last executing test programs: 6.512659114s ago: executing program 3 (id=4): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r0, 0xffffffffffffffff, 0x0) 6.309195242s ago: executing program 3 (id=6): r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x8400, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40186f40, &(0x7f0000000440)=0x1f) 5.945375712s ago: executing program 1 (id=8): syz_open_dev$tty1(0xc, 0x4, 0x1) openat$sndseq(0xffffff9c, &(0x7f0000000000), 0x8000) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x147c40, 0x0) keyctl$clear(0x5, 0xffffffffffffffff) r0 = getpid() syz_pidfd_open(r0, 0x0) syz_usb_connect(0x6, 0x75, &(0x7f0000000780)=ANY=[@ANYBLOB="1201010240d85bc7b1131100345c010203010902630002040800070904880400c192fa280724060000d2cf0524001c620d240f0100000000020005f29011cc03080353ee97050a2401f90a00020102092403060703020208"], &(0x7f0000000280)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x110, 0x9, 0x2, 0xf4, 0x20, 0x93}, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x8400, 0x0) prlimit64(r1, 0x7, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x4) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="6c00000002060104db406e3e0004000200000000100003006269746d61703a706f72740005000400000000000900020073797a32000000000500050000006c00050001000600000024000780080008400000137906000440fffff000060005400000000008000640"], 0x6c}}, 0x0) 5.657031536s ago: executing program 3 (id=9): syz_open_dev$vim2m(0x0, 0x2000000f5, 0x2) syz_open_dev$sndpcmc(0x0, 0x0, 0xa340658bc40d4f52) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0) syz_emit_ethernet(0x3a, &(0x7f00000001c0)=ANY=[@ANYBLOB="ffffffffffffaaaa"], 0x0) epoll_create1(0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="54000000020601020000000000000000070000000900020073797a300000000005000100060000000c0007800500150000000000050005000000000005000400000000000d000300686173683a6d6163"], 0x54}}, 0x0) 4.358650407s ago: executing program 3 (id=10): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000001100000000000000000a3c000000120a01020000000000000000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000114000000110001"], 0x64}, 0x1, 0x0, 0x0, 0x890}, 0x0) sendmsg$NFT_MSG_GETOBJ(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)={0x34, 0x13, 0xa, 0x3, 0x0, 0x0, {0x2}, [@NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}]}, 0x34}}, 0x4000040) socket$netlink(0x10, 0x3, 0xf) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000100)=ANY=[], 0x32600) ioctl$KVM_SET_PIT2(r6, 0x4070aea0, &(0x7f0000000280)={[{0x7fffffff, 0xc, 0x2, 0x5, 0x3f, 0x80, 0x8, 0x7, 0x2, 0x3, 0x81, 0x6c, 0x2}, {0x3, 0x1000, 0x7c, 0x4, 0x1, 0x1b, 0x7, 0x6, 0x82, 0x3, 0x8, 0xc, 0x5}, {0x0, 0x9, 0xb6, 0x80, 0x8, 0x9, 0x2, 0x5, 0x6, 0x7, 0x2, 0x8, 0x3ff}], 0x5d2}) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) r7 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_INITMSG(r7, 0x84, 0x2, 0x0, &(0x7f0000000080)) r8 = socket$netlink(0x10, 0x3, 0xf) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r8, 0x10e, 0x4, &(0x7f0000000080)=0x100, 0x4) bind$netlink(r8, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x15, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xd0, 0x0, 0x0, 0x0, 0x18}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {0x7, 0x0, 0xb, 0x6}, {0x85, 0x0, 0x0, 0x5}, {0x4}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x6, 0xa, 0x9, 0xfff0, 0x41}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x4}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x6, 0x1, 0xb, 0xa, 0x8}, {0x7, 0x0, 0x0, 0x8}, {0x7, 0x1, 0xb, 0x4, 0x9, 0x20}, {}, {}, {0x18, 0x6, 0x2, 0x0, r3}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sk_reuseport, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 3.347261232s ago: executing program 4 (id=5): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="6c00000002060104db406e3e0004000200000000100003006269746d61703a706f72740005000400000000000900020073797a32000000000500050000006c00050001000600000024000780080008400000137906000440fffff000060005400000000008000640"], 0x6c}}, 0x0) sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)=ANY=[@ANYBLOB="28000000030601020000000200fdffffffffff0205000100070000000900020073797a32"], 0x28}, 0x1, 0x0, 0x0, 0x4c814}, 0x40814) 3.268781548s ago: executing program 3 (id=11): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r1 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f00000002c0), &(0x7f0000000200)=0x8) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000380)='hugetlb.2MB.rsvd.failcnt\x00', 0x2, 0x0) setrlimit(0x6, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}]}, @NFT_MSG_NEWSETELEM={0x60, 0xc, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_SET_ELEM_LIST_SET_ID={0x8}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x38, 0x3, 0x0, 0x1, [{0x34, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x4}, @NFTA_SET_ELEM_EXPRESSIONS={0x4, 0x6, 0x0, 0x1, [{0x14, 0x7, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}, {0x14, 0x1, 0x0, 0x1, @counter={{0x6}, @val={0x480}}}]}]}]}]}], {0x14, 0x10}}, 0xe4}}, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(r0, 0xc01064c8, &(0x7f0000000280)={0x1, 0x0, &(0x7f0000000200)=[0x0]}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r0, 