last executing test programs: 8m43.087062969s ago: executing program 3 (id=806): r0 = openat$auto_tracing_saved_tgids_fops_trace(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/tracing/saved_tgids\x00', 0x0, 0x0) pread64$auto(r0, 0x0, 0x6, 0x1) r1 = openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f00000005c0)='/proc/asound/card1/pcm1p/sub4/status\x00', 0x40d80, 0x0) pread64$auto(r1, &(0x7f0000000540)='veth1\x00\xe0,\x17\xa0\xf7\x89Pl\x84K?\x01\x84\xa1i\xe00\x81p\xa0U \f\xdbP`:\xe2\'\xa7\xbf\xbd\x04\x18\xad\x90I^\x99M\xe0W\x14\x11\xf4\xeb\x90:\v\xc5\x13*\xfe\x90\xb1\xa9O\xa5\x05\xaa\x8fTi\xd6\x88Q\xda\xca', 0x20000000003f, 0x1) r2 = socket(0x2, 0x1, 0x106) bind$auto(r2, &(0x7f0000000040)=@in={0x2, 0x3, @multicast2}, 0x6a) setsockopt$auto_SO_RCVBUFFORCE(r1, 0x80000000, 0x21, &(0x7f0000000140)='^\x00', 0x6) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54) openat$dir(0xffffffffffffff9c, 0x0, 0x40000, 0x0) bind$auto(0x3, 0x0, 0x6a) openat$auto_vmuser_fops_vmci_host(0xffffffffffffff9c, &(0x7f0000000040), 0x109001, 0x0) openat$auto_vmuser_fops_vmci_host(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = setfsuid$auto(0xee00) r4 = setfsuid$auto(0xee01) setresuid$auto(r3, r4, r3) lstat$auto(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x1, 0x9, 0x9, 0xefe7, 0xee01, 0xffffffffffffffff, 0x0, 0x7, 0xa, 0x4, 0x1, 0x7, 0x0, 0x80, 0x6, 0x6}) r6 = getpid() shmctl$auto(0x4, 0x1ff, &(0x7f00000004c0)={{0x1, r3, r5, 0xa, 0x3, 0xec4e2c7, 0x3ff}, 0xfffffff8, 0x158efca1, 0x8000000000000000, 0x100000000, @raw=0x8, @inferred=r6, 0x1, 0x0, &(0x7f0000000340)="89a62613e2d107a05fb2734a7392e15af5011a0eb40aae31bab4b62e58ae2747ba0298c5173eecf15493245dba9ccad5d4188daf9d27f7fc25c8a5783be2a134464ae172db5279ea5368758254e1af6afb0c801fbee29316e371d939beb9582081ebdd90097f0784357da7be77b2103a75479a7a09e1e9b1a9b64db9085a275aa382b1fd305e6571a2d863b6c293a6ded0b09e846bc532812b2c3b9b9affdf675cdc57886e73b336576b7f", &(0x7f0000000440)="a8f51a768f0ff5fe08d7e27db8d69739046fd36b9908b25e908cb9506d7091cfaf249fd87f77c2c4d1d1b485b0abc337b6d13185bedf26562f4d6aa40701100bfb78507b4f8c625418bc16193a654233229a258ce0cf7c6ed49c72fa88728f8d4246753df5802c2d920e49342b7fd63ca72e229c283751359b2acd331fd3"}) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) recvfrom$auto(0x3, 0x0, 0x800000000e, 0x100, 0x0, 0xfffffffffffffffd) 8m42.826412625s ago: executing program 3 (id=809): mmap$auto(0x0, 0x899, 0x3ff, 0xeb1, 0x401, 0x8000) socketpair$auto(0x1e, 0x5, 0x4, 0x0) semctl$auto_GETALL(0x0, 0x3148, 0xd, 0x101) mmap$auto(0x0, 0xa020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$auto_NL802154_CMD_GET_WPAN_PHY(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c000097", @ANYRES16=r1, @ANYBLOB="251729bd7000fedbdf250100000008000300", @ANYRES32=0x0, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x41000}, 0x64810) io_uring_setup$auto(0x1, 0x0) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x840, 0x0) mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000) socket(0xa, 0x3, 0x3b) connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) nanosleep$auto(&(0x7f0000000180)={0x0, 0x44d4}, 0x0) getpid() clock_nanosleep$auto(0x9, 0x0, 0x0, 0x0) socketpair$auto(0x1, 0x1, 0x8000000000000000, 0x0) r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) r3 = socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0) select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x7, 0xd3e, 0x1, 0x948b, 0x3, 0x95f4da0a, 0x10001, 0x3, 0x62, 0x80000001, 0x7, 0x6d3f, 0x9, 0x2, 0xfffffffffffffffe]}, 0x0) ioctl$auto_BCH_IOCTL_DISK_RESIZE(r3, 0x4018bc0e, &(0x7f00000000c0)={0x7ff, 0x0, 0x101, 0x9d75}) write$auto(r2, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9) select$auto(0x11, 0x0, 0x0, &(0x7f00000002c0)={[0x1ff, 0x3, 0xd, 0x8, 0x948b, 0x3, 0x15f4da0a, 0x3, 0x1000, 0x62, 0x4000008000001f, 0x3, 0x6d3e, 0x9, 0x2, 0x6]}, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) r4 = openat$auto_ftrace_set_event_notrace_pid_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/tracing/set_event_notrace_pid\x00', 0x582, 0x0) write$auto_console_fops_tty_io(r4, &(0x7f0000001240)='4', 0x1) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0xffffffffffffffff, 0x8000) syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000005480), 0xffffffffffffffff) 8m41.357996765s ago: executing program 3 (id=813): socket(0xa, 0x3, 0x3b) connect$auto(0x3, &(0x7f0000000000)=@generic={0xa, "0000e100"}, 0x58) r0 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) mmap$auto(0x0, 0xe983, 0xdf, 0xeb1, 0x401, 0x8000) fsconfig$auto_HIDEPID_INVISIBLE(r0, 0xb967, &(0x7f0000000040)='{:\x82\x00', &(0x7f0000000080)="c67f2e9f72e8fe0b9519d659ad8b2b2e7b60cca7845886333693e411c9fc7218745057be03aa80139e24f58066c3d39b40490fa77dfb4a42a091dde598bed5213437ebebe196dd5bd5e4575402d5dc8ce1940c01921d0371b0ce093cb07817547a29eb27825678a8c1dce1af0c4c1c2185fa7646552d4696769b163264e05c243ff9162f0fb393699abd8a6e1af947fd043b246ab56f3b09c4a977d7029a89dc3053f9b1389798da4af6b00b8aae8703fd4dd868b31c0cef9aaa735979950a3f27ba398224c125bf89ba4892151b137ea0764680d77f4e02de015304", 0x2) recvmmsg$auto(0x3, 0x0, 0x10000, 0x0, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000020) sendmsg$auto_HSR_C_GET_NODE_STATUS(0xffffffffffffffff, 0x0, 0x4000080) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000) socketpair$auto(0x1, 0x2, 0x8000000000000000, 0x0) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80002, 0x73) socket(0x2, 0x1, 0x84) setsockopt$auto(0x3, 0x84, 0x17, 0x0, 0x27) close_range$auto(0x0, 0xfffffffffffff000, 0x0) 8m40.160851919s ago: executing program 3 (id=828): r0 = socket(0x2, 0x3, 0xa) connect$auto(0x3, &(0x7f0000000080)=@in={0x2, 0x3, @dev={0xac, 0x14, 0x14, 0x10}}, 0x54) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) mmap$auto(0x0, 0xe983, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000) recvmmsg$auto(r0, 0x0, 0x400fffd, 0x0, 0x0) sendmmsg$auto(0x3, 0x0, 0x9a6, 0x7000000) socketcall$auto_SYS_SOCKET(0x1, &(0x7f0000000140)=0x6) ioperm$auto(0x400, 0x7f, 0xd) openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f00000010c0)='/dev/snd/controlC1\x00', 0x2100, 0x0) mmap$auto(0x0, 0x4, 0x4000000000df, 0x78, 0x4, 0x300000000000) r1 = prctl$auto(0x1, 0x5, 0x0, 0x51, 0xf2a3) r2 = openat$auto_snd_timer_f_ops_timer(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) ioctl$auto_SNDRV_TIMER_IOCTL_TREAD64(r2, 0x400454a4, 0x0) openat$auto_fops_blob_file(0xffffffffffffff9c, &(0x7f0000011500), 0x40002, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) write$auto(0x3, 0x0, 0x580000000) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000180), r3) sendmsg$auto_NL80211_CMD_SET_REKEY_OFFLOAD(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="0000001c0031801500550080ac6d44443745ef10de92b9528279a9a0000000"], 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x20048014) sendmsg$auto_NL80211_CMD_SET_POWER_SAVE(r1, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB, @ANYRES16=r4, @ANYBLOB="00022abd7000fcdbdf253d000000080042010a000000"], 0x1c}}, 0x5) r5 = openat$auto_adf_ctl_ops_adf_ctl_drv(0xffffffffffffff9c, &(0x7f0000000000), 0x20140, 0x0) r6 = getpgrp(0x0) bpf$auto_BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)=@task_fd_query={r6, r5, 0x81, 0x220, 0x2, 0x4, 0xffffffffffffffff, 0x7, 0x2}, 0x9) ioctl$auto_IOCTL_STOP_ACCEL_DEV(r5, 0x40096101, &(0x7f0000000240)={@padding, 0xfe}) socket(0xa, 0x3, 0x3a) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) socketpair$auto(0x1e, 0x5, 0x8000000000000000, 0x0) setsockopt$auto(0x3, 0x1, 0x3e, 0x0, 0x9) 8m39.162962456s ago: executing program 3 (id=823): mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) (async) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r0 = io_uring_setup$auto(0x1, 0x0) r1 = socket(0x2, 0x3, 0xa) connect$auto(r1, &(0x7f0000000080)=@l2tp={0x2, 0x0, @loopback}, 0x54) recvmmsg$auto(r1, 0x0, 0x400fffd, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000000100), r2) sendmsg$auto_NL802154_CMD_GET_SEC_LEVEL(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)={0x14, r3, 0xf01, 0x70bd2c, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x40084}, 0x40) (async) sendmsg$auto_NL802154_CMD_GET_SEC_LEVEL(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)={0x14, r3, 0xf01, 0x70bd2c, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x40084}, 0x40) sendmsg$auto_NL802154_CMD_NEW_INTERFACE(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r3, 0x1, 0x70bd29, 0x25dfdbfe, {}, [@NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x44805}, 0x40) r4 = syz_genetlink_get_family_id$auto_nlctrl(&(0x7f0000000240), r2) sendmsg$auto_CTRL_CMD_GETFAMILY2(r1, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x2c, r4, 0x200, 0x70bd25, 0x25dfdbfd, {}, [@CTRL_ATTR_FAMILY_ID={0x6, 0x1, 0x7}, @CTRL_ATTR_FAMILY_ID={0x6, 0x1, 0x9}, @CTRL_ATTR_FAMILY_NAME={0x7, 0x2, '*^\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x31) sendmsg$auto_NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, r3, 0x20, 0x70bd25, 0x25dfdbfb, {}, [@NL802154_ATTR_MAX_BE={0x5, 0x10, 0xfc}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40081}, 0x880) futex$auto(0x0, 0x6, 0x8, 0x0, 0x0, 0xffffffd6) (async) futex$auto(0x0, 0x6, 0x8, 0x0, 0x0, 0xffffffd6) mmap$auto(0x0, 0x4, 0x4000000000df, 0x40eb2, 0x402, 0x300000000000) tkill$auto(0x1, 0x7) (async) tkill$auto(0x1, 0x7) 8m38.647829341s ago: executing program 3 (id=826): mmap$auto(0x0, 0x2020009, 0x3, 0x9000000eb1, 0xfffffffffffffffa, 0x8000) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x7ffd) r0 = socket(0xa, 0x801, 0x84) r1 = io_uring_setup$auto(0x6, 0x0) landlock_restrict_self$auto(r0, 0xffffffc0) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a) syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000000140), r1) prctl$auto_PR_SET_MM_ARG_START(0x100, 0x8, 0x0, 0x8, 0x6) r2 = getpid() process_vm_readv$auto(r2, &(0x7f0000000000)={0x0, 0xfff}, 0x1, &(0x7f0000000280)={&(0x7f0000000080), 0xffffffff}, 0x6, 0x0) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace$auto(0x10, r3, 0x4, 0x7ff) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$auto_snapshot_fops_user(0xffffffffffffff9c, 0x0, 0x80643, 0x0) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x24040, 0x0) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x28, 0x801, 0x0) socket(0xf, 0x3, 0x2) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) open(&(0x7f0000000100)='./bus\x00', 0x1cd27e, 0x12) socket(0x2, 0x1, 0x0) select$auto(0x6, 0x0, 0x0, &(0x7f0000000180)={[0x1ff, 0x3, 0x6, 0x1, 0x9, 0x3, 0x80000000, 0xc, 0x8000000000010001, 0x62, 0x7, 0x7, 0xffffffffffffffdd, 0x206, 0xa, 0x5]}, 0x0) waitid$auto_P_PID(0x1, r3, 0x0, 0x5, 0x0) 8m38.345009421s ago: executing program 32 (id=826): mmap$auto(0x0, 0x2020009, 0x3, 0x9000000eb1, 0xfffffffffffffffa, 0x8000) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x7ffd) r0 = socket(0xa, 0x801, 0x84) r1 = io_uring_setup$auto(0x6, 0x0) landlock_restrict_self$auto(r0, 0xffffffc0) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x3, @empty}, 0x6a) syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000000140), r1) prctl$auto_PR_SET_MM_ARG_START(0x100, 0x8, 0x0, 0x8, 0x6) r2 = getpid() process_vm_readv$auto(r2, &(0x7f0000000000)={0x0, 0xfff}, 0x1, &(0x7f0000000280)={&(0x7f0000000080), 0xffffffff}, 0x6, 0x0) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace$auto(0x10, r3, 0x4, 0x7ff) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$auto_snapshot_fops_user(0xffffffffffffff9c, 0x0, 0x80643, 0x0) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x24040, 0x0) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0x28, 0x801, 0x0) socket(0xf, 0x3, 0x2) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) open(&(0x7f0000000100)='./bus\x00', 0x1cd27e, 0x12) socket(0x2, 0x1, 0x0) select$auto(0x6, 0x0, 0x0, &(0x7f0000000180)={[0x1ff, 0x3, 0x6, 0x1, 0x9, 0x3, 0x80000000, 0xc, 0x8000000000010001, 0x62, 0x7, 0x7, 0xffffffffffffffdd, 0x206, 0xa, 0x5]}, 0x0) waitid$auto_P_PID(0x1, r3, 0x0, 0x5, 0x0) 5.991266562s ago: executing program 4 (id=4601): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$auto_nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async) r2 = getpgid$auto(0x0) sendmsg$auto_NL802154_CMD_GET_SEC_DEVKEY(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r1, 0x2, 0x70bd25, 0x25dfdbfb, {}, [@NL802154_ATTR_SCAN_CHANNELS={0x8, 0x21, 0x10000}, @NL802154_ATTR_IFTYPE={0x8}, @NL802154_ATTR_PID={0x8, 0x1c, r2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20008800}, 0x40) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'vlan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'nr0\x00', 0x0}) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'bond_slave_0\x00', 0x0}) sendmsg$auto_ETHTOOL_MSG_LINKMODES_GET(r3, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x7c, 0x0, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x96d}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x7}]}, @ETHTOOL_A_LINKMODES_HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x200}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x40000}, 0x4000811) (async) r8 = openat$auto_mISDN_fops_timerdev(0xffffffffffffff9c, &(0x7f0000000380), 0x200000, 0x0) ioctl$auto_IMADDTIMER(r8, 0x80044940, &(0x7f00000003c0)=0x8000) r9 = syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000000440), r3) sendmsg$auto_NL80211_CMD_ABORT_SCAN(r0, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x28, r9, 0x200, 0x70bd29, 0x25dfdbfc, {}, [@NL80211_ATTR_BSS_SHORT_SLOT_TIME={0x5, 0x1e, 0x9}, @NL80211_ATTR_DISABLE_HT={0x4}, @NL80211_ATTR_TDLS_OPERATION={0x5, 0x8a, 0xfc}]}, 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x4800) openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000540)='/dev/sg1\x00', 0x400180, 0x0) (async) shmdt$auto(&(0x7f0000000580)='!