last executing test programs: 13.72313767s ago: executing program 3 (id=108): pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r0, &(0x7f0000000140)=[{&(0x7f0000000cc0)="13", 0x1}, {&(0x7f00000007c0)="b5", 0x1}], 0x2, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000300)={0x6c, 0x0, &(0x7f00000005c0)=[@request_death, @clear_death={0x400c630f, 0x1}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000480)={@flat=@binder={0x73622a85, 0x1001, 0x1}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/245, 0xf5, 0x2, 0x200000001b}, @fda={0x66646185, 0x3, 0x1, 0x25}}, &(0x7f0000000500)={0x0, 0x18, 0x40}}}, @increfs={0x40046304, 0x2}], 0x0, 0x0, 0x0}) socket$nl_route(0x10, 0x3, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000080)={0x8efd, 0x0, 0x4, 0x800, 0xc0, 0x9, 0x67, 0x401}, 0x20) r1 = memfd_create(&(0x7f0000000280)='\x00\x00\x00\x00\x00\x00z\x9b\xb6\xe8t;\xfc\x02\x00\x00\x009\xa0\x8b\x14d\xa2\xa1\xa8!\xe8\xd1\xa0\x8a\xce0\x1c\xb7\xf1\xccm\xce\xd4\xdb\x89\xe5\x8f\xe2\xb6\xd6\x9cF\xbd\xff\x14\x05\x00\x00\x00\x00\x00\x00\x00\xf3\xdc\x91\'\x06\\8\r\xfc\xeeG\xbe\x90C\x1c)5\x98\xa3\xfa\a\xf9\x98\xbb}\xeb\x86P=\xe51\x9d,\xb7\xe6_M\xbe\x19\xea#\xff[\xd1\xc3\x9a\xa3\x1b\xf9\xe9\x1d \xce1\xc9\x9f\xb0\x14\xc2\xeb\xf9\xceE\xad\xa4\x92\f\xef\x87g\xb6\xabW\xac\rP\xf42\xb7\xc8\xaajn\xd7\n\r\x802\xd7\x1b$\x95tO*\xf4\xae\xb8\xb8m\xbf\r\xd5\xbf*\xfd\xc7\x85\x1b\x8b\xe5\x97j`c\xe0\x88?\xda\x8a#t>r\xae\xe8\xc9)', 0x0) execveat(r1, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) r2 = socket$kcm(0xa, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000a00)=@generic={0xa, "8ab77fa26849ff26650042e2dacd00005efe0000000162e2adacd2737d00ad6f9fa9f3d7145e15dd9d6d2e19c211220940ad5def53b911ba5b9da13641f9826d7012a749f54b901ee80ea6132ca6e88c776553e1833052ca376304313c4b37780136a4b838570400"}, 0x80, 0x0}, 0x0) 12.888418809s ago: executing program 3 (id=109): syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x1c0002, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0xfffffffffffffffe) io_uring_setup(0xf0c, &(0x7f000000c480)={0x0, 0xc46e, 0x400, 0x3, 0x3}) io_uring_setup(0x6f9e, &(0x7f0000000600)={0x0, 0x1e28, 0x0, 0x3, 0x28b}) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, 0x0, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) r3 = socket$unix(0x1, 0x2, 0x0) connect$unix(r3, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r3, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) r4 = dup(r2) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESDEC=r3, @ANYBLOB=',wfdno=', @ANYRESHEX=r4]) r5 = socket$unix(0x1, 0x5, 0x0) r6 = dup2(r5, r0) close_range(r6, 0xffffffffffffffff, 0x0) 8.55467252s ago: executing program 3 (id=115): r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r1) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0xfffffffd, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x90) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000080)='sched_switch\x00'}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42f82, 0x0) ioctl$SNDCTL_DSP_SPEED(r5, 0xc0045002, &(0x7f0000000240)) write$dsp(r5, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) poll(&(0x7f0000000600)=[{r0, 0x48}], 0x1, 0x400) 7.530147303s ago: executing program 4 (id=118): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) close_range(r1, 0xffffffffffffffff, 0x0) 7.165153991s ago: executing program 4 (id=120): r0 = socket(0x2, 