last executing test programs: 8m33.778565556s ago: executing program 1 (id=679): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB="180000002f00090027bd7000002800000400000004000d"], 0x18}, 0x1, 0x0, 0x0, 0x42804}, 0x20040000) 8m33.442175307s ago: executing program 1 (id=683): r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x280}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) r1 = syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f0000000080)) ioctl$PAGEMAP_SCAN(r1, 0xc0606610, &(0x7f0000000100)={0x60, 0x0, &(0x7f00001c9000/0x3000)=nil, &(0x7f0000c0a000/0x3000)=nil, 0x2, 0x0, 0x0, 0x0, 0xffe4, 0x2, 0x0, 0x1f}) 8m33.225722546s ago: executing program 1 (id=685): r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000180)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000040)=@ready={0x0, 0x0, 0x8, '\b\x00', {0x1, 0x8, 0x5, 0x40}}) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f00000000c0)={0x18, 0x24, 0x1, 0x0, 0x0, "", [@typed={0x8, 0x0, 0x0, 0x0, @fd=r1}]}, 0x18}], 0x1}, 0x80) r2 = socket(0x28, 0x805, 0x0) bind$vsock_stream(r2, &(0x7f0000000580)={0x28, 0x0, 0x0, @local}, 0x10) listen(r2, 0x4) accept4$unix(r2, 0x0, 0x0, 0x800) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000200)={{{@in=@empty, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in=@dev}}, &(0x7f0000000300)=0xe8) setuid(r3) syz_usb_connect(0x0, 0x63e, &(0x7f0000000f80)={{0x12, 0x1, 0x250, 0xfe, 0x6e, 0xbf, 0xff, 0x4ca, 0x300d, 0x136e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x62c, 0x2, 0x0, 0x9, 0xc0, 0x2, "", [{{0x9, 0x4, 0xc7, 0x8, 0xf, 0xe9, 0x1a, 0x49, 0x7, [], [{{0x9, 0x5, 0x80, 0x10, 0x40, 0xb9, 0x9, 0x5}}, {{0x9, 0x5, 0xb, 0x0, 0x3ff, 0x8c, 0x1, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x9, 0xb97}, @generic={0x6c, 0x11, "300449595a33d7076a6bf844e79c872d44f8f79bd1d8f217a01c7f45eeddce0cb6cf9c2d11fd7cbef23478aecf0454e1d7458737c8e8ca283648bd7168287fef809928ebd506f176b22a14e4527b73e393045ff78c7d1acc0597a5065796ac657983801e359df73f40c1"}]}}, {{0x9, 0x5, 0x3, 0x0, 0x8, 0x8, 0x0, 0xc, [@generic={0xed, 0x10, "46b3190c826d4a7e503567d6d380a14cce4a11c48bcff1c8eb0e041385f2b5a5bdd80fd214ed481bdcfbf5c32fe693a6e0bf1e1e9938dd85897363edc756f755761666c057bb72752a8978ec08d5f6bd0f8d662afe1468eb1d3f45a8871c3393afbd906e0171f6e6e99c9702e3d5b3342011da81814b27658862af9e5ad03bef7746f6a084c2e5002eb7409cdd3404f360ab23102fc0b0c6584a1e4ee760d3a36ee71de111ac0e09ec21885eed69b6ab82bee8a8b6dd44707cc5b673ac28f7ec86966beedd00ead632bd14c93e864c3681dd4ba86de63c0131c7b6939867c19e258232b4b867c2f971a134"}]}}, {{0x9, 0x5, 0x9, 0x0, 0x20, 0x9, 0xfd, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x7, 0x9}]}}, {{0x9, 0x5, 0x0, 0x2, 0x8, 0x7f, 0x6, 0x6}}, {{0x9, 0x5, 0xe, 0xc, 0x40, 0x2, 0x1, 0x6, [@generic={0x83, 0x24, "4f09dfae21806bc3b7957c7de6ebb5723be2cafa7e0f6c8ec3547b89eb12fc0d1bd257fcbdef53b999f02fcf2419bc88336592498daa2842c3ea83474981b79ded328f234bb092eb33d23142ca70cdfa72c8fb1c3974e964ff0c4d3fde0319ce8985b3835c58cedd796f1daf8c43b7a3881a6256df59fb36e0f09fc5e56a55ce76"}, @generic={0xf, 0x2, "af249b8586588077b59461a51d"}]}}, {{0x9, 0x5, 0xd, 0x8, 0x10, 0x2, 0xa, 0x7}}, {{0x9, 0x5, 0x5, 0x10, 0x3ff, 0x6f, 0x52, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0xfb, 0xffff}, @uac_iso={0x7, 0x25, 0x1, 0x4, 0x17, 0x59d}]}}, {{0x9, 0x5, 0xa, 0x2, 0x8, 0x10, 0xc, 0xf2, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x8, 0x100}]}}, {{0x9, 0x5, 0xd, 0xc, 0x30, 0x3, 0x1, 0x0, [@generic={0x5, 0x7, "651a09"}]}}, {{0x9, 0x5, 0xa, 0x3, 0x8, 0x0, 0x6, 0xe}}, {{0x9, 0x5, 0xb, 0x0, 0x0, 0x9, 0xa, 0xcb, [@generic={0x8d, 0x23, "488c785834a6dd3f804718fa7f5da2f6a47a2180030a8f2aaf21a52c93659978a15c567312dc05846fdb347a76774498b057f8c0e2c4a073434a65470b3ff8f4e2580392c6e5c8c0ee54beea7efa1a18b33c8f097e5e22ad6066092c76cb40a6e68604448beb68da551d6534d1efe7d9fbb6692934f88415196a85a78d04955d30624678db31c3a71b05cc"}]}}, {{0x9, 0x5, 0x6, 0xc, 0x8, 0x3, 0x9, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x7, 0x9}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0x41, 0x7}]}}, {{0x9, 0x5, 0x3, 0x8, 0x10, 0x2, 0x9, 0xc4}}, {{0x9, 0x5, 0x3, 0xc, 0x10, 0x0, 0x6, 0x0, [@generic={0x33, 0xe, "c28171a9561946526b9ae2d66a1eac8b85a57485e1594fd19dad02b9fac482f3909eb296d3e153a9bf8eea44f274d83d46"}, @generic={0x6c, 0xd, "2bc7e40fdddd75a8e47e4a27ccc4c11bdc6de415851dab97c2f75c23b760752f23bef2127b4b96e3bc649dc78cd586c29df87f1666eeaa034925841151bbc99ef11d69bcf56ff0bfe46b399cb3aae22b38c048c9dd907373d9d925a6c5d297af48f2ddbc4a1b803c045d"}]}}]}}, {{0x9, 0x4, 0x61, 0x1, 0x6, 0x24, 0x3e, 0x82, 0x1, [], [{{0x9, 0x5, 0xf, 0x10, 0x208, 0xd, 0x53, 0x4}}, {{0x9, 0x5, 0x6, 0x0, 0x10, 0x3, 0x5, 0xf, [@generic={0x4e, 0x24, "b0e4fdf8bb1870ee817c91a298607b0351d756089dbc94c61c5fe426866dbbb232a38ec5a1fa9364aa4ace0fb55d0636384a74a33aef80078988a0fba5d034c17d14c3b705bebb7584a708e8"}, @generic={0x21, 0x8, "2ea387caca96066f6386b8d1a22da1fe75e03da037dc6acf5bf48cc6b4968c"}]}}, {{0x9, 0x5, 0x0, 0x0, 0x200, 0x6, 0x8, 0x93, [@generic={0xbf, 0x23, "8385df7de619f2ee6b30b42a21e0233a58a19913fb83bc16a9620a91f8da24ff9a270abe342aff8ae4eb2d80367b101917300bcb2daf9945002831185d498f2f12236eaf1ee087f326bbb20a2d7bb27e249ac2656cd4739751fb0ca210e8543f347843b99fd1eadc78ec989e36abf1c43e151aeb3ade5ef959de0d29c6942505802c13b3da8dec8ee9d7e8d6a4cebd6b984bf77d88ae15918489d9f0fe76c012f28d35de1dd69773e62cafc294877323ba958a1c02a07b8940369f3726"}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0xd7, 0x4}]}}, {{0x9, 0x5, 0x5, 0x8514c03079e19b6b, 0x40, 0x19, 0x3, 0xb, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x80, 0xb43}, @generic={0xa1, 0x21, "be8531405e6107fa4693f788961450cdacab41a834cf5b50463a47cd77e631b4c4517471b2e0d49c7585dc8fbde16438ee9794baec9d826302946fe17f593e9b425c87f74e8b626ae426884d08749b4cbf2259000cc0b36e848f9ba1ee8b574a4187370384bb8a2fb756bd9125599c9346658cb3e99563129d0f6ac3d7b9f5b5256450aef09f507785ee8fc0aec45e15e06e933faf12e3c2a21d1047c29486"}]}}, {{0x9, 0x5, 0xc, 0x6a21034b211928e4, 0x40, 0x6, 0x0, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x92, 0x8}]}}, {{0x9, 0x5, 0x8, 0x0, 0x400, 0x5, 0x8, 0x1, [@generic={0x23, 0x510d7ac708bc4253, "ca867c281780ff0d4fa0e19873403090351d536fae71d60cbf6c466325528280ed"}]}}]}}]}}]}}, &(0x7f0000001900)={0xa, &(0x7f00000015c0)={0xa, 0x6, 0x110, 0xb, 0x80, 0x4, 0x40, 0x1}, 0x4c, &(0x7f0000001600)={0x5, 0xf, 0x4c, 0x1, [@generic={0x47, 0x10, 0x2, "13d4f3847551d09e5fa8e98e2fe2bc3764c11984f813b8208cf97ac9a63b4cef78f16899a670bedb472df15e3d0bf4192e1e94c0af30e290bf80a6517a8f8c3dcd809093"}]}, 0x9, [{0x4, &(0x7f0000001680)=@lang_id={0x4, 0x3, 0x443}}, {0x4, &(0x7f00000016c0)=@lang_id={0x4, 0x3, 0x101a}}, {0x7, &(0x7f0000001700)=@string={0x7, 0x3, "32d6cd96cd"}}, {0x4, &(0x7f0000001740)=@lang_id={0x4, 0x3, 0xc0c}}, {0x4b, &(0x7f0000001780)=@string={0x4b, 0x3, "be176764ed8bb64636289d2f762fc6f4d1360e089eeea2517a91e28e1d8f8e3d611b05631be13256e6f081b8bbcf787551d87bd7c4a5cbcb98f0706fae18b220f54b1e8a8b3141468e"}}, {0x4, &(0x7f0000001800)=@lang_id={0x4, 0x3, 0x455}}, {0x4, &(0x7f0000001840)=@lang_id={0x4, 0x3, 0x43f}}, {0x4, &(0x7f0000001880)=@lang_id={0x4}}, {0x4, &(0x7f00000018c0)=@lang_id={0x4, 0x3, 0x3c01}}]}) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0x10, &(0x7f0000000f40)=ANY=[@ANYBLOB="0c00004e15"]) 8m31.181326713s ago: executing program 1 (id=698): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000000c0)={0x5c, 0x2, 0x6, 0x801, 0x20000000, 0x0, {0x0, 0x0, 0x1}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x10}]}]}, 0x5c}}, 0x0) 8m30.92535552s ago: executing program 1 (id=699): r0 = syz_usb_connect(0x3, 0x371, &(0x7f0000000280)=ANY=[@ANYRES32, @ANYBLOB="94afc524029937cb46d7133101ecaacd8ef806592f73ee0d2506c6b98031be7f855da3196197eabb83669d42dcdb756f3704f12ebdf7f65fe338c57f54cfd162663282124bb23891d850372930"], 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)={0x1c, 0x45, 0x1, 0x80002, 0x25dfdbfd, {0x5}, [@typed={0x8, 0x2, 0x0, 0x0, @fd=r1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x400c0c1}, 0x4008094) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000) r3 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) close(0x3) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000380)={'vcan0\x00', 0x0}) r7 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r7, &(0x7f0000000080)={0x1d, r6, 0x0, {0x0, 0x0, 0x4}, 0xfd}, 0x18) sendmsg$can_j1939(r7, &(0x7f00000001c0)={&(0x7f0000000040)={0x1d, 0x0, 0x0, {0x0, 0x0, 0x4}}, 0x34, &(0x7f0000000180)={&(0x7f00000000c0)="92", 0x1a000}}, 0xee) connect$can_j1939(r3, &(0x7f0000000140)={0x1d, r4}, 0x18) sendmmsg(r3, &(0x7f0000003e40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4004) write$char_usb(r2, &(0x7f0000006800)="10", 0x20) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) close_range(r8, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000240)={0x0, 0x10, &(0x7f0000000200)=[@in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, &(0x7f0000000300)=0x10) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f00000003c0)={r9, 0x5, 0x20}, &(0x7f0000000400)=0xc) 8m29.346938224s ago: executing program 1 (id=708): socket$kcm(0xa, 0x3, 0x87) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd120003000000140000006000000003088700fe88a43de1a400000000000000077d01ff020000000000000000000000000001"], 0xfdef) 8m28.904568208s ago: executing program 32 (id=708): socket$kcm(0xa, 0x3, 0x87) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd120003000000140000006000000003088700fe88a43de1a400000000000000077d01ff020000000000000000000000000001"], 0xfdef) 6m32.031075926s ago: executing program 3 (id=1400): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000013c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0xc000000, {0x7, 0x0, 0x4}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x88, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7, 0x0, 0x3}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_EXPRESSIONS={0x44, 0x12, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @connlimit={{0xe}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_COUNT={0x8, 0x1, 0x1, 0x0, 0x1}]}}}, {0x20, 0x1, 0x0, 0x1, @connlimit={{0xe}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_COUNT={0x8, 0x1, 0x1, 0x0, 0xe41f}]}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x120}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xd0}}, 0x20050800) 6m31.380212929s ago: executing program 3 (id=1406): sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) readv(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x2000008, 0x8013, r0, 0xf6690000) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22, 0xfffffff9, @ipv4={'\x00', '\xff\xff', @empty}, 0x6}, 0x1c) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) writev(r1, &(0x7f0000000080)=[{&(0x7f0000000100)="5514377d925cfac68fa5e905ccd2593d6d0f37d8422f54e9fbc8881033b7e59b0ce2a896d5c195741b964850ca7444d0926630715341d8ef0611e595745d05bb0484b65adfe33ed3639e7722ef74b92df54d886779faf3deee20a0724362221a9fc4a7f86a07042dd5875131ff0d57107a01db1964be5dd15d8d3be6fd3209f87210f2e9de528884797a1c43157c6f56349e263c79cb13df66409f7cd33b9ebb000fd19d5521eab9eb89ad56a45108b1d3179077413d0e16044c0fe0", 0xbc}, {&(0x7f00000003c0)="fc30dbe99679dd0987d9b79d2816807e5ae56a882530ffe1ae10045ba28c5dd5d248346be2a47ba7ee4ad5737e6f7ee5972f54c5c05986ceaefcd934112e67e808e7197431b1ccde1f3f6c5fc18a493805bc62c575cbdf0d821e4d78766945408115744f77f5fd65bbdc64876a8a4cc6c9ac20ba24e72a582ac25cf4c4abc66e220276c80ddfadfb0d2dbd81ac158689bb3ee37cd6030474f0b67ab077d71a4af43f2ad4865aebe10863d1fbc13d4b6fa0cf2ac1622bf3c908302f7e49debf566d5390f5cc4dca4aefa4823d39cb7dd4f4b9ccaa3deca2483f38c68a6dd882630c645b3731764f609c43fdf70d1426eb074aaf64f950877536287cbb548ae806ec459b787cbca0bbc12a0044111c8b688d9d2c1400cbd43c21fee0085f3a88a87d0acc4328488cf64db57a3ac6ca7ba0effedb266c9c8c2eb03d42aa488241af22018d2f94b6e657a54801b656a8806f1f6b009a6e9f37d02caa6795ca7bd3cac3507f37a462e1ac4439246310bfef901b7664009228e5db784966aa690a2a06414cb47c02440fb402a214f204030d28d13f1267dddfab49dc95ab673ec2a243ded076600e33fdca0495a0807d4a3057b703770316b6afd5dcd1ebe22e7922e67c8378c09623c068e49f788048bd2390e8d48301490e26b950018a18b196d038d9786f268a202b76acdeb0e879e291b0585aecc2b12b692e4ebde3703a7036408accf2a7ce0155b54bbd79aebb61e2f881ee21b5dc3b1971194f66e741442683da9d9015f3535458b69b1a231ddba9dedc1c3008bdf45b6b5d8d55f70d016836a1ffcf797c8e87451a3aea994e9a8bf28339910570d2c5fd5cf258e13649667da0fb5597144ba9beaae4488fab4bf92db02dd8a567a3448fbd4994c7ef6e94c1d94fe246a50dd0d4254dbde51ae8f0c135961175d68913beb0dbd725206beb1510ebb44319a9bdcb8949f46cf187faa8ff4095ec2ced4080e9510e16eac28ab16d2b52eef8131b6bb14059566c7b40ec939c3d9da8c07cea2a41943d2b0f2c46935e9d91e0f60933e70e83362e381f8c77bcf5462a8e951b2d268e27c0942c85ef832e731d9c0c72911fb8a5ad85e0d710b48d54d2c1ca5de57b3cc28c7ab7504c11e3ed03a68509159b8ca0b2be181a3ca748cd02969b94907c2687fca03fb6423854627f0c54f8af5b84630c34ec70815063c8ca0303bd6d97f53e2437a177381eb10ec1108d87285d3669fec1b2f31acc0f5663e888cabc8aeda7ca34f377377c7100edf49a914538835a916a0f84bfb5754fe3313c801168f806675b9813c3c3c5a52cbde1b907b2922ecda1db0a81108622e3517aea76f0debee7c452bef87f78394e0d9a85b90db51fd5d953a528d12ce517deef93b518ebc26197818238481940e1b8747f8d3e3398403837fe86a5c67a708c40e6c89275c1f9d07cfd5cee1d0379275899b1cda60b71f1ebe48867864529cd72e8437c01e71fd06c5c5b88752378932aaefc5dfb8580b00ba024cf132cfc2960d50aa0b33e3683f7f193accdd3ee2d0c47724165a0698d5098112ffa058ee93aa3b692ccbfd34274763c74f831c91fb84f7be645b0a00630226659d48e49da81a6d78f4478ad25458d91aae203a9b7413e65d7ae0b837312d09368852ef44960f71e9a2f915cfaa1b0848f2ef1dd6a7656bbfb0247a1f34e1b4d55c83578f2ba3eab5f94c878341e7c05d6a79a6e8c1024cebe808a09e1f202ecd024dfdd939d57ce4ed5a48d6a9b2df40b18d1f2e8b214e172fd05aa5159b71849bef0c9f576255a646453042c4d47e93ae8e0242e58c92fbdfe6748f4787c3ef1da49f0baa841ebbfe490cefca35910db567e59453824299cd26e625fbcfff898261de4f57e54ef909b2694adf79efec260f423055d48e38ed6e177550f6eae88f2f8618348396d006826349612401b40a318a29b5bcbc26e387944b31a852bc9c9cbf3947c9ecab7a9d22b57567c344947d734cfe39742632ff637c63f8134da78e499454cd2bb8c5faaabc32a5508e8cb053b49420f53a2fd3bc5496a2300e758f8f5e128e3edb039267e426b863aff638a460579e29be2c9938a2a273949152d0a83f757cdafbc664abefd59297f5dd112d47724e28f52a9660f9def5be26a5afc022e69c37dda79656042651c7bddefeaadabae7dd8ed9232f5e037cf586f5dcc319e18ceb90e7ce62b9ab270fbb62b29578b40614fa0dfba6a22a1cc2a3cc06e5c48d9ed3c145f3306e4e2f44812d908d558740b932229db5fccab7d43c53cd18063ec26da594fd0b2f4536b5dcb8b6c1fba1cf907140cda17207a9ba8a185cce514849f48c455574ab110750da0ec415e1e4279fbc63c298336f87b4b4776430195a4ee37f6a265792eb8d32e02ad6611a68cbe13202cc937fc5b3b8503ed59ee75ecf8a11f62d17e3ac0a797f9192217ae30a3ca3361d92cae64d1e00e8dad64c7ac5071df5a77b8cfb7b9e32b19d6c2c435bda45ec7e9bdd1cded92048bc65b346f427dbfe30561b14d73ea105c3866798524be7f211a58ae5db271441368dc68e95add6cb60b66135d3da6000acb5941c3e78c399886c71d9d9e401f9608bcf4e20fb024456d24054f96d7430eb3560e5dba6039190a855f9cfa3e0602a3fd4b7ecf70f7762e07ad1495b82ca660ffd82d1be4d9c098c42a70915d37157c27c7fc07b9eba5dad6bb798b76fe20df121d38ad3c1a33b8b707b1080e34bdd137dd73320a96ecd1d77ad5f73dac3b9a495fdd887c0ed81abb889d665b20fa0eea5ae0fabf7c4660604a3d767b281b8ff54a41af67da99a68598bfeb7060c40db6944cfb5a73058d31832b981b28e5c27c485feeb4a0d5913df851eb935c10b21c0e97f149040972ace826d5d55e09c70f9e43c3e57bfaa84ecbd44e5a4309511a8e5c73d4f7a5a05cc33598b1d5ce596d564b843ca60040358e4ca652d30b8dc3b00e73a3f284578321471cfc12316a80e1d77261598b540a14613100323f11e2bfd1db94d99e7a4cea7c18d82ef0b04eacc956bc032a6c0f3e7c6c0415f9d7ff18a7e72a60c0ec33779b6c4789616c0767294ca898a50ffc7887a4c7376c7d28eb0b74c29b4e399d99fcf91be83c922aabe8065533724c9d82f819bc7a7ebcfe3586b8e2ccde8a0e0ef4fa32e78d1ac90654e70fcb565e81dbe5e51801f501a379e98a74bd31e358950ecd8b5da2232bf90d48c1979d88c429ff77df926be757213796e457064fbff5cb7fee41c32159a9cdaa1176cd406f0823abd8c2b8f83dfb96e5e2474d79e30f726c47746520ff4b3227a636d1d24fc19515a63e8333211aa6bc63961eb810ec4830d16baacd52f96eb3d16adc4128500eda2188d88d9ef0235531455eed0657874b425d6ba68a67e3905ab6f4f729aa9ced5ceb96cd183806a6c3720e907f6c7b226c0fe15219c2ff3320c2e6880ad016dc8bdd911d60ea77d971ed05ca154b0e5ee7d6ebc28b86a66baedca6d39939943bff1d8b39dea87a59fecc6279f9b117b04562db7e952b516a91a364a3b57f9f51324764b4e2c50e0dd2b4a62d19fa665be338e0071edc2725a4a775e9eb0a9e1d01482ed9009e2b17deae69740399203d231b2cb54635aab4a5bc71c1d75d5c27a0e850ad7c39a38c2658d72e8bac7e9fd4f351ad427faafebf7beed212a2fae3cc0c811cb54c468d9aacc303567a5ab03d8c00007c80085b5d39285bb161d8db8de11ec6dce9eab7b7dadd892a4f25e3382a4fe72ce2b309d02ceeadb8daa6e28f4baf8535e7dbb888005651bb5f434ec32b45042363bc424dc3b3441fcc12cef6779ca4032835a225a4196aa952ed12eebd4712fe385dd933fc4110de767d0f9127e7cd815d613a454c56f3be15526c6af0cddae6a7ff375d283871b8761e1cc63f3ada963c127bcb528f971b50ebe6da93b36c1c0b11b7a677c3a2a5a09f2e9350b509f22a51e9c1f3e11383e703b9053ddb5884e9a5804b51fa06f7fbb2ddb8a2d72bebcced8d80834780cfcc578e0e2d0219b4d120b3587db65809709197a0c9f5f5262b091fbbf15f4767206f85406e2fad15c29407243834872d55f13a42a9745822b317edb26488e8517de1c61d5003776faa94fb2d851b4c914dfafea5f0228ce3c2c795511ea5d1bc2b47ee56f56cafd0670e81ee59d2a6125075e98d475f671eca2020d96b7cc33167fde43aa045ef9d71db070d02e642bab72d0e9ac64be602228d8e1e91e9486765c2bf6cfccd723564edbbf13a44809d5a03ae5800bde612ec4dc2a96cb9b8de34998b2ba891549d956f333eb2da9a67312d77c46cb1135694e582a4ac41d9eeb4ff87047e12418f9896ffc567c67a4d172203d79077b901ff42a34dadcbf4b80eacf84093206c563d377f30e427fcff6e1e8ad572e2e4dfc3def367feaacf526fcc75cf81d013d24d51adc630db4a51053e70ce6f482f4c41d973b68dac37214e9315556e5fba8dcd68bcaa24256045ada481af6dfd80b01336ba5405b3a6f810eccff2f79e640b8ec1871140f0b773b70f13fad81121fb16f4a92db25d29206c00b3768e47dbe827257e5901c62e2509438ac6596722d9882893e2ea8b1191e09a6638eaae77c8b52c5eba0c3fa2230e48510a1b810259101d75bc488bffdfe1a9c6da9e05e149ce2e9b865db0d884f1028f03c84d947cd33895d8581c83ec55431b340b7fb04cb36d187fe6bc204f6bc390aeec4c949ff0d3db4c1c5b85909f838cf3a56b5d610036a0cc851f836ad72b73377b6eb6a869b802d1c07c424dea55f91e88defff0f07a856a2ba15070f19d5fc5858ac33e233713a1a8445e3255bf43aea9c7cc18f1c225c4b194a333d42c4bb72c994a877b5ae840f1a4f52c9d3bb3afb187b251d1c68f380a5dbd1689a78d98e7edc49014ad7c79708758d8e23c5082298627e38f1e19e1623a8b7e12a6435deae6698f0015d8e2e1e918ab06d060dacad0d6cc6d835619fe361d5e8cde40565b76913a904b7e7c60ddfcce6afc9e4676ca526a68920bcf8fee9d5055ca360d390524ac6aee07060220e13f82d53d3048b7eb0657db4597bf9ad73b1963dee280f181d3d9428baa692e2486112a308c7c5e81f98dacc516909df9df934edc8db18b7d49afc2e00c863dfeb70362571bc9cf0c4c179df7b4ab5ae4737a611966cf9c3593d6731e31ac048f046f78a2ded8c71a5bd422fc7b68239175555896d42563c8cc5b950fd28fa54db2e0cc6cded799f087befa8acd68eea3644b2711259296667530c42e8ee3dab02ce2fe770e68fbbf12e1c274ad54bbd95d16530abfca59d268bd02d5a78d9a5bd91127fcb2bca57436f7bcbffc08422ec54f887fcdd84a81ea0228d75bcca42f2d4b5bd138f5c0821ffb185cbe6c1750b3de7ef6775898c6695e11bfbe2db80e0a500841c45514ee4bd2e8", 0xf07}], 0x2) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000040)={&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000380)=0x40) 6m31.078755183s ago: executing program 3 (id=1408): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000040)=0x2800, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @empty}, 0x10) sendmsg$inet(r0, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0xffffff1f}], 0x1}, 0x0) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000500)=0x1, 0x4) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x7542d000) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1, 0x2}) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000140), 0x4) 6m29.883633234s ago: executing program 3 (id=1411): r0 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000940)={0x34, &(0x7f0000000680)={0x0, 0x30}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) r1 = syz_usb_connect$cdc_ecm(0x0, 0x6e, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x1, 0x1, 0x7, 0x50, 0x4, "", [{{0x9, 0x4, 0x0, 0x6, 0x2, 0x2, 0x6, 0x0, 0x94, {{0x8, 0x24, 0x6, 0x0, 0x0, "5b1b42"}, {0x5, 0x24, 0x0, 0x9}, {0xd, 0x24, 0xf, 0x1, 0x8, 0xf, 0x4a, 0xc7}, [@mdlm={0x15, 0x24, 0x12, 0x6}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x20, 0x1, 0xc, 0x2}}], {{0x9, 0x5, 0x82, 0x2, 0x40, 0x5, 0x6, 0x1}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x87, 0x0, 0x5}}}}}]}}]}}, &(0x7f00000002c0)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x201, 0x9, 0xe1, 0x1, 0x1de, 0x4}, 0xf, &(0x7f0000000200)={0x5, 0xf, 0xf, 0x1, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x3, 0x1, 0x0, 0x1}]}, 0x2, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x441}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x804}}]}) syz_usb_control_io(r1, 0x0, &(0x7f0000000140)={0x84, &(0x7f0000000300)=ANY=[@ANYRES64=r0, @ANYRES64=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000880)={0x34, &(0x7f0000000040)={0x40, 0x15}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000f40)={0x84, &(0x7f0000000740)={0x40, 0x17}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000e80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000ac0)={0x84, &(0x7f0000000380)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xc) r2 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) connect(r2, &(0x7f00000008c0)=@x25, 0x80) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) 6m25.983019633s ago: executing program 3 (id=1435): sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) readv(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap(&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x2000008, 0x8013, r0, 0xf6690000) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22, 0xfffffff9, @ipv4={'\x00', '\xff\xff', @empty}, 0x6}, 0x1c) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) writev(r1, &(0x7f0000000080)=[{&(0x7f0000000100)="5514377d925cfac68fa5e905ccd2593d6d0f37d8422f54e9fbc8881033b7e59b0ce2a896d5c195741b964850ca7444d0926630715341d8ef0611e595745d05bb0484b65adfe33ed3639e7722ef74b92df54d886779faf3deee20a0724362221a9fc4a7f86a07042dd5875131ff0d57107a01db1964be5dd15d8d3be6fd3209f87210f2e9de528884797a1c43157c6f56349e263c79cb13df66409f7cd33b9ebb000fd19d5521eab9eb89ad56a45108b1d3179077413d0e16044c0fe0", 0xbc}, {&(0x7f00000003c0)="fc30dbe99679dd0987d9b79d2816807e5ae56a882530ffe1ae10045ba28c5dd5d248346be2a47ba7ee4ad5737e6f7ee5972f54c5c05986ceaefcd934112e67e808e7197431b1ccde1f3f6c5fc18a493805bc62c575cbdf0d821e4d78766945408115744f77f5fd65bbdc64876a8a4cc6c9ac20ba24e72a582ac25cf4c4abc66e220276c80ddfadfb0d2dbd81ac158689bb3ee37cd6030474f0b67ab077d71a4af43f2ad4865aebe10863d1fbc13d4b6fa0cf2ac1622bf3c908302f7e49debf566d5390f5cc4dca4aefa4823d39cb7dd4f4b9ccaa3deca2483f38c68a6dd882630c645b3731764f609c43fdf70d1426eb074aaf64f950877536287cbb548ae806ec459b787cbca0bbc12a0044111c8b688d9d2c1400cbd43c21fee0085f3a88a87d0acc4328488cf64db57a3ac6ca7ba0effedb266c9c8c2eb03d42aa488241af22018d2f94b6e657a54801b656a8806f1f6b009a6e9f37d02caa6795ca7bd3cac3507f37a462e1ac4439246310bfef901b7664009228e5db784966aa690a2a06414cb47c02440fb402a214f204030d28d13f1267dddfab49dc95ab673ec2a243ded076600e33fdca0495a0807d4a3057b703770316b6afd5dcd1ebe22e7922e67c8378c09623c068e49f788048bd2390e8d48301490e26b950018a18b196d038d9786f268a202b76acdeb0e879e291b0585aecc2b12b692e4ebde3703a7036408accf2a7ce0155b54bbd79aebb61e2f881ee21b5dc3b1971194f66e741442683da9d9015f3535458b69b1a231ddba9dedc1c3008bdf45b6b5d8d55f70d016836a1ffcf797c8e87451a3aea994e9a8bf28339910570d2c5fd5cf258e13649667da0fb5597144ba9beaae4488fab4bf92db02dd8a567a3448fbd4994c7ef6e94c1d94fe246a50dd0d4254dbde51ae8f0c135961175d68913beb0dbd725206beb1510ebb44319a9bdcb8949f46cf187faa8ff4095ec2ced4080e9510e16eac28ab16d2b52eef8131b6bb14059566c7b40ec939c3d9da8c07cea2a41943d2b0f2c46935e9d91e0f60933e70e83362e381f8c77bcf5462a8e951b2d268e27c0942c85ef832e731d9c0c72911fb8a5ad85e0d710b48d54d2c1ca5de57b3cc28c7ab7504c11e3ed03a68509159b8ca0b2be181a3ca748cd02969b94907c2687fca03fb6423854627f0c54f8af5b84630c34ec70815063c8ca0303bd6d97f53e2437a177381eb10ec1108d87285d3669fec1b2f31acc0f5663e888cabc8aeda7ca34f377377c7100edf49a914538835a916a0f84bfb5754fe3313c801168f806675b9813c3c3c5a52cbde1b907b2922ecda1db0a81108622e3517aea76f0debee7c452bef87f78394e0d9a85b90db51fd5d953a528d12ce517deef93b518ebc26197818238481940e1b8747f8d3e3398403837fe86a5c67a708c40e6c89275c1f9d07cfd5cee1d0379275899b1cda60b71f1ebe48867864529cd72e8437c01e71fd06c5c5b88752378932aaefc5dfb8580b00ba024cf132cfc2960d50aa0b33e3683f7f193accdd3ee2d0c47724165a0698d5098112ffa058ee93aa3b692ccbfd34274763c74f831c91fb84f7be645b0a00630226659d48e49da81a6d78f4478ad25458d91aae203a9b7413e65d7ae0b837312d09368852ef44960f71e9a2f915cfaa1b0848f2ef1dd6a7656bbfb0247a1f34e1b4d55c83578f2ba3eab5f94c878341e7c05d6a79a6e8c1024cebe808a09e1f202ecd024dfdd939d57ce4ed5a48d6a9b2df40b18d1f2e8b214e172fd05aa5159b71849bef0c9f576255a646453042c4d47e93ae8e0242e58c92fbdfe6748f4787c3ef1da49f0baa841ebbfe490cefca35910db567e59453824299cd26e625fbcfff898261de4f57e54ef909b2694adf79efec260f423055d48e38ed6e177550f6eae88f2f8618348396d006826349612401b40a318a29b5bcbc26e387944b31a852bc9c9cbf3947c9ecab7a9d22b57567c344947d734cfe39742632ff637c63f8134da78e499454cd2bb8c5faaabc32a5508e8cb053b49420f53a2fd3bc5496a2300e758f8f5e128e3edb039267e426b863aff638a460579e29be2c9938a2a273949152d0a83f757cdafbc664abefd59297f5dd112d47724e28f52a9660f9def5be26a5afc022e69c37dda79656042651c7bddefeaadabae7dd8ed9232f5e037cf586f5dcc319e18ceb90e7ce62b9ab270fbb62b29578b40614fa0dfba6a22a1cc2a3cc06e5c48d9ed3c145f3306e4e2f44812d908d558740b932229db5fccab7d43c53cd18063ec26da594fd0b2f4536b5dcb8b6c1fba1cf907140cda17207a9ba8a185cce514849f48c455574ab110750da0ec415e1e4279fbc63c298336f87b4b4776430195a4ee37f6a265792eb8d32e02ad6611a68cbe13202cc937fc5b3b8503ed59ee75ecf8a11f62d17e3ac0a797f9192217ae30a3ca3361d92cae64d1e00e8dad64c7ac5071df5a77b8cfb7b9e32b19d6c2c435bda45ec7e9bdd1cded92048bc65b346f427dbfe30561b14d73ea105c3866798524be7f211a58ae5db271441368dc68e95add6cb60b66135d3da6000acb5941c3e78c399886c71d9d9e401f9608bcf4e20fb024456d24054f96d7430eb3560e5dba6039190a855f9cfa3e0602a3fd4b7ecf70f7762e07ad1495b82ca660ffd82d1be4d9c098c42a70915d37157c27c7fc07b9eba5dad6bb798b76fe20df121d38ad3c1a33b8b707b1080e34bdd137dd73320a96ecd1d77ad5f73dac3b9a495fdd887c0ed81abb889d665b20fa0eea5ae0fabf7c4660604a3d767b281b8ff54a41af67da99a68598bfeb7060c40db6944cfb5a73058d31832b981b28e5c27c485feeb4a0d5913df851eb935c10b21c0e97f149040972ace826d5d55e09c70f9e43c3e57bfaa84ecbd44e5a4309511a8e5c73d4f7a5a05cc33598b1d5ce596d564b843ca60040358e4ca652d30b8dc3b00e73a3f284578321471cfc12316a80e1d77261598b540a14613100323f11e2bfd1db94d99e7a4cea7c18d82ef0b04eacc956bc032a6c0f3e7c6c0415f9d7ff18a7e72a60c0ec33779b6c4789616c0767294ca898a50ffc7887a4c7376c7d28eb0b74c29b4e399d99fcf91be83c922aabe8065533724c9d82f819bc7a7ebcfe3586b8e2ccde8a0e0ef4fa32e78d1ac90654e70fcb565e81dbe5e51801f501a379e98a74bd31e358950ecd8b5da2232bf90d48c1979d88c429ff77df926be757213796e457064fbff5cb7fee41c32159a9cdaa1176cd406f0823abd8c2b8f83dfb96e5e2474d79e30f726c47746520ff4b3227a636d1d24fc19515a63e8333211aa6bc63961eb810ec4830d16baacd52f96eb3d16adc4128500eda2188d88d9ef0235531455eed0657874b425d6ba68a67e3905ab6f4f729aa9ced5ceb96cd183806a6c3720e907f6c7b226c0fe15219c2ff3320c2e6880ad016dc8bdd911d60ea77d971ed05ca154b0e5ee7d6ebc28b86a66baedca6d39939943bff1d8b39dea87a59fecc6279f9b117b04562db7e952b516a91a364a3b57f9f51324764b4e2c50e0dd2b4a62d19fa665be338e0071edc2725a4a775e9eb0a9e1d01482ed9009e2b17deae69740399203d231b2cb54635aab4a5bc71c1d75d5c27a0e850ad7c39a38c2658d72e8bac7e9fd4f351ad427faafebf7beed212a2fae3cc0c811cb54c468d9aacc303567a5ab03d8c00007c80085b5d39285bb161d8db8de11ec6dce9eab7b7dadd892a4f25e3382a4fe72ce2b309d02ceeadb8daa6e28f4baf8535e7dbb888005651bb5f434ec32b45042363bc424dc3b3441fcc12cef6779ca4032835a225a4196aa952ed12eebd4712fe385dd933fc4110de767d0f9127e7cd815d613a454c56f3be15526c6af0cddae6a7ff375d283871b8761e1cc63f3ada963c127bcb528f971b50ebe6da93b36c1c0b11b7a677c3a2a5a09f2e9350b509f22a51e9c1f3e11383e703b9053ddb5884e9a5804b51fa06f7fbb2ddb8a2d72bebcced8d80834780cfcc578e0e2d0219b4d120b3587db65809709197a0c9f5f5262b091fbbf15f4767206f85406e2fad15c29407243834872d55f13a42a9745822b317edb26488e8517de1c61d5003776faa94fb2d851b4c914dfafea5f0228ce3c2c795511ea5d1bc2b47ee56f56cafd0670e81ee59d2a6125075e98d475f671eca2020d96b7cc33167fde43aa045ef9d71db070d02e642bab72d0e9ac64be602228d8e1e91e9486765c2bf6cfccd723564edbbf13a44809d5a03ae5800bde612ec4dc2a96cb9b8de34998b2ba891549d956f333eb2da9a67312d77c46cb1135694e582a4ac41d9eeb4ff87047e12418f9896ffc567c67a4d172203d79077b901ff42a34dadcbf4b80eacf84093206c563d377f30e427fcff6e1e8ad572e2e4dfc3def367feaacf526fcc75cf81d013d24d51adc630db4a51053e70ce6f482f4c41d973b68dac37214e9315556e5fba8dcd68bcaa24256045ada481af6dfd80b01336ba5405b3a6f810eccff2f79e640b8ec1871140f0b773b70f13fad81121fb16f4a92db25d29206c00b3768e47dbe827257e5901c62e2509438ac6596722d9882893e2ea8b1191e09a6638eaae77c8b52c5eba0c3fa2230e48510a1b810259101d75bc488bffdfe1a9c6da9e05e149ce2e9b865db0d884f1028f03c84d947cd33895d8581c83ec55431b340b7fb04cb36d187fe6bc204f6bc390aeec4c949ff0d3db4c1c5b85909f838cf3a56b5d610036a0cc851f836ad72b73377b6eb6a869b802d1c07c424dea55f91e88defff0f07a856a2ba15070f19d5fc5858ac33e233713a1a8445e3255bf43aea9c7cc18f1c225c4b194a333d42c4bb72c994a877b5ae840f1a4f52c9d3bb3afb187b251d1c68f380a5dbd1689a78d98e7edc49014ad7c79708758d8e23c5082298627e38f1e19e1623a8b7e12a6435deae6698f0015d8e2e1e918ab06d060dacad0d6cc6d835619fe361d5e8cde40565b76913a904b7e7c60ddfcce6afc9e4676ca526a68920bcf8fee9d5055ca360d390524ac6aee07060220e13f82d53d3048b7eb0657db4597bf9ad73b1963dee280f181d3d9428baa692e2486112a308c7c5e81f98dacc516909df9df934edc8db18b7d49afc2e00c863dfeb70362571bc9cf0c4c179df7b4ab5ae4737a611966cf9c3593d6731e31ac048f046f78a2ded8c71a5bd422fc7b68239175555896d42563c8cc5b950fd28fa54db2e0cc6cded799f087befa8acd68eea3644b2711259296667530c42e8ee3dab02ce2fe770e68fbbf12e1c274ad54bbd95d16530abfca59d268bd02d5a78d9a5bd91127fcb2bca57436f7bcbffc08422ec54f887fcdd84a81ea0228d75bcca42f2d4b5bd138f5c0821ffb185cbe6c1750b3de7ef6775898c6695e11bfbe2db80e0a500841c45514ee4bd2e84809cd3046eb820c9c96976a90732eebbd3023d02cb7d67f9cc891f8ba3700", 