184413][T16829] netlink: 256 bytes leftover after parsing attributes in process `syz.8.2122'. [ 1872.190121][ T1238] usb 9-1: USB disconnect, device number 6 [ 1872.211902][T11963] Bluetooth: hci3: command tx timeout [ 1872.384364][T16724] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1872.384380][T16724] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1872.384407][T16724] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1872.386910][T16693] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1872.386924][T16693] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1872.386950][T16693] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1872.557984][T16724] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1872.558001][T16724] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1872.558027][T16724] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1872.559819][T16693] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1872.559833][T16693] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1872.559859][T16693] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1876.926214][T16724] hsr_slave_0: entered promiscuous mode [ 1876.927504][T16724] hsr_slave_1: entered promiscuous mode [ 1876.928452][T16724] debugfs: 'hsr0' already exists in 'hsr' [ 1876.928475][T16724] Cannot create hsr debugfs directory [ 1876.969448][T16693] hsr_slave_0: entered promiscuous mode [ 1876.970815][T16693] hsr_slave_1: entered promiscuous mode [ 1876.971720][T16693] debugfs: 'hsr0' already exists in 'hsr' [ 1876.989755][T16693] Cannot create hsr debugfs directory [ 1876.990338][T16784] chnl_net:caif_netlink_parms(): no params data found [ 1883.993545][T16784] bridge0: port 1(bridge_slave_0) entered blocking state [ 1884.003478][T16784] bridge0: port 1(bridge_slave_0) entered disabled state [ 1884.003743][T16784] bridge_slave_0: entered allmulticast mode [ 1884.012117][T16784] bridge_slave_0: entered promiscuous mode [ 1884.096229][T16784] bridge0: port 2(bridge_slave_1) entered blocking state [ 1884.096394][T16784] bridge0: port 2(bridge_slave_1) entered disabled state [ 1884.096674][T16784] bridge_slave_1: entered allmulticast mode [ 1884.112023][T16784] bridge_slave_1: entered promiscuous mode [ 1887.917172][T16910] No control pipe specified [ 1888.406019][T16916] netlink: 4 bytes leftover after parsing attributes in process `syz.8.2137'. [ 1888.907899][T16784] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1889.263951][T16784] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1894.713300][T16784] team0: Port device team_slave_0 added [ 1895.106659][T16784] team0: Port device team_slave_1 added [ 1895.394383][T16784] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1895.394404][T16784] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1895.394432][T16784] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1895.424374][T16784] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1895.424390][T16784] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1895.424415][T16784] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1896.404660][T16784] hsr_slave_0: entered promiscuous mode [ 1896.405993][T16784] hsr_slave_1: entered promiscuous mode [ 1896.406882][T16784] debugfs: 'hsr0' already exists in 'hsr' [ 1896.406907][T16784] Cannot create hsr debugfs directory [ 1898.003296][T15945] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1898.023715][T15945] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1898.025281][T15945] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1898.026674][T15945] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1898.055870][T15945] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1898.655733][ T3707] bridge_slave_1: left allmulticast mode [ 1898.655765][ T3707] bridge_slave_1: left promiscuous mode [ 1898.656008][ T3707] bridge0: port 2(bridge_slave_1) entered disabled state [ 1898.793789][ T3707] bridge_slave_0: left allmulticast mode [ 1898.793824][ T3707] bridge_slave_0: left promiscuous mode [ 1898.812099][ T3707] bridge0: port 1(bridge_slave_0) entered disabled state [ 1898.916341][ T3707] bridge_slave_1: left allmulticast mode [ 1898.916375][ T3707] bridge_slave_1: left promiscuous mode [ 1898.916638][ T3707] bridge0: port 2(bridge_slave_1) entered disabled state [ 1899.029027][T15945] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1899.056327][ T3707] bridge_slave_0: left allmulticast mode [ 1899.056361][ T3707] bridge_slave_0: left