0x2, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{}, 0x1}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x0) write$cgroup_int(r4, 0x0, 0x0) dup(0xffffffffffffffff) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3f8, 0x0, 0x32}, 0x9c) bind$inet6(r5, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x0, 0x0, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r6 = memfd_create(&(0x7f0000000680)='\x103q}2\x9a\xce\xaf^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99\x18\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1f\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\tRJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd99C\x9fF\x9c[M=\xa0^\xa8\xed)\xe8Z\xe8\x9b&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xc9\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8ZmH\x98\xaeb\xa5B5)\x80m\xff\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6\x05\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa\x19\x06U)j!\x91\'\x98\xd2kFN\xfa\x80)O\xb9(!n\x9d\x13\x15\xf1\x1a\xb8y\x14l\xd1', 0x7) ioctl$FS_IOC_RESVSP(r6, 0x402c5828, &(0x7f00000000c0)={0x0, 0x0, 0x1, 0x762}) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0xb, 0x2012, r6, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone3(&(0x7f00000003c0)={0x385200080, 0x0, 0x0, 0x0, {0x4}, 0x0, 0x0, 0x0, 0x0}, 0x58) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mtu(r7, 0x0, 0xa, &(0x7f0000000000)=0x3, 0x4) sendto$inet(r7, &(0x7f0000000040)="0400", 0xffec, 0x0, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) 6.281356512s ago: executing program 2 (id=123): r0 = openat$binfmt(0xffffff9c, 0x0, 0x41, 0x1ff) finit_module(r0, &(0x7f0000000240)='Bank', 0x1) socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) sendfile(r2, r1, 0x0, 0x23b) syz_io_uring_setup(0x82e, &(0x7f0000000300)={0x0, 0x0, 0x10100}, &(0x7f0000000100), &(0x7f0000000080)) r3 = syz_open_procfs$pagemap(0x0, &(0x7f0000001080)) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x400}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000000)={&(0x7f00002b9000/0x400000)=nil, &(0x7f0000779000/0x1000)=nil, 0x400000, 0x3, 0x2}) ioctl$PAGEMAP_SCAN(r3, 0xc0606610, &(0x7f0000000140)={0x60, 0x0, &(0x7f0000305000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x4, 0x0, 0x0, 0xa00, 0x1e, 0x0, 0x8}) 3.533793399s ago: executing program 2 (id=127): r0 = syz_io_uring_setup(0x1458, &(0x7f00000004c0)={0x0, 0x4, 0x10180, 0x2000, 0x3ab}, &(0x7f0000000100)=0x0, &(0x7f0000000380)=0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB='9'], 0x38}}, 0x4000) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r3, &(0x7f0000000180)=ANY=[], 0x118) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x20, 0x0, @fd_index=0x1, 0x80, {}, 0x4, 0x5}) io_uring_enter(r0, 0x2d3e, 0xfffffffd, 0x0, 0x0, 0x0) 3.453994743s ago: executing program 0 (id=128): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='setgroups\x00') r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8041, 0x0) write$dsp(r1, &(0x7f0000000200)="bd4c", 0x2) r2 = syz_open_dev$sndctrl(&(0x7f0000000180), 