last executing test programs: 4.176786078s ago: executing program 0 (id=1): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = socket(0x40000000015, 0x5, 0x0) bind$inet(r0, &(0x7f00008a5ff0)={0x2, 0x0, @loopback}, 0x10) recvmmsg(r0, &(0x7f00000003c0)=[{{0x0, 0x0, 0x0}, 0x8}], 0x1, 0x120, 0x0) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10) 3.855295866s ago: executing program 1 (id=2): openat$fb0(0xffffffffffffff9c, 0x0, 0x401, 0x0) r0 = syz_open_dev$video4linux(&(0x7f00000007c0), 0x80000005, 0x20040) ioctl$VIDIOC_SUBDEV_S_FMT(r0, 0xc0585605, &(0x7f0000000280)={0x1, 0x0, {0xa, 0x2000, 0x300e, 0x0, 0xa, 0x4, 0x1, 0x1993012db91ab52e}}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000003dc0)) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$sock_int(r3, 0x1, 0x10, &(0x7f00000002c0)=0x8001, 0x4) splice(r1, 0x0, r3, 0x0, 0xd9d7, 0x5) write$FUSE_INIT(r2, &(0x7f0000000340)={0x50, 0x0, 0x0, {0x7, 0x28, 0x1, 0xc002e38, 0x7ff, 0x80, 0x10000, 0xa79, 0x0, 0x0, 0x100}}, 0xffffffed) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) write$tun(0xffffffffffffffff, 0x0, 0x33) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x0, 0x0}) r6 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa2003, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r6, 0xc0184800, &(0x7f0000000100)={0x20004, r5, 0x2}) r8 = syz_open_dev$dri(&(0x7f0000000280), 0x1ff, 0x140) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r8, 0xc00c642e, &(0x7f00000000c0)={0x0, 0x0, r7}) ioctl$DRM_IOCTL_GEM_FLINK(r8, 0xc008640a, 0x0) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffffff, 0xc0106442, &(0x7f0000000180)) ioctl$DRM_IOCTL_GEM_OPEN(r2, 0xc010640b, 0x0) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001580)=ANY=[@ANYBLOB="600000000206030000000000b8791fa80000000014000780080012400000000005001500010000000500010006000000050005000200000005000400000000000900020073797a310000000012000300686173683a6e65742c706f7274"], 0x60}}, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)={0x54, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x84}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4620}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x34040017}, 0x80) r10 = syz_open_dev$vbi(0x0, 0x3, 0x2) ioctl$VIDIOC_G_STD(r10, 0x80085617, &(0x7f0000000080)) 3.830667217s ago: executing program 0 (id=5): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0x3, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x3}}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x19, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r0}, 0xc) 3.769454298s ago: executing program 3 (id=4): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000bdf7130870270c936a8d010203010902120001000000000904"], 0x0) syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f0000000140)={0x1c, &(0x7f00000002c0)={0x20, 0x13, 0x2, "1504"}, 0x0, 0x0}) 3.624063282s ago: executing program 2 (id=3): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e24, @remote}, 0x3, 0x0, 0x1, 0x3}}, 0x26) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f00000020c0), 0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_DELETE(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000070}, 0x4) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) prctl$PR_SCHED_CORE(0x3e, 0x2, 0x0, 0x0, 0x0) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mmap$xdp(&(0x7f0000eed000/0x2000)=nil, 0x2000, 0x7000001, 0x6e073, 0xffffffffffffffff, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, &(0x7f0000000500)={0xffff, 0x0, "83594fe93d78b83238556b7ceae6d7f02746767f8d1f912b20e110c4d238fa9b11b3c046654b43ecbb2b5ecf1be0ac07329c3c694ccf87d484a29fc039580cfbbd44440bc9956b884417d3f4862854d9523fc8dcd03960de918f23cddd6a72074fe147cf2ee73d75be28d013d1ee5e0d83b650a59e64fbfb5fc7423d381d6a497c15f03b49ff8242c31af5b538640c9f96f7b18ca0da06aad29f824490056265d0e0d1e8f843cd0e54f0f436382ebd00223188b2a0b49cdcdba0fe68760f55505d6afc0f2749c212118821a35878d62cda26a66ce262ba121aae04c6ff272acf07c57c52224da08fe5c63dabba39df09805cc82ab8051a5ac3a622e7f0795188"}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_tracing={0x1a, 0xa, 0x0, 0x0, 0x2, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x19, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xf475, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x40000000}, 0x94) r2 = socket$kcm(0x11, 0x2, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0x14, &(0x7f0000000000), 0x4) sendmsg$kcm(r2, 0x0, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0xfffffffffffffffe, 0x8000, 0x4, 0x3}, 0x0, 0x0, 0x0, 0x0) r3 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000140), 0x82084, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xd) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000080)=0x28) ioctl$FIONREAD(r3, 0x541b, 0x0) 3.564914153s