0xf26}], 0x2) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000040)={&(0x7f0000ffa000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000380)=0x40) 6m25.761019208s ago: executing program 3 (id=1436): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r4) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_PROBE_MESH_LINK(r4, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={&(0x7f00000000c0)={0x44, r5, 0x1, 0x70bd2d, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_FRAME={0x1c, 0x33, @data_frame={@a_msdu=@type10={{0x0, 0x2, 0x4}, {0xe9}, @initial, @device_a, @initial, {0x1, 0x1}}}}]}, 0x44}}, 0x10804) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000200)={0x1a4, r5, 0x8, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x9, 0x30}}}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x14, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0x8, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_FCSFAIL={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0x20, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "7440651f47d881d005816ad793df37a239005975596204ec"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @broadcast}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @broadcast}], @mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x18, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}]}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "9c5a152b70f0b0ccd37f1c7b9c247e1b54b80d4f72258fd1"}, @NL80211_ATTR_MNTR_FLAGS={0xc, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}]}], @mon_options=[@NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MNTR_FLAGS={0x28, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}]}], @NL80211_ATTR_MESH_ID={0xa}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "d93002176a618a060bb8d5f48a230e98e6b906d8a43e0ec2"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "cabd0666f121ff4c29770fe7d80f5f1757d364a7d1aa71e3"}, @NL80211_ATTR_MNTR_FLAGS={0x14, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}]}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}], @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x1}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}]}, 0x1a4}, 0x1, 0x0, 0x0, 0x40011}, 0x1) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_9p2000}]}}) write$P9_RVERSION(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r1, @ANYRES64=r0], 0x15) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000180)) (async) pipe2$9p(&(0x7f00000001c0), 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r4) (async) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) (async) sendmsg$NL80211_CMD_PROBE_MESH_LINK(r4, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={&(0x7f00000000c0)={0x44, r5, 0x1, 0x70bd2d, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_FRAME={0x1c, 0x33, @data_frame={@a_msdu=@type10={{0x0, 0x2, 0x4}, {0xe9}, @initial, @device_a, @initial, {0x1, 0x1}}}}]}, 0x44}}, 0x10804) (async) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000200)={0x1a4, r5, 0x8, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x9, 0x30}}}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x14, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0x8, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_FCSFAIL={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0x20, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "7440651f47d881d005816ad793df37a239005975596204ec"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @broadcast}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @broadcast}], @mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x18, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}]}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "9c5a152b70f0b0ccd37f1c7b9c247e1b54b80d4f72258fd1"}, @NL80211_ATTR_MNTR_FLAGS={0xc, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}]}], @mon_options=[@NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MNTR_FLAGS={0x28, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}]}], @NL80211_ATTR_MESH_ID={0xa}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "d93002176a618a060bb8d5f48a230e98e6b906d8a43e0ec2"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "cabd0666f121ff4c29770fe7d80f5f1757d364a7d1aa71e3"}, @NL80211_ATTR_MNTR_FLAGS={0x14, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}]}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}], @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x1}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}]}, 0x1a4}, 0x1, 0x0, 0x0, 0x40011}, 0x1) (async) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_9p2000}]}}) (async) write$P9_RVERSION(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r1, @ANYRES64=r0], 0x15) (async) 6m10.648188334s ago: executing program 33 (id=1436): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r4) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_PROBE_MESH_LINK(r4, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={&(0x7f00000000c0)={0x44, r5, 0x1, 0x70bd2d, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_FRAME={0x1c, 0x33, @data_frame={@a_msdu=@type10={{0x0, 0x2, 0x4}, {0xe9}, @initial, @device_a, @initial, {0x1, 0x1}}}}]}, 0x44}}, 0x10804) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000200)={0x1a4, r5, 0x8, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x9, 0x30}}}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x14, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0x8, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_FCSFAIL={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0x20, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "7440651f47d881d005816ad793df37a239005975596204ec"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @broadcast}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @broadcast}], @mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x18, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}]}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "9c5a152b70f0b0ccd37f1c7b9c247e1b54b80d4f72258fd1"}, @NL80211_ATTR_MNTR_FLAGS={0xc, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}]}], @mon_options=[@NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MNTR_FLAGS={0x28, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}]}], @NL80211_ATTR_MESH_ID={0xa}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "d93002176a618a060bb8d5f48a230e98e6b906d8a43e0ec2"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "cabd0666f121ff4c29770fe7d80f5f1757d364a7d1aa71e3"}, @NL80211_ATTR_MNTR_FLAGS={0x14, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}]}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}], @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x1}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}]}, 0x1a4}, 0x1, 0x0, 0x0, 0x40011}, 0x1) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_9p2000}]}}) write$P9_RVERSION(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r1, @ANYRES64=r0], 0x15) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000180)) (async) pipe2$9p(&(0x7f00000001c0), 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r4) (async) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) (async) sendmsg$NL80211_CMD_PROBE_MESH_LINK(r4, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={&(0x7f00000000c0)={0x44, r5, 0x1, 0x70bd2d, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_FRAME={0x1c, 0x33, @data_frame={@a_msdu=@type10={{0x0, 0x2, 0x4}, {0xe9}, @initial, @device_a, @initial, {0x1, 0x1}}}}]}, 0x44}}, 0x10804) (async) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000200)={0x1a4, r5, 0x8, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x9, 0x30}}}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x14, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0x8, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_FCSFAIL={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0x20, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "7440651f47d881d005816ad793df37a239005975596204ec"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @broadcast}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @broadcast}], @mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x18, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}]}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "9c5a152b70f0b0ccd37f1c7b9c247e1b54b80d4f72258fd1"}, @NL80211_ATTR_MNTR_FLAGS={0xc, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}]}], @mon_options=[@NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MNTR_FLAGS={0x28, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}]}], @NL80211_ATTR_MESH_ID={0xa}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "d93002176a618a060bb8d5f48a230e98e6b906d8a43e0ec2"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "cabd0666f121ff4c29770fe7d80f5f1757d364a7d1aa71e3"}, @NL80211_ATTR_MNTR_FLAGS={0x14, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}]}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}], @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x1}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}]}, 0x1a4}, 0x1, 0x0, 0x0, 0x40011}, 0x1) (async) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_9p2000}]}}) (async) write$P9_RVERSION(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff", @ANYRES16=r1, @ANYRES64=r0], 0x15) (async) 2m25.500184723s ago: executing program 2 (id=3473): r0 = getpid() process_vm_readv(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 2m25.231371657s ago: executing program 2 (id=3479): r0 = semget$private(0x0, 0x6, 0x0) semtimedop(r0, &(0x7f0000000140)=[{0x4, 0xf7ff, 0x1000}], 0x1, 0x0) semctl$SETALL(r0, 0x0, 0x11, &(0x7f0000000300)) 2m24.24697792s ago: executing program 2 (id=3503): mkdir(&(0x7f0000000040)='./file0\x00', 0xa4) mount$cgroup2(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000002c0), 0x2000000, 0x0) statfs(&(0x7f00000001c0)='./file0/file0\x00', &(0x7f0000000200)=""/128) 2m24.217355208s ago: executing program 2 (id=3505): r0 = syz_clone(0x2000, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$getregset(0x4204, r0, 0x2, &(0x7f00000000c0)={0x0}) 2m24.030877329s ago: executing program 2 (id=3509): r0 = syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) setuid(0xee00) tkill(r0, 0x12) 2m23.933640707s ago: executing program 2 (id=3511): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f00000026c0)='./file0\x00', &(0x7f0000002700)='mqueue\x00', 0x2, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x100419, 0x0) mount$9p_unix(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x10101d, 0x0) mount$cgroup(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040), 0xc, &(0x7f0000000100)={[{@subsystem='devices'}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x0) 2m21.641074054s ago: executing program 0 (id=3538): r0 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @multicast2}, 0x10) 2m21.546644966s ago: executing program 0 (id=3541): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$setregs(0xd, r0, 0x3, &(0x7f0000001380)="b90811038928bd51187872fe4ca7c19ca07a2469cd9c74aca3ba9a890746082deec0e8b7dab32616d91e5d78fa5add0dbff3e40052fa43141942e5a64d4b9e6249628da25e716ae98c22cc6e0698b47d7dee59f867756b8572075b1a1e0465c81ac96c988e6435d25305f0c4f26e6ea5388e6b56e55a62af3ad7df57970ad289820208adff5118b6cf10a8a8103d6d30c021a6e2e65ab9da5dae1c77669f2ff121c4fc27ddaa6a4d452eb5df807d1942fffc426e33b727a65f0665b9a56973e3d8") 2m21.354917761s ago: executing program 0 (id=3544): syz_clone(0xb44040, 0x0, 0x0, 0x0, 0x0, 0x0) setitimer(0x2, &(0x7f0000000040)={{0x0, 0xea60}, {0x0, 0x2710}}, 0x0) 2m21.018839833s ago: executing program 0 (id=3552): r0 = socket$inet_udp(0x2, 0x2, 0x0) fadvise64(r0, 0x100, 0x7, 0x6) 2m20.973615944s ago: executing program 0 (id=3555): r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/if_inet6\x00') read$FUSE(r0, 0x0, 0x0) 2m20.843550529s ago: executing program 0 (id=3558): r0 = syz_open_procfs(0x0, &(0x7f0000000000)='cgroup\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$cgroup(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f00000001c0), 0xc, &(0x7f0000000100)={[{@subsystem='devices'}]}) read$FUSE(r0, 0x0, 0x0) 2m8.849682849s ago: executing program 34 (id=3511): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f00000026c0)='./file0\x00', &(0x7f0000002700)='mqueue\x00', 0x2, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x100419, 0x0) mount$9p_unix(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x10101d, 0x0) mount$cgroup(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040), 0xc, &(0x7f0000000100)={[{@subsystem='devices'}]}) umount2(&(0x7f0000000040)='./file0\x00', 0x0) 2m5.5775894s ago: executing program 35 (id=3558): r0 = syz_open_procfs(0x0, &(0x7f0000000000)='cgroup\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$cgroup(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f00000001c0), 0xc, &(0x7f0000000100)={[{@subsystem='devices'}]}) read$FUSE(r0, 0x0, 0x0) 1m2.957721522s ago: executing program 7 (id=4117): r0 = socket$kcm(0x21, 0x2, 0xa) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x5452, &(0x7f0000000300)) sendmsg$kcm(r0, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x4e24, @empty}}, 0x80, 0x0, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000100100000e000000000000000000000010"], 0x28}, 0x4044454) 1m2.795187495s ago: executing program 7 (id=4120): r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_open_dev$vim2m(&(0x7f0000000140), 0x3, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000a80), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_generic(0x10, 0x3, 0x10) fsopen(&(0x7f0000000280)='hfs\x00', 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) socket$inet_udp(0x2, 0x2, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000009a40)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000030000000a20000000000a01010000000000000000010000040900010073797a30000000002c000000030a01080000000000000000010000000900030073797a32000000000900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a30000000002800048024000180090001006d6574610000000014000280080001400000001208000240000000", @ANYRES16=r2], 0xc4}}, 0x0) 1m1.998855629s ago: executing program 7 (id=4126): r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000100)=0x2c0000) ioctl$SG_IO(r0, 0x2285, &(0x7f00000005c0)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x20000, 0x0}, &(0x7f0000000240)="948d7acda0b2", 0x0, 0x0, 0xfffffffc, 0x0, 0x0}) 1m1.873914483s ago: executing program 7 (id=4127): mkdir(&(0x7f0000000400)='./file0\x00', 0x0) (async) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000400)='qnx4\x00', 0x2800000, 0x0) r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f0000000040)='mountinfo\x00') capset(0x0, 0x0) (async) capset(0x0, 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) (async) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f0000000140)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b1052, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) r2 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) syz_usb_disconnect(r2) (async) syz_usb_disconnect(r2) r3 = syz_usb_connect(0x0, 0x58, &(0x7f0000000080)=ANY=[], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) (async) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000002280)={0x84, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lseek(r1, 0x10001, 0x0) (async) lseek(r1, 0x10001, 0x0) 1m0.698651577s ago: executing program 7 (id=4137): landlock_create_ruleset(&(0x7f00000001c0)={0xa019, 0x1, 0x3}, 0x18, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'netdevsim0\x00', 0x0}) sendmsg$nl_xfrm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="5c0100001000130700000000ffdbdf25fc0100feffffffffffffff0000000000ff0200000000000000000000000000010004fffe4e2100020000000021000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="fe800000000100000000000000000037000004d232000000fc020000000000000000000000000000050000000000000000000000000000000000000000000000090000000000000001000000ffffffff0000000000000000030000800000000043050000000000000400000000000000ffffffffffffff7f000100000000000001000000000000000000000000000000000000002cbd70000535004002000400500000000000000060001200726663343130362867636d2861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000080000000210466d38547aa140db9a200000000c538c7cb7a0c001c00", @ANYRES32=r3, @ANYRES16=r0], 0x15c}, 0x1, 0x0, 0x0, 0x880}, 0x2014) 59.52680812s ago: executing program 7 (id=4149): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="14000000100001000000000000fff5000000000a80000000060a0b0400000000000000000200fffe540004802800018007000100637400001c0002800800014000000002080002400000001005000300010000002800018007000100637400001c0002800800024000000011080004400000000c05000300010000000900010073797a30000000000900020073797a320000000014000000110001"], 0xa8}, 0x1, 0x0, 0x0, 0x840}, 0x2000c0c2) 59.073905299s ago: executing program 36 (id=4149): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="14000000100001000000000000fff5000000000a80000000060a0b0400000000000000000200fffe540004802800018007000100637400001c0002800800014000000002080002400000001005000300010000002800018007000100637400001c0002800800024000000011080004400000000c05000300010000000900010073797a30000000000900020073797a320000000014000000110001"], 0xa8}, 0x1, 0x0, 0x0, 0x840}, 0x2000c0c2) 29.683028477s ago: executing program 6 (id=4346): landlock_create_ruleset(&(0x7f00000001c0)={0xa019, 0x1, 0x3}, 0x18, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'netdevsim0\x00', 0x0}) sendmsg$nl_xfrm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="5c0100001000130700000000ffdbdf25fc010000140000000000000000000000ff0200000000000000000000000000010004fffe4e2100020000000021000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="fe800000000100000000000000000037000004d232000000fc020000000000000000000000000000050000000000000000000000000000000000000000000000090000000000000001000000ffffffff0000000000000000030000800000000043050000000000000400000000000000ffffffffffffff7f000100000000000001000000000000000000000000000000000000002cbd70000535004002000400500000000000000060001200726663343130362867636d2861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000080000000210466d38547aa140db9a200000000c538c7cb7a0c001c00", @ANYRES32=r3, @ANYRES16=r0], 0x15c}, 0x1, 0x0, 0x0, 0x880}, 0x2014) 29.581345127s ago: executing program 6 (id=4348): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="1400000010000100000000000000f5000000000a80000000060a0b0400000000000000000200fffe540004802800018007000100637400001c0002800800014000000002080002400000001005000300010000002800018007000100637400001c0002800800024000000011080004400000000c05000300010000000900010073797a30000000000900020073797a320000000014000000110001"], 0xa8}, 0x1, 0x0, 0x0, 0x840}, 0x2000c0c2) 29.382674131s ago: executing program 6 (id=4351): socket$kcm(0xa, 0x3, 0x87) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) pselect6(0x40, &(0x7f0000000040)={0x3, 0x7ffffffffffffffc, 0xffffffffffffffff, 0x4, 0x3, 0x1007, 0x2, 0x4}, 0x0, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd120000000000140000006000000003088700fe88a43de1a400400000000000007d01ff020000000000000000000000000001"], 0xfdef) 28.362759836s ago: executing program 6 (id=4365): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000006c0)=ANY=[@ANYBLOB="1201000000000040c41090ea80000000000109022400010000000009040000010300000009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000001f80)={{0x12, 0x1, 0x250, 0xf8, 0xf0, 0x21, 0x10, 0x1608, 0x201, 0x4682, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x9, 0xe, 0x20, 0x2, "", [{{0x9, 0x4, 0x30, 0x9, 0x1, 0xff, 0x25, 0x77, 0x3, [], [{{0x9, 0x5, 0xa, 0x2, 0x10, 0x7, 0xa, 0x4}}]}}]}}]}}, &(0x7f0000002e40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f00000000c0)={0x2c, &(0x7f0000000100)={0x0, 0x0, 0x8, {0x8, 0x0, "392cdaab4a73"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000000)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x20, 0x1, 0x3, "c282fe"}, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000b40)={0x84, &(0x7f0000000840)={0x20, 0x16, 0xe, "cc63970e5c6720e95af8d0076b38"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, &(0x7f00000009c0)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x20, 0x29, 0xf, {0xf, 0x29, 0xd, 0xc92557b0ce253e8d, 0x4, 0x0, "c439e465", "fb1ff24a"}}, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000380)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_usb_connect(0x3, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) syz_usb_control_io$cdc_ncm(r1, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_ep_write$ath9k_ep1(r1, 0x82, 0xec4, &(0x7f0000002c80)={[{0xec0, 0x4e00, "72084a9a1e42ce850d0793b47d5a41ee7426a8014d2f4174b89a5a972534f9c1ae624b83d202241822444c482b9b90157009dcd091fec399ec509c9ad8a213b92ef10cdb170da93e82dace1ce7eab63092d9e693f36e853f2410886df1bf5cdbd806d2e51d738e673feff662d04d6e1603fda3655ef59976ad034b44d04d5d8937387411787618b2c6e5fc30df08f77dfb21646c580b1c1e9ae58503171210426269c5641aa2ad9df41279fef5816e6eb5258d4258f99219efedb3fa0c749b0b2dc9ddf508d9546aef58cf67e443a7ac2ea5ae15e32cd5d55f13ec0f1e0b562031aadf70e144d353b5c4d145da477db016b2ff9c57c8f477db954251346ad8293c66ffab4ae20c45a9b1c1b69ffd8163fcd7755f185237e22610708cf0b300ec757eeb847bab93128790bfa6f8b961913dbcdce766368d35d849c4bb60b300034224f2428cc05ff6e57cfdace9aceab45bc25607b7aed52d96df5de4aeab979891b7ff7e4b5cbb18e9300df0acc8c579ec0af721bbd4d5aaa4ef3f1cb2e67b8dbc1f988c79b019fbbffb765b3ed63665fddf47c258450e57217da1bdb3d5aec91ea4a0b5dc9bc4014dfc77ab8b587e2ab3e51e6ebc1ddee2631dd5d1beda9779a83abea4d299e2dcab5d9ea981d0cee814d75d317bdcec66cdafab25c15bc14523ed15a4e2cf816d965b208b2cd2f1d12f478da7dffea10a41dfb37dd208eac09606191ca90ebc127c9e297e120fab73b32d821391c033a4ea03e1caf1292cc44a88384d9ddaf75d516ed42ba75204ee616a70ca570af23875bbbef35e5dd7a5ab04941a49783139357d28b692525dd587653d6e3535a85fb28938f0bb46855dbda55c74498533e2342a93da3eef9a0cbe39b84dae8dd173b343c83224a58973db388ec924dfedf8eef0386bb843fceb9699ef2a8a3c49064b5c964ffd518f65560abb5fcf01839132f09989a76a0640a20437932462dae911d66a686ae733573186ca3ce24a841ed25980a61f2cf19a764ba01c996b108fe0f7a26ff6df59052189e8d5a8948fb34bcadf8b2db8d9bd67875a6eb0feed1b521b5f389d3c14543af4aba8498d9c951cbadda8ff4177a0e6244972153c28acff2f9836f3ad1ad93c91238bece62b22fcb96bc50e98d55a6af89e1c7a72af56703d7df236fd73369940da520e2a5da8fd4601983adc0dee57aba0ebe23df00ccf77cf5c216b7b993b87118750417b5211743fd7ee3daa8235330574c781685af3a4b6848e3fdc0f8aa9be34f841a0580473e9c1ec8636c730b81ff400b114c541b3ab981fb8473e0f89dc7cebe9332e8348087ffbe806ea27ad11720da42f19708fd547343f0398f7a28383f0df7bc3191ec616313061206129a78610b8f4290e1275328d9ab9aeb90fd71accb367cf8b5653e1452d4457e5684b401bb7ebb130ed879361db82f761073d370975ff3b18cac7ea901c67c83a596368c52870ffb3f28c9c8396ba1fdba4c81b0cf819d40a9dd91a06c1962fb09ac29e67d94df9d2a8df2d21cfddf8487f9d80ebfbe046b291c8aac528cfa27d27e7ba50b0349f87b0c4d4a1259ca4f471c84afa9f4f6dabf9f5e16bcdde2fc7be9aa24884e56656f23f30011a01f40a6d80a24ebedeb9c8c7d05dd7922e3d7afa74153eeb7a1514c266481ec32be2ccc4d2686d31ea4a43696a3eeb7c8dcfa34df711b29449e5b8bb39c4c68145c39083225bf841876344036a1337ce4bc1d1b0f03110c1532e07e251eabbbba43c58f0f2cb65feb0e319467e2e7689855047a93a625616b9b32b21a55033d5929a61a1c81a429e481ea1ca762efd671c25fb999b6299e45e1111833332d2c473994f059546b34a4642583399abc87430306a7cc161871c87f9cbad0ccff960c7b8b998706a33f78d99c3b2340ce6fa8d4580a3ee4d7ed917336111c966e7d97d099729cf3147ec46515a6559c31518c583c83de3de86224b4f9c432fe98f85a61bc1ea49878973a7e220c2b74ec9d6756ceda88afa15fe154ff746b9075b4ac9c87e544d83409c94775c155ba1242bb1828d6cb0b4a65e3ebac112c58ca96715c856b4d548522de75a5af793280170037bf695f8e9dd619b7b08fb88f85313ded66b90e5e973b11a57a1f1a33d70f183d4f477e5f27d79c4f197c5df9de6bec795d92325254c89443cfb34a0a1383ac0b9487313d6bf71b8b8ad7711aa6e00ff14c87f1c8b4214a87830d799656233e4d5c2f78ba6fea8735455ce6626458223ea4042968d15eeec13501e8e52fc3db7ac2105d98b221ea8be864a4595e868f2ee4cbedaf7c37d1430fe29fc5a824fa2b763fb919559b8ecf944e601dc59cf37a1289159efd69ff656ed755d36aa25b556b58389b161d66c798bffefd91da6cebeeb8a2875f6f544c8e1c0f17f2f2bed46ef660f9d34753c1b2720eafcc6c1cfa6f356b6aa53f5cbe9b3b7f331598896dc86f1571dcd38933e4c9a28944203650ee8773747a8bb1b6442d9595f8b815058d1e0a623d4eec62e1a0839c1019bd44f99c6e0522368c3075b0104ca19738d6ae2d134d7ba956ffcf835f966227efd503d6ace0b1747d5fcbc188a4879b9c2d1c5b8b12d4c9542af5a81c2552006703cc5b4c2f0a4ae8b8d9bd3fcddafcbd26a947aa5eca3cea11834f66fc2278fd8194de9201b296a3c4a88fc7942fd048eed87e72073db218f26b3315bce1ef6e8f1bcf84144df9ffa442cdd92ca518a00a21deaf3e10c5d99c203fa45579671de6eef25eebca8ee6f302bbf0bd5d4abeb4f61dad8a74f0e29a6daaa26d858ad358470be97578a7ac6968180e4ff148c4598e4d6343dcc9f45672de2a082b700a457c7d079e191741ab40004e8f16bb86f52b772724d45bd0b12aafce0b4a95449cead1e63e6c06865234476a95dedb31d62bb4a7b86b061228519208eae312f3ce31fb7198605a1f0c9f48c5efad726f9f4e53653ab6cb3c2def74411dd5b57902e62aaa125de67ede4a0febe3247a4db64b4aba7406a689f23527a70e39b7761ac8db9a0f176e80b9d4dd597a8fce749208c61c0df8de223eac199a7e743fc19566da4736287839abffd4d97bd0202ccabe8489f3fed52f450139303d84c747541e4b37708cff870e9e1924c42944d1eff73c8b011db50acf67b7155f33ec699380d3bd19b25633e27cfd605a927fb64987f0254f00f77740a7c825d3dcf4b2d6d293ec50adcc3f532dd8a184ba86c5659db5081dab7feeea6b3f0de06983a765bdde0e869438a86ecd29b7b10e0979b3934bcbc975cfc848d432f72701fbd5910b872f4cf7c7b4bd53d0d52e836c80bc3d477d5e7bf98e03c641d21a0fd3c34e26c1d7dfb67881704b750a39d5facb0610e08ce7613a59608eddac0c0ce1bf3752b94fdcba82e70fa2557458a5728e2437dc2915a86e5e503d3463bba26f937878b5a6dd72662dfdf034be221a106cede0f1ed2c0f8ca33f541c0a2b7c4723f9260ab3843ed79df90231070b3a31fdf09bb8aa01bd77111a5df505473d16d666ce893e3da7b189a35f3f4b452f8ccb421202eaeadbdb48af2592aa523a010ed2191c14733900abba1e80f4dafc8d0ee4b571d1fd1687585f92d23e2aebd86da467fca0d29c9272e1a66bfc6b2b18489d735b58738776c316097f874d4bd151c0cf8cc1447122292050e272f87fc64553ee7ecafc16ec1e378b7dd9009e8da20d3934e58665cda4de0414c0e8c596d8eeb55de6bc3b9729ac20198054df2a97b5d8072ef8fde78c8db7e9738ad73eb7dafbfa71aae2dcab38a1bb30576b9930b01fb974996fc76afd98f314013e020ee1dbdde06da8be841d62315293e7932343088b043b127e5afd4f300f2e95b9fd7f33d07eba2ac8d9c320b94f30b2a05cc6dc25c7b1703e20f5e7a77f8505b1a8df3cea97270bd9e035bce9bdcf74f112321c69390363157748740f0e8a7266cbbd66930003486845acf34ece79a243d11d3fecf26efcad85f678b796576fcdc854d0e30dbe979761ea98bbbb305784bbc97130751ac9bb69301369ca29bd022ae9c0e4cbc23be862d0f886c65fed32ad27f7cacf68c8464f4c103d02938753f34fc23152810644a8000d11f52a6c6cfc86ccb3e47ae4e405f6c5d7da8e6e58ee2b01a3c0a4b8b63060c0af107576acdfc3522b376962a789ff0976d9c3c3ec557e078d07f082fdcb314f6b0d23e4f14035a3b3ada6d62a2edf827c7b289ea2a93433957265656bdee9caeb3c0c0044f1402883bd394d11c87c189501e4a330c49492f54b702fde9e6e2a5b6321f4a92a1184e3b8099d39c7d06a7b1bd7efd1df0323f98538801654cb548e3a8ac1966fe1b81a274edad65157ddfa49f8bb90346cd5d9febfd60db7e3fb8e0ed36e363496ee1f20b570114ab119e400dacd12c6cddc5c1b50e6126a9ec2cdcc042abbd433f5d567f4c2d7a27161ed61b2ecec1752a9c9c7e5e020a5d21e4e57fe6bf5085b4c6313ef2379265e6c097d1032b50a7fe225276bf1a7fa0f765d15265fb019ada7c2e831c6e1e691434397904bbc00be422d175e4580ef157ce277784175f98eb2ed136dbe27cbdf560053d2babde005839a6fe94e0fc64ef902d15a432668714b528e605cf1e986c33e66133ac82ffd4aaa2e9005e84a6a3758fc6d8dd3f0e44e178eab479adc37514e6c9124039b05ff754150c821473a11bd1ef36b1324e78e283497b6eb03940b53acc044bf15a3b236d45207a49982012d2afca9085700929d8b6efdf6f3af8b6b0304851715617185363c8f5046f7aad7b375dbdf54d327156f8e766d6aee9dd1483e7ae6793ad705d8a05d188495c020670406be09474f9c38b48376172e99b495c7bc3459d94e4a21ab868563cf1a1739c4a4ee7e8ba0573ff1275ae80d794086d2288a99ea927385242a39c2ef2809a384c2e8d3f8890185efa494dcff428f860ecc34b5bbc0057e19b26627d8e14b2ac04fb744acb9680554cd44069c26c3913fb321516a250c0737269d52ba25e3b3ecc00a9b8218820391479fe753e1111cb059e3520871560801a902dc1ba26e62418274393ec9ad2c277ae700d9a69ce5ada60447587cf09daa0395c4de7f375fbd15360f4e276f602163d020b2270311ce3d7d9cfa05de0dbb4d8c651e0aee9d07bdbf38aa45398ed3664730b162b6af9357aad278dcbc5def94cb38bf6cc85c09d4ead82154fe44a376be6062800a2912944b2adf213e4c0eb24b5a12ac9888040de0cb47e86eff91bcc1467da31af1f6e76bbc5ae7cbb8261381e9aacb3544a19e0cbe9fbffa68580bccbb24dc89cc8060ea4b7dc240f776105a66fb4d9a7de203c49ff21"}]}) 27.717589515s ago: executing program 6 (id=4373): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x200a}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f00000006c0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x700, 0x0, 0x0}, 0x1800}], 0xf0, 0x1000000000000, 0x0}) 27.526685268s ago: executing program 6 (id=4374): r0 = socket$kcm(0x10, 0x2, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_procfs(0x0, &(0x7f0000004600)='map_files\x00') (async) mount$cgroup(0x0, &(0x7f00000000c0)='.