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="88010000", @ANYRES16=r4, @ANYBLOB="01000000000000000000010000003c01088080000080500009804c000080060001000200000008000200ac1414aa0500030002000000060001000200000008000200e00000020500030001000000060001000200000008000200e000de00050003000100000024000100975c9d81c983c8209ee781254b899f8ed925ae9f0923c23c62f53c57cdbf691c06000500060000004c00008024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff24000200491bc0be1dc1f88092e741a88b64f6dd9218ad21b44b472e44f1d0807ee6675c6c00008024000100f44da367938ee6564f020211456727082f5cebee8b1bf5eb7337341b459b3922200004000a000009000000070000000000000000000000000000000003000000240009800c0000800600010002000000080002007f000001050003000300000044fe008024000300b00e73e8d44e91e3da922c22438244bb885c69e269c8e9d835b114293a4ddc6e1400020077673000"], 0x188}, 0x1, 0x0, 0x0, 0x4004840}, 0x40000) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r2, 0x40045532, &(0x7f0000000140)) r5 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r5, 0xc0684113, &(0x7f0000000380)={0x1, 0x5, 0x0, 0x1003, 0x0, 0x80000000, 0xffffffed, 0xf, 0x0, 0x40000, 0x2, 0x1}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 3.117393871s ago: executing program 1 (id=129): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@delsa={0x48, 0x12, 0x1, 0x0, 0x0, {@in=@dev}, [@srcaddr={0x14, 0xd, @in6=@rand_addr=' \x01\x00'}, @mark={0xc, 0x15, {0x2}}]}, 0x48}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x401, 0x3, 0x25dfdbfa, {0x0, 0x0, 0x0, 0x0, 0x190, 0xf1f80502f07a58b}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_FAIL_OVER_MAC={0x5, 0xd, 0x2}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40010}, 0x240080c1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00000018"], 0x50}}, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x400000000000235, 0x0) 3.104948884s ago: executing program 2 (id=130): r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a000008048002000905", @ANYRES64], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r1, 0x0, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x3, 0x6) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) socket$inet6(0xa, 0x2, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000008c80)=ANY=[@ANYBLOB=',\x00\x00\x00&\x00'], 0x2c}}, 0x800) r4 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r4, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r2, 0x0, 0x0) syz_usb_disconnect(r0) 2.682628819s ago: executing program 1 (id=131): socket$inet6_sctp(0xa, 0x1, 0x84) syz_open_dev$vcsa(&(0x7f0000000000), 0x1, 0x1a1300) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 2.552887293s ago: executing program 4 (id=132): r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x239, &(0x7f0000000500)={0x0, 0x1c2a, 0x10100, 0x0, 0xc8, 0x0, r1}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, {0x3010}, 0x1}) io_uring_enter(r2, 0x2ded, 0x4000, 0x0, 0x0, 0x0) r5 = socket(0x40000000015, 0x5, 0x0) bind$inet(r5, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000200)="0000000000aa303e97380e90231bdbdaf6a4bd866226b7cdb7c26858c4e4fd703be2f51ed6ddc4a47116ec2db75c7042a22491af0ffea4174a9de3350c0a498396b28c7d1784d04aa38922721cb7816094cb82950fd012efd26d", 0x5a}, {&(0x7f0000000900)="0f198d5aa5caa1c55b84b414797cbdd4e8c576a921a070fc828060506683fd1106a961ac55b5b8ea3342ca7de5559ca2c14e05e42aed8ba14b2c78cb540f71a817d80fbf1945a046ebda494a8048a106a4d49d7f214735ada53397db3b203885ce39ee48d69465935eade21ce36e61826c52c82f038341d9bab5687c740ed3c18897094e7e1391eb84a4052e03c0c7c39ae86d454938f65e284620b99481c33d9f5e5b7a6c0d7548723f55b213c76be37f40c850c38e265758ebd8238257a146d6eced16fd658a784c928fea7a841db1a7fd6520442dae5fc0d3a3d3a5f16fcf6fe4f062ecdad7d0f3c6cd339339533c0ef28ad1e2729907094c3de93c1b1b00ad6df89507000000fb7565d3a8e9eaea020ed173