ago: executing program 0 (id=6): syz_usb_connect(0x3, 0x4e, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000401107500500000102000109023c00010100a03209040000060000000007058e0240000007050e02400000070501024000000705030240000007058d0240000007050d0240"], &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000300)={0x15, 0x110, 0xfa08, {0xffffffffffffffff, 0xfffffffe, 0x10, 0x10, 0x0, @in={0x2, 0x4e23, @multicast1}, @in={0x2, 0x4e1f, @loopback}}}, 0x118) 2.682079305s ago: executing program 1 (id=7): r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000440)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a000008048002000905811765"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[], 0x0) writev(0xffffffffffffffff, &(0x7f0000001780)=[{&(0x7f00000004c0)="be7000d36230c29f14684b4f2adb85ab06c1857c38289bc0948c79b0a57b251d7fa392", 0x23}, {0x0}], 0x2) write$char_usb(0xffffffffffffffff, 0x0, 0x0) syz_usb_disconnect(r1) 2.570442047s ago: executing program 2 (id=8): socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) socket$kcm(0x1e, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, 0x0, 0x0) recvfrom(r1, &(0x7f0000002800)=""/4071, 0xfffffffffffffdab, 0x17, 0x0, 0x0) openat$sequencer(0xffffff9c, &(0x7f0000001bc0), 0x88302, 0x0) creat(&(0x7f0000000140)='./bus\x00', 0x0) pselect6(0x40, &(0x7f0000000240)={0x3, 0x0, 0x202, 0x7d, 0x10000, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006, 0xb06c}, 0x0, 0x0) ioctl$vim2m_VIDIOC_S_CTRL(0xffffffffffffffff, 0xc008561c, 0x0) 1.372774437s ago: executing program 2 (id=9): socket$inet_udp(0x2, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) read$FUSE(r0, &(0x7f0000000b80)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_CREATE_OPEN(r0, &(0x7f0000002bc0)={0xa0, 0x0, r1, {{0x3, 0x0, 0x5, 0x6, 0x8ca9, 0x4, {0x3, 0x6, 0x5, 0x2, 0xa065, 0xfffffffffffffffa, 0x519e, 0x7ff, 0xfffffffd, 0x4000, 0x80, 0xee00, 0xffffffffffffffff, 0x0, 0xf35a}}, {0x0, 0x1}}}, 0xa0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r6, &(0x7f0000000640)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000380)='}', 0x1}], 0x1, &(0x7f0000000180)=ANY=[@ANYBLOB="14000000000000000100000001000000a5847f16d1f1941a05db2c9a7f1173adbf7fd7a67a150364b1f157b24ae4bae3d48ad0cce5eb930b8356", @ANYRES32=r4, @ANYRES32=r5, @ANYRES32=r6], 0x30, 0x4048080}}], 0x1, 0x4) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) r7 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_ABSBIT(r7, 0x40045567, 0x0) write$uinput_user_dev(r7, &(0x7f0000000300)={'syz0\x00', {0xb, 0x5f93, 0x8, 0x671}, 0x3, [0x2955, 0x2, 0x1000, 0x80000001, 0x8, 0xfa5, 0x6, 0x0, 0x2d, 0x7, 0x6, 0x7, 0x2, 0x1, 0x6, 0x5, 0xe, 0xe93, 0x3, 0xe, 0x12, 0x9, 0x2, 0x3, 0x40000, 0xff, 0x2, 0x1, 0x9, 0xfffffffb, 0xfffffffe, 0x10, 0x13d, 0x5, 0xfffffff8, 0x4, 0xb, 0x9, 0x3, 0x4, 0x9, 0x6, 0x3, 0x2a12, 0x2, 0x8, 0x7, 0x2, 0x7, 0x2, 0x3, 0x4, 0x8, 0x1, 0x1, 0x3325, 0x51, 0x28ba, 0x2, 0xaa, 0x9, 0xfffffffd, 0x2, 0x6], [0xf, 0x1, 0x5fd, 0x0, 0x5, 0x2f3, 0x8000, 0x5000, 0x85, 0x0, 0x1fda, 0x1, 0x7fffffff, 0x0, 0xa, 0x80000000, 0x4, 0x1ff, 0x8, 0x300000, 0x9, 0x84d, 0x5fdb3133, 0x40, 0x3, 0x8, 0x6, 0x9, 0x9ef, 0x2, 0x0, 0x401, 0x3, 0x1, 0x2, 0x7, 0x8, 0x9, 0x3, 0x35, 0x8001, 0x80009, 0x4, 0x0, 0x0, 0x101, 0x1, 0x0, 0x412, 0x3, 0xfffffffc, 0x8, 0x27bb, 0x3, 0xfff, 0x7, 0x36, 0x20009, 0x7, 0x8, 0x312, 0x5, 0x7, 0x1], [0x58a4, 0x80000000, 0x10, 0xffff, 0x3, 0x9, 0x3, 0x0, 0x9e, 0x4e0aea88, 0x4bea, 0xfff, 0x6, 0x3, 0x10, 0xa0c2, 0xfff, 0xc, 0x1, 0x8, 0x7fff, 0x4, 0x7, 0x3, 0x7f, 0x1, 0x80000001, 0x7, 0x8001, 0x3, 0x6, 0x3, 0x9, 0x3, 0x5a7, 0x44, 0x1, 0x27, 0x2, 0x7, 0x1, 0x10100, 0xe6c, 0x2, 0x4, 0x7, 0x76, 0x2, 0xe7a5, 0x1, 0x7, 0x694e1c44, 0x3, 0x800, 0x7, 0x401, 0xdee, 0x1, 0x7, 0x4, 0x2, 0xd9, 0x1, 0x7fff], [0x3, 0x9, 0x400003, 0x3, 0xfffff800, 0x0, 0x0, 0x627, 0x7, 0xa6ea7521, 0x3, 0x8, 0xeeb6, 0xf, 0x0, 0x100, 0x5, 0x800, 0x9, 0x6, 0x800, 0xcb8a, 0x1, 0x3, 0x8, 0x4, 0x8, 0xf, 0xfffffffd, 0xfffffff3, 0x3ff, 0x7, 0xfffffffc, 0x336, 0x4, 0x4d, 0x0, 0x7623d9cc, 0xf8, 0x1, 0x100, 0x7, 0xfffffff9, 0x17b8, 0xea2, 0x81, 0x1000, 0x3, 0x7f95, 0x7, 0x7fffffff, 0x4, 0x7fffffff, 0x6, 0x8, 0x6, 0x1, 0x200, 0x8, 0xfffffff7, 0x4, 0xc, 0x2, 0x9]}, 0x45c) r8 = gettid() fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) tkill(r8, 0xb) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, 0x4, 0x1, 0x301, 0x0, 0x0, {0x1, 0x0, 0x5}}, 0x14}, 0x1, 0x0, 0x0, 0x20040061}, 0x10) 1.372568817s ago: executing program 3 (id=10): syz_emit_vhci(&(0x7f0000000080)=ANY=[@ANYBLOB="04280f00000010"], 0xa) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000000c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) unshare(0x2040400) r3 = fsopen(&(0x7f0000000440)='cgroup2\x00', 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x60, 0x2, 0x6, 0x801, 