\x00', &(0x7f0000000100), 0x8, &(0x7f0000000c00)={[{@release_agent={'release_agent', 0x3d, './file0'}}]}) fchdir(r2) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) (async) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) socket(0x10, 0x3, 0x0) getsockopt$inet6_buf(r4, 0x29, 0x3d, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, 0x0) (async) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x2e, 0x24, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0xdf3}}}, &(0x7f0000000300)=0x0) (async) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000480)={0x0, 0x2, 0x1000, 0xfffffffe, 0x238, 0x0, r7}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4704, 0x4000, 0x1000000, 0x2033f, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffffff, 0x2000, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xcd51, 0x400}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2, 0x8000, 0x2, 0xdfffffff}}], 0x1, 0x0, 0x0) (async) sendmmsg$unix(r1, &(0x7f0000002d80)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000080)=@abs={0x1, 0x30, 0x4e36}, 0x6e, 0x0}}], 0x2, 0x40008004) (async) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000980)=ANY=[@ANYBLOB="fc00000019000100000000000000400000000000000000000000000000000000ff02000000000000000000000000000100000008fffd00000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000000001000000000000001c07000000000000ffffffffffffffff000000000000000002000000000000000000000000000000000a0000000000000000000000804000020000000000000800000000000000000000000000000000440005000a010101000000000000000000000000000000003c000000000000007f0000010000000000000000000000000200000004"], 0xfc}, 0x1, 0x0, 0x0, 0x80}, 0x0) (async) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000006c0)=ANY=[@ANYBLOB="a0000000210001000000000000000000fc020000000000000000000000000001fe80000000000000000000000000003a00000000000000000a0000a02e000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000500011000a0101010000000000000000000000007f000001000000000000000000000000fc020000000000000000000000000001000000000000000000000000000000013c040000000000000a"], 0xa0}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001340)=[{&(0x7f0000000080)="2e00000010008188040f46ecdb4cb9cca7480ef431000000e3bd6efb010509000b000a000d000000ba8000001201", 0x2e}], 0x1, 0x0, 0x0, 0xc9e}, 0x8000) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f0000000100)) 12.516049087s ago: executing program 37 (id=4374): r0 = socket$kcm(0x10, 0x2, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_procfs(0x0, &(0x7f0000004600)='map_files\x00') (async) mount$cgroup(0x0, &(0x7f00000000c0)='.\x00', &(0x7f0000000100), 0x8, &(0x7f0000000c00)={[{@release_agent={'release_agent', 0x3d, './file0'}}]}) fchdir(r2) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) (async) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) socket(0x10, 0x3, 0x0) getsockopt$inet6_buf(r4, 0x29, 0x3d, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, 0x0) (async) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x2e, 0x24, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0xdf3}}}, &(0x7f0000000300)=0x0) (async) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000480)={0x0, 0x2, 0x1000, 0xfffffffe, 0x238, 0x0, r7}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4704, 0x4000, 0x1000000, 0x2033f, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffffff, 0x2000, 0x0, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xcd51, 0x400}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2, 0x8000, 0x2, 0xdfffffff}}], 0x1, 0x0, 0x0) (async) sendmmsg$unix(r1, &(0x7f0000002d80)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000080)=@abs={0x1, 0x30, 0x4e36}, 0x6e, 0x0}}], 0x2, 0x40008004) (async) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000980)=ANY=[@ANYBLOB="fc00000019000100000000000000400000000000000000000000000000000000ff02000000000000000000000000000100000008fffd00000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000000001000000000000001c07000000000000ffffffffffffffff000000000000000002000000000000000000000000000000000a0000000000000000000000804000020000000000000800000000000000000000000000000000440005000a010101000000000000000000000000000000003c000000000000007f0000010000000000000000000000000200000004"], 0xfc}, 0x1, 0x0, 0x0, 0x80}, 0x0) (async) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000006c0)=ANY=[@ANYBLOB="a0000000210001000000000000000000fc020000000000000000000000000001fe80000000000000000000000000003a00000000000000000a0000a02e000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000500011000a0101010000000000000000000000007f000001000000000000000000000000fc020000000000000000000000000001000000000000000000000000000000013c040000000000000a"], 0xa0}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001340)=[{&(0x7f0000000080)="2e00000010008188040f46ecdb4cb9cca7480ef431000000e3bd6efb010509000b000a000d000000ba8000001201", 0x2e}], 0x1, 0x0, 0x0, 0xc9e}, 0x8000) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f0000000100)) 3.420402374s ago: executing program 8 (id=4558): setsockopt$nfc_llcp_NFC_LLCP_RW(0xffffffffffffffff, 0x118, 0x0, 0x0, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$video(&(0x7f0000000080), 0x7, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$VIDIOC_ENUMINPUT(r0, 0xc050561a, &(0x7f00000000c0)={0x3, "a8df7802997c0f0f26a793d1c000000000000000000005000000fdfd00", 0x2, 0x5, 0x1, 0x3200e0, 0x4000000, 0x2}) 3.206825663s ago: executing program 8 (id=4560): syz_usb_connect(0x3, 0x2d, &(0x7f00000004c0)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x8, 0x32, 0xffffffffffffffff, 0x0) ioctl$AUTOFS_IOC_READY(0xffffffffffffffff, 0x9360, 0x7) r0 = socket$kcm(0x1e, 0x5, 0x0) sendmsg$kcm(r0, &(0x7f0000000540)={&(0x7f0000000280)=@tipc=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000300)="80", 0xfdef}], 0x1}, 0x0) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000080), 0x401, 0xa101) ioctl$BLKFLSBUF(r1, 0x1261, 0x0) 2.478682335s ago: executing program 5 (id=4561): r0 = syz_open_dev$sg(&(0x7f0000001940), 0x0, 0x0) timer_create(0x8, &(0x7f00000002c0)={0x0, 0x21}, &(0x7f0000000000)) timer_settime(0x0, 0x0, &(0x7f0000000200)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000040)={0x53, 0xfffffffffffffffb, 0x6, 0x4, @scatter={0x0, 0x0, 0x0}, &(0x7f00000000c0)="a109a81b133d", 0x0, 0x0, 0x10012, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000}) 2.325577884s ago: executing program 4 (id=4562): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e22, 0x2, @empty, 0x5}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000540), 0x3c) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000000)=@gcm_256={{0x304}, '\x00', "e8582491a0c4050000000000f6542a9b6800000000000000003967d2daa45b4e", "61241765", "9b1f80001b00"}, 0x38) sendmsg$DEVLINK_CMD_TRAP_SET(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x20040000}, 0x8000) sendmsg$inet(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="e4000000008d0000000000000700000094040000865400000003051005c3e45b3e088e6f722b0df22b3c00126eacb1ceb7f260dab33486c73af20b59020788c2fdffc9060c47629611bad4427b49310104076002042a03051106b63d39a9a516678325f283800b5d83237b00000000ac1414aaac1414bbe0000002ffffffff00000000ac14142de0000002890327440c7b302e7dc6a00000000807174bac1414aae00000027f0000017f000001ac1e10018317eaac1e0101ac1414aaffffffff64010101e0000001831b0b640101017f00000164010102ffffffffac1414aae0000001000000000014000000000000001a01000001"], 0x100}, 0x0) 2.074951441s ago: executing program 5 (id=4563): capset(&(0x7f00000006c0)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff, 0x400000}) r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000800)={0x53, 0xfffffffffffffff8, 0x6, 0x0, @scatter={0x0, 0x23000, 0x0}, &(0x7f0000000140)="b65292d1cb70", 0x0, 0x7e4, 0x10011, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfbff}) 2.01038739s ago: executing program 4 (id=4564): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000034709d405f0530c6acb60102030109021200fd000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000700)={0x2c, &(0x7f0000000400)={0x40, 0xd, 0x1, "1d"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000a80)={0x34, &(0x7f0000000940)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000340)={0x2c, &(0x7f0000000380)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000ac0)={0x44, &(0x7f00000007c0)={0x40, 0xe}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000480)={0x44, &(0x7f0000000540)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000900)={0x1c, &(0x7f0000000780)={0x20, 0xe}, 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000840)={0x34, &(0x7f0000000580)={0x40, 0x11}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000500)={0x44, &(0x7f0000000180)={0x20, 0x16}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.926819462s ago: executing program 5 (id=4565): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000080), 0x12) ioctl$AUTOFS_IOC_SETTIMEOUT(r0, 0x80049367, &(0x7f00000000c0)=0xa) r2 = epoll_create1(0x0) r3 = epoll_create1(0x0) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r1, 0xc0189373, &(0x7f0000000100)={{0x1, 0x1, 0x18, r2, {0x8001}}, './file0\x00'}) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r3, 0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f0000000040)={0x20000001}) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r5, 0x0) socket$nl_route(0x10, 0x3, 0x0) quotactl$Q_SYNC(0xffffffff80000100, 0x0, 0x0, 0x22000000) 1.827986305s ago: executing program 8 (id=4566): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001480)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x88, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x38ff}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2f}, @NFTA_SET_EXPRESSIONS={0x44, 0x12, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @quota={{0xa}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_QUOTA_BYTES={0xc, 0x1, 0x1, 0x0, 0x9}]}}}, {0x20, 0x1, 0x0, 0x1, @connlimit={{0xe}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_COUNT={0x8, 0x1, 0x1, 0x0, 0x7ff}]}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x106}]}, @NFT_MSG_NEWSETELEM={0x34, 0xc, 0xa, 0x401, 0x0, 0x0, {0x7, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0xc, 0x3, 0x0, 0x1, [{0x8, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x4}]}]}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x104}}, 0x20050800) 1.446842669s ago: executing program 5 (id=4567): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) r8 = syz_ublk_setup_io_uring(0x2, &(0x7f00000003c0)={0x0, 0xfcf1, 0x800, 0x1, 0x1c5, 0x0, r7}, &(0x7f0000000480), &(0x7f00000004c0), &(0x7f0000000500)) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x767a, 0x0, 0x7ffffffe, 0x257, 0x0, r7}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x100, 0x1000000, 0x10000004, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffffc, 0x2, 0x4, 0x144, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x1, 0x200}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8000, 0x1, 0xffffffff}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1f, {}, 0x0, 0x0, '\x00', {0xfff9, 0x5, 0x0, 0x0}}, 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0x3c, &(0x7f0000000340)={0x1, 0x4}, 0x8) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)={0x18, r9, 0x1, 0x70bd29, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DAEMON={0x4}]}, 0x18}}, 0x20044880) 1.446510025s ago: executing program 8 (id=4568): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000000c0)={0x5c, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x1}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x10}]}]}, 0x5c}}, 0xa00000000000000) 1.322354107s ago: executing program 4 (id=4569): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x200a}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f00000006c0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x1472, 0x0, 0x0}, 0x1800}], 0xf0, 0x1000000000000, 0x0}) 1.312913029s ago: executing program 8 (id=4570): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x42001, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) syz_kvm_setup_cpu$x86(r2, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, 0x0}], 0x1, 0x3, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000003680)=@vmx={0x3, 0x0, 0x2080, {0x3000, 0x3000, {0x3}, 0x0, 0x7}, {"00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200", "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008bc584c800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001f6f38740000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000376400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a4900"}}) 995.146117ms ago: executing program 4 (id=4571): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000600)=@newsa={0x104, 0x10, 0x7, 0x0, 0x0, {{@in6=@mcast2, @in=@multicast2, 0x4e20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x3, 0x1, 0x2, 0x0, 0x10000000, 0x1}, {0x0, 0x200000, 0x7}, {0x40000, 0xfffffffd, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0xfe, 0x34}, [@coaddr={0x14, 0xe, @in6=@remote}]}, 0x104}, 0x1, 0x0, 0x0, 0x41}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000740)=ANY=[@ANYBLOB="040100001a0007002abd700000000000fe80000000000000000000000000001be0000001000000000000000000000000000300004e2200000000000002000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff0100000000000000c0c00000000001000000002b000000fc0000000000000000000000000000005a0000000002000000b40000000000000200000000000000010000007ffffffe0000000000000000000006000000000000000000000000000000000000000000000000000000000000002000000000000700000000000000fdffffffffffffff0000040000000000e80a000000000000000000000a000200700000000000000014000e00"], 0x104}}, 0x0) 854.741611ms ago: executing program 4 (id=4572): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r0) (async) r1 = socket$inet(0x2, 0x3, 0x1) r2 = syz_open_dev$video4linux(&(0x7f0000000000), 0x1, 0x0) ioctl$VIDIOC_G_CTRL(r2, 0xc008561b, &(0x7f0000000040)={0x980001}) (async) setsockopt$sock_int(r1, 0x1, 0x5, &(0x7f0000000340)=0x6, 0x4) (async) sendmsg$inet(r1, &(0x7f0000001040)={&(0x7f00000000c0)={0x2, 0xffff, @broadcast}, 0x10, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1c000000000000000000000007000000830b040a0101027f00000100000000001c000000000000000000000008"], 0x40}, 0x20008024) (async) r3 = userfaultfd(0x80001) r4 = userfaultfd(0x1) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x690}) (async) ioctl$UFFDIO_UNREGISTER(r4, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000001000/0x2000)=nil, 0x2000}) (async) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x1b3}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xa, 0x204031, 0xffffffffffffffff, 0xc9751000) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) (async) ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f000000c000/0x3000)=nil, &(0x7f000000d000/0x1000)=nil, 0x3000, 0x1}) 805.56116ms ago: executing program 5 (id=4573): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r2, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r2, 0xc02064b6, &(0x7f00000001c0)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = syz_open_dev$dri(&(0x7f0000000000), 0xab, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r5, 0xc04064a0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000000200)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000480)={&(0x7f00000002c0)=[r6], 0x1, r7, r4, 0x0, 0x3, 0x100, 0x4, {0x8, 0x1, 0x3, 0x65, 0x200, 0x0, 0x2, 0x5, 0xe, 0xe153, 0x2, 0x0, 0x80007, 0xffffffff, "fe1d00003413000000dd0000000caa000000090000000000000004b427180010"}}) 674.838389ms ago: executing program 4 (id=4574): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002d40)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000000a01040000000000000000010000030900010073797a30000000000c000c4000000000000000042c000000030a01010000000000000000010000000900010073797a30000000000900030073797a320000000054010000060a010400000000000000000100000208000b40000000002c010480340001800b000100657874686472000024000280080001400000000c080003400000000208000440000000220500020007000000f40001800c0001006269747769736500e4000280080003400000000208000140000000140800024000000012c000058008000100cc66248d3c0002800900020073797a32000000000900020073797a30000000000900020073797a30000000000900020073797a30000000000800034000000003100002800900020073797a31000000000c00028008000180fffffffd5c0002800800034000000003080003400000000208000180ffffffff080003400000000208000180fffffffb080003400000000208000180fffffffc0900020073797a30000000000900020073797a3200000000080003400000000208000640000000020900010073797a30"], 0x1d4}}, 0x0) 355.472988ms ago: executing program 5 (id=4575): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000041436120410e5150e8d5000000010902f98a5c01000000090401001186eee2000905821704"], 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) syz_io_uring_setup(0x363, &(0x7f00000004c0)={0x0, 0x3b40, 0x13080, 0xffffffff, 0x2b7, 0x0, r1}, &(0x7f0000000080), &(0x7f0000000180), &(0x7f0000000000)=0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), 0xffffffffffffffff) r4 = socket$inet(0x2, 0x3, 0x30) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r5, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) connect$inet6(r5, &(0x7f0000000080)={0xa, 0x4e22, 0x2000000, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) sendto$inet6(r5, &(0x7f00000001c0)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee059853", 0xfffffffffffffcc1, 0x840, 0x0, 0x56) sendmmsg$inet6(r5, &(0x7f0000005640)=[{{0x0, 0x0, &(0x7f0000004140)=[{&(0x7f00000007c0)="4b000ffd096c1b77cd99b1000009c4b82100375ca9411e734cc8e9627df29e9b97a002d7f15ea9f42bd71401384ed6b5772b5c618c35c4aab72b1d515ceada9e64d7a35fd435e98f06243fcd53966c196ff3f47537912a1a5dec7e8e1fbf4543d1a6c80467d6ba3d241e3fd22efa09c638c98b4ce9fbe6d2053fcfa334eaee64efad2d349f048afb2635ae06c05697746fe073ed230c9c091f7d276305424c1c7eaa3ee09891995a607de26be9abcd2b65a4f9093da8a07eea61b1ff21ea3b323b191f95b997cfdface3dc21a664e38896f9f689bc06f4800d5c977102358770b0d8425f098be9383b5e487e7165e847191d5e95233e971edd0eb9ae865614e2164f43b968c29910de437d051b7e7bd337f3aa414bda48049ba94d11ba32326eb56575bd72b747591396f7c26b28036952ef6cf8adae9acb1649d599f573f089df51d558fdba120e63db65ec3945f1e9e191ce966eb5693281d9c878f6a27ffef79481510bdd44e7cea15a670a713ea3ee8a488a42e0f63a852d23a37f4146e53829ff02555faf815eedb5ce5af9c2de0ab1e4e32b6d31ab4e98a078908ab5d046e4a6196ffe5c55010a4bb8b80dc993c8f94a9fda", 0x1b5}, {&(0x7f0000000380)="5f62f632763c84825847145170282f67ba6d5dadf0baf135d503e93a17ee5604080000005f0de32b0e53e4d26d04c825d923318fd574b1924b09ebb91d5be30b532a2fb95030c6be2a14ccfbce6eef05ea88cf1b612298d2413dc3fc0ae8a2e071f8764a4843611ae28b340100ddefa8ffed32420677397aa63e880adc56d03d8799429f33741886bd6c4065bba5005d74f67508dc3434165b51bf8f73bf1a7c158d8905e519e8", 0xa7}, {&(0x7f0000000440)="0b0ec2a1e3fc84788983f461fec27348bd54a57f68a85a0200ad43c367bae5f7bd6c1e1d9017109e232e5b1f1b8b9acdc89d4d5725350a9ec9303e53def89bcb6bb6ea83324927b43749f25be60c4f8707382b8e3062032c28dcccbd55e05bf1cca4db828a5be79e518cf55a88e130609528b8437cdf76d793584aad3f751172c449fb00"/154, 0x9a}, {&(0x7f00000024c0)="a66554178426362975b882a7d6b43fe537b6b0036a966a05363793ec2f6830cc5b81e514b9cbe4c27c3f3a581556b832100a4233e3e80fda14dd84611893300a863a8a6f6d8e0c7633e168ad7e25d4bd14ba6812101488e9444165b8100d576a996fec019ae11a03498329bcbacd0e8a206bd0de0c7e09f64a57d56974599f09aa148b4224dcffe1b5a1e55bbc1fdae8bf2f72437cf399c4cda11554b21158e3ddb00ddb71a1bd1daa50d631b027238397d692214223af1d685e7a3318da65c9233eba674ff72097411ef3ee19b892b1b36eeb925a6698f4d455b02163a3504ee6accffad7aaf9d19763d886272559ef0501594ea2d11397d2b33ad100d3753d45a43e13bba05d7d332750ce5d9d3b37d234f46464fcc5f495e0fae02a24efd67db315c92f9483196bd38b38b3675bc0de5873f9d7b01ee5c564f5573b474e3c9f3b955929d9112007049e4245d68b93f365a90d35c837cc13999f2d6a23be87786e4234d74b1160669c7962b3b413201192565fb93252c153dd735e280e01d13dc34468f67684a4308c7dbe07687e0f56fa54f44b0141895ad75781ca026d813e8c17794b9d87d97136d29aced71b1f526dfab6301b78f1deab7949c97cce6616f4afd46a331e2fb54342dd1964c70a2717f4239c9e5157ac93c42d05f230da440a9227f0f82ee95cc79ca2d3da3f889b37f85f50d75711a910a57d213edb4b981cde33e01ec960885f31511ed7f8e01ddd36d76e1b1e40e81cd21ef9c34134400fdd94e34e5d77f4b7ca3612663e0f6b364be4a9dc775f3b12386ec04960524a9a5e6879e50db657c89a7dc7ec1f919ba8c77e926538599e7969868a5ef3e92817a3402c13de0efcb9fef445ee49f4b0ed26c5dbadff51459d5229661e4b7d2548c9ea4ce89b828daf5f5873e1d9e693ba037fc00ccc3dd74096c0f1ea508ee96ad7d85664947193e011e2f037917af7716d7f27cac25c9785f13baddfeba40997af5f6f4029cf5b781b654a635ee8696078d99025012cbad5af13bc26e2d100726fc98c11f8f16057a8506f29cf30bcf9ab7883ad1708d11bf70ee54fced84c69d90eb302e8aff586c0b25893e09868426cb4649145ede32035c47360fba7fe863cb00b86f583090c5b8d8549ba62cb822ed182fc07f029a826b5c86dccd603408bfc060c80c8ae21be086998f45923e1fe36eea10a66a55cc9f3cb6a296535dabc831fefe26b80ee47c723c596c51e1d7c073df20874eef79a291934c4c6a7c6b656595fc76b25d0d50590c1df29d59842a19a6acd60e783069aa0c21d792129132d590da18e30a70a330e7b05aebf09e93aa545ca382a29f810e8a4efc0fffd3660f76892c2027daccfd743734c359bacaec86e4f15ca31b83894b67b3a3539cb5567bbcacd9a52c9b8d87252ddab0acd3b4fbe21997754874d1c0dbdd373f7150b87893fa4b6c5e6016f2146471f092a2cf4c75b6ed08a2f27f9f68d1817d7e782c0fa3026fd4e283b6b23bff2a9d84f5cdea217ce396080b623fe6d5da91fcab0e563b8c54af99007f6680efc9fdcd35d1d2ad8539ee04744e38c750114de55b80192c5d6aee8cbc34a47426bb22a9e3e2fcb87530c418a65fad7d5fbb15f569a69fc2cb92dad8f574330fdf2aa6033d1be037d5e3e964ff01329c43401bc86a72025288100ce86c053b922e9a7a692912bca4dabfc0e3a8966a65c96d3a420809c2d600928546a4ea26ff7100081f3ca8a70c64b3a4fc33b3e2546ff4a43502d448f2c0b274a244d32c955b02d897b1c53a2724ff886a1ccc91ea3a22dbd1f5f3f2e33db9ac9aae458a27e2a529ac2d8671f0e30df63a5d1a579b8f5a68f4a53fb4f3f76d41bee8e10635606f2a7fde9af7bd0df3ab9750b0c6c962fbc36e9474e3efac01ea98a4fe6e0f819d62dcde2b9b77fb0d430495ee042d1e70a52debb0d13b09906f77327dd4ccfe2b6796f9aa5e5b2fa9b2249c66b49cd7e1cbdb194c239d7e2e0928a45c8c55904cd345c5d8b92a5526ff5135c2e477089eeb16cb3996c243c66a82f4349370ac26bef5d900ec582f274cc38b0258993de6cc79574fdacb895721fd4d04f84c4d89e109629f48a24fb3241882f154a35ae6659e0bb35af409c51cb11a26413be88a1e5ae1e8d2b1333a6c80c42c654f269dd875aa7f19517f62b8e031f11bdb11bafcf4b4f06496142579f7769ee41dd24701cd3ed016030f7d5cf24a4cfdcd9b05e7442bdc81b68b36495b5f4aa44d7c2fdea8703849a17f7d3327086355ca3b36c10eb38556bf95b3575ba32b97f268af1f1347ed28368828124361f6c1e6b64e6ba9efc3094d50bb049c35db5ea2b3c76576b1a8f37da0711436048ae443523032497e542c04458f04cfffd11c53c431065c20e8add72c0c31caeec12d0bf391fa1c0a75e23d39c31da409083f768f545090b05c54084ffc5d7fd85cea725807638f4ab0026204452a8c198cc60133ce00e9a2b9ebeb30d7f33a1bb25cb2948bf44288cce43b6ac13012d8860fce83d9a0f6f1886723f41130466186ac56d5384bfd04fe87c67528996c1ee1ad8e551dda563e75d5dc8ac6a47990a62c915dc23f4ae6596dcfdb44661de969aec7f6d3fa8f05e106a8db7abeb3682bdc8e87aefbb09e642b2cef2919ddc55ded8dbce0606d3c4a0747a293a991b8cd832381c30813b887a22c2df569c12c430cf7471578eb787acab65b54569bece6921805af9ac41b268ce329a25bacdb02f8f3c4ef930f1799ff940f42c21955ddd5496234d62447d1c9d8e0cc7bb8fd5ca5e9fa2ef99105a4d44d6ce37532407fcccc4e71103baa0c7ff1767e05762424d9301294daa95523792cb73b348c41ec713d19c2b917a4dc50be3f0742762e5055cd6ebb3afa2b89a94c6a921e039ddaee98fc7a961a5e415322bd4b333d83768ee8945f29556f94372a16285cb1ff103640d93b837861f1d0d9e65fe35583b6f76889e7d09a2cdf3c2ef305a0f6d205deedee94ac602974fa58284e33aee55947a7a042abf0759ec8c1410493114454320b5003f23dac1c600a471ff09bdbf5bb40be87a69d388592241d9989f0435eeede193e6994b80a2145eca4afb5e691341e37e4580b0c54d7fc506cc9641020cd342a85fe56946e49854756ae6534edd03de881481e11701851f0f30fedbfcf335c3855c8d9541ef234f8718fbb0d9f127093a3e7c1d49d8a20729ab41a0118683b7044ee490d7137bebbbbfb245d5e30356e102eda0052a37cca70c221475b5c596f68c745701dc6e31f7846270bcd516ded5d0b4666b249a32f0acb1b8a7de8e6f007ee740561f64b7f30b4764ec5116a1eda1526225ddd01b1d999ff17d0798be47e3a5957011aa6e03318897ce1c452b78f9badf89098fe696894953581b01ceffc4fa0eefd654df9ea70b1f2f1e287192a5a20a381e8fad0fb99814208970902fdd28cf6a6457d7873a76359e226e5b203bd6f85bea30cb06b5817e1b32fbbbd33a4e67f3771b7256a3a9ec20dae8a248af32a909bb5ec28f0f85722b81151f0f0a500a5c39c36476ac42c30bcb68a61a13141541ec54d895f0d7ca1afb728202e77f2f85170a3c2de378f1cfa0c2d1b0353f5d2fd0537017dc5510232a7a27a444476bbca2b84394639cf8ded35568868f9dcfa445b33c694aa8696d899afdf0d98a542e6a3c0212480ef3063ae0b8bcaa133978e9ebd76a3ccf652b0022b3cc7f1c9f2731c1c08f45fc84f7dade8471f6855e3005d75390e36a6646b8ac0dd5da9f9ef4bc35639ac96280bc47a547c0941af4516278b66469c7fc22932cbb2ac92cc12745bdf4ab4411d48396120f0e397ff6c22c54873296a897928d0158a5e63e6d48016cb4af44a3d71296acffe59241a8537f8b2cbc88b8ee2f4090e8e16b8af4700a60d0c199cc45cedf8dfe9a78ddd8637f7a9cfc16b078b1f9acfb8cb35f94b7564b1e23904e40dd5bdef1c78397457c05dd1108c3257bfda2e36b31969e8642c825c9dafe2fa4ee2708023c26255e6c41c2c873923e98eb1397dbc51324dfbec7943a5564fa815b9492d53c6cf6d42cd07165ae54e81f7989f2e406a13bea4df4d4a6971d81a4492e5703b6ba1f21ca5ffd68cdb15a713abd70d411e64d873b9f36ced7f354273c5c9782dd8a410ac28fee250f4b82095f4ab7a5c5a7d57114b6196cc2accdb44e39351a5d7c2c519ff861db8e4a368fdc1c5459f2b4cef0076d9b57b9ba2e76b3d8b87a515fc5c777d7e8023ef898fcf31365abc3e0a1307fa8", 0xbd5}, {&(0x7f0000000500)="a405df87c6e89abd7ae7e6b8550f9923917c9d38e14a4e9ace3100b805b34d0056282b7ed43e9c6efe6245152417b356ca23162493370e9055e9320279b93aa8f7231ef5c2928c6284654a2204c4c4f8ffdda3684a000000809658c07e3a7c75d219403b0be9379f7b017bd850fd4c3a18d59f735980d1520b641a6fc2a58ba15bce382460c95db8299b404b8d0d5821a4604f59cfa04cd0d4496fc41b951e7f8ed2a6ac350002000000000000babffca7484a82e2b3bd3e55b4a6f01587e997359498ac5b57e8b86fbf5327519ebc68cb81762ebdada6dca6eaee8ac113c10eead6548244be72d5e261f0084329890a01da108431ece9146f6a5f6214c44e05a9750f872bb69b2ac0386c26b78819c32bec4043042e0c8cfc589a077c5e3b062fd0f5a277056779ea21", 0x12a}, {&(0x7f00000030c0)="8ce8c35d7b1affb769fccf", 