promiscuous mode [ 1899.056609][ T3707] bridge0: port 1(bridge_slave_0) entered disabled state [ 1899.057189][T15945] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1899.089815][T15945] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1899.099115][T15945] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1899.105827][T15945] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1899.226951][ T3707] bridge_slave_1: left allmulticast mode [ 1899.226988][ T3707] bridge_slave_1: left promiscuous mode [ 1899.227250][ T3707] bridge0: port 2(bridge_slave_1) entered disabled state [ 1899.314204][ T3707] bridge_slave_0: left allmulticast mode [ 1899.314237][ T3707] bridge_slave_0: left promiscuous mode [ 1899.314497][ T3707] bridge0: port 1(bridge_slave_0) entered disabled state [ 1899.426581][ T3707] bridge_slave_1: left allmulticast mode [ 1899.426620][ T3707] bridge_slave_1: left promiscuous mode [ 1899.426925][ T3707] bridge0: port 2(bridge_slave_1) entered disabled state [ 1899.523633][ T3707] bridge_slave_0: left allmulticast mode [ 1899.523666][ T3707] bridge_slave_0: left promiscuous mode [ 1899.523937][ T3707] bridge0: port 1(bridge_slave_0) entered disabled state [ 1900.132036][T11963] Bluetooth: hci4: command tx timeout [ 1900.162988][ T3707] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1900.312756][ T3707] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1900.397887][ T3707] bond0 (unregistering): Released all slaves [ 1900.702940][ T3707] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1900.802838][ T3707] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1900.875997][ T3707] bond0 (unregistering): Released all slaves [ 1901.252005][T11963] Bluetooth: hci5: command tx timeout [ 1901.306042][ T3707] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1901.394410][ T3707] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1901.476762][ T3707] bond0 (unregistering): Released all slaves [ 1902.092979][ T3707] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1902.153076][ T3707] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1902.214482][ T3707] bond0 (unregistering): Released all slaves [ 1902.222375][T11963] Bluetooth: hci4: command tx timeout [ 1902.262879][T17051] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2144'. [ 1903.331998][T11963] Bluetooth: hci5: command tx timeout [ 1904.292167][T11963] Bluetooth: hci4: command tx timeout [ 1905.411933][T11963] Bluetooth: hci5: command tx timeout [ 1906.611869][T11963] Bluetooth: hci4: command tx timeout [ 1907.491938][T11963] Bluetooth: hci5: command tx timeout [ 1910.672427][ C0] sched: DL replenish lagged too much [ 1915.775838][ T1322] ieee802154 phy0 wpan0: encryption failed: -22 [ 1915.775913][ T1322] ieee802154 phy1 wpan1: encryption failed: -22 [ 1919.738454][T15945] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1919.766518][T15945] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1919.768127][T15945] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1919.769449][T15945] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1919.770348][T15945] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1919.900332][T11963] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 1919.931037][T11963] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 1919.945135][T11963] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 1919.946502][T11963] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 1919.966443][T11963] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 1921.892030][T15945] Bluetooth: hci6: command tx timeout [ 1922.052171][T15945] Bluetooth: hci7: command tx timeout [ 1923.972301][T15945] Bluetooth: hci6: command tx timeout [ 1924.132799][T15945] Bluetooth: hci7: command tx timeout [ 1924.755760][T11963] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 1924.798402][T11963] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 1924.815950][T11963] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 1924.831595][T11963] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 1924.846829][T11963] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 1926.052027][T15945] Bluetooth: hci6: command tx timeout [ 1926.213001][T15945] Bluetooth: hci7: command tx timeout [ 1926.932191][T11963] Bluetooth: hci8: command tx timeout [ 1928.132211][T11963] Bluetooth: hci6: command tx timeout [ 1928.292461][T11963] Bluetooth: hci7: command tx timeout [ 1929.012066][T11963] Bluetooth: hci8: command