0x0, 0x0, {0xa}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}, @IPSET_ATTR_BUCKETSIZE={0x5}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x13, 0x3, 'hash:net,iface\x00'}]}, 0x60}}, 0x0) unshare(0x2000400) fsmount(r3, 0x0, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(0xffffffffffffffff, 0xc02c564a, &(0x7f0000001b00)={0x0, 0x34325842, 0x1, @discrete={0x40001, 0x100}}) r5 = openat$vimc1(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_G_FMT(r5, 0xc0cc5604, &(0x7f00000000c0)={0xa, @sliced={0x25e, [0x28e2, 0x4, 0x8, 0xcc, 0x1, 0xfffb, 0x7, 0x1, 0x8001, 0x6, 0x8, 0x6, 0xf, 0x9, 0x4, 0x5, 0x9, 0x2, 0x7, 0xb8e4, 0x6, 0xb, 0x3, 0xf, 0x104, 0x27, 0x6, 0x63d, 0xa, 0xe, 0x1, 0xa, 0x81be, 0x3, 0x10, 0x8, 0x8001, 0x3, 0x6, 0x0, 0xf9, 0xfff7, 0x4, 0xf, 0xfe00, 0xb, 0x3, 0x7fff], 0x37}}) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000840)=@raw={'raw\x00', 0x3c1, 0x3, 0x48c, 0x0, 0x18c, 0x203, 0x0, 0x19030000, 0x3c4, 0x2e0, 0x2e0, 0x3c4, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x2d4, 0x2fc, 0x0, {}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{0x1d}, {0x2}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0xfffffffe}, {}, {}, {}, {0xfffc, 0x0, 0x0, 0xe}, {}, {0x0, 0x0, 0x3}, {0x2}, {0xffff}, {0x0, 0x0, 0x0, 0x1}, {}, {0x0, 0x3}, {0x16}, {}, {}, {0x7}, {}, {0x0, 0x0, 0x0, 0x101}, {}, {}, {}, {}, {}, {}, {0xfffe}, {}, {}, {}, {0x0, 0xfd}, {}, {0x7a04}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x800}, {}, {0xb84, 0x0, 0x0, 0xf00}, {0x0, 0x1, 0x0, 0x3}, {0x0, 0x0, 0x4}, {0xfffe}, {0x0, 0x0, 0x0, 0x2}, {}, {}, {}, {0x0, 0x0, 0x0, 0x2000000}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4, 0x0, 0x10}]}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x4}}}, {{@uncond, 0x0, 0xa4, 0xc8}, @common=@inet=@TCPMSS={0x24, 'TCPMSS\x00', 0x0, {0x1}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x4e8) 247.191224ms ago: executing program 2 (id=11): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x32cc0000) mbind(&(0x7f00003e1000/0x4000)=nil, 0x4000, 0x8003, &(0x7f0000000000)=0x6, 0x7, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps_rollup\x00') madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) read$FUSE(r0, 0x0, 0x0) 0s ago: executing program 0 (id=12): r0 = socket$kcm(0x23, 0x5, 0x0) listen(r0, 0x800) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000f00)=[{&(0x7f0000000200)="5c00000014006b05c84e21000ab16d6e230675f811000000440002005817d30461bc24eeb556a7ef595105ea1698fa51f60a64c9f408000000e786a6d0bdbdc3d44bd70011b6c0504bb9189d9193e9bd00"/92, 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x240040c4) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r2, &(0x7f0000000040)={0x23, 0x0, 0x58}, 0x10) socket$inet_sctp(0x2, 0x1, 0x84) socket$inet6(0xa, 0x1, 0x100) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000180)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) r5 = accept4(r0, 0x0, 0x0, 0x80000) socket$inet_icmp_raw(0x2, 0x3, 0x1) timerfd_create(0x0, 0x80000) syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), r5) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, 0x0) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, 0x0, 0x40) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000940)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x20, 0x87}, {0x0, 0x7fffffffffffffff, 0x0, 0x10000, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0x0, 0x4, 0x200000000000000}, 0x0, 0x0, 0x0, 0x1, 0x3, 0x2}}, 0xb8}}, 0x2c000010) recvmsg(r6, 0x0, 0x40000000) kernel console output (not intermixed with test programs): [ 58.756345][ T5434] 8021q: adding VLAN 0 to HW filter on device bond0 [ 58.776316][ T5434] eql: remember to turn off Van-Jacobson compression on your slave devices Starting crond: OK [ 59.275676][ T5516] ssh-keygen (5516) used greatest stack depth: 20376 bytes left Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.191' (ED25519) to the list of known hosts. syzkaller login: [ 78.738154][ T5760] cgroup: Unknown subsys name 'net' [ 78.879190][ T5760] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 80.579735][ T5760] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 82.179416][ T5773] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 82.190139][ T5773] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 82.209808][ T5773] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 82.218037][ T5773] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 82.226137][ T5773] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 82.233674][ T5773] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 82.290359][ T5084] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 82.298221][ T5084] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 82.310073][ T5084] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 