0xb}], 0x6}}], 0x1, 0xc004041) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r5, 0x604ab000) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r5, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000001380)=""/4080, 0xfffffffffffffdcc, 0x0, 0x0, 0xffffffffffffff87}, &(0x7f0000000000)=0x40) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r5, 0x6, 0x23, &(0x7f0000000740)={&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000180)=0x40) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c00000eea969d03abfbc0e701e2ce658b8d15d4810ccf4b58137d482d10a5d093cbdc6bf0db94f8d41fe3105794deda744c1d092a523bd3626eaedd3b6aa50a340cba297b3c10f036a46139935ce8", @ANYRES16=r3, @ANYBLOB="010025bd7000fddbdf256300000008000300", @ANYRES32=r7, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x8041}, 0x4000000) mount$9p_fd(0x0, &(0x7f0000000440)='./file0\x00', &(0x7f0000000200), 0x84, &(0x7f00000001c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESOCT=r7, @ANYBLOB=',wfdno=', @ANYRES64=r2]) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_NETID(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r8, 0x4, 0x70bd25, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x20000000) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xfffffffffffffd22, &(0x7f00000001c0)=ANY=[]) 0s ago: executing program 8 (id=4576): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x82, &(0x7f0000000040)='\x00\'\x00\x00\x00\x00\x00\x00', 0x8) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x8, @loopback, 0x9}, 0x1c) sendto$inet6(r0, &(0x7f0000000100)="b8", 0xffe0, 0x2000c851, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0xffff0044}, 0x1c) kernel console output (not intermixed with test programs): ne upperpath [ 497.264390][T12817] fuse: fd is not a fuse device [ 497.784104][T12842] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2352'. [ 497.784170][T12842] openvswitch: netlink: Missing key (keys=40, expected=80) [ 498.646605][T12860] fuse: fd is not a fuse device [ 499.510761][T12891] netlink: 'syz.5.2372': attribute type 4 has an invalid length. [ 499.510786][T12891] netlink: 'syz.5.2372': attribute type 5 has an invalid length. [ 499.510799][T12891] netlink: 'syz.5.2372': attribute type 5 has an invalid length. [ 499.510813][T12891] netlink: 3269 bytes leftover after parsing attributes in process `syz.5.2372'. [ 500.692842][T12908] netlink: 'syz.0.2378': attribute type 21 has an invalid length. [ 500.692859][T12908] netlink: 128 bytes leftover after parsing attributes in process `syz.0.2378'. [ 500.925918][T12917] netlink: 'syz.0.2383': attribute type 21 has an invalid length. [ 500.925937][T12917] netlink: 128 bytes leftover after parsing attributes in process `syz.0.2383'. [ 500.925988][T12917] netlink: 3 bytes leftover after parsing attributes in process `syz.0.2383'. [ 502.412009][T12971] fuse: fd is not a fuse device [ 502.415507][ T39] kauditd_printk_skb: 75 callbacks suppressed [ 502.415595][ T39] audit: type=1326 audit(1783971570.747:92): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=12970 comm="syz.4.2403" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fa80832de59 code=0x0 [ 503.042276][T12999] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2414'. [ 503.054030][T12999] hsr0: entered allmulticast mode [ 503.054073][T12999] hsr_slave_0: entered allmulticast mode [ 503.054109][T12999] hsr_slave_1: entered allmulticast mode [ 503.502051][T13014] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2418'. [ 503.502081][T13014] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2418'. [ 503.502102][T13014] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2418'. [ 503.876046][T13026] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2422'. [ 504.030428][T13028] 9pnet: p9_errstr2errno: server reported unknown error 0x000 [ 504.829057][T13049] netlink: 9 bytes leftover after parsing attributes in process `syz.5.2431'. [ 504.872684][T13050] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2430'. [ 504.902007][T13049] netlink: 9 bytes leftover after parsing attributes in process `syz.5.2431'. [ 507.094535][ T1340] ieee802154 phy0 wpan0: encryption failed: -22 [ 507.094657][ T1340] ieee802154 phy1 wpan1: encryption failed: -22 [ 507.153069][T13109] netlink: 'syz.2.2452': attribute type 23 has an invalid length. [ 507.907762][T13140] /dev/nullb0: Can't lookup blockdev [ 508.182094][T13155] netlink: 'syz.0.2467': attribute type 11 has an invalid length. [ 508.333506][T13160] netlink: 'syz.2.2469': attribute type 21 has an invalid length. [ 508.333523][T13160] netlink: 128 bytes leftover after parsing attributes in process `syz.2.2469'. [ 508.333576][T13160] netlink: 3 bytes leftover after parsing attributes in process `syz.2.2469'. [ 508.428440][T13162] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2470'. [ 508.428494][T13162] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2470'. [ 508.784672][T13176] netlink: 'syz.0.2477': attribute type 27 has an invalid length. [ 508.784700][T13176] netlink: 164 bytes leftover after parsing attributes in process `syz.0.2477'. [ 508.788392][T13174] 9pnet: p9_errstr2errno: server reported unknown error 0x00 [ 509.459272][T13212] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2490'. [ 509.900737][T13227] netlink: 'syz.0.2496': attribute type 27 has an invalid length. [ 510.002084][T13229] netlink: 44 bytes leftover after parsing attributes in process `syz.5.2497'. [ 510.836370][T13221] Invalid ELF header len 2 [ 511.318182][T13254] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2505'. [ 511.318213][T13254] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2505'. [ 511.318235][T13254] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2505'. [ 512.228021][T13275] netlink: 9 bytes leftover after parsing attributes in process `syz.5.2515'. [ 512.304376][T13275] netlink: 9 bytes leftover after parsing attributes in process `syz.5.2515'. [ 512.377672][ T5601] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 512.465178][ T5601] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 512.491982][ T5601] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 512.498692][ T5601] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 512.526636][ T5601] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 512.914503][T13295] netlink: 'syz.4.2522': attribute type 27 has an invalid length. [ 513.163170][T13298] fuse: fd is not a fuse device [ 514.690598][ T5598] Bluetooth: hci5: command tx timeout [ 515.481223][ T948] usb 3-1: USB disconnect, device number 87 [ 516.286923][ T6191] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 516.763496][ T5598] Bluetooth: hci5: command tx timeout [ 517.144385][ T6191] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 517.266243][T13277] bridge0: port 1(bridge_slave_0) entered blocking state [ 517.268134][T13277] bridge0: port 1(bridge_slave_0) entered disabled state [ 517.268379][T13277] bridge_slave_0: entered allmulticast mode [ 517.291121][T13277] bridge_slave_0: entered promiscuous mode [ 517.314763][T13277] bridge0: port 2(bridge_slave_1) entered blocking state [ 517.315051][T13277] bridge0: port 2(bridge_slave_1) entered disabled state [ 517.315582][T13277] bridge_slave_1: entered allmulticast mode [ 517.319215][T13277] bridge_slave_1: entered promiscuous mode [ 517.550776][T13277] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 517.970531][ T6191] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 518.169393][T13277] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 518.376434][T13277] team0: Port device team_slave_0 added [ 518.420943][T13277] team0: Port device team_slave_1 added [ 518.649707][ T39] audit: type=1326 audit(1783971586.977:93): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=13364 comm="syz.0.2541" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7124ccde59 code=0x7ffc0000 [ 518.674269][ T39] audit: type=1326 audit(1783971586.977:94): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=13364 comm="syz.0.2541" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7124ccde59 code=0x7ffc0000 [ 518.674326][ T39] audit: type=1326 audit(1783971587.007:95): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=13364 comm="syz.0.2541" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7124ccde59 code=0x7ffc0000 [ 518.674674][ T39] audit: type=1326 audit(1783971587.007:96): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=13364 comm="syz.0.2541" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7f7124ccde59 code=0x7ffc0000 [ 518.675549][ T39] audit: type=1326 audit(1783971587.007:97): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=13364 comm="syz.0.2541" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7124ccde59 code=0x7ffc0000 [ 518.777208][ T39] audit: type=1326 audit(1783971587.107:98): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=13364 comm="syz.0.2541" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7124ccde59 code=0x7ffc0000 [ 518.777266][ T39] audit: type=1326 audit(1783971587.107:99): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=13364 comm="syz.0.2541" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7124ccde59 code=0x7ffc0000 [ 518.828925][ T39] audit: type=1326 audit(1783971587.157:100): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=13364 comm="syz.0.2541" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7124ccde59 code=0x7ffc0000 [ 518.828987][ T39] audit: type=1326 audit(1783971587.157:101): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=13364 comm="syz.0.2541" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7124ccde59 code=0x7ffc0000 [ 518.829034][ T39] audit: type=1326 audit(1783971587.157:102): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=13364 comm="syz.0.2541" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7124ccde59 code=0x7ffc0000 [ 518.850431][ T5598] Bluetooth: hci5: command tx timeout [ 518.971870][ T6191] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 519.365015][T13277] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 519.365032][T13277] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 519.365058][T13277] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 519.399762][T13277] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 519.399814][T13277] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 519.399928][T13277] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 519.500651][T13408] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2552'. [ 519.500679][T13408] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2552'. [ 519.502624][T13406] netlink: 'syz.4.2552': attribute type 2 has an invalid length. [ 519.502647][T13406] netlink: 'syz.4.2552': attribute type 2 has an invalid length. [ 519.786838][T13277] hsr_slave_0: entered promiscuous mode [ 519.789135][T13277] hsr_slave_1: entered promiscuous mode [ 519.795463][T13277] debugfs: 'hsr0' already exists in 'hsr' [ 519.795548][T13277] Cannot create hsr debugfs directory [ 520.223369][T13427] netlink: 'syz.0.2557': attribute type 27 has an invalid length. [ 520.922436][ T5598] Bluetooth: hci5: command tx timeout [ 521.120852][ T6191] bond0: left allmulticast mode [ 521.120875][ T6191] bond_slave_0: left allmulticast mode [ 521.120905][ T6191] bond_slave_1: left allmulticast mode [ 521.174275][ T6191] bond0: left promiscuous mode [ 521.174301][ T6191] bond_slave_0: left promiscuous mode [ 521.174568][ T6191] bond_slave_1: left promiscuous mode [ 521.203226][ T6191] bridge0: port 3(bond0) entered disabled state [ 521.473730][ T6191] bridge_slave_1: left allmulticast mode [ 521.473769][ T6191] bridge_slave_1: left promiscuous mode [ 521.474046][ T6191] bridge0: port 2(bridge_slave_1) entered disabled state [ 521.697277][ T6191] bridge_slave_0: left allmulticast mode [ 521.697330][ T6191] bridge_slave_0: left promiscuous mode [ 521.697625][ T6191] bridge0: port 1(bridge_slave_0) entered disabled state [ 521.765254][T13471] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2569'. [ 522.039344][T13481] fuse: fd is not a fuse device [ 522.952406][T13501] netlink: 52 bytes leftover after parsing attributes in process `syz.5.2578'. [ 522.952438][T13501] netlink: 52 bytes leftover after parsing attributes in process `syz.5.2578'. [ 522.952459][T13501] netlink: 52 bytes leftover after parsing attributes in process `syz.5.2578'. [ 523.661591][ T6191] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 523.741388][ T6191] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 523.787359][ T6191] bond0 (unregistering): Released all slaves [ 523.888993][ T5253] 8021q: adding VLAN 0 to HW filter on device eth5 [ 525.812803][T13578] netlink: 1788 bytes leftover after parsing attributes in process `syz.5.2601'. [ 525.919816][ T5253] 8021q: adding VLAN 0 to HW filter on device eth6 [ 525.984388][T13583] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2602'. [ 526.682255][T13596] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2607'. [ 527.402586][T13603] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.2610'. [ 529.610243][ T6191] hsr_slave_0: left promiscuous mode [ 529.652435][ T6191] hsr_slave_1: left promiscuous mode [ 529.653597][ T6191] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 529.653625][ T6191] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 529.717398][ T6191] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 529.717445][ T6191] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 529.741903][T13683] fuse: fd is not a fuse device [ 530.039459][ T6191] veth1_macvtap: left promiscuous mode [ 530.039597][ T6191] veth0_macvtap: left promiscuous mode [ 530.056542][T13688] netlink: 9 bytes leftover after parsing attributes in process `syz.0.2632'. [ 530.087885][T13690] fuse: fd is not a fuse device [ 530.137111][ T6191] veth1_vlan: left promiscuous mode [ 530.137274][ T6191] veth0_vlan: left promiscuous mode [ 530.182789][T13688] netlink: 9 bytes leftover after parsing attributes in process `syz.0.2632'. [ 530.343841][T13700] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2636'. [ 531.801230][ T6191] team0 (unregistering): Port device team_slave_1 removed [ 531.882507][ T6191] team0 (unregistering): Port device team_slave_0 removed [ 532.249066][T13277] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 532.311146][T13277] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 532.319446][T13277] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 532.503574][T13277] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 532.505787][T13277] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 532.558213][T13277] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 532.561614][T13277] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 532.643028][T13277] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 533.447268][T13277] 8021q: adding VLAN 0 to HW filter on device bond0 [ 533.785942][T13277] 8021q: adding VLAN 0 to HW filter on device team0 [ 533.823809][ T7320] bridge0: port 1(bridge_slave_0) entered blocking state [ 533.824064][ T7320] bridge0: port 1(bridge_slave_0) entered forwarding state [ 534.045998][ T7320] bridge0: port 2(bridge_slave_1) entered blocking state [ 534.046173][ T7320] bridge0: port 2(bridge_slave_1) entered forwarding state [ 534.669249][ T6191] IPVS: stop unused estimator thread 0... [ 535.188033][T13788] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2652'. [ 535.188062][T13788] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2652'. [ 536.557352][T13277] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 536.749717][T13277] veth0_vlan: entered promiscuous mode [ 536.789740][T13277] veth1_vlan: entered promiscuous mode [ 536.948938][T13842] netlink: 'syz.5.2661': attribute type 11 has an invalid length. [ 537.129294][T13277] veth0_macvtap: entered promiscuous mode [ 537.153330][T13277] veth1_macvtap: entered promiscuous mode [ 537.536661][T13857] netlink: 188 bytes leftover after parsing attributes in process `syz.5.2667'. [ 537.672060][T13860] netlink: 'syz.5.2670': attribute type 83 has an invalid length. [ 537.674236][T13860] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 537.674283][T13860] CIFS: Unable to determine destination address [ 537.675720][T13860] fuse: fd is not a fuse device [ 537.890779][T13277] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 537.983277][T13277] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 538.048655][ T6175] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 538.048734][ T6175] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 538.048779][ T6175] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 538.048823][ T6175] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 539.072616][T13891] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2677'. [ 539.411981][ T4299] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 539.412005][ T4299] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 539.890446][T13908] netlink: 'syz.5.2681': attribute type 27 has an invalid length. [ 540.277563][ T7327] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 540.277587][ T7327] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 541.138121][T13922] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 541.138144][T13922] overlayfs: fs on './file0' does not support file handles, falling back to xino=off. [ 541.671400][ T5601] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 541.717535][ T5601] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 541.719655][ T5601] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 541.744727][ T5601] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 541.748779][ T5601] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 542.949849][ T5598] Bluetooth: hci1: SCO packet for unknown connection handle 200 [ 542.962326][T13358] syz_tun (unregistering): left allmulticast mode [ 543.962847][ T5598] Bluetooth: hci0: command tx timeout [ 544.606671][T14016] fuse: Bad value for 'fd' [ 544.627966][ T6183] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 545.017988][T14014] ipvlan1: entered promiscuous mode [ 545.019528][T14014] ipvlan1: entered allmulticast mode [ 545.019582][T14014] veth0_vlan: entered allmulticast mode [ 545.745447][ T6183] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 546.042737][ T5598] Bluetooth: hci0: command tx timeout [ 546.333570][ T6183] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 547.052956][ T5598] Bluetooth: hci1: unexpected event for opcode 0x0c1b [ 547.296076][ T6183] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 547.651308][T13931] bridge0: port 1(bridge_slave_0) entered blocking state [ 547.651657][T13931] bridge0: port 1(bridge_slave_0) entered disabled state [ 547.656861][T13931] bridge_slave_0: entered allmulticast mode [ 547.685353][T13931] bridge_slave_0: entered promiscuous mode [ 547.777814][T13931] bridge0: port 2(bridge_slave_1) entered blocking state [ 547.778139][T13931] bridge0: port 2(bridge_slave_1) entered disabled state [ 547.778448][T13931] bridge_slave_1: entered allmulticast mode [ 547.819100][T13931] bridge_slave_1: entered promiscuous mode [ 547.900663][T14107] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2739'. [ 547.900688][T14107] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2739'. [ 547.900703][T14107] netlink: 31 bytes leftover after parsing attributes in process `syz.4.2739'. [ 547.900716][T14107] netlink: 'syz.4.2739': attribute type 2 has an invalid length. [ 547.900727][T14107] netlink: 31 bytes leftover after parsing attributes in process `syz.4.2739'. [ 548.059746][T13931] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 548.100946][T13931] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 548.128172][ T5598] Bluetooth: hci0: command tx timeout [ 548.253459][T13931] team0: Port device team_slave_0 added [ 548.259456][T13931] team0: Port device team_slave_1 added [ 548.335682][T13931] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 548.335697][T13931] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 548.335721][T13931] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 548.394267][T13931] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 548.394281][T13931] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 548.394303][T13931] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 548.497232][T14123] netlink: 16186 bytes leftover after parsing attributes in process `syz.5.2743'. [ 548.593695][T14127] openvswitch: netlink: Flow actions attr not present in new flow. [ 549.062502][T13931] hsr_slave_0: entered promiscuous mode [ 549.078175][T13931] hsr_slave_1: entered promiscuous mode [ 549.090375][T13931] debugfs: 'hsr0' already exists in 'hsr' [ 549.090404][T13931] Cannot create hsr debugfs directory [ 549.330683][T14136] overlayfs: failed to clone upperpath [ 549.637188][T14143] netlink: 9 bytes leftover after parsing attributes in process `syz.4.2748'. [ 549.689160][ T6183] bridge_slave_1: left allmulticast mode [ 549.689201][ T6183] bridge_slave_1: left promiscuous mode [ 549.703241][ T6183] bridge0: port 2(bridge_slave_1) entered disabled state [ 549.770453][T14143] netlink: 9 bytes leftover after parsing attributes in process `syz.4.2748'. [ 549.972306][ T6183] bridge_slave_0: left allmulticast mode [ 549.972345][ T6183] bridge_slave_0: left promiscuous mode [ 549.972643][ T6183] bridge0: port 1(bridge_slave_0) entered disabled state [ 550.157057][ T6183] pimreg: left allmulticast mode [ 550.205138][ T5598] Bluetooth: hci0: command tx timeout [ 551.775459][ T6183] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 551.831109][ T6183] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 551.875610][ T6183] bond0 (unregistering): Released all slaves [ 552.069014][ T5253] 8021q: adding VLAN 0 to HW filter on device eth5 [ 552.495680][ T6183] IPVS: stopping master sync thread 10883 ... [ 552.977511][T14221] netlink: 'syz.4.2768': attribute type 21 has an invalid length. [ 552.977537][T14221] netlink: 128 bytes leftover after parsing attributes in process `syz.4.2768'. [ 553.311006][T14221] netlink: 35 bytes leftover after parsing attributes in process `syz.4.2768'. [ 553.717206][ T5253] 8021q: adding VLAN 0 to HW filter on device eth6 [ 553.948900][T14251] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2776'. [ 554.356905][T14251] hsr0: entered allmulticast mode [ 554.356927][T14251] hsr_slave_0: entered allmulticast mode [ 554.356952][T14251] hsr_slave_1: entered allmulticast mode [ 554.928325][T14279] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2781'. [ 554.928354][T14279] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2781'. [ 555.258116][T14291] IPVS: sh: FWM 3 0x00000003 - no destination available [ 555.258212][ C1] IPVS: sh: FWM 3 0x00000003 - no destination available [ 555.556206][T14301] netlink: 'syz.2.2786': attribute type 21 has an invalid length. [ 555.556231][T14301] netlink: 128 bytes leftover after parsing attributes in process `syz.2.2786'. [ 557.637868][ T39] kauditd_printk_skb: 61 callbacks suppressed [ 557.637889][ T39] audit: type=1326 audit(1783971625.967:164): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=14354 comm="syz.5.2798" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd93cd5de59 code=0x7ffc0000 [ 557.638069][ T39] audit: type=1326 audit(1783971625.967:165): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=14354 comm="syz.5.2798" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd93cd5de59 code=0x7ffc0000 [ 557.638875][ T39] audit: type=1326 audit(1783971625.967:166): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=14354 comm="syz.5.2798" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd93cd5de59 code=0x7ffc0000 [ 557.638928][ T39] audit: type=1326 audit(1783971625.967:167): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=14354 comm="syz.5.2798" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd93cd5de59 code=0x7ffc0000 [ 557.638976][ T39] audit: type=1326 audit(1783971625.967:168): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=14354 comm="syz.5.2798" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fd93cd1e68e code=0x7ffc0000 [ 557.639906][ T39] audit: type=1326 audit(1783971625.967:170): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=14354 comm="syz.5.2798" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd93cd5de59 code=0x7ffc0000 [ 557.639959][ T39] audit: type=1326 audit(1783971625.967:169): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=14354 comm="syz.5.2798" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fd93cd5dbc2 code=0x7ffc0000 [ 557.640580][ T39] audit: type=1326 audit(1783971625.967:171): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=14354 comm="syz.5.2798" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd93cd5de59 code=0x7ffc0000 [ 557.640709][ T39] audit: type=1326 audit(1783971625.967:172): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=14354 comm="syz.5.2798" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=10 compat=0 ip=0x7fd93cd5dc57 code=0x7ffc0000 [ 557.645738][ T39] audit: type=1326 audit(1783971625.977:173): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=14354 comm="syz.5.2798" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=0 arch=c000003e syscall=14 compat=0 ip=0x7fd93cd1ab51 code=0x7ffc0000 [ 558.257725][T14364] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 559.048257][ T6183] hsr_slave_0: left promiscuous mode [ 559.093441][ T6183] hsr_slave_1: left promiscuous mode [ 559.094568][ T6183] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 559.094596][ T6183] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 559.143859][ T6183] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 559.143890][ T6183] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 559.298278][ T6183] veth1_macvtap: left promiscuous mode [ 559.298389][ T6183] veth0_macvtap: left promiscuous mode [ 559.298796][ T6183] veth1_vlan: left promiscuous mode [ 559.299010][ T6183] veth0_vlan: left promiscuous mode [ 560.661534][ T6183] team0 (unregistering): Port device team_slave_1 removed [ 560.745864][ T6183] team0 (unregistering): Port device team_slave_0 removed [ 561.403853][T13931] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 561.476652][T13931] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 561.487862][T13931] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 561.625987][T13931] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 561.627989][T13931] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 561.726400][T13931] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 561.738752][T13931] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 561.840459][T13931] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 562.269091][T13931] 8021q: adding VLAN 0 to HW filter on device bond0 [ 562.308624][T13931] 8021q: adding VLAN 0 to HW filter on device team0 [ 562.362113][ T5838] bridge0: port 1(bridge_slave_0) entered blocking state [ 562.362289][ T5838] bridge0: port 1(bridge_slave_0) entered forwarding state [ 562.374383][ T5838] bridge0: port 2(bridge_slave_1) entered blocking state [ 562.374858][ T5838] bridge0: port 2(bridge_slave_1) entered forwarding state [ 562.883712][T14437] overlayfs: failed to clone upperpath [ 563.239492][T14446] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2819'. [ 563.239516][T14446] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2819'. [ 563.239535][T14446] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2819'. [ 563.642843][T13931] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 563.853710][T13931] veth0_vlan: entered promiscuous mode [ 563.878818][T13931] veth1_vlan: entered promiscuous mode [ 564.085273][T13931] veth0_macvtap: entered promiscuous mode [ 564.133680][T13931] veth1_macvtap: entered promiscuous mode [ 564.180472][T13931] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 564.216540][T13931] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 564.306435][ T6550] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 564.307962][ T6550] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 564.308314][ T6550] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 564.346422][ T6550] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 565.308151][ T6549] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 565.308172][ T6549] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 565.699813][ T6397] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 565.699837][ T6397] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 566.228271][T14494] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2835'. [ 566.312656][T14494] hsr0: entered allmulticast mode [ 566.312683][T14494] hsr_slave_0: entered allmulticast mode [ 566.312713][T14494] hsr_slave_1: entered allmulticast mode [ 567.600407][T14521] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2845'. [ 567.621316][T14522] overlayfs: option "index=on" is useless in a non-upper mount, ignore [ 567.621333][T14522] overlayfs: missing 'lowerdir' [ 567.816042][T14524] netlink: 'syz.5.2846': attribute type 29 has an invalid length. [ 567.816059][T14524] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2846'. [ 568.316414][T14532] libceph: resolve ' [ 568.316414][T14532] -&õÌ×fÍY¹Ç²a×ïÅ2iˆ [ 568.316414][T14532] .