tx timeout [ 1931.092034][T11963] Bluetooth: hci8: command tx timeout [ 1933.172148][T11963] Bluetooth: hci8: command tx timeout [ 1960.781024][T15945] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1960.804761][T15945] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1960.806334][T15945] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1960.808142][T15945] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1960.810255][T15945] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1962.563799][ T5848] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 1962.590941][ T5848] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 1962.602511][ T5848] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 1962.603757][ T5848] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 1962.604774][ T5848] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 1967.972367][T11963] Bluetooth: hci1: command tx timeout [ 1967.973159][T11963] Bluetooth: hci9: command tx timeout [ 1970.053522][T15945] Bluetooth: hci9: command tx timeout [ 1970.053556][T15945] Bluetooth: hci1: command tx timeout [ 1972.138168][T11963] Bluetooth: hci1: command tx timeout [ 1972.138208][T11963] Bluetooth: hci9: command tx timeout [ 1973.103185][T11963] Bluetooth: hci2: command 0x0406 tx timeout [ 1974.432161][T11963] Bluetooth: hci1: command tx timeout [ 1974.432195][T11963] Bluetooth: hci9: command tx timeout [ 1976.139664][ T1322] ieee802154 phy0 wpan0: encryption failed: -22 [ 1976.139742][ T1322] ieee802154 phy1 wpan1: encryption failed: -22 [ 1980.551167][T11963] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 1980.573721][T11963] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 1980.575203][T11963] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 1980.576404][T11963] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 1980.614840][T11963] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 1982.948425][T17120] Bluetooth: hci11: unexpected cc 0x0c03 length: 249 > 1 [ 1982.982393][T17120] Bluetooth: hci11: unexpected cc 0x1003 length: 249 > 9 [ 1982.990212][T17120] Bluetooth: hci11: unexpected cc 0x1001 length: 249 > 9 [ 1982.991463][T17120] Bluetooth: hci11: unexpected cc 0x0c23 length: 249 > 4 [ 1983.019812][T17120] Bluetooth: hci11: unexpected cc 0x0c38 length: 249 > 2 [ 1985.707833][T11963] Bluetooth: hci10: command tx timeout [ 1986.090865][T11963] Bluetooth: hci12: unexpected cc 0x0c03 length: 249 > 1 [ 1986.140524][T11963] Bluetooth: hci12: unexpected cc 0x1003 length: 249 > 9 [ 1986.153548][T11963] Bluetooth: hci12: unexpected cc 0x1001 length: 249 > 9 [ 1986.158595][T11963] Bluetooth: hci12: unexpected cc 0x0c23 length: 249 > 4 [ 1986.159379][T11963] Bluetooth: hci12: unexpected cc 0x0c38 length: 249 > 2 [ 1987.732198][ T5848] Bluetooth: hci10: command tx timeout [ 1987.812164][ T5848] Bluetooth: hci11: command tx timeout [ 1988.294425][ T5848] Bluetooth: hci12: command tx timeout [ 1989.812088][ T5848] Bluetooth: hci10: command tx timeout [ 1989.892205][ T5848] Bluetooth: hci11: command tx timeout [ 1990.372144][ T5848] Bluetooth: hci12: command tx timeout [ 1991.962110][ T5848] Bluetooth: hci10: command tx timeout [ 1991.985680][ T5848] Bluetooth: hci11: command tx timeout [ 1992.457348][ T5848] Bluetooth: hci12: command tx timeout [ 1994.052393][ T5848] Bluetooth: hci11: command tx timeout [ 1994.531926][ T5848] Bluetooth: hci12: command tx timeout [ 2009.012150][T11963] Bluetooth: hci0: command 0x0406 tx timeout [ 2023.656203][T14260] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 2023.685778][T14260] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 2023.687307][T14260] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 2023.689278][T14260] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 2023.691196][T14260] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 2024.305913][T17120] Bluetooth: hci4: command 0x0406 tx timeout [ 2024.371993][T17120] Bluetooth: hci5: command 0x0406 tx timeout [ 2029.228975][T17130] Bluetooth: hci13: unexpected cc 0x0c03 length: 249 > 1 [ 2029.257312][T17130] Bluetooth: hci13: unexpected cc 0x1003 length: 249 > 9 [ 2029.258951][T17130] Bluetooth: hci13: unexpected cc 0x1001 length: 249 > 9 [ 2029.260360][T17130] Bluetooth: hci13: unexpected cc 0x0c23 length: 249 > 4 [ 2029.261297][T17130] Bluetooth: hci13: unexpected cc 0x0c38 length: 249 > 2 [ 2037.587948][ T1322] ieee802154 phy0 wpan0: encryption failed: -22 [ 2037.588027][ T1322] ieee802154 