82.321347][ T5084] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 82.341510][ T51] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 82.349190][ T51] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 82.358254][ T5773] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 82.367529][ T5773] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 82.390947][ T5773] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 82.399197][ T5773] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 82.407638][ T5773] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 82.415216][ T5773] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 82.480805][ T51] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 82.489243][ T51] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 82.502200][ T51] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 82.522544][ T51] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 82.530860][ T5773] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 82.538213][ T5773] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 82.809163][ T5771] chnl_net:caif_netlink_parms(): no params data found [ 82.989691][ T5771] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.997201][ T5771] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.006040][ T5771] bridge_slave_0: entered allmulticast mode [ 83.013877][ T5771] bridge_slave_0: entered promiscuous mode [ 83.062010][ T5781] chnl_net:caif_netlink_parms(): no params data found [ 83.087340][ T5771] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.100701][ T5771] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.107961][ T5771] bridge_slave_1: entered allmulticast mode [ 83.115652][ T5771] bridge_slave_1: entered promiscuous mode [ 83.189186][ T5771] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.205421][ T5774] chnl_net:caif_netlink_parms(): no params data found [ 83.216502][ T5775] chnl_net:caif_netlink_parms(): no params data found [ 83.230551][ T5771] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.353609][ T5781] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.362982][ T5781] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.371414][ T5781] bridge_slave_0: entered allmulticast mode [ 83.378544][ T5781] bridge_slave_0: entered promiscuous mode [ 83.387884][ T5781] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.395154][ T5781] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.402616][ T5781] bridge_slave_1: entered allmulticast mode [ 83.410470][ T5781] bridge_slave_1: entered promiscuous mode [ 83.424278][ T5771] team0: Port device team_slave_0 added [ 83.473789][ T5771] team0: Port device team_slave_1 added [ 83.516221][ T5781] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.529236][ T5781] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.570375][ T5775] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.577610][ T5775] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.585211][ T5775] bridge_slave_0: entered allmulticast mode [ 83.592955][ T5775] bridge_slave_0: entered promiscuous mode [ 83.624156][ T5771] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.634692][ T5771] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.661182][ T5771] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.673540][ T5775] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.681598][ T5775] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.688942][ T5775] bridge_slave_1: entered allmulticast mode [ 83.696766][ T5775] bridge_slave_1: entered promiscuous mode [ 83.714910][ T5774] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.722583][ T5774] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.730117][ T5774] bridge_slave_0: entered allmulticast mode [ 83.737536][ T5774] bridge_slave_0: entered promiscuous mode [ 83.745940][ T5771] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.755978][ T5771] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.785811][ T5771] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.831185][ T5781] team0: Port device team_slave_0 added [ 83.837667][ T5774] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.845033][ T5774] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.852741][ T5774] bridge_slave_1: entered allmulticast mode [ 83.859905][ T5774] bridge_slave_1: entered promiscuous mode [ 83.895310][ T5775] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.907637][ T5775] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.920447][ T5781] team0: Port device team_slave_1 added [ 83.961544][ T5774] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.984628][ T5781] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.992464][ T5781] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.019482][ T5781] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.048089][ T5771] hsr_slave_0: entered promiscuous mode [ 84.055129][ T5771] hsr_slave_1: entered promiscuous mode [ 84.064314][ T5774] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.095536][ T5781] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.102719][ T5781] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.129234][ T5781] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.187337][ T5775] team0: Port device team_slave_0 added [ 84.197120][ T5775] team0: Port device team_slave_1 added [ 84.225128][ T5781] hsr_slave_0: entered promiscuous mode [ 84.232421][ T5781] hsr_slave_1: entered promiscuous mode [ 84.238888][ T5781] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 84.247127][ T5781] Cannot create hsr debugfs directory [ 84.259064][ T5774] team0: Port device team_slave_0 added [ 84.280562][ T5773] Bluetooth: hci0: command tx timeout [ 84.306091][ T5774] team0: Port device team_slave_1 added [ 84.336164][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.343531][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.369676][ T5775] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.418408][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.425693][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.452023][ T5775] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.472382][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.479389][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.505837][ T5774] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.519819][ T5773] Bluetooth: hci1: command tx timeout [ 84.525550][ T5773] Bluetooth: hci2: command tx timeout [ 84.552404][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.559401][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.585831][ T5774] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.599871][ T5773] Bluetooth: hci3: command tx timeout [ 84.740341][ T5774] hsr_slave_0: entered promiscuous mode [ 84.746951][ T5774] hsr_slave_1: entered promiscuous mode [ 84.753886][ T5774] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 84.764888][ T5774] Cannot create hsr debugfs directory [ 84.775759][ T5775] hsr_slave_0: entered promiscuous mode [ 84.782880][ T5775] hsr_slave_1: entered promiscuous mode [ 84.789279][ T5775] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 84.797088][ T5775] Cannot create hsr debugfs directory [ 85.077854][ T5771] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 85.115860][ T5771] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 85.128704][ T5771] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 85.152114][ T5771] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 85.248214][ T5781] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 85.260784][ T5781] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 85.275242][ T5781] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 85.285437][ T5781] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 85.366602][ T5775] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 85.384602][ T5775] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 85.404117][ T5775] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 85.415635][ T5775] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 85.498638][ T5774] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 85.510851][ T5774] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 85.543402][ T5774] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 85.573577][ T5771] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.582168][ T5774] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 85.641847][ T5771] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.662857][ T1092] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.670405][ T1092] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.715989][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.723206][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.746110][ T5781] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.815393][ T5781] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.831421][ T1092] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.838684][ T1092] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.863176][ T1092] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.870407][ T1092] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.909337][ T5775] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.973366][ T5775] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.024613][ T1081] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.031850][ T1081] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.045149][ T1081] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.052445][ T1081] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.078248][ T5781] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 86.125559][ T5774] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.234464][ T5774] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.278014][ T60] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.285241][ T60] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.332830][ T60] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.340054][ T60] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.360982][ T5773] Bluetooth: hci0: command tx timeout [ 86.600079][ T5773] Bluetooth: hci2: command tx timeout [ 86.601273][ T5084] Bluetooth: hci1: command tx timeout [ 86.667669][ T5771] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.680068][ T5084] Bluetooth: hci3: command tx timeout [ 86.744657][ T5781] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.784440][ T5775] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.881301][ T5771] veth0_vlan: entered promiscuous mode [ 86.900985][ T5774] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.946535][ T5771] veth1_vlan: entered promiscuous mode [ 86.956627][ T5775] veth0_vlan: entered promiscuous mode [ 86.996957][ T5775] veth1_vlan: entered promiscuous mode [ 87.043199][ T5781] veth0_vlan: entered promiscuous mode [ 87.098437][ T5781] veth1_vlan: entered promiscuous mode [ 87.154500][ T5771] veth0_macvtap: entered promiscuous mode [ 87.187307][ T5774] veth0_vlan: entered promiscuous mode [ 87.207207][ T5771] veth1_macvtap: entered promiscuous mode [ 87.234819][ T5774] veth1_vlan: entered promiscuous mode [ 87.266142][ T5771] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.277723][ T5775] veth0_macvtap: entered promiscuous mode [ 87.305307][ T5771] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.342299][ T5781] veth0_macvtap: entered promiscuous mode [ 87.353231][ T5771] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.364486][ T5771] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.374924][ T5771] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.384052][ T5771] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.403081][ T5775] veth1_macvtap: entered promiscuous mode [ 87.414046][ T5781] veth1_macvtap: entered promiscuous mode [ 87.444618][ T5774] veth0_macvtap: entered promiscuous mode [ 87.488799][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 87.515930][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.530200][ T5781] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.540456][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 87.552557][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.564249][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 87.577187][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.589127][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.602441][ T5774] veth1_macvtap: entered promiscuous mode [ 87.634973][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 87.663961][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.683909][ T5781] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.696943][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 87.711622][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.731544][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 87.746615][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.758464][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.795128][ T5781] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.816675][ T5781] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.825572][ T5781] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.843618][ T5781] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.858255][ T5775] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.872883][ T5775] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.884084][ T5775] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.893026][ T5775] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.976952][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 87.989050][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.999288][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 88.010363][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.020782][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 88.031711][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.055588][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.138344][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 88.149048][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.159465][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 88.170804][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.183397][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 