c2179fb03e0944460989240a689c7fe795d310be4e7a6b778a903280dbf426b39c3603c49049980767e31edb997f59785184cbd7b9070400000073c745f71db0906cb51780f908fa61634af8ac85d9f04f3dff0a948e81cd3229a59aaeb00995358155343e3239588a0383e4df109d5ca24276d0d83a27d0e9bf681c1bbea12a6f3c20ad50f63430333bb327eb6ae32fe8809065bce26d2dc2fbb2b48d404637d61fd86852e0e1b6ccc6f75b1107aaa5f60ef45f94e953b3f213c3cb4ca4c716565078c666f84e1a99bb4cb5c7190648132f6ff1f6cb79b93f20752753c938da6241607a742361d995188b23cb4b8269e98e822585695962620673433748e476f7cc3e37db88639c525ff3a502c82c283b00aecfe7734ab369e1ed7c75e27a5a333641817baa3ea37844e20e6266c5095abf9d47ca5f8ad93f1a4d8795daec222ada00d65cf91425fae7939ceaa8d94ec1ab5082e1d251c27b3132119b350e81771f3733be232ffb90c03a818bf458aac3314007c3e35d5e4bed6b897608b01e7e26a54433e5f5c74a2ee3c2fc50067be05a677f122b7dba7010830b879a41b579d44158fb89ea05761d2d369853bea84dfb8081ed7b891dcb3bb3361534fdc5252e4964aed936ad2838e7af14fc65c7c1c6d44c6256f2462ae83cfd6a6b2651da607fe79d345e5080098e9e6e7482cc5c267e00d8d09dcde70b60fe6220fe9530547201664db91cf1885ecc2f106b66cd99131523c99f6102ddd7403791b3a7ac59b256cc4c938fe01740ae4f19b5204ca305b1666b0c2a7e5015d6d530995843adfbac3954306d4cd82257d4d2c3283d45dbae43548fed9879328f114f7c8238ac955391b24614d91be1701ae07c170a9c299fcf3d0ac4cea07e88fbf66b697883af17a06ac3f9954eb2fbd20f101802cd023fc48c5d464c16059cc9dce8558c5322ac7612db0e2725427628c2c41a21f0d2f3962e32f710bf9e216ff1694e8d88c8a81328744b36d9ef9f08c0ea3ccd4f8729e2f00a048162834a95", 0x3f1}, {&(0x7f00000003c0)="128b9306006d4810e5ac5040ad9201847839fc378469d5765b9cc241840896c1498194a7197b45d74a8532b82037b02c9e6045c361eb", 0x36}], 0x3}, 0x0) socket$kcm(0x10, 0x2, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) pselect6(0x40, &(0x7f0000000080)={0x5, 0x0, 0x120000000000, 0x2, 0x500, 0x0, 0x1000001000, 0x49}, 0x0, &(0x7f0000000180)={0x3fe, 0x7, 0x0, 0x9, 0x86, 0x800, 0x80000002}, 0x0, 0x0) 2.469480514s ago: executing program 1 (id=133): io_setup(0x3ff, &(0x7f0000000500)) 2.243384487s ago: executing program 0 (id=134): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000900)={0x44, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_FRAME={0x8, 0x33, @action={{{}, {}, @device_b}, @sp_mp_open={0xf, 0x1, {0xa8, {0x1, 0x3a}, @void, @void}}}}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}]}, 0x44}}, 0x0) 2.012176657s ago: executing program 1 (id=135): r0 = socket$packet(0x11, 0x2, 0x300) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x1, 0x5, &(0x7f0000000500)=ANY=[@ANYBLOB="180200000200000000000000000000008500000011000000850000005000000095"], &(0x7f0000000000)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x3, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x40}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000140)=r1, 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@ipv6_getaddrlabel={0x1c, 0x4a, 0x1, 0x0, 0x0, {0xa, 0x0, 0x80}}, 0x1c}}, 0x0) 1.703018204s ago: executing program 0 (id=136): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, 0x0) close_range(r0, 0xffffffffffffffff, 0x400000000000000) 1.523107293s ago: executing program 1 (id=137): r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) syz_usb_disconnect(r0) ioctl$EVIOCRMFF(r0, 0x4004550e, &(0x7f0000000400)=0x1) 1.427612443s ago: executing program 3 (id=138): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000140)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x9, 