phy1 wpan1: encryption failed: -22 [ 2041.257248][T17120] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 2041.281428][T17120] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 2041.290590][T17120] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 2041.295002][T17120] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 2041.312408][T17120] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 2044.853538][T17137] Bluetooth: hci14: unexpected cc 0x0c03 length: 249 > 1 [ 2044.883465][T17137] Bluetooth: hci14: unexpected cc 0x1003 length: 249 > 9 [ 2044.887276][T17137] Bluetooth: hci14: unexpected cc 0x1001 length: 249 > 9 [ 2044.891266][T17137] Bluetooth: hci14: unexpected cc 0x0c23 length: 249 > 4 [ 2044.916983][T17137] Bluetooth: hci14: unexpected cc 0x0c38 length: 249 > 2 [ 2047.849360][T17153] Bluetooth: hci15: unexpected cc 0x0c03 length: 249 > 1 [ 2047.878395][T17153] Bluetooth: hci15: unexpected cc 0x1003 length: 249 > 9 [ 2047.880495][T17153] Bluetooth: hci15: unexpected cc 0x1001 length: 249 > 9 [ 2047.881680][T17153] Bluetooth: hci15: unexpected cc 0x0c23 length: 249 > 4 [ 2047.905928][T17153] Bluetooth: hci15: unexpected cc 0x0c38 length: 249 > 2 [ 2052.292623][ T38] INFO: task syz-executor:16724 blocked for more than 143 seconds. [ 2052.292648][ T38] Not tainted syzkaller #0 [ 2052.292659][ T38] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2052.292669][ T38] task:syz-executor state:D stack:21128 pid:16724 tgid:16724 ppid:1 task_flags:0x400140 flags:0x00004004 [ 2052.292715][ T38] Call Trace: [ 2052.292722][ T38] [ 2052.292737][ T38] __schedule+0x16f3/0x4c20 [ 2052.292795][ T38] ? __pfx___schedule+0x10/0x10 [ 2052.292840][ T38] ? _raw_spin_unlock_irq+0x23/0x50 [ 2052.292868][ T38] rt_mutex_schedule+0x77/0xf0 [ 2052.292889][ T38] rt_mutex_slowlock_block+0x5ba/0x6d0 [ 2052.292912][ T38] ? task_blocks_on_rt_mutex+0x78c/0x1380 [ 2052.292953][ T38] rt_mutex_slowlock+0x2b1/0x6e0 [ 2052.292977][ T38] ? rt_mutex_slowlock+0x1c9/0x6e0 [ 2052.293000][ T38] ? __pfx_rt_mutex_slowlock+0x10/0x10 [ 2052.293031][ T38] ? lockdep_hardirqs_on+0x9c/0x150 [ 2052.293059][ T38] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 2052.293086][ T38] ? __pfx_sscanf+0x10/0x10 [ 2052.293113][ T38] ? new_device_store+0x12c/0x6f0 [ 2052.293133][ T38] mutex_lock_nested+0x16a/0x1d0 [ 2052.293161][ T38] ? new_device_store+0x12c/0x6f0 [ 2052.293185][ T38] new_device_store+0x12c/0x6f0 [ 2052.293208][ T38] ? __pfx_new_device_store+0x10/0x10 [ 2052.293226][ T38] ? sysfs_file_kobj+0x1a/0x230 [ 2052.293253][ T38] ? sysfs_file_kobj+0x1e4/0x230 [ 2052.293277][ T38] ? sysfs_kf_write+0x166/0x260 [ 2052.293305][ T38] ? __pfx_sysfs_kf_write+0x10/0x10 [ 2052.293327][ T38] kernfs_fop_write_iter+0x3ad/0x540 [ 2052.293358][ T38] vfs_write+0x5d5/0xb40 [ 2052.293386][ T38] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 2052.293410][ T38] ? __pfx_vfs_write+0x10/0x10 [ 2052.293436][ T38] ? do_sys_openat2+0x154/0x1c0 [ 2052.293453][ T38] ? kmem_cache_free+0x195/0x510 [ 2052.293493][ T38] ksys_write+0x14b/0x260 [ 2052.293519][ T38] ? __pfx_ksys_write+0x10/0x10 [ 2052.293546][ T38] ? do_syscall_64+0xbe/0x3b0 [ 2052.293569][ T38] do_syscall_64+0xfa/0x3b0 [ 2052.293586][ T38] ? lockdep_hardirqs_on+0x9c/0x150 [ 2052.293610][ T38] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2052.293629][ T38] ? clear_bhb_loop+0x60/0xb0 [ 2052.293652][ T38] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2052.293671][ T38] RIP: 0033:0x7f5fa237d6df [ 2052.293688][ T38] RSP: 002b:00007ffdd2e6e5e0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 2052.293708][ T38] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007f5fa237d6df [ 2052.293723][ T38] RDX: 0000000000000003 RSI: 00007ffdd2e6e630 RDI: 0000000000000005 [ 2052.293735][ T38] RBP: 00007f5fa240310d R08: 0000000000000000 R09: 00007ffdd2e6e437 [ 2052.293749][ T38] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003 [ 2052.293761][ T38] R13: 00007ffdd2e6e630 R14: 00007f5fa30f4620 R15: 0000000000000003 [ 2052.293792][ T38] [ 2052.293826][ T38] [ 2052.293826][ T38] Showing all locks held in the system: [ 2052.293836][ T38] 8 locks held by ktimers/0/16: [ 2052.293850][ T38] 1 lock held by khungtaskd/38: [ 2052.293860][ T38] #0: ffffffff8d9a8d80 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 2052.293923][ T38] 4 locks held by kworker/u8:11/3707: [ 2052.293934][ T38] #0: ffff88801a6f4138 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 2052.293981][ T38] #1: ffffc9000cd17bc0 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 2052.294026][ T38] #2: ffffffff8ecc6940 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf7/0x800 [ 2052.294073][ T38] #3: ffffffff8ecd3838 (rtnl_mutex){+.