\x00') (async) lstat$auto(&(0x7f0000000600)='./file0\x00', &(0x7f0000000640)={0x2, 0xb, 0x8, 0x100, 0xee00, 0xffffffffffffffff, 0x0, 0x7, 0x24000000000000, 0x9, 0x3, 0x8, 0x6, 0x8, 0x7, 0x4, 0xa37}) (async) shmctl$auto_SHM_LOCK(0x0, 0xb, &(0x7f0000000780)={{0x3, 0xee00, 0x0, 0x4, 0x8, 0x7, 0x7}, 0x75, 0x2, 0x2, 0x2e6, @inferred=r2, @raw=0x61, 0x5, 0x0, &(0x7f0000000700)="027d81b58d14d2d98510692877553947b08d54a4f3ae8fa7b6bbd950b998bb7ce95df253a7a9273f9218", &(0x7f0000000740)="65bf070795742a269afcdd268b337599237e1bc72bad3776c4ae65a29acdcabd92fdfba5"}) sendmsg$auto_THERMAL_GENL_CMD_TZ_GET_ID(0xffffffffffffffff, &(0x7f0000001080)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001040)={&(0x7f0000000800)={0x814, 0x0, 0x20, 0x70bd29, 0x25dfdbfc, {}, [@THERMAL_GENL_ATTR_TZ_TRIP_ID={0x8, 0x5, 0x5}, @THERMAL_GENL_ATTR_THRESHOLD_DIRECTION={0x8, 0x1a, 0x7}, @THERMAL_GENL_ATTR_TZ_TRIP={0x20c, 0x4, 0x0, 0x1, [@generic="d44407f447ac95b588d21014e92cab9d4e37ddf622b0a29c4f2fdfd0d3125b54ebf7c3ff192b877990ba313fe6b32ffd9b2ec830a588caf8a8b4f5", @generic="a9e93cfdc3af461e69224461181bc9b2c19173631042cf6044bfe0daffd90d6d584ece93f0e91c139d5826a97a9fdcb8144fa09add68f4a857c6a8637414ebe69bc7d56f906aaba8a50edf6c7edf8f39bab1052b12e51d4855fcb0edeb5441cca7aa6d2091d50e75a91fa13d0b2e9587e6ce1f7183a464ff045ff329d49ed2cd9b96113619247079725827a8013a29d883c4e533e2a9ace5474757f9a892d6c46a016c007c", @nested={0x4, 0xd3}, @typed={0x8, 0xae, 0x0, 0x0, @uid=r10}, @nested={0x11a, 0x50, 0x0, 0x1, [@nested={0x4, 0x64}, @generic="55aaa9b08ade5a186317c2923d2d7cf3290a502d8fb024e8ee360d7c8e2560735f7377930f4680d587096d4a238517f31eb425b899f44d40cff853b37eda165d21189f36549f1a75cf561dc13da588e684ee18ab9ae8740904ba65d707d0b0848a646708ca06b6759bf2e59f9317419b883f388cac30cff0009407693bedfd3bf20cfbbd07c63cfbee0582e2317346c52b5eca462f91fbb3ed3c6d4b30a4cc190c25b85f47a349170a9f21c68339e0d00f6887cd7c19e8833694619c3e2b", @nested={0x4, 0x10c}, @typed={0xa, 0x4f, 0x0, 0x0, @str='bond0\x00'}, @typed={0x4, 0x8a}, @nested={0x4, 0xa4}, @generic="23832208a1b208adf57bd923", @typed={0x7, 0xc6, 0x0, 0x0, @str='!+\x00'}, @typed={0x26, 0x94, 0x0, 0x0, @binary="be6ccfb4396a8d74d42f0c9f30c0f03e7c3c123509067356c2a5e74d2d2afd84f101"}]}]}, @THERMAL_GENL_ATTR_CPU_CAPABILITY={0x1cb, 0x14, 0x0, 0x1, [@typed={0x8, 0x81, 0x0, 0x0, @u32=0x10e}, @typed={0x8, 0xdb, 0x0, 0x0, @uid=r11}, @generic="6ab0595272760f517c8f49d1f3e5db7ee39132e6dffc0c20c9dec2462034b103aecdfe12f770d8765d28fb192f3d2d3125fe4ac58eae", @nested={0xbd, 0x13e, 0x0, 0x1, [@nested={0x4, 0x31}, @generic="f36714c329ef9918e7ae028c582d5f8ecba0a5002d6b666874204a020d81d8470d909e5329bb0121d61a4470b04668f7ee18377db046865e42ccd3b0a4944acb6eafda8a3eb695235d306caaed7483fbf021e5a98f79805f196ab3df617fb9096c96a830f8a426a6c74036fd3a887cc910c1de07f29a9cbd1a65a57bd38336ee627ce423060af485b2c8a2a1bd39f7f0c032deb4df325d459017701c41a640827f13baedcf", @nested={0x4, 0x68}, @typed={0xc, 0x66, 0x0, 0x0, @u64=0x401}]}, @generic="ab381b6308fd63a8779741b7fee5eb49f1d86b3880ebe6ca433c52b5b67bf38dd19456c249ba499249cad44e924cb03740e1488cb43a8bd76f74bcc6ce7ce745dc34a6ff115b5c02a604792374b4f3eadfd89523c037955fa1b6517187f22e5869eb5975ad587694afbd7f6b7334ff02e357d710f471608635e67a5890e4621ae6a0fc14365d90259fc3aa235d3afef62ae4b272f58ac4fc6a9c9783042d8bdffa82f5f6bf9ac35b4c7bae6c0de657031d20d298b928c61701c5aa70afe8e9c8f6"]}, @THERMAL_GENL_ATTR_THRESHOLD={0x400, 0x18, 0x0, 0x1, [@nested={0x2e9, 0x138, 0x0, 0x1, [@nested={0x4, 0xc3}, @generic="8422c51dfcb03fb937eb43a67b22d697a8a12327783f138f26deef0cd1d0822d33bdedeb3c7498ae1c4e6c2054605ac9bb2c45a14a5a66b405c0fa510a519fd7d4d0ad0a5009f9e000adab1180c62063dee82b15170cec5b826f81310e41af6c6f1c5c0942343b87bb3f7cd96191a5de6d1f20ee5e552eb13549e34f41de25e70b555b93eff6ffa173e60658ca10a4641f6f9ae99f30df488170c787b4c2e0e37db538c2adf3c90238f47f282db73dc714859acf73027ae3a436cf7720ca932bbee68629980e1192b5fe4db8248b363d3c843299f1486ea33ff9cd1b9ba25a0b4dbf36", @nested={0x4, 0x108}, @nested={0x4, 0xde}, @generic="5791e81123487f9c41ccfaa09bc0a2fda49fc82db23e9d5bc9a96c164cc35f858f6d40d89ac74e1f0653c5231978889be0430c3bb08887fa8efd549821f05642c3d7addf324f96d00d2f56a77e3448fa11d2b688afe068969910511dee51520346331dcbb8e0db7d304ecad8b33ce161ef5cf131e17b68a9a0fc9f36a02ea48296164abeb1e299967092b933ac8bc7d91fdde6f041a585c86238225fccd19b0663591a9b6327ba3387a1913bba59d17e972e75c9656f028f3c55b6737f5798a2740495906ce0aca8a879f5ff93d21d2544b69f73d9710970a33553ed94ac5adadda7c42fb28a02dca1e350977062ca5822c67f81be39", @generic="032f8769f0a51588486fc6507a1610234ce7d4f227d3eaa07bee22101972634fb3c18465982b3e9528a4f5b892382051c06906d9a710da34fb7a26309de46ef19f0deee9307a4e4551f3f524787e6c9d405bf4754cd939504abb3fc8ac33315e02dca2c580e9c6dd96f47ba5ac91a74fd0fb95c36a74289aeed541f3311fef0c562dbae5850c638f231ade1d1ef00057bc4a0c57f48eff4b52438f60fb3c004b7653b484b6dc67b1f3ad94fb91ae7fa963e5cd714c97bb69414246b17a33a78f0911136cc89a81eb064ad2d3a8a43e16f894334de0e83e80e224b67fca36db59ddc2d84fd5b0420c500bfb07c9680912171c59455ebdfe3efd175f18", @nested={0x4, 0xb3}]}, @nested={0x110, 0xb7, 0x0, 0x1, [@generic="cd0a96c47c90f3c783b74b13f266155f61754ca82884f604b20e3d8923617bd2acd68eaadaa7c390ba3722754a6ae681bbb0c889c2d7a908a8775e183f6a2d273f5224939fb61d14a35e289c4230ca385cde88474875fd58a37762677e8d65a5c3a6ba42085b51bce7475823f00395dac76f0941502642d27946326e20eda79b5eca66a4187ffeac546cfcae3751d6f93176dff6cc492fa21dd1e8cdb1", @typed={0x8, 0xb5, 0x0, 0x0, @u32=0x5}, @nested={0x4, 0xec}, @generic="4d2a8adddc382b4d3c51443ab62f3461f2637f55cba1d5981960a76d12116e6316aecf1ff3414da08d91ca423576e82be065205859987b86d3854284b75e0f71f1a3bbd9b169e12846fb6aa469a976", @typed={0xc, 0x54, 0x0, 0x0, @u64}, @typed={0x8, 0xfe, 0x0, 0x0, @fd=r0}]}]}, @THERMAL_GENL_ATTR_TZ_TEMP={0x8, 0x3, 0x4}, @THERMAL_GENL_ATTR_CPU_CAPABILITY_PERFORMANCE={0x8, 0x16, 0x80000000}, @THERMAL_GENL_ATTR_CPU_CAPABILITY_EFFICIENCY={0x8, 0x17, 0x2}]}, 0x814}, 0x1, 0x0, 0x0, 0x10}, 0x8080) (async, rerun: 32) r12 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000010c0)='/sys/devices/platform/serial8250/serial8250:0/serial8250:0.1/tty/ttyS1/port\x00', 0xc400, 0x0) (async, rerun: 32) sendmsg$auto_NL80211_CMD_GET_MESH_CONFIG(r0, &(0x7f0000001200)={&(0x7f0000001140)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000011c0)={&(0x7f0000001180)={0x1c, r9, 0x110, 0x70bd26, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x35}]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x4000001) syz_genetlink_get_family_id$auto_nl80211(&(0x7f0000001240), r3) (async) r13 = openat$auto_seq_oss_f_ops_seq_oss(0xffffffffffffff9c, &(0x7f0000001280)='/dev/sequencer\x00', 0xa000, 0x0) write$auto_seq_oss_f_ops_seq_oss(r13, &(0x7f00000012c0)="4f0c3b2e2702e735c29ccf619aa049f5ba7b144c96cacbd80c728ec223833c89cc841162399cf657f086baff0b29ad04211ec602ccc116eb39ab458728b0da054f5f2ce3d6a337a47896a2fe219f1ab01d73ad9ee02c484ebe97090bac1e46e7179becf5d28840aa0fe60b6580a6845449cb978b86bc34a978629c420d2fa8142080a29cdbcd1a9133ef22e662e02927139a26ead5f2e53539d3e5a5bbc0c980cfc5594b6ec7207cb717e98e7eedb516e29b2ecb63b8c866fb06b2c0f871c1426b872582ef83a74ad05ff83448d59d6412615c34ffd3e8682f9781c59335d2", 0xdf) ioctl$auto_VHOST_SET_VRING_CALL2(0xffffffffffffffff, 0x4008af21, &(0x7f00000013c0)={0x0, r3}) ioctl$sock_SIOCGIFINDEX(r14, 0x8933, &(0x7f0000001400)={'dummy0\x00'}) r15 = openat$auto_wakeup_sources_stats_fops_wakeup(0xffffffffffffff9c, &(0x7f0000001440), 0x240000, 0x0) r16 = bpf$auto_BPF_OBJ_GET(0x7, &(0x7f0000001480)=@link_update={r15, @new_map_fd=r12, 0xffffffff, @old_prog_fd=r3}, 0x0) r18 = syz_genetlink_get_family_id$auto_smc_gen_netlink(&(0x7f0000001580), r17) sendmsg$auto_SMC_NETLINK_GET_DEV_SMCD(r16, &(0x7f0000001680)={&(0x7f0000001540)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x5c, r18, 0x400, 0x70bd2b, 0x25dfdbfe, {}, "9de1af7f52144916fe2dec3aeb8e2188b2f535f962e7c141baaf8e253b13008cd203a5044ba835ab16ba8fa132db802e23ab7fc9867c0ebaefbaa69e34b4f83ec4eddeb26c"}, 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x800) 5.939047113s ago: executing program 4 (id=4602): mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000200)='/sys/devices/system/node/node1/compact\x00', 0xc2481, 0x0) writev$auto(r0, &(0x7f0000000080)={&(0x7f0000000040), 0x1000}, 0x3) move_pages$auto(0x1, 0xf54, 0x0, 0x0, 0x0, 0x8000000000000000) rt_tgsigqueueinfo$auto(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000100)={@siginfo_0_0={0x6, 0xe, 0x5, @_sigchld={0x0, 0x0, 0x401, 0x5, 0x7}}}) open(&(0x7f0000000140)='./file0\x00', 0x2a4c0, 0x40) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/devices/netdevsim0/del_port\x00', 0xa001, 0x0) mmap$auto(0x0, 0x8, 0xdf, 0x9b72, 0x2, 0x8000) close_range$auto(0x2, 0x8, 0x0) socketpair$auto(0x21, 0x5, 0x8000000000000000, 0x0) r1 = open(0x0, 0x22240, 0x55) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket(0xa, 0x2, 0x0) connect$auto(0x3, &(0x7f00000018c0)=@generic={0xa}, 0x55) statx$auto(r1, 0x0, 0x2001003, 0x4005, 0x0) setsockopt$auto(0x3, 0x1, 0x41, 0x0, 0x88) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) io_uring_setup$auto(0x3, 0x0) close_range$auto(0x2, 0x8, 0x0) r2 = openat$auto_sw_sync_debugfs_fops_sync_debug(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0) ioctl$auto_SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, 0x0) openat$auto_usbdev_file_operations_usb(0xffffffffffffff9c, 0x0, 0x2901, 0x0) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) close_range$auto(0x0, 0x5, 0x0) pipe$auto(0x0) pipe$auto(0x0) tee$auto(0x2000000000000, 0x3, 0x402, 0xd) r3 = socket(0x11, 0x80003, 0x300) sendfile$auto(0x1, r3, 0x0, 0x8fb5) 5.785041152s ago: executing program 1 (id=4604): unshare$auto(0x40000080) close_range$auto(0x2, 0x8, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) r0 = socket(0x2, 0x1, 0x0) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dmmidi2\x00', 0x90043, 0x0) openat$auto_proc_gid_map_operations_base(0xffffffffffffff9c, &(0x7f0000001480)='/proc/thread-self/gid_map\x00', 0x24441, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) bind$auto(0x3, &(0x7f0000000040)=@in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x37}}, 0x6e) socket(0x1d, 0x2, 0x2) mmap$auto(0x0, 0x20009, 0xdf, 0xeb1, 0x401, 0x8000) connect$auto(0x3, 0x0, 0x55) r1 = socket(0x10, 0x3, 0x6) socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0) write$auto(0x3, 0x0, 0x5c8) close_range$auto(r1, 0xfffffffffffff000, 0x4000000000002) socket(0xa, 0x5, 0x0) io_uring_setup$auto(0x6, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$auto(0x1e, 0x4, 0x8000000000000000, 0x0) write$auto(0x3, 0x0, 0x5c8) sendmmsg$auto(r0, &(0x7f0000000140)={{&(0x7f0000000040), 0x12, 0x0, 0x9, 0x0, 0x1f, 0xb}, 0x800009}, 0x9, 0x7) socketpair$auto(0x1e, 0xb9, 0x8000000000000000, 0x0) setsockopt$auto(0x3, 0x0, 0x3e, 0x0, 0x4) syz_genetlink_get_family_id$auto_nl80211(0x0, r0) shmctl$auto_IPC_INFO(0x8, 0x3, &(0x7f0000000280)={{0x9, 0xee00, 0xee00, 0x8, 0x1b, 0x351, 0x6}, 0xfffffffb, 0xd, 0x9, 0xfffffffffffff4b2, @inferred, @inferred=0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000080)="83deb4ac3a82c74bb2876eba2cb9db689d80d463b25c3953bb1017c44c797cc35b957b8008338657484626827895b8034b5654a49e54ae65dd514bbdb1b14762812903b1fa4a36f6f4508efdaf8321403fbb6d7ec57776caf8043834", &(0x7f0000000180)="e91da2648ba18eb97a5478dbf4a91f6e8225cc67de8e651d10272b6a59239f1ca6f03ce7910bacb7c66bd2cc4137655a92448ee00428a49dfa6189ed3c3206d7baefd770f7e222e7474a75d8ab1241d2dc452274e18b070eceec7830e3d935df5094233b77dc78fa794fb729f35c2670c2aeea8a9af869ca4d22864d2699eac4bb3a17275d77190a2accdda921790f00830b7d0ca51ba73699ac67127631ed43e7ddb24d6a0b8967e25c93f5c6aef2a1a17a0730f25b311d5d18b002438a4dde9a08ea6364bced05605d15d1a5532601d26e67"}) msgctl$auto_MSG_STAT(0x4, 0xb, &(0x7f0000000340)={{0x6, 0xee00, 0xee00, 0x1ff, 0x7, 0xb, 0x8}, &(0x7f0000000100)=0x5, &(0x7f0000000300)=0x2d, 0x2ac, 0xffffffffffffffff, 0x1, 0x3, 0x275, 0x0, 0x0, 0x68b7, @inferred=r3}) msgctl$auto(0x823, 0x1, &(0x7f0000000440)={{0x7, r2, r4, 0x8, 0x4, 0x4, 0x8a3}, &(0x7f00000003c0)=0x1, &(0x7f0000000400)=0xfb, 0x0, 0x56, 0x7, 0x3, 0x0, 0x9, 0x0, 0x0, @raw=0x5}) sendmsg$auto_NL80211_CMD_GET_REG(r0, 0x0, 0x8) unshare$auto(0x4760) 5.452884359s ago: executing program 2 (id=4609): mmap$auto(0x0, 0x2000a, 0x10000000000df, 0xeb6, 0x401, 0x8000) r0 = socket$nl_generic(0x10, 0x3, 0x10) openat$auto_proc_mountinfo_operations_mnt_namespace(0xffffffffffffff9c, &(0x7f0000000440)='/proc/thread-self/mountinfo\x00', 0x800, 0x0) unshare$auto(0x40000080) write$auto(0xffffffffffffffff, &(0x7f0000000400)='/de\xef\xe7auDio1\x00\f\'\x8b\xd9\xfeN\xcd#)\x8c\x89>-o\xd7\x8f$\xac\xfc\xa2\xccm\x0e \xfb\xe5\xe9\x92\xaa\xef\x84$\x84Ia>6pV;{\'\xaa\xbeS\x14\xb6\xd2\xf6\xb7\xcd\xf6P\x05X\x1dK\x18\x99\x02\xb3\x0fY0\x80\x99\xe3\x0e\xa2D\xc0\xecE\x86\xd9J\x9c\xa8\x98\x02\xdb\xf1\x81TMpS\xc5\xab\xa1\x1bG\v>\x03\xf7\xe1\xaf\xe3\x04\xc3 ffF\x0f\xa6}\xa3\xa8\xd1\xe2\xd0QG\xa6\xa6\x8e7\x80\xd9\xd0\xdf\xad\xb1\x15\xca\xbb\xd5j\x94\xc6<\x18\x15\xcc\x8d\x14\xd8\xb8L\x03\xdd~\xe7%\xcb\xdd\xda!