last executing test programs: 4.992157276s ago: executing program 4 (id=490): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) pipe2(&(0x7f0000000080)={0xffffffffffffffff}, 0x4000) fallocate(r0, 0x2, 0x100000000, 0x9c7) 4.923847387s ago: executing program 4 (id=491): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x10c4, 0xea90, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000000c0)={0x2c, &(0x7f0000000580)=ANY=[@ANYBLOB="00090101"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000500)={0x2c, 0x0, 0x0, 0x0, &(0x7f00000005c0)={0x20, 0x1, 0x3, "c28201"}, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$I2C_RDWR(0xffffffffffffffff, 0x707, &(0x7f0000000140)={&(0x7f0000000240)=[{0xdd6, 0x3000, 0x0, 0x0}], 0x1}) socket$kcm(0xa, 0x922000000003, 0x11) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r1, 0x84, 0x6e, 0x0, 0x0) 4.658863383s ago: executing program 2 (id=498): socketpair$unix(0x1, 0x5, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/rt_acct\x00') preadv(r2, &(0x7f0000000540)=[{&(0x7f0000000140)=""/205, 0xcd}], 0x1, 0xfffffffb, 0xbf6b) 4.336029801s ago: executing program 4 (id=503): r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, {0x4, 0x1, 0x3, 0x69, 0x200, 0x0, 0x2, 0x5, 0x4cab, 0xe156, 0x0, 0x0, 0x96, 0x8000, "fe1d00003413000000000000000caa000000090000000000000004b427180010"}}) 4.218913649s ago: executing program 4 (id=508): landlock_restrict_self(0xffffffffffffffff, 0x0) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = landlock_create_ruleset(&(0x7f00000001c0)={0xa019, 0x1, 0x3}, 0x18, 0x0) landlock_restrict_self(r1, 0x0) r2 = getpgid(r0) r3 = syz_pidfd_open(r2, 0x0) pidfd_send_signal(r3, 0x0, 0x0, 0x4) 4.068359317s ago: executing program 4 (id=513): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000280)={{0x0, 0x1, 0x0, 0x9}, 'syz1\x00', 0x3f}) socket$nl_netfilter(0x10, 0x3, 0xc) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xfffffdff}) r1 = socket$kcm(0xa, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x8936, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) ioctl$RTC_AIE_ON(r2, 0x7001) ioctl$RTC_AIE_OFF(r2, 0x7002) ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f00000002c0)={0x3f, {0x0, 0xb, 0x0, 0xffffffff}}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0xf, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b1f203401e0903003bd7010203010902"], 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0xf, 0x0, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) r5 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x2881) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r5, 0xc08c5332, 0x0) write$sndseq(r5, 0x0, 0x0) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x3) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a70000000060a0b0400000000000000000200000044000480400001800a0001006d6174636800000030000280080002400000000118000300c6a41d106c720000f5ffffff2fad0a4883cdbba10a0001006f776e65720000000900010073797a30000000000900020073797a32"], 0x98}}, 0x4048010) unshare(0xc040400) r7 = timerfd_create(0x7, 0x0) timerfd_settime(r7, 0x7, &(0x7f0000000140)={{0x77359400}}, &(0x7f0000000200)) 4.067199326s ago: executing program 1 (id=523): landlock_restrict_self(0xffffffffffffffff, 0x0) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = landlock_create_ruleset(&(0x7f00000001c0)={0xa019, 0x1, 0x3}, 0x18, 0x0) landlock_restrict_self(r1, 0x0) r2 = getpgid(r0) r3 = syz_pidfd_open(r2, 0x0) pidfd_send_signal(r3, 0x0, 0x0, 0x4) 3.931040037s ago: executing program 1 (id=517): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x300) setsockopt$inet_int(r0, 0x0, 0x12, &(0x7f0000000180)=0x1f5, 0x4) recvmmsg(r0, &(0x7f0000000340)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x45833af92e4b39ff, 0x0) 3.341650774s ago: executing program 1 (id=518): r0 = socket$nl_generic(0x10, 0x3, 0x10) recvmmsg(r0, &(0x7f0000001700)=[{{0x0, 0x0, 0x0}, 0xfffff2a8}], 0x1, 0x40002102, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r5, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000001}, 0xc) r6 = socket$inet6(0xa, 0x80003, 0x6) connect$inet6(r6, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r6, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x6}, {0x0, 0x4, 0x0, 0xa78a}, 0xfffffffe, 0x0, 0x1}, {{@in=@private, 0x0, 0x33}, 0x0, @in=@rand_addr=0x64010101, 0x0, 0x3, 0x1, 0x7}}, 0xe8) sendmmsg(r6, &(0x7f0000000480), 0x2e9, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f00000001c0)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="020100000a0000000600000000000000030006000000000002000000ffffffff0000000000000000030005000000000002000000ac1e00010000000000000000020013"], 0x50}}, 0x0) r8 = userfaultfd(0x80001) ioctl$UFFDIO_API(r8, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x110}) ioctl$UFFDIO_REGISTER(r8, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_REGISTER(r8, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x0, 0x2}) sendmmsg$unix(r2, 0x0, 0x0, 0x10) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) 2.201748411s ago: executing program 1 (id=525): r0 = syz_usb_connect$uac1(0x0, 0xac, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000000000106b1d010140000102030109029a0003010000000904000000010100000a24010000000201020c24020000000000000800000524050000082407000000009e0c240700000000a3e82f07070d240701060000fd80000000e90924030000000001"], 0x0) syz_usb_control_io(r0, &(0x7f0000000140)={0x2c, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x407}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac1(r0, &(0x7f0000001840)={0x14, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000840)={0x84, &(0x7f0000000380)={0x8605dff54cf56be5, 0x17, 0x2, "fb72"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f00000009c0)={0x84, &(0x7f00000002c0)={0x0, 0xf, 0x1, "e9"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.975891027s ago: executing program 0 (id=527): r0 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0xfffffeffffff7f7e, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000001780)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000001280)={0xa, 0x4e23, 0xfffffe01, @local, 0x3}, 0x1c, 0x0}}], 0x2, 0x24008051) 1.303734749s ago: executing program 0 (id=528): landlock_restrict_self(0xffffffffffffffff, 0x0) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = landlock_create_ruleset(&(0x7f00000001c0)={0xa019, 0x1, 0x3}, 0x18, 0x0) landlock_restrict_self(r1, 0x0) r2 = getpgid(r0) r3 = syz_pidfd_open(r2, 0x0) pidfd_send_signal(r3, 0x0, 0x0, 0x4) 1.190531207s ago: executing program 0 (id=529): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r0, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x300) setsockopt$inet_int(r0, 0x0, 0x12, &(0x7f0000000180)=0x1f5, 0x4) recvmmsg(r0, &(0x7f0000000340)=[{{0x0, 0x0, 0x0}, 0x4}], 0x1, 0x45833af92e4b39ff, 0x0) 1.131875038s ago: executing program 2 (id=530): socket$inet6(0xa, 0x1, 0x8010000000000084) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect(0x0, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902"], 0x0) socket(0x10, 0x3, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000240), 0xc0802, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0) r0 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x81000000, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_ECN={0x8, 0x4, 0x1}]}}]}, 0x3c}}, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x58, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x1a3, 0x655c, 0x4, 0x40, 0x7fffffff, 0x7fffffff, 0x80, 0xffffffff, 0x1}}}}]}, 0x58}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.060618665s ago: executing program 0 (id=531): socket$netlink(0x10, 0x3, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000140)=@newtfilter={0x90, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0xfffa}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x58, 0x2, [@TCA_FLOWER_ACT={0x54, 0x3, [@m_connmark={0x50, 0x1, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xfffffff5, 0x9, 0x6, 0x6, 0xb87}, 0x6}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0x8, 0x1}}]}, 0x90}, 0x1, 0x0, 0x0, 0x2000080d}, 0x24000000) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 963.235692ms ago: executing program 0 (id=533): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2, 0x0, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000000000)='g', 0x1, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0x398, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='htcp\x00', 0x5) writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000040)='8', 0x1}], 0x1) 936.29455ms ago: executing program 3 (id=534): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x8848}, 0x80) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r0, 0x11c, 0x4, &(0x7f0000000000)=""/152, &(0x7f00000000c0)=0x98) 