88.194700][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.207967][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.229253][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.234142][ T5774] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.248693][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.259505][ T5774] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.271371][ T5774] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.281498][ T5774] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.332755][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.347445][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.376189][ T1081] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.388490][ T1081] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.447357][ T5084] Bluetooth: hci0: command tx timeout [ 88.464240][ T1097] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.493606][ T1097] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.578383][ T1081] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.609810][ T1081] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.668248][ T4852] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.688662][ T5084] Bluetooth: hci1: command tx timeout [ 88.688673][ T5773] Bluetooth: hci2: command tx timeout [ 88.706702][ T4852] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.715806][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.733933][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.759967][ T5773] Bluetooth: hci3: command tx timeout [ 88.853897][ T48] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.900558][ T48] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.522988][ T56] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 89.709901][ T5829] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 89.839718][ T56] usb 4-1: Using ep0 maxpacket: 8 [ 89.862215][ T56] usb 4-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 89.875286][ T56] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.886001][ T56] usb 4-1: Product: syz [ 89.890462][ T56] usb 4-1: Manufacturer: syz [ 89.898005][ T56] usb 4-1: SerialNumber: syz [ 89.905868][ T5829] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 64 [ 89.918921][ T5829] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0xE has invalid maxpacket 64 [ 89.934848][ T56] usb 4-1: config 0 descriptor?? [ 89.940757][ T5829] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 89.963578][ T5829] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 89.978640][ T56] gspca_main: sq930x-2.14.0 probing 2770:930c [ 89.988334][ T5829] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x8D has invalid maxpacket 64 [ 90.002241][ T5829] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0xD has invalid maxpacket 64 [ 90.018753][ T5829] usb 1-1: New USB device found, idVendor=0711, idProduct=0550, bcdDevice= 0.00 [ 90.085526][ T5829] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 90.110088][ T5829] usb 1-1: Product: syz [ 90.114328][ T5829] usb 1-1: Manufacturer: syz [ 90.175045][ T5845] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 90.193418][ T5845] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 90.231219][ T5845] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 90.238587][ T5845] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 90.253478][ T5845] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 90.262777][ T5845] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 90.277283][ T5829] usb 1-1: USB2VGA dongle found at address 2 [ 90.317822][ T5829] usb 1-1: Allocated 8 output buffers [ 90.352872][ T5829] usb 1-1: Failed to early initialize device [ 90.407396][ T56] gspca_sq930x: ucbus_write failed -71 [ 90.540707][ T5773] Bluetooth: hci0: command tx timeout [ 90.805935][ T56] gspca_sq930x: Sensor ov9630 not yet treated [ 90.906807][ T56] sq930x: probe of 4-1:0.0 failed with error -22 [ 90.955684][ T5773] Bluetooth: hci2: command tx timeout [ 90.955689][ T5084] Bluetooth: hci1: command tx timeout [ 90.955721][ T5773] Bluetooth: hci3: command tx timeout [ 91.013380][ T5845] ucma_write: process 8 (syz.0.6) changed security contexts after opening file descriptor, this is not allowed. [ 91.238058][ T5857] usb 1-1: USB disconnect, device number 2 [ 91.268094][ T56] usb 4-1: USB disconnect, device number 2 [ 91.441879][ T5808] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 92.399747][ T5868] workqueue: Failed to create a rescuer kthread for wq "ceph-completion": -EINTR [ 92.433026][ T9] cfg80211: failed to load regulatory.db [ 92.528551][ T5808] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 92.547539][ T5808] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 92.602455][ T5808] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 92.626026][ T5808] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 92.642853][ T5808] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 92.660958][ T5808] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 92.668984][ T5808] usb 2-1: Product: syz [ 92.679489][ T5808] usb 2-1: Manufacturer: syz [ 92.703686][ T5808] cdc_wdm 2-1:1.0: skipping garbage [ 92.721262][ T5808] cdc_wdm 2-1:1.0: skipping garbage [ 92.794004][ T5808] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 92.813674][ T5808] cdc_wdm 2-1:1.0: Unknown control protocol [ 92.866515][ T5875] netlink: 'syz.0.12': attribute type 2 has an invalid length. [ 92.921522][ T5808] usb 2-1: USB disconnect, device number 2 [ 93.024933][ T5875] ------------[ cut here ]------------ [ 93.030716][ T5875] kernel BUG at net/phonet/socket.c:213! [ 93.040629][ T5875] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 93.046876][ T5875] CPU: 1 PID: 5875 Comm: syz.0.12 Not tainted syzkaller #0 [ 93.054120][ T5875] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 93.064231][ T5875] RIP: 0010:pn_socket_sendmsg+0x235/0x240 [ 93.069996][ T5875] Code: 41 5f 5d c3 e8 bc dd ca 00 89 d9 80 e1 07 fe c1 38 c1 0f 8c 0f ff ff ff 48 89 df e8 55 05 1e f8 e9 02 ff ff ff e8 3b 88 c5 f7 <0f> 0b 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 55 48 89 e5 41 57 41 [ 93.089638][ T5875] RSP: 0018:ffffc90004f67c20 EFLAGS: 00010283 [ 93.095757][ T5875] RAX: ffffffff89c1e6e5 RBX: 0000000000000000 RCX: 0000000000080000 [ 93.103773][ T5875] RDX: ffffc9000c439000 RSI: 0000000000000a3f RDI: 0000000000000a40 [ 93.111903][ T5875] RBP: ffffc90004f67cd0 R08: ffffffff8e8c7caf R09: 1ffffffff1d18f95 [ 93.119931][ T5875] R10: dffffc0000000000 R11: fffffbfff1d18f96 R12: dffffc0000000000 [ 93.128292][ T5875] R13: ffff888076cf5a00 R14: ffff88801cfd0c80 R15: 1ffff920009ecf88 [ 93.136366][ T5875] FS: 00007f61496fc6c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 93.145316][ T5875] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 93.151935][ T5875] CR2: 00007feda2ca4068 CR3: 0000000077465000 CR4: 00000000003506e0 [ 93.160030][ T5875] Call Trace: [ 93.163340][ T5875] [ 93.166316][ T5875] ? pn_socket_ioctl+0x350/0x350 [ 93.171320][ T5875] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 93.176642][ T5875] ? security_socket_sendmsg+0x80/0xa0 [ 93.182143][ T5875] __sys_sendto+0x4a9/0x6b0 [ 93.186680][ T5875] ? __ia32_sys_getpeername+0x90/0x90 [ 93.192084][ T5875] ? __lock_acquire+0x7d80/0x7d80 [ 93.197140][ T5875] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 93.203156][ T5875] ? lock_chain_count+0x20/0x20 [ 93.208041][ T5875] ? lock_chain_count+0x20/0x20 [ 93.212942][ T5875] __x64_sys_sendto+0xde/0xf0 [ 93.217652][ T5875] do_syscall_64+0x55/0xb0 [ 93.222099][ T5875] ? clear_bhb_loop+0x40/0x90 [ 93.226836][ T5875] ? clear_bhb_loop+0x40/0x90 [ 93.231547][ T5875] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 93.237468][ T5875] RIP: 0033:0x7f614875e84e [ 93.241933][ T5875] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 93.261580][ T5875] RSP: 002b:00007f61496fae88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 93.270031][ T5875] RAX: ffffffffffffffda RBX: 00007f61496fc6c0 RCX: 00007f614875e84e [ 93.278042][ T5875] RDX: 0000000000000020 RSI: 00007f61496fb000 RDI: 0000000000000009 [ 93.286053][ T5875] RBP: 0000000000000000 R08: 00007f61496faf04 R09: 000000000000000c [ 93.294059][ T5875] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000009 [ 93.302061][ T5875] R13: 00007f61496faf58 R14: 00007f61496fb000 R15: 0000000000000000 [ 93.310067][ T5875] [ 93.313110][ T5875] Modules linked in: [ 93.320664][ T5875] ---[ end trace 0000000000000000 ]--- [ 93.326316][ T5875] RIP: 0010:pn_socket_sendmsg+0x235/0x240 [ 93.333477][ T5875] Code: 41 5f 5d c3 e8 bc dd ca 00 89 d9 80 e1 07 fe c1 38 c1 0f 8c 0f ff ff ff 48 89 df e8 55 05 1e f8 e9 02 ff ff ff e8 3b 88 c5 f7 <0f> 0b 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 55 48 89 e5 41 57 41 [ 93.376952][ T5875] RSP: 0018:ffffc90004f67c20 EFLAGS: 00010283 [ 93.389140][ T5875] RAX: ffffffff89c1e6e5 RBX: 0000000000000000 RCX: 0000000000080000 [ 93.398712][ T5875] RDX: ffffc9000c439000 RSI: 0000000000000a3f RDI: 0000000000000a40 [ 93.418324][ T5875] RBP: ffffc90004f67cd0 R08: ffffffff8e8c7caf R09: 1ffffffff1d18f95 [ 93.428437][ T5875] R10: dffffc0000000000 R11: fffffbfff1d18f96 R12: dffffc0000000000 [ 93.444933][ T5875] R13: ffff888076cf5a00 R14: ffff88801cfd0c80 R15: 1ffff920009ecf88 [ 93.467906][ T5875] FS: 00007f61496fc6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 93.497149][ T5875] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 93.515118][ T5875] CR2: 00007f3b8840b000 CR3: 0000000077465000 CR4: 00000000003506f0 [ 93.527634][ T5875] Kernel panic - not syncing: Fatal exception [ 93.533916][ T5875] Kernel Offset: disabled [ 93.538253][ T5875] Rebooting in 86400 seconds..