+.}-{4:4}, at: cfg80211_pernet_exit+0x19/0x140 [ 2052.294117][ T38] 2 locks held by dhcpcd/5503: [ 2052.294128][ T38] #0: ffff8880327d4910 (nlk_cb_mutex-ROUTE){+.+.}-{4:4}, at: netlink_dump+0xbd/0xe90 [ 2052.294180][ T38] #1: ffffffff8ecd3838 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_dumpit+0x92/0x200 [ 2052.294228][ T38] 2 locks held by getty/5602: [ 2052.294238][ T38] #0: ffff88823bf3e8a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 2052.294289][ T38] #1: ffffc90003e8b2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x444/0x1410 [ 2052.294335][ T38] 4 locks held by kworker/u9:2/5848: [ 2052.294346][ T38] #0: ffff888035258938 ((wq_completion)hci15#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 2052.294396][ T38] #1: ffffc90004bafbc0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 2052.294442][ T38] #2: ffff8880249fc0a8 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x9b/0x8e0 [ 2052.294487][ T38] #3: ffffffff8ee3b298 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x516/0x8e0 [ 2052.294534][ T38] 4 locks held by kworker/0:4/5907: [ 2052.294546][ T38] 3 locks held by kworker/u8:25/6051: [ 2052.294558][ T38] #0: ffff888019881138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 2052.294603][ T38] #1: ffffc90005417bc0 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 2052.294648][ T38] #2: ffffffff8ecd3838 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 2052.294692][ T38] 3 locks held by kworker/u8:10/9598: [ 2052.294703][ T38] #0: ffff88802ff47138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 2052.294749][ T38] #1: ffffc90005497bc0 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 2052.294795][ T38] #2: ffffffff8ecd3838 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 [ 2052.294841][ T38] 3 locks held by kworker/u8:13/10445: [ 2052.294852][ T38] 6 locks held by kworker/u9:1/11963: [ 2052.294864][ T38] #0: ffff88803405c138 ((wq_completion)hci5){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 2052.294909][ T38] #1: ffffc9000498fbc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 2052.294955][ T38] #2: ffff88804c2c4e80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d4/0x3a0 [ 2052.295000][ T38] #3: ffff88804c2c40a8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x242/0xe30 [ 2052.295047][ T38] #4: ffffffff8ee3b298 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x165/0x310 [ 2052.295093][ T38] #5: ffff88803405d358 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x70/0x680 [ 2052.295139][ T38] 2 locks held by kworker/1:2/12423: [ 2052.295155][ T38] #0: ffff888019898538 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 2052.295200][ T38] #1: ffffc90005477bc0 (free_ipc_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 2052.295248][ T38] 4 locks held by kworker/u9:3/14260: [ 2052.295260][ T38] #0: ffff88804b8b1138 ((wq_completion)hci3#4){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 2052.295310][ T38] #1: ffffc90004cbfbc0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 2052.295355][ T38] #2: ffff88807d2780a8 (&hdev->lock){+.+.}-{4:4}, at: le_conn_complete_evt+0xb1/0x1220 [ 2052.295402][ T38] #3: ffffffff8ee3b298 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm+0x2c/0x140 [ 2052.295451][ T38] 7 locks held by syz-executor/16693: [ 2052.295462][ T38] #0: ffff888034a04488 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x217/0xb40 [ 2052.295511][ T38] #1: ffff88804b9f3c78 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1df/0x540 [ 2052.295556][ T38] #2: ffff888143bc5e18 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x232/0x540 [ 2052.295606][ T38] #3: ffffffff8e542f78 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x360 [ 2052.295650][ T38] #4: ffff8880574d40d8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb6/0x800 [ 2052.295693][ T38] #5: ffff8880574d5300 (&devlink->lock_key#41){+.+.}-{4:4}, at: nsim_drv_remove+0x50/0x160 [ 2052.295743][ T38] #6: ffffffff8ecd3838 (rtnl_mutex){+.+.