912.798935ms ago: executing program 4 (id=535): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000002280)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x8000}}) read$FUSE(r0, &(0x7f00000050c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_ATTR(r0, &(0x7f0000007100)={0x78, 0x0, r3, {0xa0, 0x6, 0x0, {0x4, 0x0, 0x9, 0x8, 0x0, 0x23, 0xfffff92f, 0x0, 0x4, 0xc000, 0x3ff, 0xee00, 0x0, 0x7fffffff, 0x4}}}, 0x78) r4 = syz_io_uring_setup(0x10d, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x3}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000000300)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000480)='./file0\x00', 0x0, 0x80}) io_uring_enter(r4, 0x3516, 0x0, 0x0, 0x0, 0xfffffdcf) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000180)={0xffffff}, 0x10) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000c80)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x4000041) syz_emit_vhci(0x0, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) fcntl$setpipe(0xffffffffffffffff, 0x408, 0x0) 855.984572ms ago: executing program 1 (id=536): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@ipv6_newrule={0x1c, 0x20, 0x1, 0x70bd26, 0xffffffff, {0xa, 0x14, 0x20, 0x40, 0x3, 0x0, 0x0, 0x7, 0x1}}, 0x1c}, 0x1, 0x0, 0x0, 0x40814}, 0x4000004) 855.692716ms ago: executing program 3 (id=537): r0 = syz_io_uring_setup(0x1e1e, &(0x7f0000000200)={0x0, 0x86f7, 0x10100}, &(0x7f0000002000)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r1, r2, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x22}) io_uring_enter(r0, 0x48e9, 0x0, 0x2, 0x0, 0x0) readv(0xffffffffffffffff, &(0x7f0000000340)=[{&(0x7f0000000080)=""/140, 0x8c}], 0x1) ioctl$IMADDTIMER(0xffffffffffffffff, 0x80044940, &(0x7f0000000000)) 855.303466ms ago: executing program 1 (id=538): r0 = syz_open_dev$usbmon(&(0x7f0000000140), 0x5a2, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000980)={0x40000000}) syz_open_dev$usbfs(&(0x7f0000000000), 0x200, 0x102) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x7, 0x3, 0x6, 0xfffa}, 0x1d, [0x8000, 0x8000, 0xf, 0x9, 0x80, 0x2, 0x3, 0x7f, 0x6, 0x4b, 0x39cc1917, 0x5f, 0x9, 0x5, 0xffff2d37, 0x0, 0x6, 0x3, 0x4000, 0x5, 0x4, 0x3, 0x4, 0x6, 0x1, 0x6, 0x9, 0x3, 0x15bb, 0x2, 0xe661, 0x4, 0x7, 0x3, 0x7fff, 0x4c74, 0x80000000, 0xa72, 0x3, 0x7, 0x0, 0x71, 0x7, 0x1, 0x1, 0x5, 0xd091, 0x3e, 0x7, 0x9a59, 0x6, 0x0, 0x5, 0x4, 0x8, 0x0, 0x80, 0x0, 0x5, 0x5, 0x8, 0x7, 0x1, 0x40], [0x10000007, 0x3, 0x800, 0x8000, 0x10, 0xfffffff3, 0x129432e6, 0x200c7, 0xf9, 0xd, 0x2bf, 0x6c9, 0x10000007, 0xfffffffc, 0x3, 0x0, 0xd14, 0x5, 0x2f, 0xe, 0x4312, 0x0, 0xea4, 0x0, 0x4, 0x4, 0x8000, 0x9, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x5, 0x5f31, 0x7f5, 0x0, 0x2, 0x80, 0x9, 0x4, 0x9, 0x8, 0x7, 0x6, 0x7, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x7b, 0x9, 0x3, 0x3, 0x9, 0x1, 0x8, 0xffffffff, 0x9, 0x10, 0x42, 0x2], [0x7, 0xffc00000, 0x0, 0x5, 0xfffffffa, 0x100, 0x8d2, 0x9, 0x800003, 0x7fff, 0x6, 0x5, 0xad, 0x4, 0x5, 0x20000005, 0x800, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x9, 0x367, 0x9, 0x5, 0x2, 0x2, 0x3, 0x8, 0x8, 0x6cfc, 0x5, 0x38, 0x800003, 0x200, 0xfffffffb, 0x3, 0x8004, 0x7, 0x1000, 0xa2, 0x7, 0x5, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x11, 0x7ff, 0xfffffff9, 0x0, 0x1, 0xffff, 0x0, 0x6, 0xc4, 0x120000, 0xbe, 0x9, 0xa2ed, 0x2, 0x25], [0x9, 0xbb31, 0x7, 0xb, 0x5, 0x938, 0xa, 0x80000006, 0x0, 0x5, 0x7d, 0x1fc, 0x40006, 0x6, 0x8, 0x57b, 0x101, 0x10000, 0x6, 0x7fff, 0xfffd, 0x4, 0x20002, 0x5, 0x1, 0x2, 0x14c, 0x60a6, 0x6, 0x6, 0xffffffff, 0x80000000, 0x5, 0x8, 0xca, 0xee1, 0xfffff000, 0xffff, 0x3, 0x7e, 0x100, 0x9600, 0xa, 0x2, 0x4, 0x40000006, 0x1, 0x10080, 0x5, 0x8, 0x30b1d693, 0xa1f, 0xc, 0x7, 0xfffffffe, 0x6, 0x0, 0x4, 0x24000000, 0xb1e, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) 838.502301ms ago: executing program 3 (id=539): ioctl$sock_qrtr_TIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r2, {0x0, 0x10}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x8c, 0x2c, 0xd27, 0x70bd25, 0x25dfdc00, {0x0, 0x0, 0x0, r5, {0x0, 0x8}, {}, {0x7}}, [@filter_kind_options=@f_matchall={{0xd}, {0x58, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x7, 0x24d417d6, 0x3, 0x800, 0xe26}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) 728.108226ms ago: executing program 3 (id=540): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=ANY=[@ANYBLOB="74010000170001000000000000000000fc0000000000000000000000000000000000000000000000fe8000000000000000000000000000bbfe8000000000000000000000000000bbac1e000100"/104, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc020000000000000000000000feff077f00000100000000000000000000000000000000000000000a0000ea"], 0x174}}, 0x0) 607.74962ms ago: executing program 3 (id=541): timer_settime(0x0, 0x0, 0x0, 0x0) syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x0) syz_open_procfs(0x0, 0x0) r0 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0x8c36, 0x3c00, 0x2, 0xbfdffffc}, &(0x7f0000000000)=0x0, &(0x7f00000000c0)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) io_uring_enter(r0, 0x47f6, 0x0, 0x0, 0x0, 0x0) 585.049057ms ago: executing program 3 (id=542): syz_emit_ethernet(0x32, &(0x7f0000000040)={@local, @multicast, @void, {@ipv4={0x800, @icmp={{0x7, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010102, @local, {[@generic={0x94, 0x6, "d853bd7a"}, @noop, @noop]}}, @address_request={0x11, 0x0, 0x0, 0x90b6}}}}}, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x3) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(0xffffffffffffffff, 0x0, 0x0) close(0xffffffffffffffff) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r4 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r4, 0x89e0, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r5 = mq_open(&(0x7f0000000380)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\x01\x00\x00\x00a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|\x00\x17\xc0\xa3\xd5\xf9\xaa\x98/\xa4v\xe4)I\xf3+[e\x95\x89\x99\xca\x8e\xc5\xd3\\T\xf0\x1a|5\xfff\xff\x99\xa4\xbb\x9e#oR\xa4\xf1\xba\x04c\xb3-\xf7R\xb85\xb5\xdb\xe9?\xfa/\xdf\xb4R\xbfx=\v_j\x8e\xb0\'\xf4\xe5\xff!\xe1\xbf\x82e\xb1\x9b\x8d\xf3L\t\xd21\x9cbwV\xc8\xcc\xe4\x96M_w\xbc\xdf9\b\r\xf6\x95\xae\xb5,\x92\x8c\xc0DQm\x80\xd1w\xa2\x1a\x12Z\xe5\xf4H\xf7D\n\x96J\x93\xfb\xf0$\x9f\xf7\xa2\xae$O\xa3\xb6\xf5\x98\xd3\v\x00\x86\xa5\x8b\x81\x04\xaf\x03s\xe5\x86>\x0e\xa6\xe6\x1aV\x17\x8b\xed\xa7\'\xd0\r_\xe8,XVR\x13\xe5%\xb9\x88\xb8W@D\'\x17A\xc8\x80\x02J\xd4V\x00wH(\xc5v\f\xc9\xb6\xdf..$\xe6P(_\xf1\'\xc1:\xa3\xcb\xd9\xd1\xc7\x13\x99Md\x1dc\xf1\'j\x03!\x13\xd1\xb8\xbf\xe6\xb2M\b/\rp\xa5\x00\x00\x00\x00', 0x40, 0x9, 0x0) fcntl$setlease(r5, 0x400, 0x0) mq_unlink(&(0x7f0000000340)='eth0\x00') close(r5) write$6lowpan_enable(0xffffffffffffffff, 0x0, 0x0) ioctl$UI_SET_ABSBIT(r1, 0x40045567, 0x0) write$uinput_user_dev(r1, &(0x7f0000000ec0)={'syz0\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffc], [0x0, 0x0, 0x2, 0xb16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0xf, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x8], [0x88000001, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0xe, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x4], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x3, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5]}, 0x45c) ioctl$UI_DEV_CREATE(r1, 0x5501) write$uinput_user_dev(r1, &(0x7f0000000a40)={'syz1\x00', {}, 0x4d, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0xffff], [0xffffffff, 0x3, 0x3, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x400000, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd5], [0x0, 0x80000000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x3, 0x8000000, 0x0, 0x0, 0x6, 0x0, 0x3, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], [0x81, 0x0, 0x5d30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe58b, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1ff]}, 0x45c) move_pages(0x0, 0x2064, &(0x7f0000000040)=[&(0x7f0000ff9000/0x2000)=nil], &(0x7f0000001180), &(0x7f0000000000), 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$DRM_IOCTL_GET_UNIQUE(r0, 0xc0106401, &(0x7f0000000400)={0x0, 0x0}) 558.53598ms ago: executing program 2 (id=543): socket$netlink(0x10, 0x3, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x24}}, 0x0) r0 = socket(0x2a, 0x2, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000140)=@newtfilter={0x90, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0xfffa}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x58, 0x2, [@TCA_FLOWER_ACT={0x54, 0x3, [@m_connmark={0x50, 0x1, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0xfffffff5, 0x9, 0x6, 0x6, 0xb87}, 0x6}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0x8, 0x1}}]}, 0x90}, 0x1, 