0xc02064b9, &(0x7f0000000040)={&(0x7f0000000300)=[0x0, 0x0, 0x0], &(0x7f0000000040), 0x3, r5, 0xcccccccc}) 3.150922049s ago: executing program 4 (id=12): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setxattr$incfs_metadata(0x0, 0x0, &(0x7f0000000880)="22cff5", 0x3, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socket(0x400000000010, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0x2a, &(0x7f0000000240)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000000), 0x4) r2 = socket$packet(0x11, 0x2, 0x300) socket(0x1000000010, 0x6, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000340)={'gretap0\x00'}) r4 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r4, &(0x7f0000001d80)=[{{&(0x7f0000000280)={0x2, 0x4e22, @private=0xa010101}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000200)="9c", 0x1}], 0x1}}, {{&(0x7f0000000080)={0x2, 0x4e22, @rand_addr=0x64010104}, 0x10, &(0x7f0000000180)=[{&(0x7f00000000c0)="99", 0x1}], 0x1}}], 0x2, 0x48000) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xc, 0x0, &(0x7f0000000000)) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x42000, 0x0) ioctl$PPPIOCNEWUNIT(r5, 0xc004743e, &(0x7f00000002c0)=0xfffffffe) ioctl$PPPIOCSMAXCID(r5, 0x40047451, &(0x7f0000000100)=0xffff0080) ioctl$PPPIOCSMAXCID(r5, 0x40047451, &(0x7f0000000000)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r4, 0x84, 0x18, &(0x7f0000000100)={0x0, 0xc}, 0x8) close(r2) unshare(0x42000000) 3.009029933s ago: executing program 0 (id=1): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) openat$incfs(0xffffffffffffffff, 0x0, 0x8800, 0x11) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x1ff, 0x1, 0x0, 0x1000, &(0x7f0000001000/0x1000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4008ae93, &(0x7f0000000040)=0x4) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.970975756s ago: executing program 2 (id=3): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 2.755736241s ago: executing program 1 (id=13): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r0, 0xffffffffffffffff, 0x0) 2.43661334s ago: executing program 2 (id=14): syz_usb_connect(0x0, 0x2d, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x40000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x481e) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) chdir(&(0x7f0000000300)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.throttle.io_service_bytes_recursive\x00', 0x275a, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2a, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(0x0, r3, 0x0) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) migrate_pages(r4, 0x3, 0x0, 0x0) 2.436300106s ago: executing program 1 (id=15): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000f40), r0) sendmsg$IPVS_CMD_NEW_SERVICE(r0, &(0x7f0000001100)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000000500)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010067bd7000fbdbdf25010000005800018014000300fe8000000000000000000000000000bb060001000a00000008000500010000"], 0x6c}, 0x1, 0x0, 0x0, 0x20004084}, 0x20008800) 2.04443763s ago: executing program 1 (id=16): syz_clone(0x120e1100, 0x0, 0x0, 0x0, 0x0, 0x0) 2.030692661s ago: executing program 0 (id=17): socket$inet6(0xa, 0x11, 0x7) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x10, 0x4, 0x8, 0x8}, 0x50) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) chown(&(0x7f00000079c0)='.\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0x84042, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='rpc_pipefs\x00', 0x10, 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='rpc_pipefs\x00', 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r5, 0x4138ae84, &(0x7f0000000100)={{0x10000, 0x100000, 0x8, 0x1}, {0x0, 0x2000, 0xf, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5}, {0x3000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x72, 0x0, 0x80, 0x80, 0x4}, {0x10000, 0xffff1000, 0xf, 0x0, 0x0, 0x0, 0x0, 0xfc, 0x0, 0x3}, {0x0, 0xffff1000, 0xc, 0x2, 0x3, 0x10, 0x6, 0x0, 0x1, 0x0, 0x4}, {0x8080000, 0x10000, 0x0, 0x0, 0x0, 0xfd}, {0x0, 0x0, 0xa, 0x0, 0x80, 0xf9, 0x0, 0x7, 0x3a, 0x2}, {0x0, 0x3000, 0x0, 0x2, 0x0, 0x54, 0x7, 0x0, 0x0, 0x0, 0x0, 0x5}, {0x2, 0x400}, {}, 0xddf8ffdb, 0x0, 0x11111001, 0x100, 0x8, 0x8000, 0x3000, [0x0, 0x0, 0x2]}) ioctl$KVM_TRANSLATE(r5, 0xc018ae85, &(0x7f0000001280)={0x0, 0xdddd0000, 0x2, 0x5, 0x50}) 1.071776009s ago: executing program 1 (id=18): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$IOMMU_TEST_OP_MD_CHECK_REFS(r0, 0x3ba0, &(0x7f0000000300)={0x48, 0x4, 0x0, 0x0, 0x0, &(0x7f0000000240), 0xfff}) 6.205617ms ago: executing program 0 (id=19): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)={{0x14}, [@NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x6c}}, 0x0) 0s ago: executing program 1 (id=20): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="6c00000002060104db406e3e0004000200000000100003006269746d61703a706f72740005000400000000000900020073797a32000000000500050000006c00050001000600000024000780080008400000137906000440fffff000060005400000000008000640"], 0x6c}}, 0x0) sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)=ANY=[@ANYBLOB="28000000030601020000000200fdffffffffff0205000100070000000900020073797a32"], 