\xd45Z\xd0\xfc\x1b\xf0\xe1\xd6:\xd7\xe9N\xc1W\xe3\xae\xe9\xb27>k\xf8\xdf\xe1\xf9\xcc\xcb\v\x01D\xc3\xa9T\xb9UY\xaf\xa4\xe4\xfec\xa3\x9bI@\xb7w\xf8\x14\xc0\xd5\xd5\x95', 0x8) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_batadv(&(0x7f0000001f80), r1) sendmsg$auto_GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x8000}, 0x4000804) lstat$auto(0x0, &(0x7f0000000180)={0x1, 0x10, 0x9, 0x63, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1000, 0xfffffffffffffffd, 0x7ffffffb, 0x0, 0xffffffff7ffffffc, 0x9, 0x7, 0x200000100103}) mmap$auto(0x0, 0x10000000003, 0x89b3, 0xeb1, r0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x89fc, 0x0) readahead$auto(r2, 0x80000001, 0xffffffffffffffff) socket(0x18, 0xa, 0x2) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x14be02, 0x0) r3 = socket(0x11, 0x2, 0x9) capset$auto(0x0, &(0x7f0000000000)={0x4000002, 0x4, 0x7234}) sendmmsg$auto(r3, &(0x7f00000001c0)={{&(0x7f0000000000), 0x1aa, &(0x7f0000000100)={&(0x7f00000003c0), 0x48}, 0x6, &(0x7f0000000180), 0x5, 0x1000}, 0x5}, 0x2, 0x100) mmap$auto(0x3ff, 0x810004, 0xffb, 0x8000000008011, r3, 0x8000) openat$auto_tty_fops_tty_io(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nbd8\x00', 0x0, 0x0) ioctl$auto(r4, 0xab02, r4) prctl$auto_PR_SCHED_CORE_SHARE_FROM(0x5, 0x3, 0x0, 0xffffff7ffffffffd, 0x82) socket(0x10, 0x4, 0x100) io_uring_register$auto_IORING_REGISTER_PBUF_RING(0xffffffffffffffff, 0x16, &(0x7f00000002c0)="d05d6f2f716f74230faba010656e878f1af86cd29108de4bf8bb61f80c2d38d4a7038ba0c7c51f76e06d4a15ba90d087513109136561924733c1d54fc9a8f5ee48b052879f664c3f8328365e88c643d7de7d513c46d805b35a6cae38c311835bed572cd39d6b1a5bbf0d8d56cb1076a94e85efd3508e8bd8def432f349860acb37d323f298ec9b4feb8b7ac48f397930a1fcf4f29bff8a8b28ac893866859ec288ac1b44d22ba0ec052a304f187342c3f6129dd96052217f549f3c71105d481a399a8262df0fd090807cdbb56033bbe801", 0x5) r5 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r5, &(0x7f0000000500)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tu\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc70\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d7) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/system/machinecheck/machinecheck1/check_interval\x00', 0x2062, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 5.403644729s ago: executing program 1 (id=4610): r0 = socket(0xa, 0x5, 0x0) mmap$auto(0x0, 0x400008, 0xde, 0x9b72, 0x2, 0x8000) bind$auto(0x3, &(0x7f0000000080), 0x6b) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) move_pages$auto(0x1, 0xf54, 0x0, 0x0, 0x0, 0x8000000000000000) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000001400)='ns/mnt\x00') ioctl$NS_GET_PARENT(r1, 0x8008b705, 0x0) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) setsockopt$auto(0x3, 0x10000000084, 0xc, 0x0, 0x4) listen$auto(0x3, 0x81) mmap$auto(0x0, 0x2020006, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) socket(0xa, 0x3, 0x3b) close_range$auto(0x2, 0x8, 0x0) r2 = socket(0x18, 0x1, 0x401) mmap$auto(0x1, 0xc, 0x3, 0xc43e, r0, 0xffffffffffffffff) close_range$auto(0x2, 0x8, 0x0) socket(0x10, 0x2, 0xc) socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) close_range$auto(0x2, 0x8, 0x0) r4 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x6ab82, 0x0) ioctl$auto_KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$auto(0x3, 0xae41, r4) ioctl$auto_KVM_GET_MSRS(r3, 0xc008ae88, &(0x7f0000000080)={0x2, 0x0, [{0xc0010141, 0x400, 0x9}]}) clone$auto(0x20003b46, 0x2, 0x0, 0x0, 0x2) prctl$auto(0x10000000024, 0x2, 0x2008, 0x4000000c, 0x80001) mmap$auto(0x0, 0xdf53, 0xfffffffffffffe06, 0x16, r2, 0x48) socket(0x2, 0x80002, 0x73) r5 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/mm/swap/vma_ra_enabled\x00', 0xe3102, 0x0) sendfile$auto(r5, r5, 0x0, 0x3) 5.166962479s ago: executing program 4 (id=4611): mmap$auto(0x0, 0x6, 0x6, 0xeb1, 0xfffffffffffffffa, 0x3) r0 = openat$auto_sg_fops_sg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sg0\x00', 0x2, 0x0) readv$auto(0x3, &(0x7f00000001c0)={0x0, 0x7fffffffefff}, 0x7) bpf$auto_BPF_LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000240)=@bpf_attr_11={0xfffffffffffffffe, 0x2, 0xa34, 0xb0, 0x8, 0x401, 0x4}, 0xff8) r1 = open(&(0x7f0000000800)='./file0\x00', 0x22240, 0x154) execveat$auto(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) write$auto_sg_fops_sg(r0, &(0x7f0000001380)="4a0200000000040000899edb615550fd8c44924d87f0010047eb02eff5d2adc245a4e1eded0e91b86c61b6b42ed6", 0x2e) 5.110451461s ago: executing program 1 (id=4612): mmap$auto(0x0, 0x2020009, 0x7, 0xeb1, 0xfffffffffffffffa, 0x8000) close_range$auto(0x0, 0xfffffffffffff000, 0x4000000000002) r0 = memfd_create$auto(0x0, 0x9) fcntl$auto(0xff80000000000000, 0x409, 0x13) fallocate$auto(r0, 0x3, 0x2, 0x4) r1 = openat$auto_hwsim_simulate_radar_(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/ieee80211/phy7/hwsim/dfs_simulate_radar\x00', 0x40002, 0x0) write$auto(r1, &(0x7f0000000040)='7\x00\\\xa0\x04|\x03\xcb\x12\xfa\b\x1c\xc7k', 0x81) 5.020203745s ago: executing program 4 (id=4613): syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000080), 0xffffffffffffffff) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000040)='/sys/module/uvcvideo/parameters/nodrop\x00', 0xa3182, 0x0) symlink$auto(&(0x7f0000001500)='./file0/file0\x00', 0x0) mmap$auto(0x0, 0x20009, 0xe3, 0x100000eb1, 0x40000000000a1, 0x8000) (async) mmap$auto(0x0, 0x20009, 0xe3, 0x100000eb1, 0x40000000000a1, 0x8000) r0 = io_uring_setup$auto(0x401, 0x0) close_range$auto(0x2, 0x8, 0x0) prctl$auto_PR_SET_MM_BRK(0xfffffff7, 0x7, 0x0, 0x2, 0x2) syz_genetlink_get_family_id$auto_macsec(&(0x7f0000000100), r0) (async) syz_genetlink_get_family_id$auto_macsec(&(0x7f0000000100), r0) socket(0x11, 0x3, 0x2) (async) socket(0x11, 0x3, 0x2) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/cifs/Stats\x00', 0x28102, 0x0) (async) openat$auto_proc_reg_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000040)='/proc/fs/cifs/Stats\x00', 0x28102, 0x0) readv$auto(r0, &(0x7f0000000a80)={0x0, 0xffff}, 0xbf85) (async) readv$auto(r0, &(0x7f0000000a80)={0x0, 0xffff}, 0xbf85) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) getrandom$auto(0x0, 0x6000000, 0x3) listmount$auto(0xfffffffffffffffd, 0x0, 0x8, 0x0) (async) listmount$auto(0xfffffffffffffffd, 0x0, 0x8, 0x0) remap_file_pages$auto(0x6a27, 0x1000, 0x0, 0x3, 0x4) mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2) madvise$auto(0x110c230000, 0x1, 0x9) (async) madvise$auto(0x110c230000, 0x1, 0x9) openat$auto_proc_iter_file_ops_compat_inode(0xffffffffffffff9c, &(0x7f0000000080)='/proc/pagetypeinfo\x00', 0x43102, 0x0) socket(0xa, 0x2, 0x0) (async) r1 = socket(0xa, 0x2, 0x0) setsockopt$auto(r1, 0x29, 0x30, 0x0, 0x56b) mmap$auto(0x0, 0x40009, 0x36, 0x9b72, 0x7, 0x28000) mmap$auto(0x0, 0x400008, 0xdc, 0x9b72, 0x2, 0x8000) mmap$auto(0x0, 0x400108, 0xdf, 0x9b72, 0x2, 0x8000) read$auto(0xffffffffffffffff, 0x0, 0xb4d3) (async) read$auto(0xffffffffffffffff, 0x0, 0xb4d3) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0xe0180, 0x0) (async) r2 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0xe0180, 0x0) ioctl$auto_KVM_CREATE_VM(r2, 0xae01, 0x0) mbind$auto(0x0, 0x2091d2, 0x4, 0x0, 0x6, 0x2) mremap$auto(0x4000, 0xb8, 0x13fd4, 0x3, 0xfffff000) madvise$auto(0x0, 0x2003f0, 0x18) mlock$auto(0x5, 0xffff) 4.975842964s ago: executing program 1 (id=4614): close_range$auto(0x0, 0x5, 0x0) socket(0x23, 0x80805, 0x0) epoll_create$auto(0x3e) socket(0x2, 0x80002, 0x73) openat$auto_configfs_file_operations_configfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/config/target/core/alua/lu_gps/default_lu_gp/lu_gp_id\x00', 0x189002, 0x0) r0 = openat$auto_hwsim_fops_rx_rssi_(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/ieee80211/phy0/hwsim/rx_rssi\x00', 0x404402, 0x0) mmap$auto(0x0, 0x20009, 0x7fffffff, 0xeb1, 0x401, 0x8000) r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/adr\x00', 0x0, 0x0) read$auto_hwsim_fops_rx_rssi_(r0, &(0x7f0000000100)=""/141, 0x8d) read$auto(r1, 0x0, 0x20) write$auto(0x3, 0x0, 0x81) 4.751747408s ago: executing program 1 (id=4615): mmap$auto(0x0, 0x20009, 0x4000800000df, 0xeb1, 0x401, 0x400000000008000) adjtimex$auto(&(0x7f0000000200)={0x5f95, 0x0, 0x2, 0x2000000a, 0xff7d, 0xbc58, 0x4000005, 0x0, 0x5, 0x8, 0x80000000, {0x7ff, 0xf423f}, 0x2744, 0x200000001, 0xff, 0x7, 0x0, 0x3c8, 0x8, 0x8, 0xffffffffffffffff, 0x1560cc85, 0x9}) sendmmsg$auto(0x3, 0x0, 0x787b, 0x7000000) sched_get_priority_min$auto(0x40) timer_create$auto(0xb, 0x0, 0x0) timer_settime$auto(0x0, 0xffff8000, &(0x7f00000000c0)={{0xf, 0x10007}, {0x9}}, 0x0) adjtimex$auto(&(0x7f0000000500)={0x3ffa34bb, 0x0, 0xfffffffffffffff5, 0xffffffffffffffff, 0x3, 0x9, 0x26ab, 0x0, 0x8, 0xa, 0x0, {0x9, 0x3}, 0x10, 0x5, 0xffffffffffffffff, 0x8, 0x0, 0x5, 0x8, 0x8001, 0x51b, 0x7, 0x0, 0x0, 0x7000000}) 4.591825508s ago: executing program 4 (id=4617): mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) r0 = openat$auto_cec_devnode_fops_cec_priv(0xffffffffffffff9c, &(0x7f0000002c00)='/dev/cec18\x00', 0x900, 0x0) ioctl$auto_CEC_DQEVENT(r0, 0xc0506107, &(0x7f0000000280)={0x4, 0x80003, 0xa, @state_change={0x200, 0x9, 0x3}}) r1 = openat$auto_snd_pcm_oss_f_reg_pcm_oss(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/audio1\x00', 0x80502, 0x0) ioctl$auto_SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f00000000c0)) openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/controlC1\x00', 0x20400, 0x0) r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D3\x00', 0x204a1, 0x0) prctl$auto(0xb9, 0x1, 0x0, 0x5, 0x80) mmap$auto(0x0, 0x4, 0x9, 0xeb6, 0xffffffffffffffff, 0x8000) socketpair$auto(0x29b6c2c2, 0x2, 0x8000000000000000, 0x0) socketpair$auto(0x4, 0x2, 0x10, &(0x7f0000000040)=0x9) select$auto(0xe, 0x0, 0x0, &(0x7f00000002c0)={[0x4001ff, 0x7, 0x6, 0x1, 0x948b, 0x3, 0x6, 0x572f14df, 0x80000000, 0x80000000, 0x0, 0x7, 0x6d3c, 0x4, 0x2, 0x1]}, 0x0) write$auto(r2, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9) openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f0000000180)='/dev/snd/controlC0\x00', 0x10b500, 0x0) unshare$auto(0x40000080) r3 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) setresuid$auto(0xffffffffffffffff, 0x0, 0x0) write$auto(r3, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) mmap$auto(0x0, 0x2020007, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) madvise$auto(0x0, 0xffffffffffff0005, 0x19) madvise$auto(0x0, 0x2003f2, 0x15) madvise$auto(0x0, 0x200007, 0x19) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) openat$auto_proc_pagemap_operations_internal(0xffffffffffffff9c, &(0x7f0000000300)='/proc/thread-self/pagemap\x00', 0x1, 0x0) mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, r1, 0x8000) openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_submit$auto(0x6, 0x7f, &(0x7f0000000040)=&(0x7f0000000000)={0x6fffffffffffff, 0xb, 0x8, 0x3, 0x2, 0x3b, 0xfffffffffffffc00, 0x2, 0xfff, 0x0, 0x6}) writev$auto(0xc8, &(0x7f00000028c0)={&(0x7f0000000000), 0x200}, 0x9) 4.387443818s ago: executing