0x0, 0x0, 0x2000080d}, 0x24000000) sendmmsg(0xffffffffffffffff, &(0x7f00000002c0), 0x40000000000009f, 0x0) 447.887864ms ago: executing program 2 (id=544): r0 = socket$inet(0x2, 0x5, 0x0) sendmmsg$inet_sctp(r0, &(0x7f00000046c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000004b40)=ANY=[@ANYBLOB="30000000000000008400000001000000090003000582"], 0xc8, 0x4001084}], 0x1, 0x40010) 377.773061ms ago: executing program 2 (id=545): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x48, 0x2, 0x6, 0x401, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}]}, 0x48}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, 0x0, 0x4000084) sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000580)={0x1c, 0x3, 0x6, 0x5, 0x0, 0x0, {0x5, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x4000080) 283.843974ms ago: executing program 2 (id=546): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x458, 0x5011, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x5, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x394}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000140), 0x0, 0x20000) ioctl$HIDIOCGUSAGE(r1, 0xc018480b, &(0x7f00000000c0)={0x2, 0x100, 0x2d7, 0x0, 0xffff6d93, 0x4}) 0s ago: executing program 0 (id=547): syz_emit_ethernet(0x3b6, &(0x7f00000003c0)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00\b@', 0x380, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [{0x3, 0xa, "a78ce54006598080a8030037004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af0302"}, {0x0, 0x1, "00001c050000000026000400"}, {0x3, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0x0, 0x1d, "06aa85616177c41bc943afcb84619755403946b0730a18d5c38cf7dcad830f2dc8675b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee96f24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fecf894222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000"}, {0x22, 0xb, "17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f003"}, {0x21, 0x7, "b8a3e100908f61640000000200fff500000000000000000000008879e66485201a0015ca83747357a02745000400"/55}, {0x0, 0x14, "5e14f0e74d2d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e26eb1d18065daa7628cf9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4808288e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c676d8800871a6aa54155dea2d995cb22c9924e0ad38c6967052cc7786d779b8353aac33a57d79b05613a12328f61129017fb632dbf04542188b196e213408c"}, {0x0, 0x5, "d5170000dce9674a36da018dff16e70b8b14c4b7a94fe18e88605aa6be1a02a326a6bce65f81ed"}]}}}}}}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.156' (ED25519) to the list of known hosts. [ 34.984442][ T6504] cgroup: Unknown subsys name 'net' [ 35.109124][ T6504] cgroup: Unknown subsys name 'cpuset' [ 35.112776][ T6504] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 35.303962][ T6504] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 36.799250][ T6518] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 36.799713][ T6518] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 36.802646][ T6518] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 36.808453][ T6524] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 36.810944][ T6524] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 36.813541][ T6524] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 36.816473][ T6527] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 36.816605][ T6525] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 36.817966][ T6529] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 36.821268][ T6525] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 36.821710][ T6525] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 36.822776][ T6525] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 36.825369][ T6083] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 36.826041][ T6083] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 36.827533][ T6529] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 36.828199][ T6529] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 36.828626][ T6529] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 36.828943][ T6083] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 36.838440][ T6525] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 36.838724][ T6525] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 36.846672][ T6525] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 36.849939][ T6518] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 36.853607][ T6518] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 36.857816][ T6518] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 36.859927][ T6518] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 37.161120][ T6515] chnl_net:caif_netlink_parms(): no params data found [ 37.173462][ T6528] chnl_net:caif_netlink_parms(): no params data found [ 37.245463][ T6521] chnl_net:caif_netlink_parms(): no params data found [ 37.295304][ T6514] chnl_net:caif_netlink_parms(): no params data found [ 37.365778][ T6515] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.366468][ T6515] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.366609][ T6515] bridge_slave_0: entered allmulticast mode [ 37.367515][ T6515] bridge_slave_0: entered promiscuous mode [ 37.370201][ T6515] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.370250][ T6515] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.370351][ T6515] bridge_slave_1: entered allmulticast mode [ 37.371290][ T6515] bridge_slave_1: entered promiscuous mode [ 37.371962][ T6528] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.372009][ T6528] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.372218][ T6528] bridge_slave_0: entered allmulticast mode [ 37.373099][ T6528] bridge_slave_0: entered promiscuous mode [ 37.374563][ T6528] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.374608][ T6528] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.374717][ T6528] bridge_slave_1: entered allmulticast mode [ 37.375652][ T6528] bridge_slave_1: entered promiscuous mode [ 37.435979][ T6521] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.436046][ T6521] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.439601][ T6521] bridge_slave_0: entered allmulticast mode [ 37.440632][ T6521] bridge_slave_0: entered promiscuous mode [ 37.442061][ T6521] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.442106][ T6521] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.442208][ T6521] bridge_slave_1: entered allmulticast mode [ 37.443104][ T6521] bridge_slave_1: entered promiscuous mode [ 37.474590][ T6515] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 37.476224][ T6515] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 37.477930][ T6528] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 37.479504][ T6528] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 37.514822][ T6515] team0: Port device team_slave_0 added [ 37.527334][ T6528] team0: Port device team_slave_0 added [ 37.535824][ T6521] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 37.545644][ T6515] team0: Port device team_slave_1 added [ 37.550083][ T6528] team0: Port device team_slave_1 added [ 37.569802][ T6521] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 37.570021][ T6514] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.570098][ T6514] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.570208][ T6514] bridge_slave_0: entered allmulticast mode [ 37.571069][ T6514] bridge_slave_0: entered promiscuous mode [ 37.572434][ T6514] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.572480][ T6514] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.572711][ T6514] bridge_slave_1: entered allmulticast mode [ 37.573574][ T6514] bridge_slave_1: entered promiscuous mode [ 37.594433][ T6515] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 37.594480][ T6515] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.594751][ T6515] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 37.596278][ T6528] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 37.596633][ T6528] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.596667][ T6528] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 37.598091][ T6528] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 37.598117][ T6528] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.598149][ T6528] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 37.633361][ T6523] chnl_net:caif_netlink_parms(): no params data found [ 37.641494][ T6515] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 37.641540][ T6515] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.641867][ T6515] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 37.657216][ T6521] team0: Port device team_slave_0 added [ 37.659699][ T6514] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 37.665520][ T6514] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 37.680688][ T6521] team0: Port device team_slave_1 added [ 37.746049][ T6514] team0: Port device team_slave_0 added [ 37.750076][ T6514] team0: Port device team_slave_1 added [ 37.755429][ T6528] hsr_slave_0: entered promiscuous mode [ 37.757923][ T6528] hsr_slave_1: entered promiscuous mode [ 37.760525][ T6521] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 37.760580][ T6521] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.760621][ T6521] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 37.761662][ T6521] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 37.761686][ T6521] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.761719][ T6521] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 37.841912][ T6521] hsr_slave_0: entered promiscuous mode [ 37.842428][ T6521] hsr_slave_1: entered promiscuous mode [ 37.842742][ T6521] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 37.842842][ T6521] Cannot create hsr debugfs directory [ 37.850855][ T6523] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.852816][ T6523] bridge0: port 1(bridge_slave_0) entered disabled state [ 37.854925][ T6523] bridge_slave_0: entered allmulticast mode [ 37.857321][ T6523] bridge_slave_0: entered promiscuous mode [ 37.858667][ T6523] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.858713][ T6523] bridge0: port 2(bridge_slave_1) entered disabled state [ 37.858837][ T6523] bridge_slave_1: entered allmulticast mode [ 37.859635][ T6523] bridge_slave_1: entered promiscuous mode [ 37.862414][ T6515] hsr_slave_0: entered promiscuous mode [ 37.862905][ T6515] hsr_slave_1: entered promiscuous mode [ 37.863185][ T6515] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 37.863213][ T6515] Cannot create hsr debugfs directory [ 37.876535][ T6514] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 37.876585][ T6514] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.876640][ T6514] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 37.877784][ T6514] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 37.877822][ T6514] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 37.877882][ T6514] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 37.942042][ T6514] hsr_slave_0: entered promiscuous mode [ 37.944316][ T6514] hsr_slave_1: entered promiscuous mode [ 37.946381][ T6514] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 37.946999][ T6514] Cannot create hsr debugfs directory [ 37.970439][ T6523] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 37.974960][ T6523] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 38.033702][ T6523] team0: Port device team_slave_0 added [ 38.057276][ T6523] team0: Port device team_slave_1 added [ 38.092132][ T6523] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 38.094104][ T6523] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 38.096559][ T6523] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 38.139958][ T6523] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 38.140017][ T6523] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 38.140058][ T6523] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 38.228234][ T6523] hsr_slave_0: entered promiscuous mode [ 38.228833][ T6523] hsr_slave_1: entered promiscuous mode [ 38.229198][ T6523] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 38.229228][ T6523] Cannot create hsr debugfs directory [ 38.316186][ T6514] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 38.332631][ T6514] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 38.337201][ T6514] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 38.345156][ T6514] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 38.393642][ T6521] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 38.401536][ T6521] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 38.415674][ T6521] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 38.420159][ T6521] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 38.458803][ T6528] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 38.464623][ T6528] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 38.469105][ T6528] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 38.473523][ T6528] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 38.545464][ T6515] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 38.563843][ T6514] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.567026][ T6515] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 38.583095][ T6515] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 38.597289][ T6521] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.601769][ T6523] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 38.607941][ T6515] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 38.614585][ T6523] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 38.618656][ T6523] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 38.634970][ T6523] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 38.650363][ T6514] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.664343][ T835] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.664461][ T835] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.672232][ T323] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.672326][ T323] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.679615][ T6521] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.682539][ T835] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.682618][ T835] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.712643][ T835] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.712741][ T835] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.742836][ T6528] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.755956][ T6514] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 38.774277][ T6521] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 38.791296][ T6528] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.796128][ T137] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.796207][ T137] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.835545][ T137] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.835633][ T137] bridge0: port 2(bridge_slave_1) entered forwarding state [ 38.876935][ T6520] Bluetooth: hci4: command tx timeout [ 38.878765][ T52] Bluetooth: hci3: command tx timeout [ 38.880180][ T6515] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.888807][ T52] Bluetooth: hci1: command tx timeout [ 38.892098][ T6528] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 38.932534][ T6515] 8021q: adding VLAN 0 to HW filter on device team0 [ 38.938789][ T14] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.938879][ T14] bridge0: port 1(bridge_slave_0) entered forwarding state [ 38.948082][ T6521] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 38.961684][ T6523] 8021q: adding VLAN 0 to HW filter on device bond0 [ 38.966681][ T52] Bluetooth: hci0: command tx timeout [ 38.968391][ T52] Bluetooth: hci2: command tx timeout [ 38.982074][ T14] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.982142][ T14] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.016118][ T6523] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.030228][ T6514] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.059721][ T323] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.059832][ T323] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.061341][ T6521] veth0_vlan: entered promiscuous mode [ 39.069461][ T323] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.069545][ T323] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.113857][ T6521] veth1_vlan: entered promiscuous mode [ 39.131195][ T6521] veth0_macvtap: entered promiscuous mode [ 39.148237][ T6521] veth1_macvtap: entered promiscuous mode [ 39.162022][ T6528] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.184508][ T6521] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.188341][ T6521] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.202147][ T6521] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.202243][ T6521] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.202574][ T6521] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.202606][ T6521] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.223328][ T6514] veth0_vlan: entered promiscuous mode [ 39.255617][ T6528] veth0_vlan: entered promiscuous mode [ 39.261581][ T6514] veth1_vlan: entered promiscuous mode [ 39.264495][ T6528] veth1_vlan: entered promiscuous mode [ 39.277076][ T6528] veth0_macvtap: entered promiscuous mode [ 39.280636][ T6528] veth1_macvtap: entered promiscuous mode [ 39.324205][ T6523] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.333423][ T6528] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.338890][ T6515] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.350294][ T266] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.350382][ T266] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.356066][ T6528] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.380395][ T6528] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.383285][ T6528] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.385710][ T6528] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.390259][ T6528] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.415931][ T6514] veth0_macvtap: entered promiscuous mode [ 39.424341][ T6514] veth1_macvtap: entered promiscuous mode [ 39.445019][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.445085][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.459724][ T6515] veth0_vlan: entered promiscuous mode [ 39.492914][ T6514] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.505644][ T6514] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.523772][ T6514] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.526975][ T6514] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.529506][ T6514] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.531973][ T6514] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.540198][ T6515] veth1_vlan: entered promiscuous mode [ 39.559106][ T6521] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 39.613709][ T323] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.613776][ T323] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.629118][ T6515] veth0_macvtap: entered promiscuous mode [ 39.639419][ T6515] veth1_macvtap: entered promiscuous mode [ 39.709721][ T6523] veth0_vlan: entered promiscuous mode [ 39.712784][ T6523] veth1_vlan: entered promiscuous mode [ 39.717438][ T6515] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.721391][ T6515] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.735630][ T6515] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.735701][ T6515] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.736085][ T6515] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.736117][ T6515] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.776030][ T323] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.776091][ T323] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.792008][ T2138] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.792061][ T2138] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.951536][ T266] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 39.955418][ T266] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 39.957784][ T6523] veth0_macvtap: entered promiscuous mode [ 39.982921][ T6523] veth1_macvtap: entered promiscuous mode [ 40.007408][ T6523] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.011909][ T6523] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.095669][ T266] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.095727][ T266] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.105373][ T6523] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.105451][ T6523] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.105483][ T6523] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.105513][ T6523] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.272572][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.272644][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.339881][ T6638] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9'. [ 40.360742][ T6638] netlink: 96 bytes leftover after parsing attributes in process `syz.1.9'. [ 40.360858][ T6638] netlink: 96 bytes leftover after parsing attributes in process `syz.1.9'. [ 40.365655][ T266] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.365725][ T266] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.381706][ T6642] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4'. [ 40.415045][ T266] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.415110][ T266] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.648133][ T6657] netlink: 28 bytes leftover after parsing attributes in process `syz.3.13'. [ 40.703098][ T31] audit: type=1326 audit(40.690:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6662 comm="syz.2.15" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffaf95a8a8 code=0x7ffc0000 [ 40.703185][ T31] audit: type=1326 audit(40.690:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6662 comm="syz.2.15" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffaf95a8a8 code=0x7ffc0000 [ 40.717746][ T31] audit: type=1326 audit(40.710:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6662 comm="syz.2.15" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=179 compat=0 ip=0xffffaf95a8a8 code=0x7ffc0000 [ 40.748850][ T31] audit: type=1326 audit(40.710:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6662 comm="syz.2.15" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffaf95a8a8 code=0x7ffc0000 [ 40.754393][ T31] audit: type=1326 audit(40.710:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6662 comm="syz.2.15" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffaf95a8a8 code=0x7ffc0000 [ 40.763944][ T31] audit: type=1326 audit(40.710:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6662 comm="syz.2.15" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=56 compat=0 ip=0xffffaf95a8a8 code=0x7ffc0000 [ 40.772193][ T6668] syz.4.16 uses obsolete (PF_INET,SOCK_PACKET) [ 40.784399][ T31] audit: type=1326 audit(40.710:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6662 comm="syz.2.15" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffaf95a8a8 code=0x7ffc0000 [ 40.784481][ T31] audit: type=1326 audit(40.710:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6662 comm="syz.2.15" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffaf95a8a8 code=0x7ffc0000 [ 40.784527][ T31] audit: type=1326 audit(40.710:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6662 comm="syz.2.15" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=198 compat=0 ip=0xffffaf95a8a8 code=0x7ffc0000 [ 40.784575][ T31] audit: type=1326 audit(40.710:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6662 comm="syz.2.15" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffaf95a8a8 code=0x7ffc0000 [ 40.870413][ T6672] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 40.956428][ T6520] Bluetooth: hci1: command tx timeout [ 40.956501][ T6520] Bluetooth: hci3: command tx timeout [ 40.956559][ T6520] Bluetooth: hci4: command tx timeout [ 41.036597][ T52] Bluetooth: hci2: command tx timeout [ 41.038212][ T6520] Bluetooth: hci0: command tx timeout [ 41.201626][ T6676] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 41.202054][ T6676] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 41.456042][ T6680] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 41.490799][ T6680] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 41.505651][ T6680] netlink: 'syz.4.19': attribute type 64 has an invalid length. [ 41.505710][ T6680] netlink: 9 bytes leftover after parsing attributes in process `syz.4.19'. [ 42.217435][ T6688] netlink: 32 bytes leftover after parsing attributes in process `syz.3.22'. [ 42.553094][ T6697] netlink: 36 bytes leftover after parsing attributes in process `syz.1.25'. [ 42.681703][ T6703] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 42.684668][ T6703] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 43.002789][ T6713] tun0: tun_chr_ioctl cmd 1074025681 [ 43.037079][ T52] Bluetooth: hci4: command tx timeout [ 43.037512][ T6520] Bluetooth: hci3: command tx timeout [ 43.037569][ T6520] Bluetooth: hci1: command tx timeout [ 43.095708][ T6672] syz.0.1 (6672): drop_caches: 2 [ 43.124406][ T52] Bluetooth: hci2: command tx timeout [ 43.124485][ T52] Bluetooth: hci0: command tx timeout [ 43.812141][ T6756] netlink: 32 bytes leftover after parsing attributes in process `syz.0.45'. [ 43.865841][ T6760] netlink: 72 bytes leftover after parsing attributes in process `syz.0.47'. [ 44.050205][ T6772] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 44.052927][ T6772] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 44.680189][ T6807] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 44.680478][ T6807] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 44.737021][ C1] vxcan1: j1939_tp_rxtimer: 0x00000000e48b3190: rx timeout, send abort [ 44.988329][ T6829] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 44.991185][ T6829] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 45.116361][ T6520] Bluetooth: hci3: command tx timeout [ 45.126829][ T52] Bluetooth: hci1: command tx timeout [ 45.128868][ T6520] Bluetooth: hci4: command tx timeout [ 45.197131][ T52] Bluetooth: hci2: command tx timeout [ 45.198672][ T6520] Bluetooth: hci0: command tx timeout [ 45.237272][ C1] vxcan1: j1939_tp_rxtimer: 0x00000000e6bb2c21: rx timeout, send abort [ 45.237439][ C1] vxcan1: j1939_tp_rxtimer: 0x00000000e48b3190: abort rx timeout. Force session deactivation [ 45.401437][ T6838] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 45.409304][ T6838] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 45.446563][ T6585] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 45.527589][ T6847] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 45.527935][ T6847] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 45.530550][ T6847] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 45.530833][ T6847] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 45.597107][ T6585] usb 1-1: Using ep0 maxpacket: 8 [ 45.601900][ T6585] usb 1-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 45.602004][ T6585] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 45.602030][ T6585] usb 1-1: Product: syz [ 45.602052][ T6585] usb 1-1: Manufacturer: syz [ 45.602073][ T6585] usb 1-1: SerialNumber: syz [ 45.614167][ T6585] usb 1-1: config 0 descriptor?? [ 45.737350][ C1] vxcan1: j1939_tp_rxtimer: 0x00000000e6bb2c21: abort rx timeout. Force session deactivation [ 45.823818][ T6585] usb 1-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 46.158602][ T6884] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 46.248881][ T6887] __nla_validate_parse: 2 callbacks suppressed [ 46.248969][ T6887] netlink: 4 bytes leftover after parsing attributes in process `syz.3.98'. [ 46.575205][ T31] kauditd_printk_skb: 66 callbacks suppressed [ 46.575265][ T31] audit: type=1326 audit(46.560:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6901 comm="syz.4.103" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=139 compat=0 ip=0xffffaf9748bc code=0x7ffc0000 [ 46.583245][ T31] audit: type=1326 audit(46.560:79): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6901 comm="syz.4.103" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=139 compat=0 ip=0xffffaf9748bc code=0x7ffc0000 [ 46.583324][ T31] audit: type=1326 audit(46.560:80): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6901 comm="syz.4.103" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=139 compat=0 ip=0xffffaf9748bc code=0x7ffc0000 [ 46.583371][ T31] audit: type=1326 audit(46.560:81): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6901 comm="syz.4.103" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=139 compat=0 ip=0xffffaf9748bc code=0x7ffc0000 [ 46.583418][ T31] audit: type=1326 audit(46.560:82): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6901 comm="syz.4.103" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=139 compat=0 ip=0xffffaf9748bc code=0x7ffc0000 [ 46.609023][ T31] audit: type=1326 audit(46.600:83): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6901 comm="syz.4.103" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=139 compat=0 ip=0xffffaf9748bc code=0x7ffc0000 [ 46.615304][ T31] audit: type=1326 audit(46.600:84): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6901 comm="syz.4.103" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=139 compat=0 ip=0xffffaf9748bc code=0x7ffc0000 [ 46.622405][ T31] audit: type=1326 audit(46.610:85): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6901 comm="syz.4.103" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=139 compat=0 ip=0xffffaf9748bc code=0x7ffc0000 [ 46.623397][ T6904] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 46.623696][ T6904] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 46.633464][ T31] audit: type=1326 audit(46.620:86): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6901 comm="syz.4.103" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=139 compat=0 ip=0xffffaf9748bc code=0x7ffc0000 [ 46.660912][ T31] audit: type=1326 audit(46.650:87): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6901 comm="syz.4.103" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=139 compat=0 ip=0xffffaf9748bc code=0x7ffc0000 [ 47.174926][ T6915] netlink: 'syz.2.106': attribute type 21 has an invalid length. [ 47.174990][ T6915] netlink: 128 bytes leftover after parsing attributes in process `syz.2.106'. [ 47.175066][ T6915] netlink: 'syz.2.106': attribute type 5 has an invalid length. [ 47.175090][ T6915] netlink: 'syz.2.106': attribute type 6 has an invalid length. [ 47.175113][ T6915] netlink: 3 bytes leftover after parsing attributes in process `syz.2.106'. [ 47.986482][ T6585] dvb_usb_rtl28xxu 1-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 48.007594][ T6585] usb 1-1: USB disconnect, device number 2 [ 48.584946][ T6946] netlink: 'syz.1.114': attribute type 10 has an invalid length. [ 48.587235][ T6946] netlink: 40 bytes leftover after parsing attributes in process `syz.1.114'. [ 48.654009][ T6946] team0: Failed to send port change of device geneve0 via netlink (err -105) [ 48.657350][ T6946] team0: Failed to send options change via netlink (err -105) [ 48.659518][ T6946] team0: Port device geneve0 added [ 48.728979][ T6953] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 48.733128][ T6953] syz_tun: entered promiscuous mode [ 48.766218][ T6953] syz_tun: left promiscuous mode [ 49.075201][ T6965] netlink: 4 bytes leftover after parsing attributes in process `syz.2.122'. [ 49.079033][ T6965] netlink: 4 bytes leftover after parsing attributes in process `syz.2.122'. [ 49.230734][ T6972] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 49.233824][ T6972] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 49.307467][ T6976] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 49.311017][ T6976] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 50.678375][ T7001] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 50.678817][ T7001] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 51.096940][ T7004] hsr0: entered promiscuous mode [ 51.099213][ T7004] hsr0: entered allmulticast mode [ 51.100994][ T7004] hsr_slave_0: entered allmulticast mode [ 51.102868][ T7004] hsr_slave_1: entered allmulticast mode [ 51.377416][ T6520] Bluetooth: hci3: ISO packet for unknown connection handle 0 [ 52.446001][ T7046] syz_tun: entered allmulticast mode [ 52.710392][ T7042] syz_tun: left allmulticast mode [ 53.319486][ T7064] syz_tun: entered allmulticast mode [ 53.321017][ T7063] syz_tun: left allmulticast mode [ 54.956691][ T6520] Bluetooth: hci2: unexpected cc 0x0c5b length: 5 > 1 [ 57.430350][ T7217] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 57.433073][ T7217] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 57.436652][ T6516] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 57.596458][ T6516] usb 1-1: Using ep0 maxpacket: 32 [ 57.599057][ T6516] usb 1-1: config 0 has an invalid interface number: 43 but max is 1 [ 57.599126][ T6516] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 57.599169][ T6516] usb 1-1: config 0 has no interface number 0 [ 57.599196][ T6516] usb 1-1: config 0 interface 43 altsetting 250 has 3 endpoint descriptors, different from the interface descriptor's value: 0 [ 57.599226][ T6516] usb 1-1: config 0 interface 43 has no altsetting 0 [ 57.601455][ T6516] usb 1-1: New USB device found, idVendor=06cd, idProduct=0104, bcdDevice=c8.6a [ 57.601491][ T6516] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 57.601516][ T6516] usb 1-1: Product: syz [ 57.601537][ T6516] usb 1-1: Manufacturer: syz [ 57.601558][ T6516] usb 1-1: SerialNumber: syz [ 57.603751][ T6516] usb 1-1: config 0 descriptor?? [ 57.820392][ T7238] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 57.845564][ T7238] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 58.346487][ T6516] keyspan_pda 1-1:0.43: required endpoints missing [ 58.349392][ T6516] usb 1-1: USB disconnect, device number 3 [ 59.361187][ T7273] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 59.361501][ T7273] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 59.775875][ T7285] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 59.780000][ T7285] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 60.465577][ T7302] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 60.465921][ T7302] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 60.487566][ T7302] x_tables: ip_tables: owner match: used from hooks PREROUTING, but only valid from OUTPUT/POSTROUTING [ 61.180667][ T7318] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 61.180962][ T7318] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 61.844830][ T7331] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 61.846008][ T7331] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 61.919072][ T7333] netlink: 8 bytes leftover after parsing attributes in process `syz.2.251'. [ 63.871533][ T7403] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 63.874594][ T7403] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 63.882200][ T7400] netlink: 8 bytes leftover after parsing attributes in process `syz.2.277'. [ 64.478394][ T2408] ieee802154 phy0 wpan0: encryption failed: -22 [ 64.478523][ T2408] ieee802154 phy1 wpan1: encryption failed: -22 [ 65.063949][ T7417] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 65.094021][ T7447] IPVS: Scheduler module ip_vs_ not found [ 65.613820][ T7466] IPv6: NLM_F_CREATE should be specified when creating new route [ 65.663304][ T7467] netlink: 12 bytes leftover after parsing attributes in process `syz.3.301'. [ 65.842867][ T7458] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 65.843618][ T7458] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 66.219038][ T26] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 66.379487][ T26] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 66.379554][ T26] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 66.379615][ T26] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 66.379659][ T26] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 66.379692][ T26] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 66.450619][ T26] usb 1-1: config 0 descriptor?? [ 66.479303][ T7507] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 66.482526][ T7507] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 66.606895][ T7507] netlink: 4 bytes leftover after parsing attributes in process `syz.3.315'. [ 66.613373][ T7507] netlink: 4 bytes leftover after parsing attributes in process `syz.3.315'. [ 66.613503][ T7507] Zero length message leads to an empty skb [ 66.687110][ T7511] trusted_key: syz.4.316 sent an empty control message without MSG_MORE. [ 66.902598][ T26] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x6 [ 66.907041][ T26] plantronics 0003:047F:FFFF.0001: No inputs registered, leaving [ 66.922921][ T26] plantronics 0003:047F:FFFF.0001: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 67.298676][ T7518] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 67.300054][ T7518] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 67.696969][ T1815] usb 1-1: USB disconnect, device number 4 [ 68.262071][ T7562] netlink: 8 bytes leftover after parsing attributes in process `syz.4.335'. [ 68.441673][ T7565] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 68.442015][ T7565] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 68.813789][ T7579] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 68.814112][ T7579] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 69.021963][ T7582] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 69.030463][ T7582] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 69.270315][ T7573] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 69.439864][ T7588] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 69.599753][ T9] cfg80211: failed to load regulatory.db [ 70.133291][ T7629] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 70.138431][ T7629] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 70.925530][ T7679] netlink: 4 bytes leftover after parsing attributes in process `syz.4.380'. [ 70.946699][ T9] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 71.123433][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 71.127116][ T9] usb 1-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 71.127173][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 71.148211][ T9] usb 1-1: config 0 descriptor?? [ 71.582224][ T9] lenovo 0003:17EF:6047.0002: hidraw0: USB HID v1.01 Device [HID 17ef:6047] on usb-dummy_hcd.0-1/input0 [ 72.394917][ T9] lenovo 0003:17EF:6047.0002: Sensitivity setting failed: -71 [ 72.397630][ T9] usb 1-1: USB disconnect, device number 5 [ 72.461053][ T7728] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 72.461398][ T7728] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 73.036115][ T7776] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 73.042223][ T7776] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 73.122391][ T7785] netlink: 20 bytes leftover after parsing attributes in process `syz.1.417'. [ 73.125189][ T7785] netlink: 84 bytes leftover after parsing attributes in process `syz.1.417'. [ 73.272613][ T7798] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 73.276889][ T7798] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 73.845047][ T7829] netlink: 28 bytes leftover after parsing attributes in process `syz.2.431'. [ 73.861849][ T7829] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 73.861906][ T7829] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 74.510377][ T7859] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 74.513953][ T7859] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 74.558376][ T7860] binder: 7857:7860 ioctl 1265 200000c0 returned -22 [ 75.169109][ T7907] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 75.169467][ T7907] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 75.618257][ T7913] netlink: 'syz.0.468': attribute type 1 has an invalid length. [ 75.631119][ T7913] 8021q: adding VLAN 0 to HW filter on device bond1 [ 75.659448][ T7913] vlan2: entered allmulticast mode [ 75.659665][ T7913] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 75.662879][ T7913] bond1: (slave vlan2): making interface the new active one [ 75.664007][ T7913] bond1: (slave vlan2): Enslaving as an active interface with an up link [ 75.926619][ T9] atkbd serio0: keyboard reset failed on [ 75.930464][ T7931] syz_tun: entered allmulticast mode [ 75.933112][ T7930] syz_tun: left allmulticast mode [ 76.216459][ T24] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 76.376461][ T24] usb 1-1: Using ep0 maxpacket: 32 [ 76.377711][ T24] usb 1-1: config 0 has an invalid interface number: 67 but max is 0 [ 76.377777][ T24] usb 1-1: config 0 has no interface number 0 [ 76.380137][ T24] usb 1-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 76.380186][ T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 76.380228][ T24] usb 1-1: Product: syz [ 76.380256][ T24] usb 1-1: Manufacturer: syz [ 76.380283][ T24] usb 1-1: SerialNumber: syz [ 76.402353][ T24] usb 1-1: config 0 descriptor?? [ 76.405817][ T24] smsc95xx v2.0.0 [ 76.458583][ T7947] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 76.458953][ T7947] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 76.980839][ T7954] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 76.983710][ T7954] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 77.083366][ T24] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000030: -71 [ 77.086939][ T24] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Error writing E2P_CMD [ 77.090189][ T24] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 77.094858][ T24] smsc95xx 1-1:0.67: probe with driver smsc95xx failed with error -71 [ 77.105252][ T24] usb 1-1: USB disconnect, device number 6 [ 77.281036][ T7971] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 77.281389][ T7971] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 77.370077][ T7977] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 77.370385][ T7977] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 77.773656][ T7995] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 77.773997][ T7995] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 77.790842][ T7997] netlink: 12 bytes leftover after parsing attributes in process `syz.0.500'. [ 77.963454][ T8007] netlink: 4 bytes leftover after parsing attributes in process `syz.1.505'. [ 78.321442][ T6565] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 78.331121][ T6565] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [syz1] on syz0 [ 78.367185][ T8040] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 78.367483][ T8040] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 78.482410][ T8045] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 78.685736][ T8038] fido_id[8038]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 80.155125][ T8072] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 80.155478][ T8072] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 81.093493][ T8087] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 81.093816][ T8087] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 81.561157][ T8117] netlink: 76 bytes leftover after parsing attributes in process `syz.3.540'. [ 81.982028][ T8131] input: syz0 as /devices/virtual/input/input6 [ 82.010920][ T8133] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 82.011512][ T8133] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 82.189376][ T6520] Bluetooth: hci0: Controller not accepting commands anymore: ncmd = 0 [ 82.189512][ T6520] Bluetooth: hci0: Injecting HCI hardware error event [ 82.190325][ T6520] Bluetooth: hci0: hardware error 0x00 [ 82.261223][ T8135] ------------[ cut here ]------------ [ 82.261322][ T8135] memcpy: detected field-spanning write (size 20) of single field "pfx->in6_u.u6_addr8" at ./include/net/ipv6.h:614 (size 16) [ 82.261969][ T8135] WARNING: CPU: 1 PID: 8135 at ./include/net/ipv6.h:614 ipv6_addr_prefix+0x130/0x1dc [ 82.269391][ T8135] Modules linked in: [ 82.270563][ T8135] CPU: 1 UID: 0 PID: 8135 Comm: syz.0.547 Not tainted 6.16.0-rc1-syzkaller-g39dfc971e42d #0 PREEMPT [ 82.273490][ T8135] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 82.276168][ T8135] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 82.278361][ T8135] pc : ipv6_addr_prefix+0x130/0x1dc [ 82.279743][ T8135] lr : ipv6_addr_prefix+0x130/0x1dc [ 82.281187][ T8135] sp : ffff80009ebc6820 [ 82.282301][ T8135] x29: ffff80009ebc6820 x28: dfff800000000000 x27: 1ffff00013d78d2b [ 82.284484][ T8135] x26: 1ffff00013d78d2a x25: dfff800000000000 x24: 0000000000000002 [ 82.286649][ T8135] x23: ffff800092c10000 x22: ffff80009ebc6964 x21: 0000000000000007 [ 82.288900][ T8135] x20: 0000000000000014 x19: ffff0000d4868c50 x18: 00000000ffffffff [ 82.291046][ T8135] x17: 20646c6569662065 x16: ffff80008ae31308 x15: ffff700011ed61d4 [ 82.293206][ T8135] x14: 1ffff00011ed61d4 x13: 0000000000000004 x12: ffffffffffffffff [ 82.295364][ T8135] x11: 0000000000080000 x10: 0000000000005adc x9 : f4bbaf2deb32c400 [ 82.297583][ T8135] x8 : f4bbaf2deb32c400 x7 : 0000000000000001 x6 : 0000000000000001 [ 82.299716][ T8135] x5 : ffff80009ebc6178 x4 : ffff80008f727060 x3 : ffff80008054db48 [ 82.301886][ T8135] x2 : 0000000000000000 x1 : 0000000100000200 x0 : 0000000000000000 [ 82.304111][ T8135] Call trace: [ 82.305041][ T8135] ipv6_addr_prefix+0x130/0x1dc (P) [ 82.306476][ T8135] ip6_route_info_create+0x3c8/0x718 [ 82.307990][ T8135] ip6_route_add+0x38/0x1bc [ 82.309186][ T8135] addrconf_prefix_route+0x1d4/0x278 [ 82.310610][ T8135] addrconf_prefix_rcv+0x4c8/0x1130 [ 82.312088][ T8135] ndisc_router_discovery+0x184c/0x2b64 [ 82.313608][ T8135] ndisc_rcv+0x3e8/0x5fc [ 82.314797][ T8135] icmpv6_rcv+0xffc/0x1888 [ 82.315997][ T8135] ip6_protocol_deliver_rcu+0x9a4/0x12d4 [ 82.317543][ T8135] ip6_input_finish+0xd8/0x17c [ 82.318855][ T8135] NF_HOOK+0x2c4/0x358 [ 82.319985][ T8135] ip6_input+0x15c/0x270 [ 82.321144][ T8135] ip6_mc_input+0x708/0xa8c [ 82.322420][ T8135] ip6_rcv_finish+0x1f0/0x21c [ 82.323721][ T8135] NF_HOOK+0x2c4/0x358 [ 82.324864][ T8135] ipv6_rcv+0x9c/0xbc [ 82.325992][ T8135] __netif_receive_skb+0xcc/0x2a8 [ 82.327416][ T8135] netif_receive_skb+0x1e0/0x838 [ 82.328846][ T8135] tun_rx_batched+0x478/0x5b4 [ 82.330096][ T8135] tun_get_user+0x2040/0x31dc [ 82.331364][ T8135] tun_chr_write_iter+0xfc/0x204 [ 82.332690][ T8135] vfs_write+0x62c/0x97c [ 82.333846][ T8135] ksys_write+0x120/0x210 [ 82.335057][ T8135] __arm64_sys_write+0x7c/0x90 [ 82.336301][ T8135] invoke_syscall+0x98/0x2b8 [ 82.337554][ T8135] el0_svc_common+0x130/0x23c [ 82.338822][ T8135] do_el0_svc+0x48/0x58 [ 82.339946][ T8135] el0_svc+0x58/0x17c [ 82.341018][ T8135] el0t_64_sync_handler+0x78/0x108 [ 82.342430][ T8135] el0t_64_sync+0x198/0x19c [ 82.343709][ T8135] irq event stamp: 263 [ 82.344796][ T8135] hardirqs last enabled at (262): [] __console_unlock+0x70/0xc4 [ 82.347324][ T8135] hardirqs last disabled at (263): [] el1_dbg+0x24/0x80 [ 82.349618][ T8135] softirqs last enabled at (66): [] local_bh_enable+0x10/0x34 [ 82.352152][ T8135] softirqs last disabled at (68): [] local_bh_disable+0x10/0x34 [ 82.354707][ T8135] ---[ end trace 0000000000000000 ]--- [ 82.356365][ T8135] ------------[ cut here ]------------ [ 82.356399][ T8135] UBSAN: array-index-out-of-bounds in ./include/net/ipv6.h:616:21 [ 82.356428][ T8135] index 20 is out of range for type 'const __u8[16]' (aka 'const unsigned char[16]') [ 82.356458][ T8135] CPU: 1 UID: 0 PID: 8135 Comm: syz.0.547 Tainted: G W 6.16.0-rc1-syzkaller-g39dfc971e42d #0 PREEMPT [ 82.356476][ T8135] Tainted: [W]=WARN [ 82.356480][ T8135] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 82.356487][ T8135] Call trace: [ 82.356492][ T8135] show_stack+0x2c/0x3c (C) [ 82.356511][ T8135] __dump_stack+0x30/0x40 [ 82.356526][ T8135] dump_stack_lvl+0xd8/0x12c [ 82.356540][ T8135] dump_stack+0x1c/0x28 [ 82.356554][ T8135] ubsan_epilogue+0x14/0x48 [ 82.356567][ T8135] __ubsan_handle_out_of_bounds+0xd0/0xfc [ 82.356582][ T8135] ipv6_addr_prefix+0x158/0x1dc [ 82.356596][ T8135] ip6_route_info_create+0x3c8/0x718 [ 82.356610][ T8135] ip6_route_add+0x38/0x1bc [ 82.356622][ T8135] addrconf_prefix_route+0x1d4/0x278 [ 82.356638][ T8135] addrconf_prefix_rcv+0x4c8/0x1130 [ 82.356652][ T8135] ndisc_router_discovery+0x184c/0x2b64 [ 82.356666][ T8135] ndisc_rcv+0x3e8/0x5fc [ 82.356678][ T8135] icmpv6_rcv+0xffc/0x1888 [ 82.356688][ T8135] ip6_protocol_deliver_rcu+0x9a4/0x12d4 [ 82.356703][ T8135] ip6_input_finish+0xd8/0x17c [ 82.356716][ T8135] NF_HOOK+0x2c4/0x358 [ 82.356730][ T8135] ip6_input+0x15c/0x270 [ 82.356743][ T8135] ip6_mc_input+0x708/0xa8c [ 82.356757][ T8135] ip6_rcv_finish+0x1f0/0x21c [ 82.356788][ T8135] NF_HOOK+0x2c4/0x358 [ 82.356802][ T8135] ipv6_rcv+0x9c/0xbc [ 82.356815][ T8135] __netif_receive_skb+0xcc/0x2a8 [ 82.356829][ T8135] netif_receive_skb+0x1e0/0x838 [ 82.356845][ T8135] tun_rx_batched+0x478/0x5b4 [ 82.356856][ T8135] tun_get_user+0x2040/0x31dc [ 82.356867][ T8135] tun_chr_write_iter+0xfc/0x204 [ 82.356878][ T8135] vfs_write+0x62c/0x97c [ 82.356893][ T8135] ksys_write+0x120/0x210 [ 82.356906][ T8135] __arm64_sys_write+0x7c/0x90 [ 82.356920][ T8135] invoke_syscall+0x98/0x2b8 [ 82.356935][ T8135] el0_svc_common+0x130/0x23c [ 82.356949][ T8135] do_el0_svc+0x48/0x58 [ 82.356963][ T8135] el0_svc+0x58/0x17c [ 82.356976][ T8135] el0t_64_sync_handler+0x78/0x108 [ 82.356989][ T8135] el0t_64_sync+0x198/0x19c [ 82.357203][ T8135] ---[ end trace ]--- [ 82.357220][ T8135] ------------[ cut here ]------------ [ 82.357237][ T8135] UBSAN: array-index-out-of-bounds in ./include/net/ipv6.h:616:3 [ 82.357258][ T8135] index 20 is out of range for type '__u8[16]' (aka 'unsigned char[16]') [ 82.357279][ T8135] CPU: 1 UID: 0 PID: 8135 Comm: syz.0.547 Tainted: G W 6.16.0-rc1-syzkaller-g39dfc971e42d #0 PREEMPT [ 82.357294][ T8135] Tainted: [W]=WARN [ 82.357298][ T8135] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 82.357305][ T8135] Call trace: [ 82.357308][ T8135] show_stack+0x2c/0x3c (C) [ 82.357323][ T8135] __dump_stack+0x30/0x40 [ 82.357337][ T8135] dump_stack_lvl+0xd8/0x12c [ 82.357351][ T8135] dump_stack+0x1c/0x28 [ 82.357364][ T8135] ubsan_epilogue+0x14/0x48 [ 82.357377][ T8135] __ubsan_handle_out_of_bounds+0xd0/0xfc [ 82.357391][ T8135] ipv6_addr_prefix+0x188/0x1dc [ 82.357403][ T8135] ip6_route_info_create+0x3c8/0x718 [ 82.357416][ T8135] ip6_route_add+0x38/0x1bc [ 82.357429][ T8135] addrconf_prefix_route+0x1d4/0x278 [ 82.357444][ T8135] addrconf_prefix_rcv+0x4c8/0x1130 [ 82.357458][ T8135] ndisc_router_discovery+0x184c/0x2b64 [ 82.357471][ T8135] ndisc_rcv+0x3e8/0x5fc [ 82.357483][ T8135] icmpv6_rcv+0xffc/0x1888 [ 82.357493][ T8135] ip6_protocol_deliver_rcu+0x9a4/0x12d4 [ 82.357508][ T8135] ip6_input_finish+0xd8/0x17c [ 82.357521][ T8135] NF_HOOK+0x2c4/0x358 [ 82.357534][ T8135] ip6_input+0x15c/0x270 [ 82.357548][ T8135] ip6_mc_input+0x708/0xa8c [ 82.357561][ T8135] ip6_rcv_finish+0x1f0/0x21c [ 82.357575][ T8135] NF_HOOK+0x2c4/0x358 [ 82.357588][ T8135] ipv6_rcv+0x9c/0xbc [ 82.357601][ T8135] __netif_receive_skb+0xcc/0x2a8 [ 82.357614][ T8135] netif_receive_skb+0x1e0/0x838 [ 82.357629][ T8135] tun_rx_batched+0x478/0x5b4 [ 82.357640][ T8135] tun_get_user+0x2040/0x31dc [ 82.357651][ T8135] tun_chr_write_iter+0xfc/0x204 [ 82.357661][ T8135] vfs_write+0x62c/0x97c [ 82.357675][ T8135] ksys_write+0x120/0x210 [ 82.357688][ T8135] __arm64_sys_write+0x7c/0x90 [ 82.357702][ T8135] invoke_syscall+0x98/0x2b8 [ 82.357716][ T8135] el0_svc_common+0x130/0x23c [ 82.357737][ T8135] do_el0_svc+0x48/0x58 [ 82.357751][ T8135] el0_svc+0x58/0x17c [ 82.357774][ T8135] el0t_64_sync_handler+0x78/0x108 [ 82.357787][ T8135] el0t_64_sync+0x198/0x19c [ 82.357800][ T8135] ---[ end trace ]--- [ 82.359436][ T8135] IPv6: addrconf: prefix option has invalid lifetime [ 84.087311][ T52] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 84.087477][ T52] Bluetooth: hci1: Injecting HCI hardware error event [ 84.089115][ T6083] Bluetooth: hci1: hardware error 0x00 [ 84.646450][ T6520] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 86.316457][ T6083] Bluetooth: hci1: Opcode 0x0c03 failed: -110