ÖúÕ?Çý&*»§&' (ret=-3): failed [ 568.527227][ T1340] ieee802154 phy0 wpan0: encryption failed: -22 [ 568.527349][ T1340] ieee802154 phy1 wpan1: encryption failed: -22 [ 568.633965][T14547] binder: 14546:14547 ioctl 5001 0 returned -22 [ 568.635717][ T39] kauditd_printk_skb: 237 callbacks suppressed [ 568.635736][ T39] audit: type=1326 audit(1783971636.967:411): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=14546 comm="syz.0.2853" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd3fc7cde59 code=0x0 [ 568.897245][T14554] fuse: fd is not a fuse device [ 569.761182][T14583] netlink: 'syz.2.2865': attribute type 27 has an invalid length. [ 569.831071][ T5601] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 569.899682][ T5601] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 569.916508][ T5601] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 569.960830][ T5601] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 569.979210][ T5601] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 570.722970][T14583] ipvlan1: left promiscuous mode [ 570.723003][T14583] ipvlan1: left allmulticast mode [ 570.723018][T14583] veth0_vlan: left allmulticast mode [ 571.047411][ T6167] usb 1-1: new low-speed USB device number 56 using dummy_hcd [ 571.229582][ T6167] usb 1-1: unable to get BOS descriptor or descriptor too short [ 571.235462][ T6167] usb 1-1: config 1 has an invalid interface number: 7 but max is 0 [ 571.235538][ T6167] usb 1-1: config 1 has no interface number 0 [ 571.235669][ T6167] usb 1-1: config 1 interface 7 altsetting 7 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 571.235752][ T6167] usb 1-1: config 1 interface 7 altsetting 7 endpoint 0x81 has invalid wMaxPacketSize 0 [ 571.235817][ T6167] usb 1-1: config 1 interface 7 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 571.235892][ T6167] usb 1-1: config 1 interface 7 has no altsetting 0 [ 571.323970][ T6167] usb 1-1: string descriptor 0 read error: -22 [ 571.324091][ T6167] usb 1-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.40 [ 571.324110][ T6167] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 571.452725][ T6167] usbhid 1-1:1.7: can't add hid device: -22 [ 571.452811][ T6167] usbhid 1-1:1.7: probe with driver usbhid failed with error -22 [ 571.704152][T14598] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 571.704817][T14598] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 571.815504][T14617] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2876'. [ 571.816359][T14598] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3901428352 (7802856704 ns) > initial count (110847878 ns). Using initial count to start timer. [ 572.214600][ T5598] Bluetooth: hci2: command tx timeout [ 572.304355][ T5700] usb 1-1: USB disconnect, device number 56 [ 572.666576][ T7323] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 573.818562][ T7323] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 573.955328][T14578] bridge0: port 1(bridge_slave_0) entered blocking state [ 573.955750][T14578] bridge0: port 1(bridge_slave_0) entered disabled state [ 573.956064][T14578] bridge_slave_0: entered allmulticast mode [ 573.959824][T14578] bridge_slave_0: entered promiscuous mode [ 573.996868][T14578] bridge0: port 2(bridge_slave_1) entered blocking state [ 573.997315][T14578] bridge0: port 2(bridge_slave_1) entered disabled state [ 573.997586][T14578] bridge_slave_1: entered allmulticast mode [ 574.021750][T14578] bridge_slave_1: entered promiscuous mode [ 574.089017][T14578] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 574.111535][T14578] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 574.283583][ T5598] Bluetooth: hci2: command tx timeout [ 574.591396][ T7323] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 574.686587][T14578] team0: Port device team_slave_0 added [ 574.691035][ T5700] usb 1-1: new high-speed USB device number 57 using dummy_hcd [ 574.779477][T14578] team0: Port device team_slave_1 added [ 574.851869][ T5700] usb 1-1: Using ep0 maxpacket: 16 [ 574.855157][ T5700] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 7 [ 574.855192][ T5700] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 9331, setting to 1024 [ 574.858707][ T5700] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 574.858738][ T5700] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 574.858766][ T5700] usb 1-1: Product: syz [ 574.858778][ T5700] usb 1-1: Manufacturer: syz [ 574.858789][ T5700] usb 1-1: SerialNumber: syz [ 574.925795][ T5700] usb 1-1: config 0 descriptor?? [ 574.950717][ T5700] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 574.950751][ T5700] em28xx 1-1:0.0: DVB interface 0 found: isoc [ 575.193619][ T5700] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 575.277666][ T7323] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 575.376967][ T5700] em28xx 1-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 575.377023][ T5700] em28xx 1-1:0.0: board has no eeprom [ 575.451056][ T5700] em28xx 1-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 575.451088][ T5700] em28xx 1-1:0.0: dvb set to isoc mode. [ 575.452213][ T6167] em28xx 1-1:0.0: Binding DVB extension [ 575.604139][ T5700] usb 1-1: USB disconnect, device number 57 [ 575.614654][ T5700] em28xx 1-1:0.0: Disconnecting em28xx [ 575.742925][T14578] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 575.742944][T14578] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 575.742976][T14578] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 575.749636][ T6167] em28xx 1-1:0.0: Registering input extension [ 575.749916][ T5700] em28xx 1-1:0.0: Closing input extension [ 575.818671][T14578] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 575.818689][T14578] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 575.818722][T14578] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 575.993750][T14702] IPVS: sh: FWM 3 0x00000003 - no destination available [ 575.993846][ C1] IPVS: sh: FWM 3 0x00000003 - no destination available [ 576.026001][T14578] hsr_slave_0: entered promiscuous mode [ 576.029866][T14578] hsr_slave_1: entered promiscuous mode [ 576.136065][T14707] netlink: 'syz.2.2902': attribute type 21 has an invalid length. [ 576.136090][T14707] netlink: 128 bytes leftover after parsing attributes in process `syz.2.2902'. [ 576.369812][ T5598] Bluetooth: hci2: command tx timeout [ 576.487720][ T5700] em28xx 1-1:0.0: Freeing device [ 576.793979][ T5700] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 576.945654][ T5700] usb 1-1: config 1 has an invalid interface number: 188 but max is 0 [ 576.945685][ T5700] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 576.945707][ T5700] usb 1-1: config 1 has no interface number 0 [ 576.945762][ T5700] usb 1-1: config 1 interface 188 altsetting 209 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 576.945795][ T5700] usb 1-1: config 1 interface 188 has no altsetting 0 [ 576.948386][ T5700] usb 1-1: New USB device found, idVendor=2040, idProduct=7210, bcdDevice=5b.6b [ 576.948417][ T5700] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 576.948439][ T5700] usb 1-1: Product: syz [ 576.948454][ T5700] usb 1-1: Manufacturer: syz [ 576.948475][ T5700] usb 1-1: SerialNumber: syz [ 577.280689][T14700] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 577.282865][T14700] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 577.349085][ T5700] usb 1-1: unknown interface protocol 0xc1, assuming v1 [ 577.349113][ T5700] usb 1-1: 188:0 : does not exist [ 577.708558][ T5700] usb 1-1: USB disconnect, device number 58 [ 577.813065][ T7323] bridge_slave_1: left allmulticast mode [ 577.813103][ T7323] bridge_slave_1: left promiscuous mode [ 577.813395][ T7323] bridge0: port 2(bridge_slave_1) entered disabled state [ 578.236847][ T7323] bridge_slave_0: left allmulticast mode [ 578.236883][ T7323] bridge_slave_0: left promiscuous mode [ 578.237142][ T7323] bridge0: port 1(bridge_slave_0) entered disabled state [ 578.442573][ T5598] Bluetooth: hci2: command tx timeout [ 580.290903][ T7323] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 580.374236][T14782] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2923'. [ 580.630970][ T7323] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 580.762984][ T7323] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 580.808361][ T7323] bond0 (unregistering): Released all slaves [ 580.866039][T14795] netlink: 'syz.2.2929': attribute type 28 has an invalid length. [ 580.871941][T14795] openvswitch: netlink: Duplicate or invalid key (type 0). [ 580.872096][T14795] openvswitch: netlink: Actions may not be safe on all matching packets [ 581.094131][ T5253] 8021q: adding VLAN 0 to HW filter on device eth5 [ 584.794430][T14883] fuse: fd is not a fuse device [ 584.860270][T14886] fuse: fd is not a fuse device [ 585.575810][T14910] IPVS: sh: FWM 3 0x00000003 - no destination available [ 585.575911][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 585.829815][T14915] overlayfs: failed to clone upperpath [ 585.905235][T14578] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 585.957027][T14578] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 585.974560][T14578] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 586.016731][T14578] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 586.048108][T14578] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 586.248237][T14578] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 586.261994][T14925] openvswitch: netlink: VXLAN extension message has 12 unknown bytes. [ 586.582186][T14578] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 586.636125][T14578] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 587.819450][T14974] netlink: 14 bytes leftover after parsing attributes in process `syz.0.2972'. [ 587.841145][T14976] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2973'. [ 587.883068][T14975] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2973'. [ 587.885374][T14977] netlink: 'syz.0.2972': attribute type 1 has an invalid length. [ 587.885397][T14977] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2972'. [ 588.540764][T14984] netlink: 160 bytes leftover after parsing attributes in process `syz.5.2975'. [ 588.597992][T14578] 8021q: adding VLAN 0 to HW filter on device bond0 [ 588.900149][ T7323] hsr_slave_0: left promiscuous mode [ 588.982877][ T7323] hsr_slave_1: left promiscuous mode [ 589.055563][ T7323] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 589.055594][ T7323] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 589.091200][ T7323] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 589.091223][ T7323] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 589.186572][ T7323] veth1_macvtap: left promiscuous mode [ 589.186686][ T7323] veth0_macvtap: left promiscuous mode [ 589.187093][ T7323] veth1_vlan: left promiscuous mode [ 589.187307][ T7323] veth0_vlan: left promiscuous mode [ 589.523800][T15016] netlink: 9 bytes leftover after parsing attributes in process `syz.5.2984'. [ 589.602005][T15016] netlink: 9 bytes leftover after parsing attributes in process `syz.5.2984'. [ 590.611377][ T7323] team0 (unregistering): Port device team_slave_1 removed [ 590.623712][T15037] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 590.623712][T15037] The task syz.5.2993 (15037) triggered the difference, watch for misbehavior. [ 590.694567][ T7323] team0 (unregistering): Port device team_slave_0 removed [ 591.259456][T14578] 8021q: adding VLAN 0 to HW filter on device team0 [ 591.297920][ T1179] bridge0: port 1(bridge_slave_0) entered blocking state [ 591.299382][ T1179] bridge0: port 1(bridge_slave_0) entered forwarding state [ 591.455175][ T7328] bridge0: port 2(bridge_slave_1) entered blocking state [ 591.455352][ T7328] bridge0: port 2(bridge_slave_1) entered forwarding state [ 592.773252][T14578] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 592.820682][ T7323] IPVS: stop unused estimator thread 0... [ 593.161093][T15083] bond0: entered promiscuous mode [ 593.161126][T15083] bond_slave_0: entered promiscuous mode [ 593.161374][T15083] bond_slave_1: entered promiscuous mode [ 593.220520][T15083] netlink: 408 bytes leftover after parsing attributes in process `syz.2.3002'. [ 593.451034][T14578] veth0_vlan: entered promiscuous mode [ 593.488070][T14578] veth1_vlan: entered promiscuous mode [ 593.783440][ T200] IPVS: starting estimator thread 0... [ 593.872443][T15099] IPVS: using max 10 ests per chain, 24000 per kthread [ 593.954710][T14578] veth0_macvtap: entered promiscuous mode [ 593.978449][T14578] veth1_macvtap: entered promiscuous mode [ 594.038454][T14578] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 594.113726][T14578] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 594.186879][ T6176] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 594.187132][ T6176] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 594.187173][ T6176] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 594.187211][ T6176] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 594.580937][T15109] dvmrp12: entered allmulticast mode [ 594.844573][ T7323] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 594.844596][ T7323] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 594.927965][ T6392] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 594.927988][ T6392] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 597.097894][T15168] fuse: fd is not a fuse device [ 597.169076][ T5598] Bluetooth: hci5: Malformed Event: 0x02 [ 597.246640][ T5598] Bluetooth: hci5: hcon ffff88802a114000 sent 1 < count 16 [ 597.246886][ T5598] Bluetooth: hci5: hcon ffff88802a114000 sent 0 < count 35176 [ 597.407494][ T5598] Bluetooth: hci5: hcon ffff88805e85c000 sent 1 < count 257 [ 597.408278][ T5598] Bluetooth: hci5: hcon ffff88802a114000 sent 0 < count 129 [ 597.622434][T15185] netlink: 9 bytes leftover after parsing attributes in process `syz.4.3038'. [ 597.700864][T15185] netlink: 9 bytes leftover after parsing attributes in process `syz.4.3038'. [ 598.140215][ T5732] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 598.290193][ T5732] usb 5-1: Using ep0 maxpacket: 16 [ 598.295976][ T5732] usb 5-1: config 0 has an invalid interface number: 105 but max is 0 [ 598.296008][ T5732] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 598.296029][ T5732] usb 5-1: config 0 has no interface number 0 [ 598.337552][ T5732] usb 5-1: New USB device found, idVendor=046d, idProduct=08d3, bcdDevice= b.28 [ 598.337589][ T5732] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 598.337612][ T5732] usb 5-1: Product: syz [ 598.337628][ T5732] usb 5-1: Manufacturer: syz [ 598.337644][ T5732] usb 5-1: SerialNumber: syz [ 598.387957][ T5732] usb 5-1: config 0 descriptor?? [ 598.403697][ T5732] uvcvideo 5-1:0.105: probe with driver uvcvideo failed with error -22 [ 600.857197][T15232] netlink: 188 bytes leftover after parsing attributes in process `syz.2.3058'. [ 600.889105][T15233] netlink: 'syz.0.3057': attribute type 21 has an invalid length. [ 600.889134][T15233] netlink: 128 bytes leftover after parsing attributes in process `syz.0.3057'. [ 600.889254][T15233] netlink: 35 bytes leftover after parsing attributes in process `syz.0.3057'. [ 601.017575][ T5580] usb 5-1: USB disconnect, device number 26 [ 601.787837][T15265] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3069'. [ 601.969932][T15271] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3072'. [ 601.978659][T15271] hsr0: left allmulticast mode [ 601.978726][T15271] hsr_slave_0: left allmulticast mode [ 601.978793][T15271] hsr_slave_1: left allmulticast mode [ 602.156193][T15275] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3073'. [ 602.156214][T15275] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3073'. [ 602.156230][T15275] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3073'. [ 603.058223][T15300] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3078'. [ 603.058294][T15300] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3078'. [ 603.985592][T15328] IPVS: sh: FWM 3 0x00000003 - no destination available [ 603.985707][ C1] IPVS: sh: FWM 3 0x00000003 - no destination available [ 604.218172][T15336] binder: 15334:15336 unknown command 0 [ 604.218199][T15336] binder: 15334:15336 ioctl c0306201 2000000001c0 returned -22 [ 605.094288][T15360] pim6reg: entered allmulticast mode [ 607.002458][T15407] __nla_validate_parse: 1 callbacks suppressed [ 607.002480][T15407] netlink: 9 bytes leftover after parsing attributes in process `syz.4.3117'. [ 607.087341][T15407] netlink: 9 bytes leftover after parsing attributes in process `syz.4.3117'. [ 607.533046][T15416] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3120'. [ 607.533064][T15416] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3120'. [ 607.533078][T15416] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3120'. [ 607.584523][ T5732] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 607.752855][ T5732] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 607.752909][ T5732] usb 5-1: New USB device found, idVendor=04b4, idProduct=0001, bcdDevice= 0.00 [ 607.752935][ T5732] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 607.759100][ T5732] usb 5-1: config 0 descriptor?? [ 608.174659][ T5732] cypress 0003:04B4:0001.001E: ignoring exceeding usage max [ 608.177214][ T5732] cypress 0003:04B4:0001.001E: item fetching failed at offset 17/41 [ 608.178005][ T5732] cypress 0003:04B4:0001.001E: parse failed [ 608.178121][ T5732] cypress 0003:04B4:0001.001E: probe with driver cypress failed with error -22 [ 608.384250][T15426] overlayfs: option "index=on" is useless in a non-upper mount, ignore [ 608.384270][T15426] overlayfs: missing 'lowerdir' [ 608.395228][T15411] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 608.507858][T15434] netlink: 'syz.5.3127': attribute type 27 has an invalid length. [ 608.733726][T15440] netlink: 'syz.4.3119': attribute type 4 has an invalid length. [ 609.009273][T15442] overlayfs: failed to clone upperpath [ 610.651307][T15461] netlink: 1004 bytes leftover after parsing attributes in process `syz.0.3135'. [ 613.037690][ T5732] usb 5-1: USB disconnect, device number 27 [ 613.335940][T15490] netlink: 'syz.4.3142': attribute type 4 has an invalid length. [ 613.335958][T15490] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3142'. [ 613.600332][ T5732] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 613.752384][ T5732] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 613.752432][ T5732] usb 5-1: config 0 interface 0 has no altsetting 0 [ 613.754967][ T5732] usb 5-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=7e.ce [ 613.754999][ T5732] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 613.755022][ T5732] usb 5-1: Product: syz [ 613.755038][ T5732] usb 5-1: Manufacturer: syz [ 613.755054][ T5732] usb 5-1: SerialNumber: syz [ 613.814992][ T5732] usb 5-1: config 0 descriptor?? [ 613.827854][ T5732] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 613.844872][ T5732] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 613.845989][ T5732] dvbdev: DVB: registering new adapter (MSI DIGI VOX mini II DVB-T USB2.0) [ 613.846049][ T5732] usb 5-1: media controller created [ 613.899523][ T5732] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 613.980714][ T5732] DVB: Unable to find symbol tda10046_attach() [ 613.980738][ T5732] dvb-usb: no frontend was attached by 'MSI DIGI VOX mini II DVB-T USB2.0' [ 613.980779][ T5732] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 successfully initialized and connected. [ 614.424807][ T5732] dvb_usb_m920x 5-1:0.0: probe with driver dvb_usb_m920x failed with error -71 [ 614.459025][ T5732] usb 5-1: USB disconnect, device number 28 [ 615.587718][T15556] netlink: 64 bytes leftover after parsing attributes in process `syz.2.3166'. [ 616.634696][T15599] netlink: 128 bytes leftover after parsing attributes in process `syz.5.3182'. [ 616.999320][T15614] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:2a to non-existent VLAN 1280 [ 617.071053][ T200] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 617.220138][ T200] usb 5-1: Using ep0 maxpacket: 32 [ 617.224665][ T200] usb 5-1: unable to get BOS descriptor or descriptor too short [ 617.248715][ T200] usb 5-1: New USB device found, idVendor=09e8, idProduct=0062, bcdDevice= 0.40 [ 617.248752][ T200] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 617.248774][ T200] usb 5-1: Product: syz [ 617.248790][ T200] usb 5-1: Manufacturer: syz [ 617.248806][ T200] usb 5-1: SerialNumber: syz [ 617.525041][ T200] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 617.743805][ T200] usb 5-1: USB disconnect, device number 29 [ 617.833385][T15482] udevd[15482]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 618.139726][T15635] netlink: 'syz.4.3195': attribute type 27 has an invalid length. [ 618.165353][T15636] overlayfs: failed to clone upperpath [ 618.706160][T15649] overlayfs: failed to clone upperpath [ 618.726345][T15651] netlink: 'syz.0.3201': attribute type 21 has an invalid length. [ 618.726369][T15651] netlink: 176 bytes leftover after parsing attributes in process `syz.0.3201'. [ 618.916212][T15660] netlink: 'syz.4.3205': attribute type 21 has an invalid length. [ 618.916229][T15660] netlink: 128 bytes leftover after parsing attributes in process `syz.4.3205'. [ 618.916309][T15660] netlink: 35 bytes leftover after parsing attributes in process `syz.4.3205'. [ 619.740883][T15684] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3214'. [ 619.750165][ T5700] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 619.900306][ T5700] usb 5-1: device descriptor read/64, error -71 [ 620.140156][ T5700] usb 5-1: new high-speed USB device number 31 using dummy_hcd [ 620.270196][ T5700] usb 5-1: device descriptor read/64, error -71 [ 620.399603][ T5700] usb usb5-port1: attempt power cycle [ 620.744454][ T5700] usb 5-1: new high-speed USB device number 32 using dummy_hcd [ 620.766450][ T5700] usb 5-1: device descriptor read/8, error -71 [ 621.001856][ T5700] usb 5-1: new high-speed USB device number 33 using dummy_hcd [ 621.021256][ T5700] usb 5-1: device descriptor read/8, error -71 [ 621.131609][ T5700] usb usb5-port1: unable to enumerate USB device [ 621.662759][T15715] netlink: 6 bytes leftover after parsing attributes in process `syz.5.3223'. [ 623.019396][T15757] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3239'. [ 623.019416][T15757] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3239'. [ 623.177028][ T200] usb 5-1: new high-speed USB device number 34 using dummy_hcd [ 623.320510][ T200] usb 5-1: Using ep0 maxpacket: 16 [ 623.331657][ T200] usb 5-1: unable to get BOS descriptor or descriptor too short [ 623.333048][ T200] usb 5-1: config 1 has an invalid interface number: 21 but max is 0 [ 623.333077][ T200] usb 5-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 623.333096][ T200] usb 5-1: config 1 has an invalid descriptor of length 56, skipping remainder of the config [ 623.333121][ T200] usb 5-1: config 1 has no interface number 0 [ 623.333153][ T200] usb 5-1: config 1 interface 21 altsetting 93 bulk endpoint 0xE has invalid maxpacket 64 [ 623.333172][ T200] usb 5-1: config 1 interface 21 altsetting 93 bulk endpoint 0x83 has invalid maxpacket 1024 [ 623.333191][ T200] usb 5-1: config 1 interface 21 altsetting 93 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 623.333212][ T200] usb 5-1: config 1 interface 21 has no altsetting 0 [ 623.335585][ T200] usb 5-1: New USB device found, idVendor=0424, idProduct=9505, bcdDevice=f4.97 [ 623.335618][ T200] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 623.335641][ T200] usb 5-1: Product: syz [ 623.335657][ T200] usb 5-1: Manufacturer: syz [ 623.335674][ T200] usb 5-1: SerialNumber: syz [ 623.461507][T15752] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 623.461662][T15752] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 623.735406][ T200] smsc95xx 5-1:1.21 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -71 [ 623.735702][ T200] smsc95xx 5-1:1.21: probe with driver smsc95xx failed with error -71 [ 623.765634][ T200] usb 5-1: USB disconnect, device number 34 [ 623.825827][T15771] netlink: 6032 bytes leftover after parsing attributes in process `syz.5.3244'. [ 623.847123][T15772] netlink: 6032 bytes leftover after parsing attributes in process `syz.5.3244'. [ 623.864740][T15771] syz_tun: refused to change device tx_queue_len [ 624.226301][T15793] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 624.391450][T15798] team0: entered allmulticast mode [ 624.391474][T15798] team_slave_0: entered allmulticast mode [ 624.391502][T15798] team_slave_1: entered allmulticast mode [ 624.755427][T15809] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3901428352 (7802856704 ns) > initial count (110847878 ns). Using initial count to start timer. [ 624.824236][T15816] fuse: fd is not a fuse device [ 625.310724][T15837] netlink: 'syz.2.3270': attribute type 4 has an invalid length. [ 625.310747][T15837] netlink: 17 bytes leftover after parsing attributes in process `syz.2.3270'. [ 626.248647][T15884] netlink: 9 bytes leftover after parsing attributes in process `syz.2.3285'. [ 626.320733][T15884] netlink: 9 bytes leftover after parsing attributes in process `syz.2.3285'. [ 626.998602][T15910] netlink: 'syz.4.3297': attribute type 27 has an invalid length. [ 627.266197][T15914] netlink: 'syz.4.3300': attribute type 21 has an invalid length. [ 627.266223][T15914] netlink: 128 bytes leftover after parsing attributes in process `syz.4.3300'. [ 627.385022][T15918] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 627.385044][T15918] overlayfs: fs on './file0' does not support file handles, falling back to xino=off. [ 627.960124][ T6167] usb 5-1: new high-speed USB device number 35 using dummy_hcd [ 628.127693][ T6167] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 628.127730][ T6167] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 628.127772][ T6167] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 628.127798][ T6167] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 628.188751][ T6167] usb 5-1: config 0 descriptor?? [ 628.208877][T15934] netlink: 'syz.0.3307': attribute type 21 has an invalid length. [ 628.208903][T15934] netlink: 128 bytes leftover after parsing attributes in process `syz.0.3307'. [ 628.208970][T15934] netlink: 35 bytes leftover after parsing attributes in process `syz.0.3307'. [ 628.675731][ T6167] pyra 0003:1E7D:2CF6.001F: unknown main item tag 0x0 [ 628.675773][ T6167] pyra 0003:1E7D:2CF6.001F: unknown main item tag 0x0 [ 628.675802][ T6167] pyra 0003:1E7D:2CF6.001F: unknown main item tag 0x0 [ 628.675828][ T6167] pyra 0003:1E7D:2CF6.001F: unknown main item tag 0x0 [ 628.675874][ T6167] pyra 0003:1E7D:2CF6.001F: unknown main item tag 0x0 [ 628.675901][ T6167] pyra 0003:1E7D:2CF6.001F: unknown main item tag 0x0 [ 628.675928][ T6167] pyra 0003:1E7D:2CF6.001F: unknown main item tag 0x0 [ 628.685205][ T6167] pyra 0003:1E7D:2CF6.001F: hidraw0: USB HID v0.00 Device [HID 1e7d:2cf6] on usb-dummy_hcd.4-1/input0 [ 629.004523][T15950] netlink: 'syz.2.3314': attribute type 10 has an invalid length. [ 629.096602][T15950] dummy0: entered allmulticast mode [ 629.098861][T15950] team0: Port device dummy0 added [ 629.253449][ T6167] pyra 0003:1E7D:2CF6.001F: couldn't init struct pyra_device [ 629.253517][ T6167] pyra 0003:1E7D:2CF6.001F: couldn't install mouse [ 629.256803][ T6167] pyra 0003:1E7D:2CF6.001F: probe with driver pyra failed with error -5 [ 629.991909][ T1340] ieee802154 phy0 wpan0: encryption failed: -22 [ 630.023013][ T1340] ieee802154 phy1 wpan1: encryption failed: -22 [ 631.549559][T15995] netlink: 100 bytes leftover after parsing attributes in process `syz.0.3325'. [ 631.875853][T16009] fuse: fd is not a fuse device [ 632.192738][ T948] usb 5-1: USB disconnect, device number 35 [ 632.225279][T16022] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3336'. [ 632.225308][T16022] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3336'. [ 633.736099][T16067] netlink: 44 bytes leftover after parsing attributes in process `syz.5.3353'. [ 634.150293][T16081] fuse: fd is not a fuse device [ 634.267916][T16085] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3362'. [ 634.460781][T16096] netlink: 260 bytes leftover after parsing attributes in process `syz.2.3366'. [ 634.982117][T16105] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 635.166100][T16116] fuse: Bad value for 'fd' [ 636.358586][T16159] netlink: 9 bytes leftover after parsing attributes in process `syz.2.3389'. [ 636.360396][T16157] netlink: 284 bytes leftover after parsing attributes in process `syz.0.3388'. [ 636.421786][T16159] netlink: 9 bytes leftover after parsing attributes in process `syz.2.3389'. [ 637.160707][ T5598] Bluetooth: hci5: command 0x0406 tx timeout [ 637.430306][T16178] netlink: 25 bytes leftover after parsing attributes in process `syz.0.3397'. [ 647.564685][ T39] audit: type=1326 audit(1783971715.897:412): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=16517 comm="syz.4.3547" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f28bd2ade59 code=0x0 [ 648.645942][T16564] netlink: 'syz.4.3568': attribute type 27 has an invalid length. [ 648.831268][T16566] netlink: 'syz.4.3569': attribute type 21 has an invalid length. [ 648.831295][T16566] netlink: 128 bytes leftover after parsing attributes in process `syz.4.3569'. [ 648.831360][T16566] netlink: 43 bytes leftover after parsing attributes in process `syz.4.3569'. [ 650.636476][T16586] netlink: 'syz.4.3578': attribute type 21 has an invalid length. [ 650.636500][T16586] netlink: 128 bytes leftover after parsing attributes in process `syz.4.3578'. [ 650.636561][T16586] netlink: 35 bytes leftover after parsing attributes in process `syz.4.3578'. [ 650.760633][T16584] netlink: 'syz.5.3577': attribute type 27 has an invalid length. [ 652.296449][T16613] fuse: fd is not a fuse device [ 653.881457][T16641] IPVS: sh: FWM 3 0x00000003 - no destination available [ 653.881570][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 654.560622][T16661] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3605'. [ 654.560642][T16661] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3605'. [ 657.191736][T16701] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3620'. [ 657.191763][T16701] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3620'. [ 657.191784][T16701] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3620'. [ 658.094427][T16707] netlink: 44 bytes leftover after parsing attributes in process `syz.5.3622'. [ 659.106941][T16724] fuse: fd is not a fuse device [ 660.175942][ T5598] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 660.225150][ T5598] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 660.231790][ T5598] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 660.253117][ T5598] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 660.254580][ T5598] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 660.549175][ T5598] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 660.652656][ T5598] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 660.656500][ T5598] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 660.672245][ T5598] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 660.727719][ T5598] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 662.308581][T16798] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3649'. [ 662.308615][T16798] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3649'. [ 662.380490][ T5598] Bluetooth: hci1: command tx timeout [ 662.392056][T16750] bridge0: port 1(bridge_slave_0) entered blocking state [ 662.392318][T16750] bridge0: port 1(bridge_slave_0) entered disabled state [ 662.392551][T16750] bridge_slave_0: entered allmulticast mode [ 662.410688][T16750] bridge_slave_0: entered promiscuous mode [ 662.464389][T16750] bridge0: port 2(bridge_slave_1) entered blocking state [ 662.464791][T16750] bridge0: port 2(bridge_slave_1) entered disabled state [ 662.465088][T16750] bridge_slave_1: entered allmulticast mode [ 662.480140][T16750] bridge_slave_1: entered promiscuous mode [ 662.584500][T16750] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 662.642377][T16750] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 662.642828][T16757] bridge0: port 1(bridge_slave_0) entered blocking state [ 662.643170][T16757] bridge0: port 1(bridge_slave_0) entered disabled state [ 662.643616][T16757] bridge_slave_0: entered allmulticast mode [ 662.646069][T16757] bridge_slave_0: entered promiscuous mode [ 662.735705][T16757] bridge0: port 2(bridge_slave_1) entered blocking state [ 662.735950][T16757] bridge0: port 2(bridge_slave_1) entered disabled state [ 662.736154][T16757] bridge_slave_1: entered allmulticast mode [ 662.738679][T16757] bridge_slave_1: entered promiscuous mode [ 662.811902][T16750] team0: Port device team_slave_0 added [ 662.842844][T16750] team0: Port device team_slave_1 added [ 662.850345][T16757] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 662.892251][T16757] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 662.920140][ T5598] Bluetooth: hci6: command tx timeout [ 662.954454][T16750] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 662.954467][T16750] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 662.954488][T16750] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 663.018399][T16750] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 663.018413][T16750] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 663.018435][T16750] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 663.030434][T16757] team0: Port device team_slave_0 added [ 663.089171][T16757] team0: Port device team_slave_1 added [ 663.348083][T16757] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 663.348104][T16757] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 663.348140][T16757] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 663.515420][ T5601] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 663.567821][ T5601] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 663.582996][ T5601] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 663.595559][ T5601] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 663.618850][ T5601] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 663.879826][T16757] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 663.879840][T16757] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 663.879861][T16757] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 663.937456][T16750] hsr_slave_0: entered promiscuous mode [ 663.939830][T16750] hsr_slave_1: entered promiscuous mode [ 663.954623][T16750] debugfs: 'hsr0' already exists in 'hsr' [ 663.954653][T16750] Cannot create hsr debugfs directory [ 664.071234][T16818] netlink: 104 bytes leftover after parsing attributes in process `syz.4.3654'. [ 664.320325][T16826] netlink: 'syz.4.3656': attribute type 4 has an invalid length. [ 664.327746][T16757] hsr_slave_0: entered promiscuous mode [ 664.333382][T16757] hsr_slave_1: entered promiscuous mode [ 664.337840][T16757] debugfs: 'hsr0' already exists in 'hsr' [ 664.337907][T16757] Cannot create hsr debugfs directory [ 664.440197][ T5598] Bluetooth: hci1: command tx timeout [ 665.000182][ T5598] Bluetooth: hci6: command tx timeout [ 665.419464][T16750] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 665.811241][ T5598] Bluetooth: hci4: command tx timeout [ 665.977755][T16750] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 666.374828][T16750] team0: Port device netdevsim1 removed [ 666.377619][T16750] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 666.524447][ T5601] Bluetooth: hci1: command tx timeout [ 666.779570][T16750] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 666.866993][T16809] bridge0: port 1(bridge_slave_0) entered blocking state [ 666.867292][T16809] bridge0: port 1(bridge_slave_0) entered disabled state [ 666.867499][T16809] bridge_slave_0: entered allmulticast mode [ 666.872350][T16809] bridge_slave_0: entered promiscuous mode [ 666.884845][T16809] bridge0: port 2(bridge_slave_1) entered blocking state [ 666.885947][T16809] bridge0: port 2(bridge_slave_1) entered disabled state [ 666.886780][T16809] bridge_slave_1: entered allmulticast mode [ 666.922322][T16809] bridge_slave_1: entered promiscuous mode [ 667.009004][T16809] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 667.029027][T16809] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 667.081702][ T5601] Bluetooth: hci6: command tx timeout [ 667.085635][T16809] team0: Port device team_slave_0 added [ 667.106306][T16809] team0: Port device team_slave_1 added [ 667.156388][T16809] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 667.156403][T16809] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 667.156424][T16809] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 667.159795][T16809] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 667.159807][T16809] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 667.159828][T16809] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 667.435076][T16809] hsr_slave_0: entered promiscuous mode [ 667.437012][T16809] hsr_slave_1: entered promiscuous mode [ 667.438742][T16809] debugfs: 'hsr0' already exists in 'hsr' [ 667.438767][T16809] Cannot create hsr debugfs directory [ 667.881246][ T5601] Bluetooth: hci4: command tx timeout [ 667.881280][ T5601] Bluetooth: hci0: command 0x0406 tx timeout [ 668.349500][T16757] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 668.391208][T16757] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 668.402815][T16757] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 668.450252][T16757] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 668.473066][T16757] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 668.495535][T16757] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 668.565375][T16757] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 668.584772][T16757] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 668.603142][ T5598] Bluetooth: hci1: command tx timeout [ 668.758830][T16852] netlink: 9 bytes leftover after parsing attributes in process `syz.4.3660'. [ 668.818126][T16852] netlink: 9 bytes leftover after parsing attributes in process `syz.4.3660'. [ 668.921251][T16750] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 668.949152][T16750] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 668.969754][T16750] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 669.133462][T16750] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 669.136250][T16750] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 669.160326][ T5598] Bluetooth: hci6: command tx timeout [ 669.226318][T16750] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 669.319014][T16750] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 669.346604][T16750] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 669.565416][T16809] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 669.622786][T16809] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 669.627715][T16809] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 669.662755][T16809] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 669.668959][T16809] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 669.708364][T16809] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 669.722375][T16809] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 669.746423][T16809] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 669.898717][T16757] 8021q: adding VLAN 0 to HW filter on device bond0 [ 669.963825][ T5598] Bluetooth: hci4: command tx timeout [ 669.993421][T16757] 8021q: adding VLAN 0 to HW filter on device team0 [ 670.057223][ T6392] bridge0: port 1(bridge_slave_0) entered blocking state [ 670.057381][ T6392] bridge0: port 1(bridge_slave_0) entered forwarding state [ 670.107131][ T6392] bridge0: port 2(bridge_slave_1) entered blocking state [ 670.107337][ T6392] bridge0: port 2(bridge_slave_1) entered forwarding state [ 670.229619][T16750] 8021q: adding VLAN 0 to HW filter on device bond0 [ 670.371061][T16750] 8021q: adding VLAN 0 to HW filter on device team0 [ 670.437163][T16809] 8021q: adding VLAN 0 to HW filter on device bond0 [ 670.439595][ T1003] bridge0: port 1(bridge_slave_0) entered blocking state [ 670.439748][ T1003] bridge0: port 1(bridge_slave_0) entered forwarding state [ 670.552332][ T1003] bridge0: port 2(bridge_slave_1) entered blocking state [ 670.552581][ T1003] bridge0: port 2(bridge_slave_1) entered forwarding state [ 670.755064][T16809] 8021q: adding VLAN 0 to HW filter on device team0 [ 670.887315][ T34] bridge0: port 1(bridge_slave_0) entered blocking state [ 670.887489][ T34] bridge0: port 1(bridge_slave_0) entered forwarding state [ 671.047943][ T34] bridge0: port 2(bridge_slave_1) entered blocking state [ 671.048185][ T34] bridge0: port 2(bridge_slave_1) entered forwarding state [ 672.055714][ T5598] Bluetooth: hci4: command tx timeout [ 672.168622][T16757] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 673.039610][T16750] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 673.133161][T16757] veth0_vlan: entered promiscuous mode [ 673.211488][T16809] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 673.292066][T16757] veth1_vlan: entered promiscuous mode [ 673.568601][T16757] veth0_macvtap: entered promiscuous mode [ 673.665411][T16757] veth1_macvtap: entered promiscuous mode [ 673.869230][T16757] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 673.915860][T16757] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 673.970500][ T6392] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 674.007468][ T6392] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 674.025683][ T6392] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 674.027892][ T6392] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 675.084527][T16809] veth0_vlan: entered promiscuous mode [ 675.507806][T16750] veth0_vlan: entered promiscuous mode [ 675.535289][ T6392] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 675.535312][ T6392] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 675.577575][T16809] veth1_vlan: entered promiscuous mode [ 675.619148][T16750] veth1_vlan: entered promiscuous mode [ 675.682725][ T6392] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 675.682749][ T6392] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 675.837070][T16750] veth0_macvtap: entered promiscuous mode [ 675.851538][T16809] veth0_macvtap: entered promiscuous mode [ 675.882385][T16750] veth1_macvtap: entered promiscuous mode [ 675.896741][T16809] veth1_macvtap: entered promiscuous mode [ 676.081588][T16750] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 676.131871][T16809] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 676.176991][T16750] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 676.188898][T16956] netlink: 'syz.6.3678': attribute type 21 has an invalid length. [ 676.188962][T16956] netlink: 128 bytes leftover after parsing attributes in process `syz.6.3678'. [ 676.217186][T16809] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 676.309365][ T153] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 676.338277][ T153] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 676.347470][ T153] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 676.363862][ T153] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 676.364522][ T153] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 676.384923][ T153] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 676.403029][ T153] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 676.436701][ T153] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 678.938077][ T153] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 678.938100][ T153] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 678.992699][T16970] raw_sendmsg: syz.6.3683 forgot to set AF_INET. Fix it! [ 678.995941][T16972] netlink: 'syz.4.3684': attribute type 21 has an invalid length. [ 678.995961][T16972] netlink: 128 bytes leftover after parsing attributes in process `syz.4.3684'. [ 679.053595][T16972] netlink: 35 bytes leftover after parsing attributes in process `syz.4.3684'. [ 679.221698][ T153] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 679.221720][ T153] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 679.308910][T13502] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 679.308933][T13502] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 679.455445][T13502] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 679.455467][T13502] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 679.963741][T16986] overlayfs: failed to clone upperpath [ 680.660172][ T948] usb 8-1: new full-speed USB device number 2 using dummy_hcd [ 680.811832][ T948] usb 8-1: not running at top speed; connect to a high speed hub [ 680.813819][ T948] usb 8-1: config 13 has an invalid interface number: 152 but max is 0 [ 680.813849][ T948] usb 8-1: config 13 has no interface number 0 [ 680.813884][ T948] usb 8-1: config 13 interface 152 has no altsetting 0 [ 680.816744][ T948] usb 8-1: New USB device found, idVendor=05e1, idProduct=0408, bcdDevice=a1.0d [ 680.816770][ T948] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 680.816786][ T948] usb 8-1: Product: syz [ 680.816799][ T948] usb 8-1: Manufacturer: syz [ 680.816812][ T948] usb 8-1: SerialNumber: syz [ 680.986291][T17003] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 681.453937][ T948] usb 8-1: no audio or video endpoints found [ 681.481339][ T948] usb 8-1: USB disconnect, device number 2 [ 682.106364][T17030] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3704'. [ 682.106391][T17030] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3704'. [ 682.370103][ T5579] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 682.542924][ T5579] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 682.542985][ T5579] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 682.543078][ T5579] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 682.543125][ T5579] usb 8-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 682.543150][ T5579] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 682.562725][ T5579] usb 8-1: config 0 descriptor?? [ 684.026340][T17085] netlink: 64 bytes leftover after parsing attributes in process `syz.6.3723'. [ 684.354759][T17094] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3725'. [ 684.354784][T17094] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3725'. [ 684.354804][T17094] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3725'. [ 684.651270][T17107] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 684.654595][T17107] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 684.655387][T17106] netlink: 4116 bytes leftover after parsing attributes in process `syz.7.3729'. [ 685.197983][T17094] syz.5.3725 (17094) used greatest stack depth: 16816 bytes left [ 685.237303][T17118] fuse: fd is not a fuse device [ 686.407661][T17148] binder: 17147:17148 unknown command 0 [ 686.407685][T17148] binder: 17147:17148 ioctl c0306201 2000000001c0 returned -22 [ 687.543874][T17192] netlink: 9 bytes leftover after parsing attributes in process `syz.6.3765'. [ 687.595618][T17190] pimreg: entered allmulticast mode [ 687.607996][T17192] netlink: 9 bytes leftover after parsing attributes in process `syz.6.3765'. [ 689.267223][T17248] netlink: 'syz.7.3784': attribute type 21 has an invalid length. [ 689.267249][T17248] netlink: 128 bytes leftover after parsing attributes in process `syz.7.3784'. [ 689.949430][T17267] netlink: 'syz.4.3789': attribute type 21 has an invalid length. [ 689.949457][T17267] netlink: 128 bytes leftover after parsing attributes in process `syz.4.3789'. [ 690.304110][T17281] netlink: 'syz.5.3796': attribute type 21 has an invalid length. [ 690.304137][T17281] netlink: 128 bytes leftover after parsing attributes in process `syz.5.3796'. [ 690.304244][T17281] netlink: 35 bytes leftover after parsing attributes in process `syz.5.3796'. [ 690.779267][T17308] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 690.796467][T17308] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 690.844441][T17310] fuse: Bad value for 'fd' [ 691.108604][T17320] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3810'. [ 691.108624][T17320] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3810'. [ 691.442684][ T1340] ieee802154 phy0 wpan0: encryption failed: -22 [ 691.442799][ T1340] ieee802154 phy1 wpan1: encryption failed: -22 [ 692.230768][ T6182] bridge_slave_1: left allmulticast mode [ 692.230814][ T6182] bridge_slave_1: left promiscuous mode [ 692.231156][ T6182] bridge0: port 2(bridge_slave_1) entered disabled state [ 692.439519][ T6182] bridge_slave_0: left allmulticast mode [ 692.439565][ T6182] bridge_slave_0: left promiscuous mode [ 692.441208][ T6182] bridge0: port 1(bridge_slave_0) entered disabled state [ 693.519078][ T5598] Bluetooth: hci2: command 0x0406 tx timeout [ 693.851600][ T6182] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 693.911279][ T6182] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 693.933623][ T6182] bond0 (unregistering): Released all slaves [ 695.371994][T17392] netlink: 36 bytes leftover after parsing attributes in process `syz.6.3835'. [ 695.372019][T17392] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3835'. [ 695.372039][T17392] netlink: 36 bytes leftover after parsing attributes in process `syz.6.3835'. [ 696.357890][T17427] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 696.381938][T17427] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 696.386457][T17428] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 696.391176][T17428] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 697.766341][T17447] kthread_run failed with err -4 [ 701.069637][T17530] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 701.070820][T17530] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 701.100342][T17531] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 701.100976][T17531] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 701.314437][T17536] netlink: 'syz.6.3887': attribute type 21 has an invalid length. [ 701.314461][T17536] netlink: 128 bytes leftover after parsing attributes in process `syz.6.3887'. [ 701.692254][ T6182] hsr_slave_0: left promiscuous mode [ 701.741678][ T6182] hsr_slave_1: left promiscuous mode [ 701.744707][ T6182] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 701.744741][ T6182] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 701.787119][ T6182] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 701.787153][ T6182] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 701.904220][T17547] netlink: 'syz.6.3892': attribute type 21 has an invalid length. [ 701.904246][T17547] netlink: 128 bytes leftover after parsing attributes in process `syz.6.3892'. [ 702.015572][ T6182] veth1_macvtap: left promiscuous mode [ 702.028162][ T6182] veth0_macvtap: left promiscuous mode [ 702.096209][ T6182] veth1_vlan: left promiscuous mode [ 702.096457][ T6182] veth0_vlan: left promiscuous mode [ 702.302035][T17560] Option '/00' to dns_resolver key: bad/missing value [ 702.457941][T17564] netlink: 'syz.5.3899': attribute type 27 has an invalid length. [ 702.762923][T17571] netlink: 'syz.7.3901': attribute type 21 has an invalid length. [ 702.763152][T17571] netlink: 128 bytes leftover after parsing attributes in process `syz.7.3901'. [ 703.751938][ T6182] team0 (unregistering): Port device team_slave_1 removed [ 703.814231][ T6182] team0 (unregistering): Port device team_slave_0 removed [ 704.297201][T17571] netlink: 3 bytes leftover after parsing attributes in process `syz.7.3901'. [ 705.246138][T17594] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3909'. [ 705.246221][T17594] openvswitch: netlink: Missing key (keys=40, expected=80) [ 705.507581][T17600] 9p: Bad value for 'rfdno' [ 705.724605][T17604] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3911'. [ 705.724625][T17604] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3911'. [ 706.628517][ T6182] IPVS: stop unused estimator thread 0... [ 707.006315][T17629] tipc: Enabling of bearer rejected, failed to enable media [ 707.314855][T17634] netlink: 44 bytes leftover after parsing attributes in process `syz.5.3924'. [ 708.107884][T17655] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 708.118289][T17655] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 708.947455][T17692] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 708.948242][T17692] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 709.041393][T17696] netlink: 36 bytes leftover after parsing attributes in process `syz.6.3944'. [ 709.041411][T17696] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3944'. [ 709.041425][T17696] netlink: 36 bytes leftover after parsing attributes in process `syz.6.3944'. [ 709.442193][T17705] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3948'. [ 709.519532][T17709] binder: 17708:17709 unknown command 0 [ 709.519556][T17709] binder: 17708:17709 ioctl c0306201 2000000001c0 returned -22 [ 712.846603][T17823] fuse: fd is not a fuse device [ 712.862354][T17825] netlink: 'syz.6.3994': attribute type 21 has an invalid length. [ 712.862381][T17825] netlink: 128 bytes leftover after parsing attributes in process `syz.6.3994'. [ 712.862494][T17825] netlink: 35 bytes leftover after parsing attributes in process `syz.6.3994'. [ 712.864774][ T39] audit: type=1326 audit(1783971781.197:413): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=17818 comm="syz.4.3992" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f28bd2ade59 code=0x0 [ 712.867652][ T39] audit: type=1326 audit(1783971781.197:414): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=17818 comm="syz.4.3992" exe="/root/ci-upstream-rust-kasan-gce/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f28bd2ade59 code=0x0 [ 713.059842][T17831] netlink: 'syz.7.3996': attribute type 21 has an invalid length. [ 713.059869][T17831] netlink: 128 bytes leftover after parsing attributes in process `syz.7.3996'. [ 713.060716][T17831] netlink: 'syz.7.3996': attribute type 6 has an invalid length. [ 713.060738][T17831] netlink: 3 bytes leftover after parsing attributes in process `syz.7.3996'. [ 713.258900][T17837] netlink: 'syz.7.3998': attribute type 27 has an invalid length. [ 713.982386][T17858] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4005'. [ 713.982414][T17858] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4005'. [ 714.086866][T17861] netlink: 'syz.5.4006': attribute type 10 has an invalid length. [ 714.343836][T17861] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 714.358356][T17861] team0: Port device netdevsim1 added [ 714.613682][T17873] netlink: 9 bytes leftover after parsing attributes in process `syz.7.4010'. [ 714.718534][T17873] netlink: 9 bytes leftover after