program 0 (id=4618): r0 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ram11\x00', 0x14be02, 0x0) mmap$auto(0x0, 0x810004, 0xffb, 0x8000000008011, 0x3, 0x8000) preadv2$auto(r0, &(0x7f0000000080)={0x0, 0x80000003}, 0x6, 0xffffffffffffffff, 0x0, 0x2f) ioctl$auto_BLKFLSBUF(r0, 0x1261, 0x0) r1 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/conf/veth1_to_hsr/accept_local\x00', 0x2002, 0x0) getsid$auto(0x0) sendfile$auto(r1, r1, 0x0, 0x80000000003) openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, 0x0, 0x40000, 0x0) mmap$auto(0x7, 0xaf, 0x4, 0x17, r1, 0x80000004) rseq$auto(0x0, 0x2, 0x0, 0x5) r2 = openat$auto_vhost_net_fops_net(0xffffffffffffff9c, 0x0, 0x105000, 0x0) ioctl$auto_VHOST_SET_BACKEND_FEATURES(r2, 0x4008af25, &(0x7f0000000000)=0x7) mmap$auto(0x0, 0x9, 0x8000, 0xe238, 0x602, 0x5) rseq$auto(0x0, 0xfffffffe, 0x3, 0xff) r3 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snd/midiC2D0\x00', 0x8001, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r3, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9) mmap$auto(0x0, 0x4020009, 0xdf, 0xeb1, 0x401, 0x8000) keyctl$auto(0x1f, 0x1, 0x6, 0x3, 0x3ff) madvise$auto(0x0, 0xffffffffffff0005, 0x19) mlock$auto(0x1004, 0x6) mlockall$auto(0x800000000000005) clone$auto(0x100000001, 0x4, 0x0, 0x0, 0x200) madvise$auto(0x0, 0x200007, 0x19) mmap$auto(0x1, 0x40009, 0xdf, 0x13, r3, 0x7) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, 0x0, 0x8df41, 0x0) msync$auto(0x1ffff000, 0x1800000ff000000, 0x400000004) r4 = openat$auto_proc_pid_smaps_operations_internal(0xffffffffffffff9c, &(0x7f0000000b00)='/proc/self/smaps\x00', 0x42000, 0x0) read$auto_proc_pid_smaps_operations_internal(r4, &(0x7f00000002c0)=""/190, 0xfffffe39) socket$nl_generic(0x10, 0x3, 0x10) 4.324851233s ago: executing program 1 (id=4619): r0 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) write$auto(0xffffffffffffffff, 0x0, 0x0) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r0, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000e3d9) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) pivot_root$auto(0x0, 0x0) pivot_root$auto(&(0x7f0000000040)='-\x00', &(0x7f0000000080)=',)(') open(0x0, 0x7ffd, 0x12) kexec_load$auto(0x9, 0x0, 0x0, 0x1003e0000) mmap$auto(0x0, 0x2020009, 0x3, 0xf8, 0xfffffffffffffffa, 0x8000) madvise$auto(0x0, 0x2000040080000008, 0x12) madvise$auto(0x0, 0x7fffffffffffffff, 0xa) mmap$auto(0x7f, 0x82020009, 0x3, 0xeb1, 0xffffffffffffffff, 0xfff) r1 = socket(0x2, 0x2, 0x0) getsockopt$auto_SO_BPF_EXTENSIONS(r1, 0x70000, 0x30, 0x0, 0x0) connect$auto(0x3, 0x0, 0x10) unshare$auto(0x40000080) socket(0x2, 0x2, 0x1) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) (async) write$auto(0xffffffffffffffff, 0x0, 0x0) (async) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) (async) write$auto(r0, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000e3d9) (async) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x2, 0x8000) (async) pivot_root$auto(0x0, 0x0) (async) pivot_root$auto(&(0x7f0000000040)='-\x00', &(0x7f0000000080)=',)(') (async) open(0x0, 0x7ffd, 0x12) (async) kexec_load$auto(0x9, 0x0, 0x0, 0x1003e0000) (async) mmap$auto(0x0, 0x2020009, 0x3, 0xf8, 0xfffffffffffffffa, 0x8000) (async) madvise$auto(0x0, 0x2000040080000008, 0x12) (async) madvise$auto(0x0, 0x7fffffffffffffff, 0xa) (async) mmap$auto(0x7f, 0x82020009, 0x3, 0xeb1, 0xffffffffffffffff, 0xfff) (async) socket(0x2, 0x2, 0x0) (async) getsockopt$auto_SO_BPF_EXTENSIONS(r1, 0x70000, 0x30, 0x0, 0x0) (async) connect$auto(0x3, 0x0, 0x10) (async) unshare$auto(0x40000080) (async) socket(0x2, 0x2, 0x1) (async) 3.824612892s ago: executing program 0 (id=4620): mmap$auto(0x0, 0x2000c, 0xdf, 0x20eb1, 0x40000000000a5, 0x8000) r0 = openat$auto_snd_pcm_f_ops_pcm1(0xffffffffffffff9c, 0x0, 0x100, 0x0) ioctl$auto_SNDRV_PCM_IOCTL_CHANNEL_INFO2(r0, 0x80184132, 0x0) openat$auto_tun_fops_tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snd/midiC2D3\x00', 0x1, 0x0) r2 = prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$auto_smc_pnetid(&(0x7f0000000080), 0xffffffffffffffff) write$auto(r1, &(0x7f0000000400)='/dev/audio1\x00', 0x100000a3d9) openat$auto_snd_pcm_f_ops_pcm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/snd/pcmC1D0p\x00', 0x0, 0x0) mmap$auto(0x0, 0x40009, 0xdf, 0x9b72, 0x7, 0x28000) syz_clone3(&(0x7f0000000880)={0x0, &(0x7f0000000640)=0xffffffffffffffff, &(0x7f0000000680)=0x0, &(0x7f00000006c0), {0x8}, &(0x7f0000000700)=""/231, 0xe7, &(0x7f0000000800)=""/40, &(0x7f0000000840)=[0x0, 0x0, 0xffffffffffffffff], 0x3, {r2}}, 0x58) waitid$auto_P_PIDFD(0x3, r3, &(0x7f0000000380)={@siginfo_0_0={0x6, 0x7f, 0x0, @_kill={r4}}}, 0xbf2b, &(0x7f0000000440)={{0xfffffffffffffffd, 0x401}, {0x8000000000000000, 0x4}, 0x2511, 0xfffffffffffffffb, 0x1, 0x3, 0x7, 0x0, 0x4, 0x3, 0x9, 0x7fffffff, 0x80, 0x6072, 0x3, 0x6}) waitid$auto(0x400, r2, &(0x7f0000000500)={@siginfo_0_0={0x9b61, 0x7, 0x3, @_timer={0x0, 0x4, @sival_ptr=&(0x7f0000000100)="d2f104fcd108649a4148e2ca2f27f3723df74341f8d48443ed3068a2ef935fc505fc2e8acb552d6930f98611ee1f1e55422cad69a4dc7f", 0xffffffff}}}, 0x54a9, &(0x7f0000000580)={{0x7, 0x2}, {0xb, 0x7}, 0xe5b5, 0x4, 0x2, 0x3, 0x28f42a7d, 0x7, 0x2, 0x8, 0x3a4b2cca, 0x5, 0x0, 0xff, 0x1, 0x4}) getsockopt$auto_SO_BROADCAST(0xffffffffffffffff, 0x6, 0x6, &(0x7f00000000c0)='~-,}\x00', &(0x7f0000000140)=0xc0000000) r5 = openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ram4\x00', 0xdd01, 0x0) madvise$auto(0x0, 0x20499d, 0x9) msync$auto(0x1ffff000, 0x180000000000000, 0x400000004) ioctl$auto_BLKRRPART(r5, 0x125f, 0x700000000000000) open(0x0, 0x161342, 0x100) open(0x0, 0xeee00, 0x31) openat$auto_cec_devnode_fops_cec_priv(0xffffffffffffff9c, &(0x7f0000000180)='/dev/cec23\x00', 0x4700, 0x0) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ram2\x00', 0x14f602, 0x0) bpf$auto_BPF_PROG_QUERY(0x10, &(0x7f0000000340)=@bpf_attr_0={0x0, 0x1, 0x1, 0x5, 0x4, 0xffffffffffffffff, 0x9, "38b7bbd1f7965a807264335b76c22027", 0x0, 0xffffffffffffffff, 0x22, 0x10, 0x7, 0x748}, 0x400) socket(0x10, 0x2, 0x0) statmount$auto(0x0, &(0x7f0000000180)={0x0, 0x1, 0x9, 0x7, 0x3b, 0x4909b6fb, 0x1ffde, 0x4007, 0x6, 0x2, 0x9, 0x2, 0x6, 0x4, 0xb4, 0x9, 0xffff, 0x10000, 0x80, 0x7, 0x40000, 0x7, 0x2000, 0x200, 0x0, 0x84, 0x6, 0x0, 0x0, 0x7f, 0x0, [0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x400000, 0xfffffffffffffffd]}, 0x202, 0xd) sendmsg$auto_OVS_VPORT_CMD_DEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYBLOB="10002d"], 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x8000) bpf$auto_BPF_MAP_CREATE(0x0, &(0x7f0000000340)=@prog_bind_map={0xffffffffffffffff, 0xffffffffffffffff, 0x5}, 0x800) close_range$auto(0x2, 0x8, 0x0) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0x6ab82, 0x0) 3.721881678s ago: executing program 2 (id=4621): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = openat$auto_ns_file_operations_nsfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/ns/cgroup\x00', 0x0, 0x0) ioctl$auto_NS_GET_TGID_IN_PIDNS(r1, 0x8004b709, 0x0) (async, rerun: 64) move_pages$auto(0x0, 0x0, 0x0, &(0x7f0000001140), 0x0, 0x2) (async, rerun: 64) r2 = bpf$auto(0x0, &(0x7f0000000000)=@task_fd_query={0x0, 0xffffffffffffffff, 0xb0, 0x8bd, 0x8, 0x2, 0xffffffffffffffff, 0x6, 0x6}, 0xa3) r3 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/bus/scsi/drivers/st/version\x00', 0x8240, 0x0) openat$auto_proc_pid_smaps_operations_internal(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/smaps\x00', 0xc0000, 0x0) exit$auto(0x7) (async) lseek$auto(0x3, 0x7fffffffffffffff, 0x1) (async, rerun: 32) read$auto_kernfs_file_fops_kernfs_internal(r3, &(0x7f0000000040)=""/125, 0x7d) (async, rerun: 32) openat$auto_mon_fops_text_t_mon_text(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/usb/usbmon/9t\x00', 0x0, 0x0) (async, rerun: 32) epoll_pwait2$auto(0xffffffffffffffff, 0x0, 0x8, 0x0, 0xfffffffffffffffe, 0x8) (rerun: 32) bpf$auto(0x0, &(0x7f0000000000)=@link_update={0xa, @new_map_fd=0x2, 0x7, @old_map_fd=r0}, 0x1) setsockopt$auto_SO_TIMESTAMPNS_OLD(r2, 0xec, 0x23, &(0x7f0000000100)='\x00', 0x1) 3.563738501s ago: executing program 2 (id=4622): close_range$auto(0x2, 0x8, 0x0) r0 = socket(0x10, 0x2, 0xc) accept$auto(r0, &(0x7f0000000180)=@phonet={0x23, 0xba, 0x2, 0x9}, &(0x7f0000000200)=0x6) r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000100)='/sys/devices/platform/vhci_hcd.0/status.8\x00', 0x103000, 0x0) readv$auto(r1, &(0x7f0000006080)={&(0x7f0000000040), 0xba41}, 0x8) socket$nl_generic(0x10, 0x3, 0x10) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) close_range$auto(0x2, 0x8, 0x0) ioctl$auto_KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000080)='/dev/pts/ptmx\x00', 0x0, 0x0) ioctl$auto(r2, 0x540c, 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_clone3(&(0x7f0000001340)={0x40101000, 0x0, 0x0, &(0x7f00000011c0), {0x3}, 0x0, 0x0, 0x0, 0x0}, 0x58) r4 = syz_genetlink_get_family_id$auto_ovs_meter(&(0x7f0000003040), 0xffffffffffffffff) sendmsg$auto_OVS_METER_CMD_SET(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)={0x20, r4, 0x82652360e804c8d3, 0x9, 0x25dfdbfe, {}, [@OVS_METER_ATTR_KBPS={0x4}, @OVS_METER_ATTR_ID={0x8, 0x1, 0xfffffff8}]}, 0x20}}, 0x8080) ioctl$auto(0x3, 0xae41, 0xffffffffffffffff) r5 = socket(0x1d, 0x2, 0x7) openat$auto_ppp_device_fops_ppp_generic(0xffffffffffffff9c, &(0x7f0000000140), 0x48100, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$auto(0x3, &(0x7f0000000040)=@can={0x1d, r6, 0xfd}, 0x6a) mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) semctl$auto(0x7, 0x2, 0x13, 0x1) r7 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty12\x00', 0x800, 0x0) mknodat$auto(0x5, 0x0, 0xfffffffffffff084, 0x400) ioctl$auto(r7, 0x560a, 0x7) 2.933697937s ago: executing program 0 (id=4623): mmap$auto(0x0, 0x3, 0x4000000000df, 0x40eb1, 0x401, 0x300000000000) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000180)='/sys/devices/virtual/mac80211_hwsim/hwsim1/ieee80211/phy1/index\x00', 0x0, 0x0) r1 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000240)='/sys/bus/pci/rescan\x00', 0x20681, 0x0) write$auto_kernfs_file_fops_kernfs_internal(r1, &(0x7f0000000200)='5', 0x1) read$auto(r0, 0x0, 0x20) unshare$auto(0x40000080) socket(0x11, 0x3, 0x400) pwrite64$auto(0xc8, 0x0, 0xfdef, 0x500000000000) 2.054336586s ago: executing program 0 (id=4624): mmap$auto(0x0, 0x9, 0x2, 0x40eb2, 0x401, 0x300000000000) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/virtual/net/nr11/tx_queue_len\x00', 0x2000, 0x0) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nbd0\x00', 0xc0c00, 0x0) adjtimex$auto(0x0) r1 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$auto(r1, &(0x7f0000000400)='/dev/audio1\x00', 0xa3d9) sendmsg$auto_ILA_CMD_DEL(0xffffffffffffffff, 0x0, 0x88d4) r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) mbind$auto(0x2, 0x80, 0x3, &(0x7f0000000200)=0xff, 0x3, 0x3) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r2, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x0, 0x100000000008000) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) getitimer$auto(0x0, 0x0) geteuid() close_range$auto(0x2, 0x8, 0x0) openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty0\x00', 0x0, 0x0) openat$auto_stat_fops_per_vm_kvm_main(0xffffffffffffff9c, &(0x7f0000000280)='/sys/kernel/debug/fail_io_timeout/probability\x00', 0x20000, 0x0) read$auto(0x3, 0x0, 0x80) r3 = openat$auto_ftrace_subsystem_filter_fops_trace_events(0xffffffffffffff9c, &(0x7f00000006c0)='/sys/kernel/tracing/events/vmalloc/filter\x00', 0x1032c1, 0x0) write$auto(r3, 0x0, 0x9) socket(0xa, 0x6, 0x0) mknod$auto(&(0x7f0000000180)=':,\x00', 0x800, 0x4) read$auto(r0, 0x0, 0x20) mbind$auto(0x7, 0x1, 0x0, &(0x7f00000001c0)=0x1, 0x5, 0x6) openat$auto_proc_page_owner_threshold_(0xffffffffffffff9c, &(0x7f0000000040), 0x400, 0x0) mmap$auto(0x0, 0x400005, 0xfffffffffffffffe, 0x4f1, 0x2, 0x8000) socket(0x2b, 0x1, 0x0) 955.507286ms ago: executing program 2 (id=4625): mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) r0 = io_uring_setup$auto(0x6, 0x0) close_range$auto(r0, r0, 0xffffffff) openat$auto_dvb_frontend_fops_dvb_frontend(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$auto_snapshot_fops_user(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x3f) openat$auto_proc_mem_operations_base(0xffffffffffffff9c, 0x0, 0x401, 0x0) r1 = syz_genetlink_get_family_id$auto_tipcv2(&(0x7f0000000180), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$auto_TIPC_NL_LINK_GET(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000051c0)={&(0x7f0000000880)={0x14, r1, 0x301, 0x70bd26, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x24000055}, 