}-{4:4}, at: nsim_destroy+0xe5/0x670 [ 2052.295786][ T38] 4 locks held by syz-executor/16724: [ 2052.295797][ T38] #0: ffff888034a04488 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x217/0xb40 [ 2052.295845][ T38] #1: ffff88802fae6478 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1df/0x540 [ 2052.295891][ T38] #2: ffff888143bc5d28 (kn->active#53){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x232/0x540 [ 2052.295940][ T38] #3: ffffffff8e542f78 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: new_device_store+0x12c/0x6f0 [ 2052.295985][ T38] 1 lock held by syz-executor/16784: [ 2052.295996][ T38] #0: ffffffff8d9ae730 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x570 [ 2052.296041][ T38] 2 locks held by syz-executor/17025: [ 2052.296052][ T38] #0: ffffffff8ecc6940 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 2052.296098][ T38] #1: ffffffff8ecd3838 (rtnl_mutex){+.+.}-{4:4}, at: ip_tunnel_init_net+0x2ab/0x800 [ 2052.296143][ T38] 2 locks held by syz-executor/17043: [ 2052.296161][ T38] #0: ffffffff8ecc6940 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 [ 2052.296206][ T38] #1: ffffffff8ecd3838 (rtnl_mutex){+.+.}-{4:4}, at: ops_undo_list+0x2a4/0x990 [ 2052.296253][ T38] 3 locks held by syz-executor/17096: [ 2052.296264][ T38] #0: ffff888073ce0e80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x510 [ 2052.296309][ T38] #1: ffff888073ce00a8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x66a/0x1330 [ 2052.296356][ T38] #2: ffffffff8ee3b298 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x230 [ 2052.296399][ T38] 1 lock held by syz-executor/17114: [ 2052.296410][ T38] #0: ffffffff8ecd3838 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8db/0x1c70 [ 2052.296456][ T38] 1 lock held by syz-executor/17119: [ 2052.296468][ T38] #0: ffffffff8ecd3838 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8db/0x1c70 [ 2052.296513][ T38] 4 locks held by kworker/u9:4/17120: [ 2052.296524][ T38] #0: ffff8880281d3138 ((wq_completion)hci6#4){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 2052.296574][ T38] #1: ffffc90004d9fbc0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 2052.296619][ T38] #2: ffff88804e5e00a8 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x9b/0x8e0 [ 2052.296665][ T38] #3: ffffffff8ee3b298 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x516/0x8e0 [ 2052.296710][ T38] 1 lock held by syz-executor/17123: [ 2052.296721][ T38] #0: ffffffff8ecd3838 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8db/0x1c70 [ 2052.296767][ T38] 1 lock held by syz-executor/17129: [ 2052.296778][ T38] #0: ffffffff8ecd3838 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x3b0/0x18b0 [ 2052.296821][ T38] 4 locks held by kworker/u9:5/17130: [ 2052.296832][ T38] #0: ffff88803d0ee138 ((wq_completion)hci13#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 2052.296882][ T38] #1: ffffc90003a47bc0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 2052.296927][ T38] #2: ffff88804aa400a8 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x9b/0x8e0 [ 2052.296971][ T38] #3: ffffffff8ee3b298 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x516/0x8e0 [ 2052.297017][ T38] 1 lock held by syz-executor/17136: [ 2052.297032][ T38] #0: ffffffff8ecd3838 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x3b0/0x18b0 [ 2052.297075][ T38] 4 locks held by kworker/u9:6/17137: [ 2052.297086][ T38] #0: ffff888029be0138 ((wq_completion)hci14#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 2052.297135][ T38] #1: ffffc90004057bc0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 2052.297186][ T38] #2: ffff88806c6180a8 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x9b/0x8e0 [ 2052.297231][ T38] #3: ffffffff8ee3b298 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x516/0x8e0 [ 2052.297277][ T38] 1 lock held by syz-executor/17142: [ 2052.297288][ T38] #0: ffffffff8ecd3838 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x3b0/0x18b0 [ 2052.297332][ T38] 1 lock held by syz-executor/17145: [ 2052.297343][ T38] #0: ffffffff8ecd3838 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x3b0/0x18b0 [ 2052.297387][ T38] 1 lock held by syz-executor/17151: [ 2052.297398][ T38] #0: ffffffff8ecd3838 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x3b0/0x18b0 [ 2052.297441][ T38] [ 2052.297447][ T38] ============================================= [ 2052.297447][ T38] [ 2052.297462][ T38] NMI backtrace for cpu 1 [ 2052.297477][ T38] CPU: 1 UID: 0 PID: 38 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 2052.297498][ T38] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 2052.297509][ T38] Call Trace: [ 2052.297517][ T38] [ 2052.297525][ T38] dump_stack_lvl+0x189/0x250 [ 2052.297554][ T38] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2052.297578][ T38] ? __pfx__printk+0x10/0x10 [ 2052.297610][ T38] nmi_cpu_backtrace+0x39e/0x3d0 [ 2052.297635][ T38] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 2052.297659][ T38] ? __pfx__printk+0x10/0x10 [ 2052.297682][ T38] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 2052.297707][ T38] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 2052.297732][ T38] watchdog+0xf93/0xfe0 [ 2052.297760][ T38] ? watchdog+0x1de/0xfe0 [ 2052.297787][ T38] kthread+0x70e/0x8a0 [ 2052.297815][ T38] ? __pfx_watchdog+0x10/0x10 [ 2052.297836][ T38] ? __pfx_kthread+0x10/0x10 [ 2052.297865][ T38] ? __pfx_kthread+0x10/0x10 [ 2052.297889][ T38] ret_from_fork+0x436/0x7d0 [ 2052.297914][ T38] ? __pfx_ret_from_fork+0x10/0x10 [ 2052.297942][ T38] ? __switch_to_asm+0x39/0x70 [ 2052.297958][ T38] ? __switch_to_asm+0x33/0x70 [ 2052.297974][ T38] ? __pfx_kthread+0x10/0x10 [ 2052.297998][ T38] ret_from_fork_asm+0x1a/0x30 [ 2052.298031][ T38] [ 2052.298038][ T38] Sending NMI from CPU 1 to CPUs 0: [ 2052.298064][ C0] NMI backtrace for cpu 0 [ 2052.298078][ C0] CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 2052.298096][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 2052.298106][ C0] RIP: 0010:__lock_acquire+0x581/0xd20 [ 2052.298126][ C0] Code: 90 31 c9 48 8b 3c 24 0f b6 81 c4 00 00 00 84 c0 0f 84 68 ff ff ff 41 0f b6 f4 0f b6 d0 40 38 c6 0f 42 d6 80 b9 c6 00 00 00 02 <0f> 84 51 ff ff ff 89 d0 e9 4a ff ff ff 48 c7 c7 50 95 87 8d 48 89 [ 2052.298139][ C0] RSP: 0018:ffffc90000156270 EFLAGS: 00000093 [ 2052.298154][ C0] RAX: 0000000000000003 RBX: 0000000000000009 RCX: ffffffff92a33c98 [ 2052.298165][ C0] RDX: 0000000000000003 RSI: 0000000000000003 RDI: ffff88801ae85940 [ 2052.298176][ C0] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8af96440 [ 2052.298186][ C0] R10: dffffc0000000000 R11: fffffbfff1e3ac47 R12: 0000000000000003 [ 2052.298198][ C0] R13: 0000000000000002 R14: ffff88801ae865f0 R15: ffff88801ae865e8 [ 2052.298210][ C0] FS: 0000000000000000(0000) GS:ffff8881268bc000(0000) knlGS:0000000000000000 [ 2052.298224][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2052.298236][ C0] CR2: 00007ff6c783df38 CR3: 0000000027eda000 CR4: 00000000003526f0 [ 2052.298251][ C0] Call Trace: [ 2052.298257][ C0] [ 2052.298268][ C0] ? rt_mutex_slowunlock+0xb0/0x8a0 [ 2052.298285][ C0] lock_acquire+0x120/0x360 [ 2052.298302][ C0] ? rt_mutex_slowunlock+0xb0/0x8a0 [ 2052.298325][ C0] _raw_spin_lock_irqsave+0xa7/0xf0 [ 2052.298344][ C0] ? rt_mutex_slowunlock+0xb0/0x8a0 [ 2052.298361][ C0] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 2052.298384][ C0] rt_mutex_slowunlock+0xb0/0x8a0 [ 2052.298406][ C0] ? reacquire_held_locks+0x127/0x1d0 [ 2052.298428][ C0] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 2052.298447][ C0] ? rt_spin_unlock+0x65/0x80 [ 2052.298466][ C0] enqueue_to_backlog+0x960/0xda0 [ 2052.298485][ C0] ? netif_skb_features+0xb04/0x1540 [ 2052.298503][ C0] netif_rx_internal+0x130/0x560 [ 2052.298524][ C0] ? __pfx_netif_rx_internal+0x10/0x10 [ 2052.298544][ C0] ? rcu_is_watching+0x15/0xb0 [ 2052.298565][ C0] __netif_rx+0xaa/0x110 [ 2052.298581][ C0] loopback_xmit+0x47a/0x6f0 [ 2052.298602][ C0] dev_hard_start_xmit+0x2f0/0x870 [ 2052.298625][ C0] sch_direct_xmit+0x241/0x4b0 [ 2052.298645][ C0] ? __pfx_sch_direct_xmit+0x10/0x10 [ 2052.298666][ C0] __qdisc_run+0xb1b/0x15c0 [ 2052.298690][ C0] __dev_queue_xmit+0x11ff/0x3b70 [ 2052.298706][ C0] ? rt_set_nexthop+0x570/0xa80 [ 2052.298726][ C0] ? __dev_queue_xmit+0x26f/0x3b70 [ 2052.298745][ C0] ? synproxy_pernet+0x23/0x240 [ 2052.298767][ C0] ? __pfx___dev_queue_xmit+0x10/0x10 [ 2052.298783][ C0] ? synproxy_pernet+0x23/0x240 [ 2052.298800][ C0] ? synproxy_pernet+0x23/0x240 [ 2052.298819][ C0] ? __asan_memset+0x22/0x50 [ 2052.298836][ C0] ? __lock_acquire+0xab9/0xd20 [ 2052.298858][ C0] ? ip_output+0x2a1/0x3c0 [ 2052.298875][ C0] ? ip_finish_output2+0xbae/0x11d0 [ 2052.298893][ C0] ip_finish_output2+0xd5a/0x11d0 [ 2052.298910][ C0] ? ip_finish_output2+0x452/0x11d0 [ 2052.298929][ C0] ? __pfx_ip_finish_output2+0x10/0x10 [ 2052.298946][ C0] ? ip_skb_dst_mtu+0x866/0xab0 [ 2052.298963][ C0] ? ip_finish_output+0x33a/0x3f0 [ 2052.298979][ C0] ip_output+0x2a1/0x3c0 [ 2052.298994][ C0] ? ip_output+0x60/0x3c0 [ 2052.299010][ C0] synproxy_send_client_synack+0x8bb/0xe20 [ 2052.299036][ C0] ? __pfx_synproxy_send_client_synack+0x10/0x10 [ 2052.299055][ C0] ? nft_synproxy_eval_v6+0x378/0x560 [ 2052.299072][ C0] ? synproxy_pernet+0x45/0x270 [ 2052.299090][ C0] nft_synproxy_eval_v4+0x36e/0x560 [ 2052.299108][ C0] ? __pfx_nft_synproxy_eval_v4+0x10/0x10 [ 2052.299125][ C0] ? nf_ip_checksum+0x13c/0x510 [ 2052.299143][ C0] nft_synproxy_do_eval+0x345/0x570 [ 2052.299161][ C0] ? __pfx_nft_synproxy_do_eval+0x10/0x10 [ 2052.299184][ C0] nft_do_chain+0x409/0x1920 [ 2052.299205][ C0] ? __pfx_nft_do_chain+0x10/0x10 [ 2052.299223][ C0] ? __lock_acquire+0xab9/0xd20 [ 2052.299247][ C0] ? try_to_take_rt_mutex+0x840/0xb00 [ 2052.299268][ C0] nft_do_chain_inet+0x25d/0x340 [ 2052.299284][ C0] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 2052.299299][ C0] ? __lock_acquire+0xab9/0xd20 [ 2052.299320][ C0] ? NF_HOOK+0x9a/0x3a0 [ 2052.299338][ C0] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 2052.299354][ C0] nf_hook_slow+0xc2/0x220 [ 2052.299375][ C0] NF_HOOK+0x206/0x3a0 [ 2052.299393][ C0] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 2052.299416][ C0] ? NF_HOOK+0x9a/0x3a0 [ 2052.299433][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 2052.299451][ C0] ? ip_rcv_finish_core+0xda3/0x1c00 [ 2052.299471][ C0] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 2052.299490][ C0] ? skb_dst+0x4f/0xd0 [ 2052.299508][ C0] ? ip_local_deliver+0x12a/0x1b0 [ 2052.299527][ C0] NF_HOOK+0x30c/0x3a0 [ 2052.299545][ C0] ? __pfx_ip_rcv_finish+0x10/0x10 [ 2052.299563][ C0] ? NF_HOOK+0x9a/0x3a0 [ 2052.299580][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 2052.299599][ C0] ? __pfx_ip_rcv_finish+0x10/0x10 [ 2052.299621][ C0] ? __pfx_ip_rcv+0x10/0x10 [ 2052.299638][ C0] __netif_receive_skb+0x143/0x380 [ 2052.299655][ C0] ? rt_spin_unlock+0x65/0x80 [ 2052.299673][ C0] ? process_backlog+0x27b/0x900 [ 2052.299691][ C0] process_backlog+0x31e/0x900 [ 2052.299713][ C0] __napi_poll+0xb6/0x540 [ 2052.299732][ C0] net_rx_action+0x707/0xe00 [ 2052.299757][ C0] ? __pfx_net_rx_action+0x10/0x10 [ 2052.299788][ C0] handle_softirqs+0x22f/0x710 [ 2052.299809][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 2052.299830][ C0] run_ktimerd+0xcf/0x190 [ 2052.299848][ C0] ? __pfx_run_ktimerd+0x10/0x10 [ 2052.299867][ C0] ? preempt_schedule_thunk+0x16/0x30 [ 2052.299884][ C0] ? smpboot_thread_fn+0x5f4/0xa60 [ 2052.299902][ C0] ? smpboot_thread_fn+0x4d/0xa60 [ 2052.299918][ C0] smpboot_thread_fn+0x53f/0xa60 [ 2052.299935][ C0] ? smpboot_thread_fn+0x4d/0xa60 [ 2052.299955][ C0] kthread+0x70e/0x8a0 [ 2052.299975][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 2052.299992][ C0] ? __pfx_kthread+0x10/0x10 [ 2052.300012][ C0] ? __pfx_kthread+0x10/0x10 [ 2052.300031][ C0] ret_from_fork+0x436/0x7d0 [ 2052.300049][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 2052.300069][ C0] ? __switch_to_asm+0x39/0x70 [ 2052.300083][ C0] ? __switch_to_asm+0x33/0x70 [ 2052.300096][ C0] ? __pfx_kthread+0x10/0x10 [ 2052.300115][ C0] ret_from_fork_asm+0x1a/0x30 [ 2052.300135][ C0] [ 2052.301068][ T38] Kernel panic - not syncing: hung_task: blocked tasks [ 2052.301083][ T38] CPU: 1 UID: 0 PID: 38 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 2052.301104][ T38] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 2052.301115][ T38] Call Trace: [ 2052.301124][ T38] [ 2052.301132][ T38] dump_stack_lvl+0x99/0x250 [ 2052.301163][ T38] ? __asan_memcpy+0x40/0x70 [ 2052.301184][ T38] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2052.301208][ T38] ? __pfx__printk+0x10/0x10 [ 2052.301239][ T38] vpanic+0x281/0x750 [ 2052.301266][ T38] ? __pfx_vpanic+0x10/0x10 [ 2052.301288][ T38] ? __x2apic_send_IPI_mask+0x1e4/0x260 [ 2052.301307][ T38] ? lockdep_hardirqs_on+0x9c/0x150 [ 2052.301341][ T38] panic+0xb9/0xc0 [ 2052.301364][ T38] ? __pfx_panic+0x10/0x10 [ 2052.301390][ T38] ? irq_work_queue+0xc3/0x140 [ 2052.301415][ T38] ? nmi_trigger_cpumask_backtrace+0x234/0x300 [ 2052.301440][ T38] watchdog+0xfd2/0xfe0 [ 2052.301467][ T38] ? watchdog+0x1de/0xfe0 [ 2052.301494][ T38] kthread+0x70e/0x8a0 [ 2052.301521][ T38] ? __pfx_watchdog+0x10/0x10 [ 2052.301542][ T38] ? __pfx_kthread+0x10/0x10 [ 2052.301571][ T38] ? __pfx_kthread+0x10/0x10 [ 2052.301595][ T38] ret_from_fork+0x436/0x7d0 [ 2052.301620][ T38] ? __pfx_ret_from_fork+0x10/0x10 [ 2052.301648][ T38] ? __switch_to_asm+0x39/0x70 [ 2052.301664][ T38] ? __switch_to_asm+0x33/0x70 [ 2052.301681][ T38] ? __pfx_kthread+0x10/0x10 [ 2052.301705][ T38] ret_from_fork_asm+0x1a/0x30 [ 2052.301739][ T38] [ 2052.302045][ T38] Kernel Offset: disabled