parsing attributes in process `syz.7.4010'. [ 715.605665][T17898] netlink: 44 bytes leftover after parsing attributes in process `syz.5.4019'. [ 718.572666][T17948] fuse: fd is not a fuse device [ 718.817337][T17954] netlink: 'syz.4.4040': attribute type 27 has an invalid length. [ 718.976478][T17958] binder: 17956:17958 unknown command 0 [ 718.976504][T17958] binder: 17956:17958 ioctl c0306201 2000000001c0 returned -22 [ 719.418623][T17968] netlink: 36 bytes leftover after parsing attributes in process `syz.7.4046'. [ 719.418646][T17968] netlink: 16 bytes leftover after parsing attributes in process `syz.7.4046'. [ 719.418664][T17968] netlink: 36 bytes leftover after parsing attributes in process `syz.7.4046'. [ 720.305599][T17996] sock: sock_set_timeout: `syz.6.4056' (pid 17996) tries to set negative timeout [ 721.395233][T18046] binder: 18044:18046 ioctl c0306201 200000000680 returned -14 [ 721.934680][T18059] GUP no longer grows the stack in syz.7.4072 (18059): 200000004000-20000000a000 (200000002000) [ 721.934722][T18059] CPU: 1 UID: 0 PID: 18059 Comm: syz.7.4072 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 721.934754][T18059] Tainted: [L]=SOFTLOCKUP [ 721.934763][T18059] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 721.934778][T18059] Call Trace: [ 721.934788][T18059] [ 721.934799][T18059] dump_stack_lvl+0xe8/0x150 [ 721.934835][T18059] __get_user_pages+0x22b5/0x2650 [ 721.934902][T18059] get_user_pages_remote+0x307/0xb10 [ 721.934939][T18059] ? __pfx_mtree_load+0x10/0x10 [ 721.934980][T18059] ? __pfx_get_user_pages_remote+0x10/0x10 [ 721.935014][T18059] ? __access_remote_vm+0x42c/0x6f0 [ 721.935056][T18059] __access_remote_vm+0x222/0x6f0 [ 721.935098][T18059] ? __pfx___access_remote_vm+0x10/0x10 [ 721.935131][T18059] ? __kmalloc_cache_noprof+0x3cd/0x670 [ 721.935169][T18059] ? proc_pid_cmdline_read+0x41f/0x900 [ 721.935191][T18059] ? proc_pid_cmdline_read+0x41f/0x900 [ 721.935222][T18059] proc_pid_cmdline_read+0x46e/0x900 [ 721.935246][T18059] ? __asan_memset+0x22/0x50 [ 721.935283][T18059] ? __pfx_proc_pid_cmdline_read+0x10/0x10 [ 721.935311][T18059] ? rw_verify_area+0x250/0x4d0 [ 721.935343][T18059] vfs_readv+0x588/0x850 [ 721.935377][T18059] ? __pfx_futex_wake+0x10/0x10 [ 721.935411][T18059] ? __pfx_proc_pid_cmdline_read+0x10/0x10 [ 721.935439][T18059] ? __pfx_vfs_readv+0x10/0x10 [ 721.935490][T18059] ? __fget_files+0x2a/0x420 [ 721.935520][T18059] ? __fget_files+0x3a8/0x420 [ 721.935543][T18059] ? __fget_files+0x2a/0x420 [ 721.935577][T18059] __x64_sys_preadv+0x19f/0x2c0 [ 721.935619][T18059] ? __pfx___x64_sys_preadv+0x10/0x10 [ 721.935660][T18059] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 721.935687][T18059] do_syscall_64+0x174/0x580 [ 721.935721][T18059] ? clear_bhb_loop+0x40/0x90 [ 721.935751][T18059] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 721.935776][T18059] RIP: 0033:0x7f73e93bde59 [ 721.935800][T18059] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 721.935821][T18059] RSP: 002b:00007f73e75f5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 721.935847][T18059] RAX: ffffffffffffffda RBX: 00007f73e9646090 RCX: 00007f73e93bde59 [ 721.935865][T18059] RDX: 0000000000000001 RSI: 0000200000000680 RDI: 000000000000000a [ 721.935881][T18059] RBP: 00007f73e9453e6f R08: 00000000fffffff9 R09: 0000000000000000 [ 721.935897][T18059] R10: 0000000000000016 R11: 0000000000000246 R12: 0000000000000000 [ 721.935912][T18059] R13: 00007f73e9646128 R14: 00007f73e9646090 R15: 00007ffd627a34c8 [ 721.935948][T18059] [ 722.990338][T18082] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 722.991043][T18082] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 723.572792][T18092] netlink: 'syz.4.4088': attribute type 21 has an invalid length. [ 723.572817][T18092] netlink: 128 bytes leftover after parsing attributes in process `syz.4.4088'. [ 724.022565][T18102] netlink: 'syz.4.4093': attribute type 21 has an invalid length. [ 724.022589][T18102] netlink: 128 bytes leftover after parsing attributes in process `syz.4.4093'. [ 724.022654][T18102] netlink: 3 bytes leftover after parsing attributes in process `syz.4.4093'. [ 724.266901][T18111] netlink: 'syz.5.4099': attribute type 27 has an invalid length. [ 724.326552][T18107] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 724.705159][T18121] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4102'. [ 724.705200][T18121] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4102'. [ 724.967100][T18130] netlink: 9 bytes leftover after parsing attributes in process `syz.5.4105'. [ 725.032675][T18130] netlink: 9 bytes leftover after parsing attributes in process `syz.5.4105'. [ 725.847576][T18159] netlink: 44 bytes leftover after parsing attributes in process `syz.6.4116'. [ 727.014894][T18192] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 727.015506][T18192] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 727.222990][T18193] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 727.223579][T18193] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 728.045931][T16809] do_umount: task=syz-executor[16809] propagate_mount_busy()!=0 [ 728.046277][T16809] do_umount: task=syz-executor[16809] propagate_mount_busy()!=0 [ 728.649002][T18241] netlink: 16 bytes leftover after parsing attributes in process `syz.6.4145'. [ 729.075723][T18248] netlink: 36 bytes leftover after parsing attributes in process `syz.5.4148'. [ 729.193967][T16963] usb 8-1: USB disconnect, device number 3 [ 730.127377][ T5598] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 730.222798][ T5598] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 730.242016][ T5598] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 730.274345][ T5598] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 730.275160][ T5598] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 730.619857][ T7328] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 731.054222][ T7328] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 731.686757][T18277] openvswitch: netlink: Flow actions attr not present in new flow. [ 731.713602][ T7328] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 731.847927][T18282] netlink: 'syz.6.4156': attribute type 21 has an invalid length. [ 731.847956][T18282] netlink: 128 bytes leftover after parsing attributes in process `syz.6.4156'. [ 732.376781][T18289] netlink: 36 bytes leftover after parsing attributes in process `syz.5.4159'. [ 732.376808][T18289] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4159'. [ 732.376829][T18289] netlink: 36 bytes leftover after parsing attributes in process `syz.5.4159'. [ 732.473751][T18281] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 732.473783][T18281] overlayfs: failed to set xattr on upper [ 732.473795][T18281] overlayfs: ...falling back to redirect_dir=nofollow. [ 732.473804][T18281] overlayfs: ...falling back to index=off. [ 732.521422][T16844] Bluetooth: hci4: command tx timeout [ 732.825970][ T7328] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 733.128172][T18312] openvswitch: netlink: Flow actions attr not present in new flow. [ 733.292388][T18316] netlink: 'syz.5.4168': attribute type 21 has an invalid length. [ 733.292415][T18316] netlink: 128 bytes leftover after parsing attributes in process `syz.5.4168'. [ 734.602895][T16844] Bluetooth: hci4: command tx timeout [ 734.674482][T18344] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4176'. [ 734.895681][T18357] openvswitch: netlink: Flow actions attr not present in new flow. [ 735.044978][T18363] netlink: 'syz.4.4180': attribute type 21 has an invalid length. [ 735.045004][T18363] netlink: 128 bytes leftover after parsing attributes in process `syz.4.4180'. [ 735.357720][T18258] bridge0: port 1(bridge_slave_0) entered blocking state [ 735.358064][T18258] bridge0: port 1(bridge_slave_0) entered disabled state [ 735.358321][T18258] bridge_slave_0: entered allmulticast mode [ 735.379814][T18258] bridge_slave_0: entered promiscuous mode [ 735.582052][ T7328] bridge_slave_1: left allmulticast mode [ 735.582092][ T7328] bridge_slave_1: left promiscuous mode [ 735.582407][ T7328] bridge0: port 2(bridge_slave_1) entered disabled state [ 735.746033][ T7328] bridge_slave_0: left allmulticast mode [ 735.746064][ T7328] bridge_slave_0: left promiscuous mode [ 735.746275][ T7328] bridge0: port 1(bridge_slave_0) entered disabled state [ 735.977906][T18390] netlink: 'syz.4.4192': attribute type 21 has an invalid length. [ 735.977924][T18390] netlink: 128 bytes leftover after parsing attributes in process `syz.4.4192'. [ 736.680123][T16844] Bluetooth: hci4: command tx timeout [ 737.010965][ T7328] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 737.091039][ T7328] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 737.133820][ T7328] bond0 (unregistering): Released all slaves [ 737.173369][T18258] bridge0: port 2(bridge_slave_1) entered blocking state [ 737.173766][T18258] bridge0: port 2(bridge_slave_1) entered disabled state [ 737.174077][T18258] bridge_slave_1: entered allmulticast mode [ 737.201241][T18258] bridge_slave_1: entered promiscuous mode [ 737.451459][T18400] fuse: fd is not a fuse device [ 737.663424][T18258] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 737.703207][T18258] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 737.709139][T18406] netlink: 'syz.4.4198': attribute type 21 has an invalid length. [ 737.709164][T18406] netlink: 128 bytes leftover after parsing attributes in process `syz.4.4198'. [ 737.807368][T18406] netlink: 3 bytes leftover after parsing attributes in process `syz.4.4198'. [ 737.934779][T18258] team0: Port device team_slave_0 added [ 737.965675][T18258] team0: Port device team_slave_1 added [ 738.252061][T18414] netlink: 'syz.4.4200': attribute type 5 has an invalid length. [ 738.473169][T18258] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 738.473188][T18258] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 738.473220][T18258] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 738.650377][T18429] fuse: fd is not a fuse device [ 738.761386][T16844] Bluetooth: hci4: command tx timeout [ 738.796457][T18435] netlink: 'syz.4.4205': attribute type 27 has an invalid length. [ 739.009639][T18442] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4207'. [ 739.009668][T18442] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4207'. [ 739.036404][T18258] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 739.036423][T18258] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 739.036454][T18258] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 739.273072][T18446] /dev/nullb0: Can't lookup blockdev [ 739.278851][T18445] overlayfs: failed to clone lowerpath [ 739.386522][T18450] netlink: 9 bytes leftover after parsing attributes in process `syz.5.4209'. [ 739.439211][T18445] overlayfs: failed to clone lowerpath [ 739.520494][T18450] netlink: 9 bytes leftover after parsing attributes in process `syz.5.4209'. [ 739.668887][ T5253] 8021q: adding VLAN 0 to HW filter on device eth5 [ 739.696076][T18458] fuse: fd is not a fuse device [ 740.247358][T18258] hsr_slave_0: entered promiscuous mode [ 740.262158][T18258] hsr_slave_1: entered promiscuous mode [ 740.266554][T18258] debugfs: 'hsr0' already exists in 'hsr' [ 740.266583][T18258] Cannot create hsr debugfs directory [ 740.450211][ T7328] hsr_slave_0: left promiscuous mode [ 740.492441][ T7328] hsr_slave_1: left promiscuous mode [ 740.493598][ T7328] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 740.493627][ T7328] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 740.534722][ T7328] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 740.534753][ T7328] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 740.627752][T18489] netlink: 44 bytes leftover after parsing attributes in process `syz.6.4221'. [ 740.714535][ T7328] veth1_macvtap: left promiscuous mode [ 740.714645][ T7328] veth0_macvtap: left promiscuous mode [ 740.715029][ T7328] veth1_vlan: left promiscuous mode [ 740.715248][ T7328] veth0_vlan: left promiscuous mode [ 741.941009][ T7328] team0 (unregistering): Port device team_slave_1 removed [ 741.993599][ T7328] team0 (unregistering): Port device team_slave_0 removed [ 744.708176][T18562] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4243'. [ 744.975792][ T5253] 8021q: adding VLAN 0 to HW filter on device eth6 [ 745.314762][T18258] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 745.621885][T18258] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 745.633903][T18258] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 745.935693][T18258] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 745.947074][T18258] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 746.035403][T18258] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 746.043351][T18258] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 746.137338][T18258] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 746.516900][ T5253] 8021q: adding VLAN 0 to HW filter on device eth7 [ 746.648635][T18258] 8021q: adding VLAN 0 to HW filter on device bond0 [ 746.773209][T18258] 8021q: adding VLAN 0 to HW filter on device team0 [ 746.916292][ T5840] bridge0: port 1(bridge_slave_0) entered blocking state [ 746.940885][ T5840] bridge0: port 1(bridge_slave_0) entered forwarding state [ 747.057321][ T6190] bridge0: port 2(bridge_slave_1) entered blocking state [ 747.057506][ T6190] bridge0: port 2(bridge_slave_1) entered forwarding state [ 749.055372][ T5253] 8021q: adding VLAN 0 to HW filter on device eth8 [ 749.082397][T18683] netlink: 36 bytes leftover after parsing attributes in process `syz.6.4271'. [ 749.082423][T18683] netlink: 16 bytes leftover after parsing attributes in process `syz.6.4271'. [ 749.082444][T18683] netlink: 36 bytes leftover after parsing attributes in process `syz.6.4271'. [ 749.906160][T18258] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 751.048817][T18258] veth0_vlan: entered promiscuous mode [ 751.072885][T18258] veth1_vlan: entered promiscuous mode [ 751.155449][T18258] veth0_macvtap: entered promiscuous mode [ 751.174005][T18258] veth1_macvtap: entered promiscuous mode [ 751.243999][T18258] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 751.309220][T18258] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 751.381196][ T5840] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 751.384336][ T5840] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 751.388735][ T5840] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 751.432201][ T5840] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 751.469034][T18739] netlink: 36 bytes leftover after parsing attributes in process `syz.5.4284'. [ 751.469057][T18739] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4284'. [ 751.469076][T18739] netlink: 36 bytes leftover after parsing attributes in process `syz.5.4284'. [ 752.891230][ T1340] ieee802154 phy0 wpan0: encryption failed: -22 [ 752.891347][ T1340] ieee802154 phy1 wpan1: encryption failed: -22 [ 753.290350][T18768] fuse: fd is not a fuse device [ 753.481871][T18773] netlink: 'syz.4.4298': attribute type 21 has an invalid length. [ 753.481895][T18773] netlink: 128 bytes leftover after parsing attributes in process `syz.4.4298'. [ 753.652673][T18773] netlink: 3 bytes leftover after parsing attributes in process `syz.4.4298'. [ 753.692727][ T6046] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 753.692751][ T6046] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 754.398355][ T6046] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 754.398379][ T6046] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 754.887654][T18795] fuse: Bad value for 'fd' [ 755.017415][T18797] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4306'. [ 755.017435][T18797] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4306'. [ 756.060127][ T5700] usb 9-1: new full-speed USB device number 2 using dummy_hcd [ 756.231070][ T5700] usb 9-1: config 0 has an invalid interface number: 117 but max is 0 [ 756.231106][ T5700] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 756.231128][ T5700] usb 9-1: config 0 has no interface number 0 [ 756.231180][ T5700] usb 9-1: config 0 interface 117 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 10 [ 756.231210][ T5700] usb 9-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 756.231236][ T5700] usb 9-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 756.235656][ T5700] usb 9-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 756.235691][ T5700] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 756.235716][ T5700] usb 9-1: Product: syz [ 756.235734][ T5700] usb 9-1: Manufacturer: syz [ 756.235750][ T5700] usb 9-1: SerialNumber: syz [ 756.290130][ T5700] usb 9-1: config 0 descriptor?? [ 756.782293][ T5700] usbtouchscreen 9-1:0.117: probe with driver usbtouchscreen failed with error -71 [ 756.830236][ T5700] usb 9-1: USB disconnect, device number 2 [ 759.006210][T18909] overlayfs: failed to clone upperpath [ 759.723378][T18944] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4355'. [ 760.032520][T18952] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4359'. [ 760.203093][T18962] netlink: 132 bytes leftover after parsing attributes in process `syz.5.4362'. [ 760.620199][T18979] netlink: 36 bytes leftover after parsing attributes in process `syz.5.4367'. [ 760.620225][T18979] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4367'. [ 760.620245][T18979] netlink: 36 bytes leftover after parsing attributes in process `syz.5.4367'. [ 761.333878][T19006] netlink: 'syz.6.4374': attribute type 10 has an invalid length. [ 761.333902][T19006] netlink: 2 bytes leftover after parsing attributes in process `syz.6.4374'. [ 761.333935][T19006] veth1_virt_wifi: entered promiscuous mode [ 761.334635][T19006] bridge0: port 3(veth1_virt_wifi) entered blocking state [ 761.339337][T19006] bridge0: port 3(veth1_virt_wifi) entered disabled state [ 761.377668][T19006] veth1_virt_wifi: entered allmulticast mode [ 761.420689][T19006] veth1_virt_wifi: left allmulticast mode [ 762.376676][T19039] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4383'. [ 762.376721][T19039] netlink: 128 bytes leftover after parsing attributes in process `syz.5.4383'. [ 762.443194][ T5755] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 762.627217][ T5755] usb 9-1: config 220 has an invalid interface number: 76 but max is 2 [ 762.627249][ T5755] usb 9-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 762.627272][ T5755] usb 9-1: config 220 has no interface number 2 [ 762.627346][ T5755] usb 9-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 762.627378][ T5755] usb 9-1: config 220 interface 0 has no altsetting 0 [ 762.627399][ T5755] usb 9-1: config 220 interface 76 has no altsetting 0 [ 762.627420][ T5755] usb 9-1: config 220 interface 1 has no altsetting 0 [ 762.700455][ T5755] usb 9-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 762.700491][ T5755] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 762.700515][ T5755] usb 9-1: Product: syz [ 762.700531][ T5755] usb 9-1: Manufacturer: syz [ 762.700548][ T5755] usb 9-1: SerialNumber: syz [ 763.233372][T19060] netlink: 24 bytes leftover after parsing attributes in process `syz.5.4386'. [ 764.036875][T19079] fuse: fd is not a fuse device [ 764.375499][T19084] overlayfs: failed to clone upperpath [ 764.669685][T19092] netlink: 'syz.4.4395': attribute type 21 has an invalid length. [ 764.897727][T19098] bond0: Error: Cannot enslave bond to itself. [ 765.144668][T19105] __nla_validate_parse: 2 callbacks suppressed [ 765.144694][T19105] netlink: 9 bytes leftover after parsing attributes in process `syz.5.4400'. [ 765.220789][T19105] netlink: 9 bytes leftover after parsing attributes in process `syz.5.4400'. [ 765.226602][ T5755] usb 9-1: selecting invalid altsetting 0 [ 765.297127][ T5755] uvcvideo 9-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 765.297164][ T5755] uvcvideo 9-1:220.0: No valid video chain found. [ 765.371101][ T5755] usb 9-1: selecting invalid altsetting 0 [ 765.371145][ T5755] usbtest 9-1:220.1: probe with driver usbtest failed with error -22 [ 765.411465][ T5755] usb 9-1: USB disconnect, device number 3 [ 765.637377][T19118] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4405'. [ 765.637406][T19118] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4405'. [ 766.422310][T19135] fuse: Bad value for 'fd' [ 766.446261][T19142] syzkaller1: entered promiscuous mode [ 766.446289][T19142] syzkaller1: entered allmulticast mode [ 768.740256][ T5580] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 768.910221][ T5580] usb 9-1: Using ep0 maxpacket: 8 [ 768.913123][ T5580] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 768.913162][ T5580] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 768.913314][ T5580] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 768.913343][ T5580] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 768.913392][ T5580] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 768.913420][ T5580] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 769.121930][T19213] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4435'. [ 769.121955][T19213] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4435'. [ 769.206636][ T5580] usb 9-1: GET_CAPABILITIES returned 0 [ 769.206697][ T5580] usbtmc 9-1:16.0: can't read capabilities [ 769.243361][T19214] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 769.259447][T19214] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 769.313609][ T5580] usb 9-1: USB disconnect, device number 4 [ 769.434265][T19222] netlink: 'syz.8.4438': attribute type 23 has an invalid length. [ 769.563272][T19225] binder: 19224:19225 unknown command 0 [ 769.563291][T19225] binder: 19224:19225 ioctl c0306201 2000000001c0 returned -22 [ 770.234894][T19239] ./bus: Can't lookup blockdev [ 770.262031][T19240] netlink: 132 bytes leftover after parsing attributes in process `syz.4.4445'. [ 770.479939][ T5598] Bluetooth: hci2: unexpected event for opcode 0x1005 [ 771.623815][T19275] overlayfs: failed to clone lowerpath [ 772.602539][T19296] 9p: Bad value for 'wfdno' [ 772.731356][T19298] binder: 19297:19298 ioctl c0306201 200000000680 returned -14 [ 773.236145][T19311] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4470'. [ 773.236172][T19311] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4470'. [ 773.236193][T19311] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4470'. [ 773.794379][T19328] netlink: 'syz.5.4479': attribute type 27 has an invalid length. [ 774.014723][T19332] netlink: 40 bytes leftover after parsing attributes in process `syz.5.4481'. [ 774.014747][T19332] netlink: 40 bytes leftover after parsing attributes in process `syz.5.4481'. [ 774.491930][ T948] hid-generic 0006:0008:0001.0020: unknown main item tag 0x0 [ 774.491968][ T948] hid-generic 0006:0008:0001.0020: unknown main item tag 0x0 [ 774.491995][ T948] hid-generic 0006:0008:0001.0020: unknown main item tag 0x0 [ 774.492022][ T948] hid-generic 0006:0008:0001.0020: unknown main item tag 0x0 [ 774.492050][ T948] hid-generic 0006:0008:0001.0020: unknown main item tag 0x0 [ 774.492077][ T948] hid-generic 0006:0008:0001.0020: unknown main item tag 0x0 [ 774.492104][ T948] hid-generic 0006:0008:0001.0020: unknown main item tag 0x0 [ 774.492132][ T948] hid-generic 0006:0008:0001.0020: unknown main item tag 0x0 [ 774.492161][ T948] hid-generic 0006:0008:0001.0020: unknown main item tag 0x0 [ 774.492200][ T948] hid-generic 0006:0008:0001.0020: unknown main item tag 0x0 [ 774.585447][ T948] hid-generic 0006:0008:0001.0020: hidraw0: VIRTUAL HID v0.04 Device [syz1] on syz0 [ 774.640980][ T5579] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 774.790284][ T5579] usb 9-1: Using ep0 maxpacket: 8 [ 774.888930][ T5579] usb 9-1: unable to get BOS descriptor or descriptor too short [ 774.890909][ T5579] usb 9-1: unable to read config index 0 descriptor/start: -71 [ 774.891008][ T5579] usb 9-1: can't read configurations, error -71 [ 775.038735][T19359] fuse: fd is not a fuse device [ 775.111743][T19362] netlink: 14 bytes leftover after parsing attributes in process `syz.4.4493'. [ 775.223078][T19369] netlink: 'syz.5.4495': attribute type 21 has an invalid length. [ 775.223097][T19369] netlink: 128 bytes leftover after parsing attributes in process `syz.5.4495'. [ 775.223149][T19369] netlink: 35 bytes leftover after parsing attributes in process `syz.5.4495'. [ 775.301885][T19371] netlink: 112 bytes leftover after parsing attributes in process `syz.5.4496'. [ 775.485114][ T5598] Bluetooth: Unexpected start frame (len 10) [ 775.669129][T19380] netlink: 28 bytes leftover after parsing attributes in process `syz.8.4500'. [ 775.929501][T19394] netlink: 9 bytes leftover after parsing attributes in process `syz.4.4504'. [ 775.990429][T19394] netlink: 9 bytes leftover after parsing attributes in process `syz.4.4504'. [ 776.043573][T19396] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4505'. [ 776.043593][T19396] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4505'. [ 776.596465][T16844] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 776.669394][T16844] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 776.719203][T16844] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 776.721299][T16844] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 776.744693][T16844] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 777.055380][T19416] netlink: 14 bytes leftover after parsing attributes in process `syz.5.4512'. [ 777.344588][T19416] bridge0: port 2(bridge_slave_1) entered disabled state [ 777.346211][T19416] bridge0: port 1(bridge_slave_0) entered disabled state [ 777.442809][ T5598] Bluetooth: Unexpected start frame (len 10) [ 777.475502][T19424] syzkaller1: entered promiscuous mode [ 777.475529][T19424] syzkaller1: entered allmulticast mode [ 778.760448][T19409] bridge0: port 1(bridge_slave_0) entered blocking state [ 778.762392][T19409] bridge0: port 1(bridge_slave_0) entered disabled state [ 778.762692][T19409] bridge_slave_0: entered allmulticast mode [ 778.769385][T19409] bridge_slave_0: entered promiscuous mode [ 779.020724][ T5598] Bluetooth: hci7: command tx timeout [ 779.021552][ T5598] Bluetooth: Unexpected start frame (len 10) [ 779.113370][T19461] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4524'. [ 779.145604][T19409] bridge0: port 2(bridge_slave_1) entered blocking state [ 779.145889][T19409] bridge0: port 2(bridge_slave_1) entered disabled state [ 779.146257][T19409] bridge_slave_1: entered allmulticast mode [ 779.148824][T19409] bridge_slave_1: entered promiscuous mode [ 779.269013][T19409] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 779.287168][T19409] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 779.358682][T19409] team0: Port device team_slave_0 added [ 779.381292][T19409] team0: Port device team_slave_1 added [ 779.396181][T19461] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4524'. [ 779.705866][T19409] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 779.705886][T19409] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 779.705918][T19409] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 779.739938][T19409] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 779.739998][T19409] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 779.740031][T19409] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 780.012901][T19409] hsr_slave_0: entered promiscuous mode [ 780.015602][T19409] hsr_slave_1: entered promiscuous mode [ 780.017280][T19409] debugfs: 'hsr0' already exists in 'hsr' [ 780.017302][T19409] Cannot create hsr debugfs directory [ 780.160268][ T948] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 780.330155][ T948] usb 9-1: Using ep0 maxpacket: 8 [ 780.336043][ T948] usb 9-1: unable to get BOS descriptor or descriptor too short [ 780.344225][ T948] usb 9-1: config 1 interface 0 has no altsetting 0 [ 780.376797][ T948] usb 9-1: string descriptor 0 read error: -22 [ 780.376944][ T948] usb 9-1: New USB device found, idVendor=0f30, idProduct=0111, bcdDevice= 