0x4) mmap$auto(0x0, 0x9, 0x3ff57696, 0x9b72, 0x2, 0x8000000000008000) mmap$auto(0x0, 0x2000c, 0xdf, 0x20eb1, 0x40000000000a5, 0x8000) prctl$auto(0x3e, 0x5, 0x0, 0x4, 0xffffffffffffffff) io_uring_setup$auto(0x6, 0x0) close_range$auto(0x2, 0x8, 0x0) r3 = openat$auto_tty_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS0\x00', 0x48140, 0x0) ioctl$auto(r3, 0x545c, 0xffffffffffffffff) ioctl$auto_TIOCMSET2(r3, 0x5418, 0x0) add_key$auto(0x0, 0x0, 0x0, 0xfffffffffffffff7, 0xfffffff7) setresuid$auto(0x2, 0x7, 0x8080) clock_nanosleep$auto(0x8, 0x1, 0x0, 0xffffffffffffffff) mmap$auto(0x0, 0x20009, 0x7, 0x12, 0xffffffffffffffff, 0xf4e) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) close_range$auto(0x2, 0x8, 0x0) r4 = syz_genetlink_get_family_id$auto_smc_gen_netlink(&(0x7f0000000080), r0) sendmsg$auto_SMC_NETLINK_GET_FBACK_STATS(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="1800ab92000083d5614878638302", @ANYRES16=r4, @ANYBLOB="000427bd7000ffdbdf2508000000a25eae00"], 0x18}, 0x1, 0x0, 0x0, 0x80}, 0x40811) 955.351181ms ago: executing program 4 (id=4626): sendmsg$auto_GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="9a000000", @ANYRES16=0x0, @ANYBLOB="01002d000800070000000000000000", @ANYRES32], 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x0) socket(0x10, 0x2, 0x0) syz_genetlink_get_family_id$auto_ethtool(0x0, 0xffffffffffffffff) openat$auto_dvb_demux_fops_dmxdev(0xffffffffffffff9c, 0x0, 0x80100, 0x0) openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, 0x0, 0x101000, 0x0) close_range$auto(0x2, 0x8, 0x0) r0 = openat$auto_kvm_chardev_ops_kvm_main(0xffffffffffffff9c, &(0x7f00000011c0), 0xe0180, 0x0) ioctl$auto_KVM_CREATE_VM(r0, 0xae01, 0x0) madvise$auto(0x0, 0xffffffffffff0005, 0x15) mmap$auto(0x0, 0x400008, 0xdd, 0x9b72, 0x2, 0x8000) close_range$auto(0x2, 0x8, 0x0) socket(0x2, 0x80002, 0x73) socket(0x2, 0x1, 0x84) socketpair$auto(0xff, 0x7, 0x8, 0x0) r1 = openat$auto_proc_fail_nth_operations_base(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/fail-nth\x00', 0x802, 0x0) write$auto(r1, &(0x7f0000000040)='7\x00\\\xa0\x04|\x03\xcb\x12\xfa\b\x1c\xc7k', 0x81) setsockopt$auto(0x3, 0x10000000084, 0x81, 0x0, 0x6) prctl$auto_PR_SET_MM_START_BRK(0x9, 0x6, 0x0, 0x101, 0x5) keyctl$auto(0xe, 0x1, 0x0, 0x5eaf, 0x8) mmap$auto(0x0, 0x400008, 0x200, 0x9b72, 0xffffffffffffffff, 0x8000) openat$auto_proc_mem_operations_base(0xffffffffffffff9c, &(0x7f0000001640)='/proc/self/mem\x00', 0x401, 0x0) mmap$auto(0x0, 0x2a, 0x4000000df, 0x210, 0x1000, 0x28000) madvise$auto(0xffffffffffffffff, 0x20200, 0x15) mincore$auto(0x1000, 0x8001, 0x0) r2 = socket(0x2b, 0x1, 0x1) listen$auto(r2, 0x6) syz_genetlink_get_family_id$auto_ovs_packet(0x0, 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x89b1, &(0x7f0000000900)={'bond0\x00'}) ioctl$auto(0x3, 0xae60, 0x10000000000402) 954.950584ms ago: executing program 0 (id=4633): mmap$auto(0x0, 0x9, 0x2, 0x40eb2, 0x401, 0x300000000000) r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000080)='/sys/devices/virtual/net/nr11/tx_queue_len\x00', 0x2000, 0x0) openat$auto_def_blk_fops_fs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nbd0\x00', 0xc0c00, 0x0) adjtimex$auto(0x0) r1 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$auto(r1, &(0x7f0000000400)='/dev/audio1\x00', 0xa3d9) sendmsg$auto_ILA_CMD_DEL(0xffffffffffffffff, 0x0, 0x88d4) r2 = openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/midiC2D0\x00', 0x1, 0x0) mbind$auto(0x2, 0x80, 0x3, &(0x7f0000000200)=0xff, 0x3, 0x3) prctl$auto(0x3e, 0x1, 0x0, 0x1, 0x0) write$auto(r2, &(0x7f00000000c0)='/Eev/audio1\x00VI\xa3\xaa\xb1;\x9dJ\xc6\xc0\'\xdbV\xd4\xee\xc2\xdd\xa7\xee$\x8d\xc4\xe9d\x03\rF\xec\xb8\xb1Z|\xffGP\x97)\xcf\a\xfb\\n\x89C:\x84D\x1du\xb4\x9ab\xce\xa7tU\x14w\xb4\x14\x1dU\x9d\x8b\xa4U\x953.O\xab\"4\x8a\xbbY8@Z5`\xa4m\xffb\x17\xbb\x7f\xea4*\xa4\xf4\xb4\x90\xc0\xbf\xd4m\xbf\xc7\x15\xbe\x01\x98\xd7lD\x97)}\xfaK\xdf>f\xb8&\x959-\n\xccWw\xe2\x9cK\fE\a\xca\xd36\xe8\xcb?(\xfaI\xe2\xae,\x95k8\x83\xcf\xc5D\xcc', 0x100000a3d9) mmap$auto(0x0, 0x400008, 0xdf, 0x9b72, 0x0, 0x100000000008000) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xfffffffffffffffa, 0x8000) prctl$auto(0x1000000003b, 0x1, 0x4, 0x5, 0x7) getitimer$auto(0x0, 0x0) geteuid() close_range$auto(0x2, 0x8, 0x0) openat$auto_console_fops_tty_io(0xffffffffffffff9c, &(0x7f0000000000)='/dev/tty0\x00', 0x0, 0x0) openat$auto_stat_fops_per_vm_kvm_main(0xffffffffffffff9c, &(0x7f0000000280)='/sys/kernel/debug/fail_io_timeout/probability\x00', 0x20000, 0x0) read$auto(0x3, 0x0, 0x80) r3 = openat$auto_ftrace_subsystem_filter_fops_trace_events(0xffffffffffffff9c, &(0x7f00000006c0)='/sys/kernel/tracing/events/vmalloc/filter\x00', 0x1032c1, 0x0) write$auto(r3, 0x0, 0x9) socket(0xa, 0x6, 0x0) mknod$auto(&(0x7f0000000180)=':,\x00', 0x800, 0x4) read$auto(r0, 0x0, 0x20) mbind$auto(0x7, 0x1, 0x0, &(0x7f00000001c0)=0x1, 0x5, 0x6) openat$auto_proc_page_owner_threshold_(0xffffffffffffff9c, &(0x7f0000000040), 0x400, 0x0) openat$auto_ftrace_avail_fops_trace_events(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/tracing/available_events\x00', 0x10002, 0x0) socket(0x2b, 0x1, 0x0) 100.031005ms ago: executing program 2 (id=4627): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$auto_ethtool(&(0x7f0000000740), 0xffffffffffffffff) r2 = syz_genetlink_get_family_id$auto_nlbl_cipsov4(&(0x7f00000000c0), r0) sendmsg$auto_NLBL_CIPSOV4_C_LISTALL(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r2, 0x2, 0x70bd28, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x40}]}, 0x1c}, 0x1, 0x0, 0x0, 0x6a59b9eb8d544bec}, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'netdevsim0\x00', 0x0}) sendmsg$auto_ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x28, r1, 0x1, 0x70bd2d, 0x25dfdbfc, {}, [@ETHTOOL_A_COALESCE_PKT_RATE_LOW={0x8}, @ETHTOOL_A_COALESCE_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xc854}, 0x0) 61.498664ms ago: executing program 0 (id=4628): r0 = openat$auto_kernfs_file_fops_kernfs_internal(0xffffffffffffff9c, &(0x7f0000000000)='/sys/devices/virtual/vtconsole/vtcon1/bind\x00', 0x182b02, 0x0) mmap$auto(0x0, 0x2020009, 0x3, 0xeb1, 0xffffffffffffffff, 0x8000) writev$auto(0x3, &(0x7f0000000100)={0x0, 0x7111}, 0x8) lseek$auto(0x3, 0x2, 0x4) unshare$auto(0x1fd2) openat$auto_lru_gen_rw_fops_vmscan(0xffffffffffffff9c, 0x0, 0x2280, 0x0) socket(0x1e, 0x1, 0x0) lsm_set_self_attr$auto(0x11, 0x0, 0x7e, 0x0) openat$auto_cpuid_fops_cpuid(0xffffffffffffff9c, 0x0, 0x101500, 0x0) r1 = openat$auto_snd_ctl_f_ops_control(0xffffffffffffff9c, &(0x7f00000016c0)='/dev/snd/controlC0\x00', 0x80, 0x0) ioctl$auto_SNDRV_CTL_IOCTL_ELEM_UNLOCK(r1, 0x40405515, &(0x7f0000001700)={@raw=0x8, 0x1000c, 0x3, 0x9, "9d4724b76f4d07faf46cb94d85033d940fdf05ecff75c12163ddeab942ed73d07dadd6f419694d591eca8162"}) openat$auto_snd_rawmidi_f_ops_rawmidi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snd/midiC2D2\x00', 0x80980, 0x0) r2 = openat$auto_proc_sys_file_operations_proc_sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv6/neigh/bond_slave_1/ucast_solicit\x00', 0x101202, 0x0) sendfile$auto(r0, r2, 0x0, 0x1) 0s ago: executing program 2 (id=4629): mmap$auto(0x0, 0x20009, 0x4000000000df, 0xeb1, 0x401, 0x8000) r0 = socketpair$auto(0x21e, 0x5, 0x8000000000000000, 0x0) close_range$auto(0x2, 0x8, 0x0) r1 = open(0x0, 0x22240, 0x55) r2 = socket(0x21, 0x2, 0xa) write$auto(0x3, 0x0, 0x8100) r3 = syz_genetlink_get_family_id$auto_ovs_datapath(&(0x7f0000000040), r1) r4 = getpgrp(0x0) socket(0x28, 0x1, 0x0) mmap$auto(0x0, 0x61, 0x100001000000003, 0x9b72, 0x2, 0x8000) getsockopt$auto(0x3, 0x200000000001, 0x45, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000280)={'dummy0\x00', 0x0}) bpf$auto(0x0, &(0x7f00000000c0)=@bpf_attr_5={@target_ifindex=r6, 0xffffffffffffffff, 0x4, 0x1ff, 0xffffffffffffffff, @relative_fd, 0xe5fd}, 0xf) r7 = fcntl$auto_F_GETOWN(r2, 0x9, 0x7) sendmsg$auto_OVS_DP_CMD_GET(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, r3, 0x2, 0x70bd2c, 0x25dfdbfc, {}, [@OVS_DP_ATTR_UPCALL_PID={0x8, 0x2, r4}, @OVS_DP_ATTR_IFINDEX={0x8, 0x9, r6}, @OVS_DP_ATTR_MASKS_CACHE_SIZE={0x8, 0x7, 0x8}, @OVS_DP_ATTR_UPCALL_PID={0x8, 0x2, r7}, @OVS_DP_ATTR_USER_FEATURES={0x8, 0x5, 0x1}, @OVS_DP_ATTR_NAME={0xa, 0x1, '-%/-]\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0xc000}, 0x4000) r8 = socket(0x2000000000000021, 0x2, 0x10000000000002) write$auto(r8, 0x0, 0x2) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.85' (ED25519) to the list of known hosts. [ 65.205449][ T5846] cgroup: Unknown subsys name 'net' [ 65.335755][ T5846] cgroup: Unknown subsys name 'cpuset' [ 65.343004][ T5846] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 66.529525][ T5846] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 68.252041][ T5861] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 68.259470][ T5861] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 68.266598][ T5861] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 68.273748][ T5869] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 68.291917][ T5868] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 68.299844][ T5869] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 68.303837][ T5861] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 68.307072][ T5868] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 68.314416][ T5871] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 68.321523][ T5869] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 68.328264][ T5871] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 68.334750][ T5868] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 68.350592][ T5868] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 68.358087][ T5871] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 68.358153][ T5869] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 68.373132][ T5869] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 68.375184][ T5870] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 68.380470][ T5868] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 68.387908][ T5870] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 68.394355][ T5869] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 68.702609][ T5855] chnl_net:caif_netlink_parms(): no params data found [ 68.774416][ T5856] chnl_net:caif_netlink_parms(): no params data found [ 68.784570][ T5858] chnl_net:caif_netlink_parms(): no params data found [ 68.837786][ T5857] chnl_net:caif_netlink_parms(): no params data found [ 68.868333][ T5855] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.875508][ T5855] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.882616][ T5855] bridge_slave_0: entered allmulticast mode [ 68.889551][ T5855] bridge_slave_0: entered promiscuous mode [ 68.917139][ T5855] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.924308][ T5855] bridge0: port 2(bridge_slave_1) entered disabled state [ 68.931488][ T5855] bridge_slave_1: entered allmulticast mode [ 68.938827][ T5855] bridge_slave_1: entered promiscuous mode [ 68.957339][ T5856] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.964529][ T5856] bridge0: port 1(bridge_slave_0) entered disabled state [ 68.971816][ T5856] bridge_slave_0: entered allmulticast mode [ 68.978987][ T5856] bridge_slave_0: entered promiscuous mode [ 68.999364][ T5856] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.006549][ T5856] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.013664][ T5856] bridge_slave_1: entered allmulticast mode [ 69.020755][ T5856] bridge_slave_1: entered promiscuous mode [ 69.050297][ T5855] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.061790][ T5855] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.094278][ T5858] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.101378][ T5858] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.108793][ T5858] bridge_slave_0: entered allmulticast mode [ 69.116072][ T5858] bridge_slave_0: entered promiscuous mode [ 69.130157][ T5856] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.146889][ T5858] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.154355][ T5858] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.161503][ T5858] bridge_slave_1: entered allmulticast mode [ 69.168045][ T5858] bridge_slave_1: entered promiscuous mode [ 69.174505][ T5857] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.181582][ T5857] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.189076][ T5857] bridge_slave_0: entered allmulticast mode [ 69.195714][ T5857] bridge_slave_0: entered promiscuous mode [ 69.204563][ T5856] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.214639][ T5855] team0: Port device team_slave_0 added [ 69.227104][ T5857] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.234297][ T5857] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.241482][ T5857] bridge_slave_1: entered allmulticast mode [ 69.248156][ T5857] bridge_slave_1: entered promiscuous mode [ 69.261770][ T5855] team0: Port device team_slave_1 added [ 69.292847][ T5858] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.316013][ T5856] team0: Port device team_slave_0 added [ 69.323703][ T5857] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.335916][ T5858] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.345805][ T5855] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.352760][ T5855] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.379086][ T5855] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.391138][ T5856] team0: Port device team_slave_1 added [ 69.404614][ T5857] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.427816][ T5855] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.435152][ T5855] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.461409][ T5855] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.495092][ T5856] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.502047][ T5856] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.528037][ T5856] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.540177][ T5856] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.547548][ T5856] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.573530][ T5856] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.585567][ T5857] team0: Port device team_slave_0 added [ 69.592909][ T5858] team0: Port device team_slave_0 added [ 69.601399][ T5858] team0: Port device team_slave_1 added [ 69.611253][ T5857] team0: Port device team_slave_1 added [ 69.632814][ T5858] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.640014][ T5858] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.666244][ T5858] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.711354][ T5858] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.718614][ T5858] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.744559][ T5858] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.755695][ T5857] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.762639][ T5857] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.789888][ T5857] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.810447][ T5855] hsr_slave_0: entered promiscuous mode [ 69.816739][ T5855] hsr_slave_1: entered promiscuous mode [ 69.826965][ T5857] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.833919][ T5857] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 69.859914][ T5857] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.880735][ T5856] hsr_slave_0: entered promiscuous mode [ 69.886869][ T5856] hsr_slave_1: entered promiscuous mode [ 69.892782][ T5856] debugfs: 'hsr0' already exists in 'hsr' [ 69.898948][ T5856] Cannot create hsr debugfs directory [ 69.985569][ T5858] hsr_slave_0: entered promiscuous mode [ 69.991571][ T5858] hsr_slave_1: entered promiscuous mode [ 69.997579][ T5858] debugfs: 'hsr0' already exists in 'hsr' [ 70.003297][ T5858] Cannot create hsr debugfs directory [ 70.015218][ T5857] hsr_slave_0: entered promiscuous mode [ 70.021189][ T5857] hsr_slave_1: entered promiscuous mode [ 70.027142][ T5857] debugfs: 'hsr0' already exists in 'hsr' [ 70.032860][ T5857] Cannot create hsr debugfs directory [ 70.215940][ T5855] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 70.233486][ T5855] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 70.249149][ T5855] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 70.261305][ T5855] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 70.287142][ T5856] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 70.297610][ T5856] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 70.312872][ T5856] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 70.322826][ T5856] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 70.371556][ T5858] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 70.402327][ T5858] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 70.417679][ T5858] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 70.428015][ T5858] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 70.453948][ T5864] Bluetooth: hci2: command tx timeout [ 70.454006][ T5868] Bluetooth: hci0: command tx timeout [ 70.459357][ T5867] Bluetooth: hci3: command tx timeout [ 70.471099][ T5869] Bluetooth: hci1: command tx timeout [ 70.482535][ T5857] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 70.491940][ T5857] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 70.506026][ T5857] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 70.515616][ T5857] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 70.557662][ T5855] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.610169][ T5856] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.622159][ T5855] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.638063][ T2951] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.645198][ T2951] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.659926][ T5856] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.671871][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.678993][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.692509][ T1102] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.699661][ T1102] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.712900][ T5857] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.726597][ T1102] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.733651][ T1102] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.769553][ T5857] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.792442][ T60] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.799594][ T60] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.823198][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.830304][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 70.847103][ T5858] 8021q: adding VLAN 0 to HW filter on device bond0 [ 70.869355][ T5855] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 70.913145][ T5858] 8021q: adding VLAN 0 to HW filter on device team0 [ 70.942421][ T2951] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.949597][ T2951] bridge0: port 1(bridge_slave_0) entered forwarding state [ 70.982122][ T2951] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.989270][ T2951] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.147921][ T5856] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.230708][ T5857] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.242903][ T5855] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.291626][ T5857] veth0_vlan: entered promiscuous mode [ 71.298736][ T5856] veth0_vlan: entered promiscuous mode [ 71.310441][ T5856] veth1_vlan: entered promiscuous mode [ 71.326759][ T5857] veth1_vlan: entered promiscuous mode [ 71.344003][ T5858] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.368872][ T5856] veth0_macvtap: entered promiscuous mode [ 71.386820][ T5856] veth1_macvtap: entered promiscuous mode [ 71.396948][ T5855] veth0_vlan: entered promiscuous mode [ 71.418592][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.430236][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.432815][ T5855] veth1_vlan: entered promiscuous mode [ 71.443527][ T5857] veth0_macvtap: entered promiscuous mode [ 71.457577][ T5858] veth0_vlan: entered promiscuous mode [ 71.466375][ T5856] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.477605][ T5857] veth1_macvtap: entered promiscuous mode [ 71.497755][ T5857] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.508489][ T5857] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.517826][ T5856] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.532598][ T5858] veth1_vlan: entered promiscuous mode [ 71.546279][ T60] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.555242][ T60] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.577206][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.586673][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.610198][ T60] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.632044][ T60] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.641437][ T60] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.657199][ T5858] veth0_macvtap: entered promiscuous mode [ 71.665146][ T5855] veth0_macvtap: entered promiscuous mode [ 71.673606][ T5855] veth1_macvtap: entered promiscuous mode [ 71.683639][ T60] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.712942][ T5858] veth1_macvtap: entered promiscuous mode [ 71.723413][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.735621][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.744223][ T5858] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.759740][ T5855] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.782755][ T5855] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.798009][ T5858] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.812789][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.820913][ T60] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.832339][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.850671][ T60] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.862272][ T60] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.876524][ T60] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.885416][ T60] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.908141][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.908724][ T60] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.923864][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.926485][ T60] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.949358][ T60] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.985880][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.000663][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.022683][ T5856] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 72.036876][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.049540][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.112718][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.132908][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.163283][ T2951] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.181133][ T2951] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.204882][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.232357][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.534914][ T5864] Bluetooth: hci1: command tx timeout [ 72.540353][ T5867] Bluetooth: hci2: command tx timeout [ 72.540377][ T5868] Bluetooth: hci3: command tx timeout [ 72.551310][ T5869] Bluetooth: hci0: command tx timeout [ 72.674113][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 72.694059][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 72.738956][ T5970] block2mtd: illegal erase size [ 72.809000][ T5973] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 73.138346][ T5973] block2mtd: error: cannot open device /Eev/audio1 [ 73.304223][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 73.314047][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 73.373618][ T5976] FAULT_INJECTION: forcing a failure. [ 73.373618][ T5976] name failslab, interval 1, probability 0, space 0, times 1 [ 73.408489][ T5976] CPU: 0 UID: 0 PID: 5976 Comm: syz.2.8 Not tainted 6.17.0-rc1-syzkaller-00224-g8d561baae505 #0 PREEMPT(full) [ 73.408529][ T5976] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 73.408544][ T5976] Call Trace: [ 73.408553][ T5976] [ 73.408563][ T5976] dump_stack_lvl+0x16c/0x1f0 [ 73.408604][ T5976] should_fail_ex+0x512/0x640 [ 73.408641][ T5976] ? devlink_fmsg_put_value+0xaa/0x2d0 [ 73.408675][ T5976] should_failslab+0xc2/0x120 [ 73.408707][ T5976] __kmalloc_noprof+0xd2/0x510 [ 73.408738][ T5976] devlink_fmsg_put_value+0xaa/0x2d0 [ 73.408773][ T5976] devlink_fmsg_bool_pair_put+0x19c/0x2f0 [ 73.408808][ T5976] ? __pfx_devlink_fmsg_bool_pair_put+0x10/0x10 [ 73.408842][ T5976] ? __pfx_kasan_disable_current+0x10/0x10 [ 73.408871][ T5976] ? devlink_fmsg_nest_common.part.0+0xcd/0x1e0 [ 73.408907][ T5976] nsim_dev_dummy_fmsg_put+0xe7/0x1e0 [ 73.408939][ T5976] devlink_health_do_dump+0x243/0x620 [ 73.408973][ T5976] devlink_health_report+0x3c9/0x9c0 [ 73.409004][ T5976] ? __pfx_devlink_health_report+0x10/0x10 [ 73.409035][ T5976] ? _copy_from_user+0x59/0xd0 [ 73.409070][ T5976] nsim_dev_health_break_write+0x166/0x210 [ 73.409098][ T5976] ? __pfx_nsim_dev_health_break_write+0x10/0x10 [ 73.409130][ T5976] ? rcu_is_watching+0x12/0xc0 [ 73.409157][ T5976] full_proxy_write+0x131/0x1a0 [ 73.409193][ T5976] ? __pfx_full_proxy_write+0x10/0x10 [ 73.409223][ T5976] vfs_write+0x2a0/0x11d0 [ 73.409247][ T5976] ? __pfx___mutex_lock+0x10/0x10 [ 73.409280][ T5976] ? __pfx_vfs_write+0x10/0x10 [ 73.409306][ T5976] ? __fget_files+0x204/0x3c0 [ 73.409331][ T5976] ? rcu_is_watching+0x12/0xc0 [ 73.409357][ T5976] ? __fget_files+0x20e/0x3c0 [ 73.409386][ T5976] ksys_write+0x12a/0x250 [ 73.409413][ T5976] ? __pfx_ksys_write+0x10/0x10 [ 73.409442][ T5976] do_syscall_64+0xcd/0x490 [ 73.409482][ T5976] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 73.409507][ T5976] RIP: 0033:0x7f066ff8ebe9 [ 73.409534][ T5976] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 73.409562][ T5976] RSP: 002b:00007f0670ea5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 73.409587][ T5976] RAX: ffffffffffffffda RBX: 00007f06701b5fa0 RCX: 00007f066ff8ebe9 [ 73.409603][ T5976] RDX: 00000000000001ff RSI: 0000000000000000 RDI: 0000000000000006 [ 73.409618][ T5976] RBP: 00007f0670011e19 R08: 0000000000000000 R09: 0000000000000000 [ 73.409631][ T5976] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 73.409646][ T5976] R13: 00007f06701b6038 R14: 00007f06701b5fa0 R15: 00007ffe19d55b58 [ 73.409670][ T5976] [ 73.791301][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 73.799965][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 73.808499][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 73.817035][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 73.825728][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 73.834199][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 73.977462][ T5991] FAULT_INJECTION: forcing a failure. [ 73.977462][ T5991] name failslab, interval 1, probability 0, space 0, times 0 [ 74.011546][ T5991] CPU: 0 UID: 0 PID: 5991 Comm: syz.2.12 Not tainted 6.17.0-rc1-syzkaller-00224-g8d561baae505 #0 PREEMPT(full) [ 74.011584][ T5991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 74.011598][ T5991] Call Trace: [ 74.011605][ T5991] [ 74.011613][ T5991] dump_stack_lvl+0x16c/0x1f0 [ 74.011646][ T5991] should_fail_ex+0x512/0x640 [ 74.011679][ T5991] should_failslab+0xc2/0x120 [ 74.011710][ T5991] __kmalloc_cache_noprof+0x6a/0x3e0 [ 74.011734][ T5991] ? __pfx_kobject_get_unless_zero+0x10/0x10 [ 74.011764][ T5991] ? tty_open+0x13e/0xf90 [ 74.011795][ T5991] ? __pfx_tty_open+0x10/0x10 [ 74.011825][ T5991] tty_open+0x13e/0xf90 [ 74.011857][ T5991] ? __pfx_tty_open+0x10/0x10 [ 74.011886][ T5991] ? chrdev_open+0x58c/0x6a0 [ 74.011913][ T5991] ? rcu_is_watching+0x12/0xc0 [ 74.011937][ T5991] ? lock_release+0x201/0x2f0 [ 74.011967][ T5991] ? __pfx_tty_open+0x10/0x10 [ 74.011997][ T5991] chrdev_open+0x234/0x6a0 [ 74.012026][ T5991] ? __pfx_chrdev_open+0x10/0x10 [ 74.012055][ T5991] ? fsnotify_open_perm_and_set_mode+0x17c/0xa60 [ 74.012085][ T5991] do_dentry_open+0x982/0x1530 [ 74.012112][ T5991] ? __pfx_chrdev_open+0x10/0x10 [ 74.012143][ T5991] vfs_open+0x82/0x3f0 [ 74.012175][ T5991] path_openat+0x1de4/0x2cb0 [ 74.012206][ T5991] ? __pfx_path_openat+0x10/0x10 [ 74.012246][ T5991] do_filp_open+0x20b/0x470 [ 74.012273][ T5991] ? __pfx_do_filp_open+0x10/0x10 [ 74.012312][ T5991] ? alloc_fd+0x471/0x7d0 [ 74.012340][ T5991] do_sys_openat2+0x11b/0x1d0 [ 74.012372][ T5991] ? __pfx_do_sys_openat2+0x10/0x10 [ 74.012411][ T5991] __x64_sys_openat+0x174/0x210 [ 74.012444][ T5991] ? __pfx___x64_sys_openat+0x10/0x10 [ 74.012482][ T5991] do_syscall_64+0xcd/0x490 [ 74.012513][ T5991] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.012539][ T5991] RIP: 0033:0x7f066ff8ebe9 [ 74.012560][ T5991] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 74.012581][ T5991] RSP: 002b:00007f0670ea5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 74.012602][ T5991] RAX: ffffffffffffffda RBX: 00007f06701b5fa0 RCX: 00007f066ff8ebe9 [ 74.012617][ T5991] RDX: 0000000000000800 RSI: 0000200000000000 RDI: ffffffffffffff9c [ 74.012633][ T5991] RBP: 00007f0670011e19 R08: 0000000000000000 R09: 0000000000000000 [ 74.012648][ T5991] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 74.012663][ T5991] R13: 00007f06701b6038 R14: 00007f06701b5fa0 R15: 00007ffe19d55b58 [ 74.012689][ T5991] [ 74.604084][ T5999] can: request_module (can-proto-3) failed. [ 74.621597][ T5867] Bluetooth: hci2: command tx timeout [ 74.627746][ T5867] Bluetooth: hci3: command tx timeout [ 74.633151][ T5869] Bluetooth: hci0: command tx timeout [ 74.633859][ T5864] Bluetooth: hci1: command tx timeout [ 74.713533][ T6007] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 74.918878][ T6007] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 75.578006][ T6009] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 75.986654][ T6025] openvswitch: netlink: IP tunnel dst address not specified [ 76.411983][ T6025] zswap: compressor not available [ 76.615736][ T6043] ubi0: attaching mtd0 [ 76.636585][ T6043] ubi0 error: ubi_attach_mtd_dev: bad VID header (536870975) or data offsets (536871039) [ 76.695600][ T5864] Bluetooth: hci1: command tx timeout [ 76.701022][ T5868] Bluetooth: hci0: command tx timeout [ 76.701066][ T5869] Bluetooth: hci3: command tx timeout [ 76.706465][ T5868] Bluetooth: hci2: command tx timeout [ 76.898029][ T6046] netlink: 342 bytes leftover after parsing attributes in process `syz.0.22'. [ 76.916261][ T6046] netlink: 342 bytes leftover after parsing attributes in process `syz.0.22'. [ 76.925301][ T6046] Zero length message leads to an empty skb [ 81.766577][ T6133] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input5 [ 84.150835][ T6170] netlink: 342 bytes leftover after parsing attributes in process `syz.1.49'. [ 84.207418][ T6170] netlink: 342 bytes leftover after parsing attributes in process `syz.1.49'. [ 86.787784][ T982] cfg80211: failed to load regulatory.db [ 89.524330][ T6250] NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030 [ 90.645012][ T6285] random: crng reseeded on system resumption [ 90.658014][ T6286] netlink: 28 bytes leftover after parsing attributes in process `syz.3.71'. [ 90.689287][ T6286] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.718872][ T6286] bridge_slave_1 (unregistering): left allmulticast mode                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    [ 746.178646][T26465] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 746.233451][T26465] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 746.258681][T26465] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 746.285657][T26465] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 746.291855][T26477] netlink: 334 bytes leftover after parsing attributes in process `syz.0.4599'. [ 746.321408][T26465] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 746.340039][T26465] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 746.364061][T26477] netlink: 334 bytes leftover after parsing attributes in process `syz.0.4599'. [ 746.376003][T26465] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 746.387024][T26477] netlink: 334 bytes leftover after parsing attributes in process `syz.0.4599'. [ 746.404654][T26477] netlink: 334 bytes leftover after parsing attributes in process `syz.0.4599'. [ 746.464046][T26477] netlink: 334 bytes leftover after parsing attributes in process `syz.0.4599'. [ 746.481427][T26477] netlink: 334 bytes leftover after parsing attributes in process `syz.0.4599'. [ 746.506050][T26443] random: crng reseeded on system resumption [ 746.508024][T26477] netlink: 334 bytes leftover after parsing attributes in process `syz.0.4599'. [ 746.526810][T26477] netlink: 334 bytes leftover after parsing attributes in process `syz.0.4599'. [ 746.543967][T26477] netlink: 334 bytes leftover after parsing attributes in process `syz.0.4599'. [ 747.398379][T26570] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 747.406015][T26570] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 747.412319][T26570] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 747.418662][T26570] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 747.869595][ T30] audit: type=1800 audit(4295147948.379:34): pid=26617 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.4614" name="lu_gp_id" dev="configfs" ino=110292 res=0 errno=0 [ 747.892308][T26617] ALUA lu_gp_id: 393216 exceeds maximum: 0x0000ffff [ 749.087441][T26651] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 749.190494][T26642] snd_aloop snd_aloop.0: Parsing timer source '' failed with -22 [ 749.583119][T16992] Bluetooth: hci2: command 0x0c1a tx timeout [ 749.589416][T11842] Bluetooth: hci1: command 0x0c1a tx timeout [ 749.595402][T11842] Bluetooth: hci0: command 0x0c1a tx timeout [ 749.601673][T11847] Bluetooth: hci3: command 0x0c1a tx timeout [ 751.678360][T11842] Bluetooth: hci0: command 0x0c1a tx timeout [ 751.684432][T11842] Bluetooth: hci1: command 0x0c1a tx timeout [ 752.113627][T26791] FAULT_INJECTION: forcing a failure. [ 752.113627][T26791] name failslab, interval 1, probability 0, space 0, times 0 [ 752.145654][T26788] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 752.165682][T26788] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 752.187973][T26788] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 752.273125][T26791] CPU: 1 UID: 0 PID: 26791 Comm: syz.4.4626 Not tainted 6.17.0-rc1-syzkaller-00224-g8d561baae505 #0 PREEMPT(full) [ 752.273162][T26791] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 752.273178][T26791] Call Trace: [ 752.273186][T26791] [ 752.273197][T26791] dump_stack_lvl+0x16c/0x1f0 [ 752.273232][T26791] should_fail_ex+0x512/0x640 [ 752.273268][T26791] ? lsm_blob_alloc+0x68/0x90 [ 752.273304][T26791] should_failslab+0xc2/0x120 [ 752.273336][T26791] __kmalloc_noprof+0xd2/0x510 [ 752.273367][T26791] lsm_blob_alloc+0x68/0x90 [ 752.273411][T26791] security_prepare_creds+0x30/0x270 [ 752.273450][T26791] prepare_creds+0x56f/0x7d0 [ 752.273488][T26791] keyctl_set_reqkey_keyring+0x8e/0x1c0 [ 752.273515][T26791] __do_sys_keyctl+0x6d/0x590 [ 752.273543][T26791] do_syscall_64+0xcd/0x490 [ 752.273575][T26791] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 752.273601][T26791] RIP: 0033:0x7f669758ebe9 [ 752.273621][T26791] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 752.273648][T26791] RSP: 002b:00007f6698405038 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 752.273673][T26791] RAX: ffffffffffffffda RBX: 00007f66977b6090 RCX: 00007f669758ebe9 [ 752.273692][T26791] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 000000000000000e [ 752.273707][T26791] RBP: 00007f6697611e19 R08: 0000000000000008 R09: 0000000000000000 [ 752.273724][T26791] R10: 0000000000005eaf R11: 0000000000000246 R12: 0000000000000000 [ 752.273740][T26791] R13: 00007f66977b6128 R14: 00007f66977b6090 R15: 00007ffcc80baf98 [ 752.273765][T26791] [ 752.607056][T26788] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 752.774681][T26839] ================================================================== [ 752.774702][T26839] BUG: KASAN: slab-use-after-free in fbcon_prepare_logo+0xa03/0xc70 [ 752.774746][T26839] Read of size 126 at addr ffff888079b80430 by task syz.0.4628/26839 [ 752.774771][T26839] [ 752.774784][T26839] CPU: 1 UID: 0 PID: 26839 Comm: syz.0.4628 Not tainted 6.17.0-rc1-syzkaller-00224-g8d561baae505 #0 PREEMPT(full) [ 752.774819][T26839] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 752.774835][T26839] Call Trace: [ 752.774845][T26839] [ 752.774856][T26839] dump_stack_lvl+0x116/0x1f0 [ 752.774889][T26839] print_report+0xcd/0x630 [ 752.774922][T26839] ? __virt_addr_valid+0x81/0x610 [ 752.774953][T26839] ? __phys_addr+0xe8/0x180 [ 752.774984][T26839] ? fbcon_prepare_logo+0xa03/0xc70 [ 752.775013][T26839] kasan_report+0xe0/0x110 [ 752.775044][T26839] ? fbcon_prepare_logo+0xa03/0xc70 [ 752.775078][T26839] kasan_check_range+0x100/0x1b0 [ 752.775113][T26839] __asan_memcpy+0x23/0x60 [ 752.775138][T26839] fbcon_prepare_logo+0xa03/0xc70 [ 752.775174][T26839] fbcon_init+0xd77/0x1900 [ 752.775205][T26839] ? __pfx_drm_fb_helper_set_par+0x10/0x10 [ 752.775233][T26839] visual_init+0x320/0x620 [ 752.775260][T26839] do_bind_con_driver.isra.0+0x57a/0xbf0 [ 752.775295][T26839] store_bind+0x61d/0x760 [ 752.775337][T26839] ? __pfx_store_bind+0x10/0x10 [ 752.775368][T26839] dev_attr_store+0x58/0x80 [ 752.775405][T26839] ? __pfx_dev_attr_store+0x10/0x10 [ 752.775438][T26839] sysfs_kf_write+0xef/0x150 [ 752.775466][T26839] kernfs_fop_write_iter+0x351/0x510 [ 752.775489][T26839] ? __pfx_sysfs_kf_write+0x10/0x10 [ 752.775516][T26839] iter_file_splice_write+0x918/0x1270 [ 752.775552][T26839] ? copy_splice_read+0x89c/0xc20 [ 752.775575][T26839] ? __pfx_iter_file_splice_write+0x10/0x10 [ 752.775605][T26839] ? __pfx_copy_splice_read+0x10/0x10 [ 752.775631][T26839] ? look_up_lock_class+0x59/0x150 [ 752.775663][T26839] ? __pfx___might_resched+0x10/0x10 [ 752.775689][T26839] ? __pfx_pipe_lock_cmp_fn+0x10/0x10 [ 752.775717][T26839] ? __pfx_iter_file_splice_write+0x10/0x10 [ 752.775745][T26839] direct_splice_actor+0x18f/0x6c0 [ 752.775772][T26839] splice_direct_to_actor+0x345/0xa30 [ 752.775798][T26839] ? __pfx_direct_splice_actor+0x10/0x10 [ 752.775828][T26839] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 752.775856][T26839] ? futex_private_hash_put+0x11c/0x300 [ 752.775887][T26839] do_splice_direct+0x174/0x240 [ 752.775912][T26839] ? __pfx_do_splice_direct+0x10/0x10 [ 752.775938][T26839] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 752.775963][T26839] ? bpf_lsm_file_permission+0x9/0x10 [ 752.775997][T26839] ? security_file_permission+0x71/0x210 [ 752.776030][T26839] ? rw_verify_area+0xcf/0x6c0 [ 752.776056][T26839] do_sendfile+0xb06/0xe50 [ 752.776085][T26839] ? __pfx_do_sendfile+0x10/0x10 [ 752.776112][T26839] ? __x64_sys_futex+0x1e0/0x4c0 [ 752.776139][T26839] ? __x64_sys_futex+0x1e9/0x4c0 [ 752.776169][T26839] __x64_sys_sendfile64+0x1d8/0x220 [ 752.776200][T26839] ? __pfx___x64_sys_sendfile64+0x10/0x10 [ 752.776237][T26839] do_syscall_64+0xcd/0x490 [ 752.776268][T26839] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 752.776292][T26839] RIP: 0033:0x7f676f58ebe9 [ 752.776314][T26839] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 752.776347][T26839] RSP: 002b:00007f677040f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 752.776373][T26839] RAX: ffffffffffffffda RBX: 00007f676f7b5fa0 RCX: 00007f676f58ebe9 [ 752.776392][T26839] RDX: 0000000000000000 RSI: 0000000000000007 RDI: 0000000000000003 [ 752.776408][T26839] RBP: 00007f676f611e19 R08: 0000000000000000 R09: 0000000000000000 [ 752.776424][T26839] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 752.776439][T26839] R13: 00007f676f7b6038 R14: 00007f676f7b5fa0 R15: 00007ffdd0fc4a98 [ 752.776465][T26839] [ 752.776474][T26839] [ 752.776481][T26839] Allocated by task 26297: [ 752.776494][T26839] kasan_save_stack+0x33/0x60 [ 752.776523][T26839] kasan_save_track+0x14/0x30 [ 752.776549][T26839] __kasan_kmalloc+0xaa/0xb0 [ 752.776575][T26839] __kmalloc_node_track_caller_noprof+0x221/0x510 [ 752.776605][T26839] kmemdup_noprof+0x29/0x60 [ 752.776632][T26839] __devinet_sysctl_register+0xbc/0x360 [ 752.776666][T26839] devinet_sysctl_register+0x17b/0x200 [ 752.776699][T26839] inetdev_init+0x2b8/0x5a0 [ 752.776727][T26839] inetdev_event+0xc5f/0x18a0 [ 752.776759][T26839] notifier_call_chain+0xbc/0x410 [ 752.776787][T26839] call_netdevice_notifiers_info+0xbe/0x140 [ 752.776821][T26839] register_netdevice+0x182e/0x2270 [ 752.776852][T26839] register_netdev+0x34/0x50 [ 752.776882][T26839] loopback_net_init+0x7a/0x170 [ 752.776906][T26839] ops_init+0x1df/0x5f0 [ 752.776935][T26839] setup_net+0x10f/0x380 [ 752.776964][T26839] copy_net_ns+0x2a6/0x5f0 [ 752.776995][T26839] create_new_namespaces+0x3ea/0xa90 [ 752.777029][T26839] unshare_nsproxy_namespaces+0xc0/0x1f0 [ 752.777056][T26839] ksys_unshare+0x45b/0xa40 [ 752.777084][T26839] __x64_sys_unshare+0x31/0x40 [ 752.777113][T26839] do_syscall_64+0xcd/0x490 [ 752.777142][T26839] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 752.777168][T26839] [ 752.777174][T26839] Freed by task 21052: [ 752.777186][T26839] kasan_save_stack+0x33/0x60 [ 752.777212][T26839] kasan_save_track+0x14/0x30 [ 752.777238][T26839] kasan_save_free_info+0x3b/0x60 [ 752.777275][T26839] __kasan_slab_free+0x60/0x70 [ 752.777302][T26839] kfree+0x2b4/0x4d0 [ 752.777328][T26839] inetdev_event+0xeb4/0x18a0 [ 752.777361][T26839] notifier_call_chain+0xbc/0x410 [ 752.777392][T26839] call_netdevice_notifiers_info+0xbe/0x140 [ 752.777427][T26839] unregister_netdevice_many_notify+0xf76/0x24c0 [ 752.777460][T26839] default_device_exit_batch+0x853/0xaf0 [ 752.777493][T26839] ops_undo_list+0x363/0xab0 [ 752.777521][T26839] cleanup_net+0x408/0x890 [ 752.777551][T26839] process_one_work+0x9cc/0x1b70 [ 752.777585][T26839] worker_thread+0x6c8/0xf10 [ 752.777606][T26839] kthread+0x3c2/0x780 [ 752.777644][T26839] ret_from_fork+0x5d4/0x6f0 [ 752.777677][T26839] ret_from_fork_asm+0x1a/0x30 [ 752.777705][T26839] [ 752.777711][T26839] The buggy address belongs to the object at ffff888079b80000 [ 752.777711][T26839] which belongs to the cache kmalloc-cg-2k of size 2048 [ 752.777731][T26839] The buggy address is located 1072 bytes inside of [ 752.777731][T26839] freed 2048-byte region [ffff888079b80000, ffff888079b80800) [ 752.777758][T26839] [ 752.777765][T26839] The buggy address belongs to the physical page: [ 752.777777][T26839] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x79b80 [ 752.777799][T26839] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 752.777819][T26839] memcg:ffff888028ccf581 [ 752.777830][T26839] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 752.777852][T26839] page_type: f5(slab) [ 752.777875][T26839] raw: 00fff00000000040 ffff88801b84b3c0 dead000000000100 dead000000000122 [ 752.777900][T26839] raw: 0000000000000000 0000000000080008 00000000f5000000 ffff888028ccf581 [ 752.777925][T26839] head: 00fff00000000040 ffff88801b84b3c0 dead000000000100 dead000000000122 [ 752.777950][T26839] head: 0000000000000000 0000000000080008 00000000f5000000 ffff888028ccf581 [ 752.777976][T26839] head: 00fff00000000003 ffffea0001e6e001 00000000ffffffff 00000000ffffffff [ 752.778001][T26839] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 752.778017][T26839] page dumped because: kasan: bad access detected [ 752.778030][T26839] page_owner tracks the page as allocated [ 752.778040][T26839] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5856, tgid 5856 (syz-executor), ts 68904212043, free_ts 68858035412 [ 752.778086][T26839] post_alloc_hook+0x1c0/0x230 [ 752.778112][T26839] get_page_from_freelist+0x132b/0x38e0 [ 752.778139][T26839] __alloc_frozen_pages_noprof+0x261/0x23f0 [ 752.778167][T26839] alloc_pages_mpol+0x1fb/0x550 [ 752.778195][T26839] new_slab+0x247/0x330 [ 752.778216][T26839] ___slab_alloc+0xcf2/0x1740 [ 752.778237][T26839] __slab_alloc.constprop.0+0x56/0xb0 [ 752.778261][T26839] __kmalloc_node_track_caller_noprof+0x2ee/0x510 [ 752.778292][T26839] kmemdup_noprof+0x29/0x60 [ 752.778318][T26839] neigh_sysctl_register+0xb2/0x670 [ 752.778357][T26839] devinet_sysctl_register+0xb6/0x200 [ 752.778392][T26839] inetdev_init+0x2b8/0x5a0 [ 752.778425][T26839] inetdev_event+0xc5f/0x18a0 [ 752.778458][T26839] notifier_call_chain+0xbc/0x410 [ 752.778487][T26839] call_netdevice_notifiers_info+0xbe/0x140 [ 752.778523][T26839] register_netdevice+0x182e/0x2270 [ 752.778554][T26839] page last free pid 5858 tgid 5858 stack trace: [ 752.778569][T26839] __free_frozen_pages+0x7d5/0x10f0 [ 752.778590][T26839] qlist_free_all+0x4d/0x120 [ 752.778614][T26839] kasan_quarantine_reduce+0x195/0x1e0 [ 752.778640][T26839] __kasan_slab_alloc+0x69/0x90 [ 752.778667][T26839] __kmalloc_cache_noprof+0x1f1/0x3e0 [ 752.778690][T26839] ref_tracker_alloc+0x18e/0x5b0 [ 752.778722][T26839] netdev_queue_update_kobjects+0x2db/0x720 [ 752.778757][T26839] netdev_register_kobject+0x2b3/0x3d0 [ 752.778790][T26839] register_netdevice+0x13dc/0x2270 [ 752.778819][T26839] veth_newlink+0x30f/0xa00 [ 752.778845][T26839] rtnl_newlink+0xc45/0x2000 [ 752.778874][T26839] rtnetlink_rcv_msg+0x95b/0xe90 [ 752.778902][T26839] netlink_rcv_skb+0x155/0x420 [ 752.778931][T26839] netlink_unicast+0x5aa/0x870 [ 752.778958][T26839] netlink_sendmsg+0x8d1/0xdd0 [ 752.778984][T26839] __sys_sendto+0x4a3/0x520 [ 752.779007][T26839] [ 752.779013][T26839] Memory state around the buggy address: [ 752.779025][T26839] ffff888079b80300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 752.779045][T26839] ffff888079b80380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 752.779063][T26839] >ffff888079b80400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 752.779084][T26839] ^ [ 752.779098][T26839] ffff888079b80480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 752.779116][T26839] ffff888079b80500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 752.779131][T26839] ================================================================== [ 752.779181][T26839] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 752.779199][T26839] CPU: 1 UID: 0 PID: 26839 Comm: syz.0.4628 Not tainted 6.17.0-rc1-syzkaller-00224-g8d561baae505 #0 PREEMPT(full) [ 752.779233][T26839] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 752.779249][T26839] Call Trace: [ 752.779259][T26839] [ 752.779269][T26839] dump_stack_lvl+0x3d/0x1f0 [ 752.779301][T26839] vpanic+0x6e8/0x7a0 [ 752.779345][T26839] ? __pfx_vpanic+0x10/0x10 [ 752.779380][T26839] ? __pfx_vprintk_emit+0x10/0x10 [ 752.779408][T26839] ? fbcon_prepare_logo+0xa03/0xc70 [ 752.779439][T26839] panic+0xca/0xd0 [ 752.779473][T26839] ? __pfx_panic+0x10/0x10 [ 752.779508][T26839] ? fbcon_prepare_logo+0xa03/0xc70 [ 752.779540][T26839] ? preempt_schedule_common+0x44/0xc0 [ 752.779570][T26839] ? preempt_schedule_thunk+0x16/0x30 [ 752.779607][T26839] check_panic_on_warn+0xab/0xb0 [ 752.779643][T26839] end_report+0x107/0x170 [ 752.779672][T26839] kasan_report+0xee/0x110 [ 752.779705][T26839] ? fbcon_prepare_logo+0xa03/0xc70 [ 752.779740][T26839] kasan_check_range+0x100/0x1b0 [ 752.779775][T26839] __asan_memcpy+0x23/0x60 [ 752.779800][T26839] fbcon_prepare_logo+0xa03/0xc70 [ 752.779838][T26839] fbcon_init+0xd77/0x1900 [ 752.779868][T26839] ? __pfx_drm_fb_helper_set_par+0x10/0x10 [ 752.779897][T26839] visual_init+0x320/0x620 [ 752.779926][T26839] do_bind_con_driver.isra.0+0x57a/0xbf0 [ 752.779962][T26839] store_bind+0x61d/0x760 [ 752.779998][T26839] ? __pfx_store_bind+0x10/0x10 [ 752.780027][T26839] dev_attr_store+0x58/0x80 [ 752.780063][T26839] ? __pfx_dev_attr_store+0x10/0x10 [ 752.780097][T26839] sysfs_kf_write+0xef/0x150 [ 752.780126][T26839] kernfs_fop_write_iter+0x351/0x510 [ 752.780150][T26839] ? __pfx_sysfs_kf_write+0x10/0x10 [ 752.780180][T26839] iter_file_splice_write+0x918/0x1270 [ 752.780216][T26839] ? copy_splice_read+0x89c/0xc20 [ 752.780241][T26839] ? __pfx_iter_file_splice_write+0x10/0x10 [ 752.780272][T26839] ? __pfx_copy_splice_read+0x10/0x10 [ 752.780300][T26839] ? look_up_lock_class+0x59/0x150 [ 752.780341][T26839] ? __pfx___might_resched+0x10/0x10 [ 752.780368][T26839] ? __pfx_pipe_lock_cmp_fn+0x10/0x10 [ 752.780399][T26839] ? __pfx_iter_file_splice_write+0x10/0x10 [ 752.780429][T26839] direct_splice_actor+0x18f/0x6c0 [ 752.780459][T26839] splice_direct_to_actor+0x345/0xa30 [ 752.780486][T26839] ? __pfx_direct_splice_actor+0x10/0x10 [ 752.780522][T26839] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 752.780551][T26839] ? futex_private_hash_put+0x11c/0x300 [ 752.780584][T26839] do_splice_direct+0x174/0x240 [ 752.780610][T26839] ? __pfx_do_splice_direct+0x10/0x10 [ 752.780637][T26839] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 752.780664][T26839] ? bpf_lsm_file_permission+0x9/0x10 [ 752.780704][T26839] ? security_file_permission+0x71/0x210 [ 752.780737][T26839] ? rw_verify_area+0xcf/0x6c0 [ 752.780764][T26839] do_sendfile+0xb06/0xe50 [ 752.780793][T26839] ? __pfx_do_sendfile+0x10/0x10 [ 752.780821][T26839] ? __x64_sys_futex+0x1e0/0x4c0 [ 752.780852][T26839] ? __x64_sys_futex+0x1e9/0x4c0 [ 752.780885][T26839] __x64_sys_sendfile64+0x1d8/0x220 [ 752.780919][T26839] ? __pfx___x64_sys_sendfile64+0x10/0x10 [ 752.780957][T26839] do_syscall_64+0xcd/0x490 [ 752.780989][T26839] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 752.781013][T26839] RIP: 0033:0x7f676f58ebe9 [ 752.781035][T26839] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 752.781061][T26839] RSP: 002b:00007f677040f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 752.781087][T26839] RAX: ffffffffffffffda RBX: 00007f676f7b5fa0 RCX: 00007f676f58ebe9 [ 752.781106][T26839] RDX: 0000000000000000 RSI: 0000000000000007 RDI: 0000000000000003 [ 752.781123][T26839] RBP: 00007f676f611e19 R08: 0000000000000000 R09: 0000000000000000 [ 752.781142][T26839] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 752.781159][T26839] R13: 00007f676f7b6038 R14: 00007f676f7b5fa0 R15: 00007ffdd0fc4a98 [ 752.781186][T26839] [ 752.781435][T26839] Kernel Offset: disabled