0x28}, 0x1, 0x0, 0x0, 0x4c814}, 0x40814) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.134' (ED25519) to the list of known hosts. [ 82.608831][ T5820] cgroup: Unknown subsys name 'net' [ 82.744584][ T5820] cgroup: Unknown subsys name 'cpuset' [ 82.754028][ T5820] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 84.342714][ T5820] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 88.560100][ T5152] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 88.568055][ T5152] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 88.580993][ T5842] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 88.588597][ T5843] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 88.596997][ T5843] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 88.604987][ T5843] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 88.613768][ T51] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 88.622104][ T51] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 88.642406][ T51] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 88.650091][ T51] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 88.740933][ T5839] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 88.751279][ T5839] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 88.758759][ T5839] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 88.767113][ T5839] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 88.774936][ T5839] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 88.841254][ T5843] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 88.850701][ T5843] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 88.858967][ T5843] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 88.866974][ T5843] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 88.881188][ T5843] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 88.963541][ T51] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 88.971792][ T51] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 88.979246][ T51] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 88.987218][ T51] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 88.995014][ T51] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 89.435279][ T5836] chnl_net:caif_netlink_parms(): no params data found [ 89.526623][ T5840] chnl_net:caif_netlink_parms(): no params data found [ 89.556011][ T5844] chnl_net:caif_netlink_parms(): no params data found [ 89.602627][ T5847] chnl_net:caif_netlink_parms(): no params data found [ 89.836680][ T5836] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.844782][ T5836] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.852713][ T5836] bridge_slave_0: entered allmulticast mode [ 89.859919][ T5836] bridge_slave_0: entered promiscuous mode [ 89.869377][ T5836] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.877418][ T5836] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.884627][ T5836] bridge_slave_1: entered allmulticast mode [ 89.892344][ T5836] bridge_slave_1: entered promiscuous mode [ 89.921967][ T5840] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.929127][ T5840] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.937552][ T5840] bridge_slave_0: entered allmulticast mode [ 89.945519][ T5840] bridge_slave_0: entered promiscuous mode [ 90.009430][ T5840] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.016991][ T5840] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.025277][ T5840] bridge_slave_1: entered allmulticast mode [ 90.033065][ T5840] bridge_slave_1: entered promiscuous mode [ 90.046726][ T5836] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.069176][ T5844] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.078256][ T5844] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.086052][ T5844] bridge_slave_0: entered allmulticast mode [ 90.094098][ T5844] bridge_slave_0: entered promiscuous mode [ 90.102533][ T5844] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.109660][ T5844] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.117251][ T5844] bridge_slave_1: entered allmulticast mode [ 90.124531][ T5844] bridge_slave_1: entered promiscuous mode [ 90.143246][ T5851] chnl_net:caif_netlink_parms(): no params data found [ 90.157740][ T5836] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.167212][ T5847] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.174838][ T5847] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.182103][ T5847] bridge_slave_0: entered allmulticast mode [ 90.189165][ T5847] bridge_slave_0: entered promiscuous mode [ 90.224406][ T5840] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.265418][ T5847] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.272861][ T5847] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.280165][ T5847] bridge_slave_1: entered allmulticast mode [ 90.287860][ T5847] bridge_slave_1: entered promiscuous mode [ 90.309972][ T5840] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.357043][ T5836] team0: Port device team_slave_0 added [ 90.377776][ T5844] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.389432][ T5844] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.422166][ T5836] team0: Port device team_slave_1 added [ 90.465627][ T5840] team0: Port device team_slave_0 added [ 90.507577][ T5847] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.518584][ T5844] team0: Port device team_slave_0 added [ 90.527109][ T5844] team0: Port device team_slave_1 added [ 90.535561][ T5840] team0: Port device team_slave_1 added [ 90.561752][ T5836] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.568727][ T5836] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.594943][ T5836] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.608946][ T5847] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.662614][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.669604][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.696094][ T5840] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.711440][ T51] Bluetooth: hci1: command tx timeout [ 90.711716][ T5843] Bluetooth: hci0: command tx timeout [ 90.731038][ T5836] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.738015][ T5836] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.764338][ T5836] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.809163][ T5840] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.816436][ T5840] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.843006][ T5840] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 90.871370][ T5843] Bluetooth: hci2: command tx timeout [ 90.879538][ T5851] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.886925][ T5851] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.894700][ T5851] bridge_slave_0: entered allmulticast mode [ 90.901996][ T5851] bridge_slave_0: entered promiscuous mode [ 90.910852][ T5851] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.917980][ T5851] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.925439][ T5851] bridge_slave_1: entered allmulticast mode [ 90.933194][ T5851] bridge_slave_1: entered promiscuous mode [ 90.941942][ T5847] team0: Port device team_slave_0 added [ 90.948483][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.955860][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.981874][ T5843] Bluetooth: hci3: command tx timeout [ 90.981903][ T5844] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.999642][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.006879][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.033547][ T5844] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.037263][ T5843] Bluetooth: hci4: command tx timeout [ 91.076561][ T5847] team0: Port device team_slave_1 added [ 91.109955][ T5836] hsr_slave_0: entered promiscuous mode [ 91.116401][ T5836] hsr_slave_1: entered promiscuous mode [ 91.180508][ T5840] hsr_slave_0: entered promiscuous mode [ 91.188176][ T5840] hsr_slave_1: entered promiscuous mode [ 91.195055][ T5840] debugfs: 'hsr0' already exists in 'hsr' [ 91.201515][ T5840] Cannot create hsr debugfs directory [ 91.211504][ T5851] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.223995][ T5851] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.247609][ T5847] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.254692][ T5847] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.280827][ T5847] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.381616][ T5847] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.388605][ T5847] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.415315][ T5847] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.449567][ T5851] team0: Port device team_slave_0 added [ 91.460442][ T5844] hsr_slave_0: entered promiscuous mode [ 91.467317][ T5844] hsr_slave_1: entered promiscuous mode [ 91.474532][ T5844] debugfs: 'hsr0' already exists in 'hsr' [ 91.480382][ T5844] Cannot create hsr debugfs directory [ 91.512847][ T5851] team0: Port device team_slave_1 added [ 91.611008][ T5851] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.618000][ T5851] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.644553][ T5851] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.657760][ T5851] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.664855][ T5851] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.691284][ T5851] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.794818][ T5847] hsr_slave_0: entered promiscuous mode [ 91.801290][ T5847] hsr_slave_1: entered promiscuous mode [ 91.807322][ T5847] debugfs: 'hsr0' already exists in 'hsr' [ 91.813597][ T5847] Cannot create hsr debugfs directory [ 91.867256][ T5851] hsr_slave_0: entered promiscuous mode [ 91.874491][ T5851] hsr_slave_1: entered promiscuous mode [ 91.880638][ T5851] debugfs: 'hsr0' already exists in 'hsr' [ 91.886399][ T5851] Cannot create hsr debugfs directory [ 91.916727][ T1208] cfg80211: failed to load regulatory.db [ 92.247934][ T5840] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 92.287284][ T5840] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 92.298645][ T5840] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 92.323042][ T5840] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 92.374928][ T5844] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 92.399723][ T5844] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 92.410394][ T5844] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 