0.40 [ 780.376971][ T948] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 780.894126][ T948] hid_parser_main: 99 callbacks suppressed [ 780.894196][ T948] pantherlord 0003:0F30:0111.0021: unknown main item tag 0x0 [ 780.894230][ T948] pantherlord 0003:0F30:0111.0021: unknown main item tag 0x0 [ 780.894267][ T948] pantherlord 0003:0F30:0111.0021: unknown main item tag 0x0 [ 780.894296][ T948] pantherlord 0003:0F30:0111.0021: unknown main item tag 0x0 [ 780.894325][ T948] pantherlord 0003:0F30:0111.0021: unknown main item tag 0x0 [ 780.894354][ T948] pantherlord 0003:0F30:0111.0021: unknown main item tag 0x0 [ 780.894384][ T948] pantherlord 0003:0F30:0111.0021: unknown main item tag 0x0 [ 780.894413][ T948] pantherlord 0003:0F30:0111.0021: unknown main item tag 0x0 [ 780.894442][ T948] pantherlord 0003:0F30:0111.0021: unknown main item tag 0x0 [ 780.894472][ T948] pantherlord 0003:0F30:0111.0021: unknown main item tag 0x0 [ 781.064805][ T948] pantherlord 0003:0F30:0111.0021: hidraw0: USB HID v0.ff Device [HID 0f30:0111] on usb-dummy_hcd.8-1/input0 [ 781.064917][ T948] pantherlord 0003:0F30:0111.0021: no output reports found [ 781.080870][T16844] Bluetooth: hci7: command tx timeout [ 781.143408][T19474] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 781.146970][T19474] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 781.206634][ T948] usb 9-1: USB disconnect, device number 7 [ 781.276339][T19477] fido_id[19477]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.8/usb9/report_descriptor': No such file or directory [ 781.647457][T19409] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 781.684478][T19409] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 781.687752][T19409] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 781.816638][T19409] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 781.819656][T19409] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 781.936445][T19482] netlink: 8 bytes leftover after parsing attributes in process `syz.8.4532'. [ 782.124441][T19409] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 782.153793][T19409] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 782.238801][T19409] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 782.477682][T16844] Bluetooth: Unexpected start frame (len 10) [ 782.708480][T19509] fuse: fd is not a fuse device [ 782.900352][T19511] netlink: 44 bytes leftover after parsing attributes in process `syz.8.4537'. [ 783.027834][T19409] 8021q: adding VLAN 0 to HW filter on device bond0 [ 783.128150][T19409] 8021q: adding VLAN 0 to HW filter on device team0 [ 783.160514][T16844] Bluetooth: hci7: command tx timeout [ 783.177730][ T6397] bridge0: port 1(bridge_slave_0) entered blocking state [ 783.177923][ T6397] bridge0: port 1(bridge_slave_0) entered forwarding state [ 783.275828][ T7323] bridge0: port 2(bridge_slave_1) entered blocking state [ 783.276023][ T7323] bridge0: port 2(bridge_slave_1) entered forwarding state [ 783.986572][ T5601] Bluetooth: Unexpected start frame (len 10) [ 784.012629][T19537] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4547'. [ 784.068473][ T5601] Bluetooth: hci2: unexpected event for opcode 0x1005 [ 785.240272][ T5601] Bluetooth: hci7: command tx timeout [ 785.602207][T19409] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 785.640919][ T5601] Bluetooth: hci1: command 0x0406 tx timeout [ 785.677711][T19578] Bluetooth: hci6: command 0x0406 tx timeout [ 785.831666][ T948] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 786.020056][ T948] usb 9-1: Using ep0 maxpacket: 16 [ 786.070779][ T948] usb 9-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 786.070818][ T948] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 786.075872][ T948] usb 9-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 786.075904][ T948] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 786.075927][ T948] usb 9-1: Product: syz [ 786.075942][ T948] usb 9-1: Manufacturer: syz [ 786.075959][ T948] usb 9-1: SerialNumber: syz [ 786.131597][ T948] usb 9-1: config 0 descriptor?? [ 786.189376][ T948] em28xx 9-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 786.189419][ T948] em28xx 9-1:0.0: Audio interface 0 found (Vendor Class) [ 786.410531][ T948] em28xx 9-1:0.0: unknown em28xx chip ID (0) [ 786.419817][ T948] em28xx 9-1:0.0: Config register raw data: 0xfffffffb [ 786.420510][ T948] em28xx 9-1:0.0: AC97 chip type couldn't be determined [ 786.420564][ T948] em28xx 9-1:0.0: No AC97 audio processor [ 786.511565][ T948] usb 9-1: USB disconnect, device number 8 [ 786.541059][ T948] em28xx 9-1:0.0: Disconnecting em28xx [ 786.578475][T19409] veth0_vlan: entered promiscuous mode [ 786.668583][T19409] veth1_vlan: entered promiscuous mode [ 786.725782][ T948] em28xx 9-1:0.0: Freeing device [ 786.836170][T19409] veth0_macvtap: entered promiscuous mode [ 786.871184][T19409] veth1_macvtap: entered promiscuous mode [ 787.031947][T19409] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 787.053855][T19409] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 787.128028][ T5837] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 787.128597][ T5837] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 787.128711][ T5837] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 787.174019][ T5837] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 788.746711][ T40] INFO: task syz.2.3511:16433 blocked for more than 143 seconds. [ 788.746741][ T40] Tainted: G L syzkaller #0 [ 788.746755][ T40] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 788.746766][ T40] task:syz.2.3511 state:D stack:28512 pid:16433 tgid:16432 ppid:13277 task_flags:0x400140 flags:0x00080002 [ 788.746834][ T40] Call Trace: [ 788.746842][ T40] [ 788.746857][ T40] __schedule+0x1709/0x5530 [ 788.746890][ T40] ? __lock_acquire+0x6df/0x2e40 [ 788.746939][ T40] ? __pfx___schedule+0x10/0x10 [ 788.746962][ T40] ? lock_acquire+0x115/0x350 [ 788.746994][ T40] ? schedule+0x90/0x2b0 [ 788.747024][ T40] schedule+0x164/0x2b0 [ 788.747069][ T40] cgroup_lock_and_drain_offline+0x51a/0x650 [ 788.747119][ T40] ? __pfx_cgroup_lock_and_drain_offline+0x10/0x10 [ 788.747155][ T40] ? __pfx_autoremove_wake_function+0x10/0x10 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 788.747187][ T40] ? safesetid_security_capable+0xa9/0x1a0 [ 788.747216][ T40] ? bpf_lsm_capable+0x9/0x20 [ 788.747241][ T40] ? security_capable+0x74/0x280 [ 788.747274][ T40] cgroup1_get_tree+0x9d/0x890 [ 788.747303][ T40] ? cap_capable+0x123/0x460 [ 788.747338][ T40] ? safesetid_security_capable+0xa9/0x1a0 [ 788.747365][ T40] ? bpf_lsm_capable+0x9/0x20 [ 788.747391][ T40] vfs_get_tree+0x92/0x2a0 [ 788.747422][ T40] do_new_mount+0x319/0xdc0 [ 788.747445][ T40] ? cap_capable+0x123/0x460 [ 788.747483][ T40] ? __pfx_do_new_mount+0x10/0x10 [ 788.747508][ T40] ? ns_capable+0x89/0xe0 [ 788.747652][ T40] ? path_mount+0x647/0x1050 [ 788.747682][ T40] ? user_path_at+0xd4/0x160 [ 788.747712][ T40] __se_sys_mount+0x31d/0x420 [ 788.747744][ T40] ? __pfx___se_sys_mount+0x10/0x10 [ 788.747776][ T40] ? __x64_sys_mount+0x20/0xc0 [ 788.747800][ T40] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 788.747827][ T40] do_syscall_64+0x174/0x580 [ 788.747855][ T40] ? trace_irq_disable+0x3b/0x140 [ 788.747878][ T40] ? clear_bhb_loop+0x40/0x90 [ 788.747905][ T40] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 788.747927][ T40] RIP: 0033:0x7f77f4ffde59 [ 788.747948][ T40] RSP: 002b:00007f77f3256028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 788.747973][ T40] RAX: ffffffffffffffda RBX: 00007f77f5285fa0 RCX: 00007f77f4ffde59 [ 788.747990][ T40] RDX: 0000200000000040 RSI: 0000200000000140 RDI: 0000000000000000 [ 788.748007][ T40] RBP: 00007f77f5093e6f R08: 0000200000000100 R09: 0000000000000000 [ 788.748023][ T40] R10: 000000000000000c R11: 0000000000000246 R12: 0000000000000000 [ 788.748046][ T40] R13: 00007f77f5286038 R14: 00007f77f5285fa0 R15: 00007ffdd6a4f698 [ 788.748083][ T40] [ 788.748144][ T40] [ 788.748144][ T40] Showing all locks held in the system: [ 788.748160][ T40] locks held by khungtaskd/40: 1, last CPU#1: [ 788.756631][ T40] #0: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 788.757275][ T40] locks held by kworker/u8:15/4299: 13, last CPU#0: [ 788.757320][ T40] #0: ffff88802be58938 ((wq_completion)wg-kex-wg2#18){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 [ 788.757513][ T40] #1: ffffc90011ab7c60 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 [ 788.757666][ T40] #2: ffffffff8e2592e0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 788.757812][ T40] #3: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 788.757914][ T40] #4: ffff8880409b6230 (&peer->endpoint_lock){++..}-{3:3}, at: wg_socket_send_skb_to_peer+0x6e/0x200 [ 788.758300][ T40] #5: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: rt_read_lock+0x277/0x4b0 [ 788.758446][ T40] #6: ffffffff8e2592e0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 788.788592][ T40] #7: ffffffff8e3c38a0 (rcu_read_lock_bh){....}-{1:3}, at: send6+0x255/0x920 [ 788.788747][ T40] #8: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: ip6_output+0x11e/0x540 [ 788.788915][ T40] #9: ffffffff8e2592e0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 788.789075][ T40] #10: ffffffff8f8f1578 (&tbl->lock){+...}-{3:3}, at: ___neigh_create+0x22b/0x23a0 [ 788.789247][ T40] #11: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 [ 788.789385][ T40] #12: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: rt_write_lock+0x86/0x220 [ 788.789745][ T40] locks held by udevd/4958: 4, last CPU#0: [ 788.789791][ T40] #0: ffff88801af56db0 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa5/0xcb0 [ 788.790061][ T40] #1: ffff888030cafc78 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 [ 788.805837][ T40] #2: ffff8880270e5698 (kn->active#5){++++}-{0:0}, at: kernfs_seq_start+0xb2/0x420 [ 788.806066][ T40] #3: ffffffff8e4eee60 (fs_reclaim){+.+.}-{0:0}, at: __kmalloc_cache_noprof+0x5e/0x670 [ 788.809969][ T40] locks held by getty/5340: 2, on CPU#0: [ 788.809991][ T40] #0: ffff88803646e0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 788.810145][ T40] #1: ffffc900044ce2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x460/0x1360 [ 788.810325][ T40] locks held by syz-executor/5577: 4, last CPU#1: [ 788.810589][ T40] #0: ffff8880359e7030 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 [ 788.810762][ T40] #1: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x200 [ 788.810922][ T40] #2: ffff88803fc5fe98 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 [ 788.811069][ T40] #3: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 [ 788.866966][ T40] locks held by kworker/0:3/5579: 5, last CPU#0: [ 788.867037][ T40] #0: ffff88805aed7538 ((wq_completion)wg-kex-wg2#14){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 [ 788.867257][ T40] #1: ffffc90004dc7c60 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 [ 788.867448][ T40] #2: ffffffff8e2592e0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 788.867570][ T40] #3: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 788.867673][ T40] #4: ffff8880b8638eb8 ((bh_lock)){+...}-{3:3}, at: napi_skb_cache_get+0xbf/0x450 [ 788.867824][ T40] locks held by kworker/0:4/5700: 5, last CPU#0: [ 788.867874][ T40] #0: ffff88805efa7938 ((wq_completion)wg-crypt-wg1#8){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 [ 788.868034][ T40] #1: ffffc90005db7c60 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 [ 788.868178][ T40] #2: ffffffff8e2592e0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 788.868324][ T40] #3: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 788.868471][ T40] #4: ffffffff8e3c38a0 (rcu_read_lock_bh){....}-{1:3}, at: wg_packet_send_queued_handshake_initiation+0x5a/0x340 [ 788.916059][ T40] locks held by kworker/1:6/5755: 9, last CPU#1: [ 788.916105][ T40] #0: ffff88803a11e538 ((wq_completion)wg-crypt-wg2#14){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 [ 788.916280][ T40] #1: ffffc90005e77c60 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 [ 788.916433][ T40] #2: ffffffff8e2592e0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 788.916606][ T40] #3: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 788.916758][ T40] #4: ffff88808143e230 (&peer->endpoint_lock){++..}-{3:3}, at: wg_socket_send_skb_to_peer+0x6e/0x200 [ 788.916901][ T40] #5: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: rt_read_lock+0x277/0x4b0 [ 788.917045][ T40] #6: ffffffff8e2592e0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 788.917201][ T40] #7: ffffffff8e3c38a0 (rcu_read_lock_bh){....}-{1:3}, at: send4+0x217/0xec0 [ 788.917335][ T40] #8: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: ip_route_output_key_hash+0xd8/0x2a0 [ 788.917528][ T40] locks held by kworker/u8:16/5837: 1, last CPU#0: [ 788.964218][ T40] #0: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: process_one_work+0x7fd/0x1480 [ 788.964346][ T40] locks held by kworker/1:7/6127: 2, last CPU#1: [ 788.964360][ T40] #0: ffff88808151d538 ((wq_completion)wg-crypt-wg1#13){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 [ 788.964405][ T40] #1: ffffc90005e97c60 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 [ 788.964447][ T40] locks held by kworker/u8:30/6175: 5, last CPU#1: [ 788.964460][ T40] #0: ffff888033140938 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 [ 788.964499][ T40] #1: ffffc90005707c60 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 [ 788.964546][ T40] #2: ffffffff8e2592e0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 788.964588][ T40] #3: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 788.964627][ T40] #4: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 [ 788.964667][ T40] locks held by kworker/u8:31/6176: 2, on CPU#1: [ 788.964680][ T40] #0: ffff88801aea4138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 [ 788.964720][ T40] #1: ffffc900056d7c60 (connector_reaper_work){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 [ 788.964760][ T40] locks held by kworker/u8:36/6183: 4, last CPU#1: [ 788.964773][ T40] #0: ffff88801aea4138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 [ 788.964813][ T40] #1: ffffc90004d67c60 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 [ 788.964854][ T40] #2: ffff888081c608d8 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 788.964895][ T40] #3: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 788.964936][ T40] locks held by kworker/u8:40/6189: 8, last CPU#1: [ 788.964949][ T40] #0: ffff88801aea4138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 [ 788.964992][ T40] #1: ffffc90005e07c60 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 [ 788.965040][ T40] #2: ffff88802e180310 (&devlink->lock_key#8){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xcb0 [ 788.965095][ T40] #3: ffff88803495b520 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1e0/0xcb0 [ 788.965138][ T40] #4: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 [ 788.965176][ T40] #5: ffffffff8e2592e0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 788.965216][ T40] #6: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 788.965256][ T40] #7: ffff8880b8738eb8 ((bh_lock)){+...}-{3:3}, at: napi_skb_cache_get+0xbf/0x450 [ 788.965300][ T40] locks held by kworker/u8:45/6391: 3, last CPU#1: [ 788.965313][ T40] #0: ffff8880590ca938 ((wq_completion)wg-kex-wg2#28){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 [ 788.965358][ T40] #1: ffffc900049f7c60 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 [ 788.965400][ T40] #2: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 [ 788.965443][ T40] locks held by kworker/u8:46/6392: 8, last CPU#1: [ 788.965457][ T40] #0: ffff88801aea4138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 [ 788.965503][ T40] #1: ffffc900045a7c60 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 [ 788.965557][ T40] #2: ffff888089c70310 (&devlink->lock_key#15){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xcb0 [ 788.965611][ T40] #3: ffff88808175a920 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1e0/0xcb0 [ 788.965658][ T40] #4: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 [ 788.974465][ T40] #5: ffff8880b8742d58 (&pcp->lock){+.+.}-{3:3}, at: get_page_from_freelist+0x8b4/0x26c0 [ 788.974698][ T40] #6: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: rt_spin_trylock+0x10c/0x2b0 [ 788.974840][ T40] #7: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 [ 788.974986][ T40] locks held by kworker/u8:47/6393: 3, on CPU#1: [ 788.975072][ T40] #0: ffff88803213a138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 [ 788.975221][ T40] #1: ffffc90004587c60 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 [ 788.975361][ T40] #2: ffffffff8f7c1e78 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x123/0x16e0 [ 788.975483][ T40] locks held by kworker/u8:48/6394: 2, on CPU#1: [ 788.975514][ T40] #0: ffff88801aea4138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 [ 788.975664][ T40] #1: ffffc90004667c60 ((reaper_work).work){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 [ 788.975845][ T40] locks held by kworker/u8:70/13502: 8, on CPU#1: [ 788.975896][ T40] #0: ffff88801aea4138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 [ 789.001619][ T40] #1: ffffc90004be7c60 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 [ 789.001675][ T40] #2: ffff8880590508d8 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 [ 789.001843][ T40] #3: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 789.001899][ T40] #4: ffff8880b873b8e0 (&rq->__lock){-...}-{2:2}, at: raw_spin_rq_lock_nested+0x2d/0x160 [ 789.002093][ T40] #5: ffff8880b8724548 (psi_seq){-...}-{0:0}, at: psi_task_switch+0x57/0x7d0 [ 789.002245][ T40] #6: ffff8880b8724548 (psi_seq){-...}-{0:0}, at: psi_task_change+0xc9/0x320 [ 789.002394][ T40] #7: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 [ 789.002544][ T40] locks held by kworker/1:1/16967: 4, last CPU#1: [ 789.002596][ T40] #0: ffff88808150c538 ((wq_completion)wg-kex-wg0#29){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 [ 789.002755][ T40] #1: ffffc90007567c60 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 [ 789.002938][ T40] #2: ffff88804d3497b8 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0x14e/0x9f0 [ 789.003133][ T40] #3: ffff888081432e98 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0x15f/0x9f0 [ 789.022877][ T40] locks held by syz-executor/18258: 9, last CPU#0: [ 789.022923][ T40] #0: ffffffff8e496fd0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x10f/0x480 [ 789.023074][ T40] #1: ffff88801ae962b0 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x16e/0x1d40 [ 789.023185][ T40] #2: ffff8880645d8430 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x256/0x1d40 [ 789.023432][ T40] #3: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x200 [ 789.023507][ T40] #4: ffff8880577aedd8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 [ 789.023595][ T40] #5: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 [ 789.023741][ T40] #6: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x200 [ 789.023893][ T40] #7: ffff88802bed6dd8 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pmd_range+0x541/0x57f0 [ 789.024080][ T40] #8: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock_nested+0x1de/0x3f0 [ 789.064400][ T40] locks held by syz-executor/19409: 7, on CPU#1: [ 789.064439][ T40] #0: ffffffff8f833020 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 789.064608][ T40] #1: ffffffff8f832e38 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 789.064778][ T40] #2: ffffffff8f7c1e78 (rtnl_mutex){+.+.}-{4:4}, at: ieee80211_register_hw+0x3d6d/0x4a50 [ 789.064954][ T40] #3: ffff8880647d08d8 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_register_hw+0x3d8b/0x4a50 [ 789.065134][ T40] #4: ffffffff8e2592e0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 789.065283][ T40] #5: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 789.065423][ T40] #6: ffffffff8f8f1578 (&tbl->lock){+...}-{3:3}, at: neigh_parms_alloc+0x347/0x540 [ 789.065572][ T40] locks held by syz.4.4574/19615: 4, last CPU#1: [ 789.065617][ T40] #0: ffff88802a7b2cb0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 [ 789.076527][ T40] #1: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x200 [ 789.076762][ T40] #2: ffff88806e7c1e98 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 [ 789.076951][ T40] #3: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 [ 789.077079][ T40] locks held by syz.5.4575/19616: 1, on CPU#1: [ 789.077128][ T40] #0: ffff8880645d91b0 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x1e0/0x4e0 [ 789.077279][ T40] locks held by syz.5.4575/19617: 2, on CPU#0: [ 789.077322][ T40] #0: ffffffff8f833020 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 789.077463][ T40] #1: ffffffff8f832e38 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 789.077526][ T40] locks held by syz.5.4575/19618: 5, last CPU#0: [ 789.077558][ T40] #0: ffff8880294a3598 (sk_lock-AF_INET6){+.+.}-{0:0}, at: do_tcp_getsockopt+0x20c1/0x2980 [ 789.077726][ T40] #1: ffff8880645d91b0 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x36/0x340 [ 789.077900][ T40] #2: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x200 [ 789.094721][ T40] #3: ffff88803a602a18 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 [ 789.094790][ T40] #4: ffffffff8e3c3840 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 [ 789.094837][ T40] [ 789.094842][ T40] ============================================= [ 789.094842][ T40] [ 789.094852][ T40] NMI backtrace for cpu 1 [ 789.094867][ T40] CPU: 1 UID: 0 PID: 40 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 789.094893][ T40] Tainted: [L]=SOFTLOCKUP [ 789.094899][ T40] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 789.094922][ T40] Call Trace: [ 789.094930][ T40] [ 789.094939][ T40] dump_stack_lvl+0xe8/0x150 [ 789.094968][ T40] nmi_cpu_backtrace+0x274/0x2d0 [ 789.094992][ T40] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 789.095022][ T40] nmi_trigger_cpumask_backtrace+0x17a/0x380 [ 789.095044][ T40] sys_info+0x135/0x170 [ 789.095058][ T40] watchdog+0xfd7/0x1030 [ 789.095080][ T40] ? watchdog+0x1c7/0x1030 [ 789.095101][ T40] kthread+0x388/0x470 [ 789.095127][ T40] ? __pfx_watchdog+0x10/0x10 [ 789.095141][ T40] ? __pfx_kthread+0x10/0x10 [ 789.095167][ T40] ret_from_fork+0x514/0xb70 [ 789.095195][ T40] ? __pfx_ret_from_fork+0x10/0x10 [ 789.095223][ T40] ? __switch_to+0xc89/0x1420 [ 789.095248][ T40] ? __pfx_kthread+0x10/0x10 [ 789.095275][ T40] ret_from_fork_asm+0x1a/0x30 [ 789.095314][ T40] [ 789.095322][ T40] Sending NMI from CPU 1 to CPUs 0: [ 789.095379][ C0] NMI backtrace for cpu 0 [ 789.095405][ C0] CPU: 0 UID: 0 PID: 4299 Comm: kworker/u8:15 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 789.095439][ C0] Tainted: [L]=SOFTLOCKUP [ 789.095446][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 789.095459][ C0] Workqueue: wg-kex-wg2 wg_packet_handshake_send_worker [ 789.095493][ C0] RIP: 0010:__lock_acquire+0x1828/0x2e40 [ 789.095513][ C0] Code: d9 29 14 48 8d 84 24 90 00 00 00 48 89 05 50 59 29 14 45 31 c0 45 31 ff 4d 85 ff 74 2e 49 8b 47 30 48 85 c0 74 25 48 8b 40 10 <48> 83 c0 30 49 8b 0f 48 89 8c 24 d8 00 00 00 48 39 c1 74 0d 4c 8b [ 789.095530][ C0] RSP: 0018:ffffc90011ab6fd0 EFLAGS: 00000086 [ 789.095546][ C0] RAX: ffffffff936d7f50 RBX: 00000000000003cd RCX: 0000000000102dea [ 789.095560][ C0] RDX: ffffffff936e3588 RSI: ffff8880351eec08 RDI: ffff8880351eddc0 [ 789.095575][ C0] RBP: 8133ae7eea621d4b R08: 00000000000003cd R09: 0000000000000020 [ 789.095588][ C0] R10: 0000000000000000 R11: ffffffff81a19680 R12: 00000000000000ed [ 789.095601][ C0] R13: ffffffff936e3588 R14: ffff8880351eec08 R15: ffffffff966fcee8 [ 789.095617][ C0] FS: 0000000000000000(0000) GS:ffff8881259fa000(0000) knlGS:0000000000000000 [ 789.095633][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 789.095647][ C0] CR2: 000020000000e000 CR3: 000000005ac48000 CR4: 00000000003526f0 [ 789.095665][ C0] Call Trace: [ 789.095673][ C0] [ 789.095692][ C0] lock_acquire+0x115/0x350 [ 789.095710][ C0] ? hrtimer_start_range_ns+0x8c/0x3f0 [ 789.095737][ C0] ? debug_object_assert_init+0x1fe/0x310 [ 789.095763][ C0] _raw_spin_lock_irqsave+0x40/0x60 [ 789.095787][ C0] ? hrtimer_start_range_ns+0x8c/0x3f0 [ 789.095810][ C0] hrtimer_start_range_ns+0x8c/0x3f0 [ 789.095835][ C0] finish_task_switch+0x3c4/0xc60 [ 789.095868][ C0] __schedule+0x1711/0x5530 [ 789.095892][ C0] ? lapic_next_event+0x11/0x20 [ 789.095923][ C0] ? __pfx_clockevents_program_event+0x10/0x10 [ 789.095955][ C0] ? __pfx___schedule+0x10/0x10 [ 789.095975][ C0] ? irqentry_exit+0x218/0x8f0 [ 789.095999][ C0] ? irqentry_exit+0x218/0x8f0 [ 789.096022][ C0] ? trace_irq_disable+0x3b/0x140 [ 789.096043][ C0] ? preempt_schedule_thunk+0x16/0x40 [ 789.096062][ C0] preempt_schedule_common+0x82/0xd0 [ 789.096085][ C0] preempt_schedule_thunk+0x16/0x40 [ 789.096105][ C0] _raw_spin_unlock_irqrestore+0x74/0x80 [ 789.096129][ C0] rt_write_unlock+0x14a/0x360 [ 789.096150][ C0] ___neigh_create+0x4a4/0x23a0 [ 789.096185][ C0] ? ___neigh_create+0x20d/0x23a0 [ 789.096216][ C0] ip6_finish_output2+0x6d6/0x1410 [ 789.096242][ C0] ? ip6_mtu+0x7d/0x490 [ 789.096265][ C0] ? ip6_output+0x11e/0x540 [ 789.096288][ C0] ip6_output+0x337/0x540 [ 789.096310][ C0] udp_tunnel6_xmit_skb+0x6e3/0xdc0 [ 789.096342][ C0] send6+0x5ce/0x920 [ 789.096366][ C0] ? send6+0x255/0x920 [ 789.096382][ C0] ? __pfx_send6+0x10/0x10 [ 789.096397][ C0] ? rcu_is_watching+0x15/0xb0 [ 789.096429][ C0] ? __local_bh_disable_ip+0x3c/0x420 [ 789.096451][ C0] ? wg_socket_send_skb_to_peer+0x59/0x200 [ 789.096470][ C0] ? wg_socket_send_skb_to_peer+0x59/0x200 [ 789.096488][ C0] wg_socket_send_skb_to_peer+0x128/0x200 [ 789.096508][ C0] wg_packet_handshake_send_worker+0x204/0x370 [ 789.096540][ C0] ? __pfx_wg_packet_handshake_send_worker+0x10/0x10 [ 789.096569][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 789.096604][ C0] ? rcu_is_watching+0x15/0xb0 [ 789.096626][ C0] ? process_one_work+0x7fd/0x1480 [ 789.096645][ C0] process_one_work+0xaaf/0x1480 [ 789.096673][ C0] ? __pfx_process_one_work+0x10/0x10 [ 789.096691][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 789.096719][ C0] ? assign_work+0x3cf/0x5d0 [ 789.096740][ C0] worker_thread+0xb05/0x10d0 [ 789.096770][ C0] kthread+0x388/0x470 [ 789.096795][ C0] ? __pfx_worker_thread+0x10/0x10 [ 789.096814][ C0] ? __pfx_kthread+0x10/0x10 [ 789.096839][ C0] ret_from_fork+0x514/0xb70 [ 789.096865][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 789.096890][ C0] ? __switch_to+0xc89/0x1420 [ 789.096913][ C0] ? __pfx_kthread+0x10/0x10 [ 789.096939][ C0] ret_from_fork_asm+0x1a/0x30 [ 789.096971][ C0] [ 789.121567][ T40] Kernel panic - not syncing: hung_task: blocked tasks [ 789.121652][ T40] CPU: 1 UID: 0 PID: 40 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 789.121740][ T40] Tainted: [L]=SOFTLOCKUP [ 789.121764][ T40] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 789.121806][ T40] Call Trace: [ 789.121830][ T40] [ 789.121860][ T40] vpanic+0x5d9/0xad0 [ 789.121957][ T40] ? __pfx_vpanic+0x10/0x10 [ 789.122024][ T40] ? irqentry_exit+0x218/0x8f0 [ 789.122066][ T40] ? __pfx___schedule+0x10/0x10 [ 789.122104][ T40] panic+0xc5/0xd0 [ 789.122124][ T40] ? __pfx_panic+0x10/0x10 [ 789.122144][ T40] ? preempt_schedule_common+0x82/0xd0 [ 789.122170][ T40] ? preempt_schedule_thunk+0x16/0x40 [ 789.122194][ T40] ? nmi_trigger_cpumask_backtrace+0x314/0x380 [ 789.122222][ T40] ? nmi_trigger_cpumask_backtrace+0x319/0x380 [ 789.122251][ T40] watchdog+0x1030/0x1030 [ 789.122281][ T40] ? watchdog+0x1c7/0x1030 [ 789.122309][ T40] kthread+0x388/0x470 [ 789.122342][ T40] ? __pfx_watchdog+0x10/0x10 [ 789.122361][ T40] ? __pfx_kthread+0x10/0x10 [ 789.122393][ T40] ret_from_fork+0x514/0xb70 [ 789.122436][ T40] ? __pfx_ret_from_fork+0x10/0x10 [ 789.122467][ T40] ? __switch_to+0xc89/0x1420 [ 789.122497][ T40] ? __pfx_kthread+0x10/0x10 [ 789.122531][ T40] ret_from_fork_asm+0x1a/0x30 [ 789.122577][ T40] [ 789.123189][ T40] Kernel Offset: disabled