92.432736][ T5844] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 92.507979][ T5836] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 92.518850][ T5836] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 92.547019][ T5836] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 92.570911][ T5836] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 92.675873][ T5847] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 92.697777][ T5847] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 92.719394][ T5840] 8021q: adding VLAN 0 to HW filter on device bond0 [ 92.741377][ T5847] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 92.752129][ T5847] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 92.788357][ T5844] 8021q: adding VLAN 0 to HW filter on device bond0 [ 92.795130][ T5843] Bluetooth: hci1: command tx timeout [ 92.806739][ T5843] Bluetooth: hci0: command tx timeout [ 92.858821][ T5840] 8021q: adding VLAN 0 to HW filter on device team0 [ 92.906571][ T5851] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 92.918592][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.926000][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 92.951073][ T5851] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 92.953372][ T5843] Bluetooth: hci2: command tx timeout [ 92.971406][ T5851] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 92.985014][ T2938] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.992187][ T2938] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.006467][ T5844] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.021464][ T5851] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 93.030839][ T5843] Bluetooth: hci3: command tx timeout [ 93.079226][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.086397][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.122582][ T5843] Bluetooth: hci4: command tx timeout [ 93.147893][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.155131][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.203375][ T5847] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.274750][ T5847] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.315591][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.322775][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.363209][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.370350][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.396191][ T5836] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.456043][ T5851] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.524499][ T5836] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.566531][ T2938] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.573755][ T2938] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.606072][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.613295][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.640368][ T5851] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.701247][ T2938] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.708443][ T2938] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.720299][ T2938] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.727479][ T2938] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.777408][ T5840] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 93.908588][ T5844] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.029445][ T5840] veth0_vlan: entered promiscuous mode [ 94.077144][ T5840] veth1_vlan: entered promiscuous mode [ 94.153477][ T5847] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.199929][ T5840] veth0_macvtap: entered promiscuous mode [ 94.286359][ T5840] veth1_macvtap: entered promiscuous mode [ 94.317486][ T5844] veth0_vlan: entered promiscuous mode [ 94.372474][ T5844] veth1_vlan: entered promiscuous mode [ 94.388631][ T5836] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.415833][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.444265][ T5840] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.520457][ T5851] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.535256][ T2938] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.546206][ T2938] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.574113][ T2938] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.585369][ T2938] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.617132][ T5844] veth0_macvtap: entered promiscuous mode [ 94.627651][ T5844] veth1_macvtap: entered promiscuous mode [ 94.698608][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.747470][ T5836] veth0_vlan: entered promiscuous mode [ 94.755481][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.776736][ T3004] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.816602][ T3004] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.825922][ T3004] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.849075][ T3004] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.872055][ T5843] Bluetooth: hci0: command tx timeout [ 94.872112][ T51] Bluetooth: hci1: command tx timeout [ 94.886050][ T2938] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.900363][ T5851] veth0_vlan: entered promiscuous mode [ 94.908703][ T2938] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.925446][ T5836] veth1_vlan: entered promiscuous mode [ 94.972950][ T5847] veth0_vlan: entered promiscuous mode [ 95.003811][ T5851] veth1_vlan: entered promiscuous mode [ 95.020300][ T2969] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.024572][ T5847] veth1_vlan: entered promiscuous mode [ 95.040195][ T51] Bluetooth: hci2: command tx timeout [ 95.061533][ T2969] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.096926][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.110910][ T51] Bluetooth: hci3: command tx timeout [ 95.116830][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.140277][ T5847] veth0_macvtap: entered promiscuous mode [ 95.164261][ T5847] veth1_macvtap: entered promiscuous mode [ 95.173898][ T5836] veth0_macvtap: entered promiscuous mode [ 95.200351][ T5840] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 95.216409][ T51] Bluetooth: hci4: command tx timeout [ 95.241441][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.251197][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.274820][ T5851] veth0_macvtap: entered promiscuous mode [ 95.291730][ T5836] veth1_macvtap: entered promiscuous mode [ 95.336411][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.353832][ T5851] veth1_macvtap: entered promiscuous mode [ 95.379323][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.434194][ T5836] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.448619][ T2969] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.490666][ T2969] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.505631][ T5949] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 95.560206][ T36] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.578493][ T36] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.592667][ T5951] ubi31: attaching mtd0 [ 95.607542][ T5951] ubi31: scanning is finished [ 95.616907][ T5836] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.633343][ T5851] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.642336][ T5951] ubi31: empty MTD device detected [ 95.677439][ T2938] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.688998][ T5851] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.710116][ T2938] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.727512][ T2938] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.807370][ T2938] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.841483][ T2938] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.886943][ T5951] ubi31: attached mtd0 (name "mtdram test device", size 0 MiB) [ 95.926640][ T2938] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.935666][ T5951] ubi31: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 95.950766][ T5951] ubi31: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 95.954181][ T2938] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.957826][ T5951] ubi31: VID header offset: 64 (aligned 64), data offset: 128 [ 95.957851][ T5951] ubi31: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 95.998105][ T5951] ubi31: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 96.008942][ T5951] ubi31: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 3266897296 [ 96.024942][ T5951] ubi31: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 96.100876][ T5955] ubi31: background thread "ubi_bgt31d" started, PID 5955 [ 96.190426][ T2938] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.256109][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.864877][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.407471][ T51] Bluetooth: hci0: command tx timeout [ 97.413437][ T51] Bluetooth: hci1: command tx timeout [ 97.419143][ T51] Bluetooth: hci2: command tx timeout [ 97.420773][ T5843] Bluetooth: hci3: command tx timeout [ 97.424942][ T51] Bluetooth: hci4: command tx timeout [ 97.481587][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.558453][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.576962][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.612313][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.776380][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 97.832905][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 97.864972][ T5968] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10'. [ 98.428325][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.467175][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.607179][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.651307][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.980653][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 99.062870][ T5981] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 99.091076][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 99.287144][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 99.492054][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 99.501315][ T0] NOHZ tick-stop error: local softirq work is pending, handler #4a!!! [ 99.633438][ T5990] netlink: 48 bytes leftover after parsing attributes in process `syz.1.15'. [ 100.761112][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 100.913266][ T6001] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11'. [ 101.335127][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 101.350868][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 101.513899][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 101.643045][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 101.833783][ T5836] [ 101.836154][ T5836] ============================================ [ 101.842314][ T5836] WARNING: possible recursive locking detected [ 101.848503][ T5836] 6.16.0-rc4-next-20250703-syzkaller #0 Not tainted [ 101.855094][ T5836] -------------------------------------------- [ 101.861230][ T5836] syz-executor/5836 is trying to acquire lock: [ 101.867389][ T5836] ffff88805a4dc8c8 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: rpc_close_pipes+0x10a/0x730 [ 101.877765][ T5836] [ 101.877765][ T5836] but task is already holding lock: [ 101.885120][ T5836] ffff88805a4d91c8 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: __simple_recursive_removal+0x190/0x510 [ 101.896351][ T5836] [ 101.896351][ T5836] other info that might help us debug this: [ 101.904400][ T5836] Possible unsafe locking scenario: [ 101.904400][ T5836] [ 101.911842][ T5836] CPU0 [ 101.915121][ T5836] ---- [ 101.918392][ T5836] lock(&sb->s_type->i_mutex_key#20); [ 101.923851][ T5836] lock(&sb->s_type->i_mutex_key#20); [ 101.929316][ T5836] [ 101.929316][ T5836] *** DEADLOCK *** [ 101.929316][ T5836] [ 101.937455][ T5836] May be due to missing lock nesting notation [ 101.937455][ T5836] [ 101.945771][ T5836] 4 locks held by syz-executor/5836: [ 101.951050][ T5836] #0: ffff88807cdcc0e0 (&type->s_umount_key#50){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 [ 101.961239][ T5836] #1: ffff888026a248a0 (&sn->pipefs_sb_lock){+.+.}-{4:4}, at: rpc_kill_sb+0x77/0x190 [ 101.970819][ T5836] #2: ffffffff8f6d0e30 ((rpc_pipefs_notifier_list).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x54/0x90 [ 101.982932][ T5836] #3: ffff88805a4d91c8 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: __simple_recursive_removal+0x190/0x510 [ 101.994666][ T5836] [ 101.994666][ T5836] stack backtrace: [ 102.000563][ T5836] CPU: 0 UID: 0 PID: 5836 Comm: syz-executor Not tainted 6.16.0-rc4-next-20250703-syzkaller #0 PREEMPT(full) [ 102.000585][ T5836] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 102.000603][ T5836] Call Trace: [ 102.000613][ T5836] [ 102.000622][ T5836] dump_stack_lvl+0x189/0x250 [ 102.000647][ T5836] ? __pfx_dump_stack_lvl+0x10/0x10 [ 102.000685][ T5836] ? __pfx__printk+0x10/0x10 [ 102.000701][ T5836] ? print_lock_name+0xde/0x100 [ 102.000717][ T5836] print_deadlock_bug+0x28b/0x2a0 [ 102.000744][ T5836] validate_chain+0x1a3f/0x2140 [ 102.000771][ T5836] __lock_acquire+0xab9/0xd20 [ 102.000790][ T5836] ? rpc_close_pipes+0x10a/0x730 [ 102.000807][ T5836] lock_acquire+0x120/0x360 [ 102.000823][ T5836] ? rpc_close_pipes+0x10a/0x730 [ 102.000846][ T5836] down_write+0x96/0x1f0 [ 102.000869][ T5836] ? rpc_close_pipes+0x10a/0x730 [ 102.000892][ T5836] ? __pfx_down_write+0x10/0x10 [ 102.000913][ T5836] ? __pfx_find_submount+0x10/0x10 [ 102.000929][ T5836] ? _raw_spin_unlock+0x28/0x50 [ 102.000947][ T5836] ? d_walk+0x6f4/0x780 [ 102.000962][ T5836] rpc_close_pipes+0x10a/0x730 [ 102.000990][ T5836] ? d_invalidate+0x204/0x260 [ 102.001004][ T5836] ? __pfx_rpc_close_pipes+0x10/0x10 [ 102.001021][ T5836] ? up_write+0x1c4/0x420 [ 102.001041][ T5836] ? __pfx_rpc_close_pipes+0x10/0x10 [ 102.001057][ T5836] __simple_recursive_removal+0x20b/0x510 [ 102.001076][ T5836] ? __pfx_rpc_close_pipes+0x10/0x10 [ 102.001093][ T5836] rpc_unlink+0x56/0x80 [ 102.001108][ T5836] rpc_pipefs_event+0xc0/0x170 [ 102.001122][ T5836] notifier_call_chain+0x1b3/0x3e0 [ 102.001143][ T5836] blocking_notifier_call_chain+0x6a/0x90 [ 102.001163][ T5836] rpc_kill_sb+0xd0/0x190 [ 102.001182][ T5836] deactivate_locked_super+0xb9/0x130 [ 102.001199][ T5836] cleanup_mnt+0x425/0x4c0 [ 102.001213][ T5836] ? lockdep_hardirqs_on+0x9c/0x150 [ 102.001234][ T5836] task_work_run+0x1d1/0x260 [ 102.001249][ T5836] ? __pfx_task_work_run+0x10/0x10 [ 102.001261][ T5836] ? __x64_sys_umount+0x122/0x160 [ 102.001281][ T5836] ? exit_to_user_mode_loop+0x40/0x110 [ 102.001297][ T5836] exit_to_user_mode_loop+0xec/0x110 [ 102.001312][ T5836] do_syscall_64+0x2bd/0x3b0 [ 102.001324][ T5836] ? lockdep_hardirqs_on+0x9c/0x150 [ 102.001343][ T5836] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.001356][ T5836] ? clear_bhb_loop+0x60/0xb0 [ 102.001370][ T5836] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.001384][ T5836] RIP: 0033:0x7f16d078fc57 [ 102.001400][ T5836] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 102.001411][ T5836] RSP: 002b:00007ffe17a7c348 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 102.001426][ T5836] RAX: 0000000000000000 RBX: 00007f16d0810925 RCX: 00007f16d078fc57 [ 102.001435][ T5836] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe17a7c400 [ 102.001443][ T5836] RBP: 00007ffe17a7c400 R08: 0000000000000000 R09: 0000000000000000 [ 102.001452][ T5836] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffe17a7d490 [ 102.001461][ T5836] R13: 00007f16d0810925 R14: 0000000000018cd4 R15: 00007ffe17a7d4d0 [ 102.001475][ T5836] [ 102.001492][ C0] vkms_vblank_simulate: vblank timer overrun [ 102.312449][ C0] vkms_vblank_simulate: vblank timer overrun