0x2) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) r4 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x200) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) r5 = dup3(r4, r1, 0x80000) ioctl$NBD_DO_IT(r5, 0xab03) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x1c, r3, 0x1, 0x70bd2b, 0x6, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8004}, 0x0) 1.29936026s ago: executing program 0 (id=139): r0 = openat$binfmt(0xffffff9c, 0x0, 0x41, 0x1ff) finit_module(r0, &(0x7f0000000240)='Bank', 0x1) socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) sendfile(r2, r1, 0x0, 0x23b) syz_io_uring_setup(0x82e, &(0x7f0000000300)={0x0, 0x0, 0x10100}, &(0x7f0000000100), &(0x7f0000000080)) r3 = syz_open_procfs$pagemap(0x0, &(0x7f0000001080)) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000001c0)={0xaa, 0x400}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) ioctl$PAGEMAP_SCAN(r3, 0xc0606610, &(0x7f0000000140)={0x60, 0x0, &(0x7f0000305000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x4, 0x0, 0x0, 0xa00, 0x1e, 0x0, 0x8}) 1.233469248s ago: executing program 4 (id=140): r0 = syz_io_uring_setup(0x1458, &(0x7f00000004c0)={0x0, 0x4, 0x10180, 0x2000, 0x3ab}, &(0x7f0000000100)=0x0, &(0x7f0000000380)=0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB='9'], 0x38}}, 0x4000) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r3, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x20, 0x0, @fd_index=0x1, 0x80, {}, 0x4, 0x5}) io_uring_enter(r0, 0x2d3e, 0xfffffffd, 0x0, 0x0, 0x0) 1.138867728s ago: executing program 0 (id=141): syz_io_uring_setup(0xa31, &(0x7f0000000480)={0x0, 0x8922, 0x0, 0x0, 0x202cf}, &(0x7f0000000040), &(0x7f0000000600)) r0 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x141a82, 0x0) fsetxattr(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="4e4f53b800"], &(0x7f0000003240)='wlan1\x00\xc3\xfb\x17~\x8a!\x9f\xf4q\xf3\xe8\x9a\xe6\xbb\xcd5\xe6y\xcchbos,R\x97\x8d\x1eRo\xb6\xed\xd2\xc3X7\x83W\xc2\x90\x81\xe8\xe3\x88\x16\x05\x81\x8e\xdc\xffW\xfc\xe7|\xa1b\x94\xd3\xad\b)\xd8\xc1<\\\xb27\xa6\x83\xfb< j0\xabk\xbf\x8a\xb6G)\x15<\xc2#B\\c\xc6\x11\xb4\xa7\xb2\xe8\x1b\xf9e\xba\xbb\"\xbb\xe4\xaa.9\x95\xea\xa3\x83\x98_\xeb7\xbf\xe9_\xbe\xca<\x9f\xf2IG;\xcd\xbb7l \x8a\xd0\x98D\n\xed\xd9\xd4?\xb8\xa39\xa4$\x11\xeb\x85\x1e\x9ev_\b\xca\x1a\xab\xdf\xa2\xba,\xf7\xdc\x86uH\xa0\xe4\x8c\x95\xe5\x98\xc8k\x10\xa1\xdb#\x1b\x02&\xe0\x0fj\xcf(\xffT\xb4\xcd\x1f\x89\b\xc8\x1f\xca\xf9M\xbc\xf3\xc6\x05\xb3\xd9u\xb2\xe4\xd3\'\x96\xc0\xd1\x05{-\x18\x17\xe4\xd1\x86\vPj&b', 0xe4, 0x2) write$cgroup_int(r0, &(0x7f0000000040)=0x900, 0xffffffffffffff7a) socketpair$unix(0x1, 0x3, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x3, @pix={0x434c, 0x8, 0x584e4f53, 0x4, 0x2, 0x7, 0x0, 0x5, 0x1, 0x4, 0x2, 0x7}}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x1) removexattr(&(0x7f0000000200)='./cgroup\x00', &(0x7f0000000240)=@known='user.incfs.metadata\x00') r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f0000000580)="240000001e005f031400ff01000000f80700b3586ff606c2e553797c080008e467dc0000", 0x24) recvmmsg(r1, &(0x7f00000055c0)=[{{&(0x7f0000000300)=@in6={0xa, 0x0, 0x0, @remote}, 0x80, &(0x7f0000005640)=[{&(0x7f0000000400)=""/85, 0x55}, {&(0x7f0000000640)=""/209, 0xd1}, {&(0x7f0000000740)=""/205, 0xcd}, {&(0x7f0000001c00)=""/39, 0x27}, {&(0x7f0000000840)=""/228, 0xe4}, {&(0x7f0000000940)=""/246, 0xf6}, {&(0x7f0000000a40)=""/30, 0x1e}, {&(0x7f0000000a80)=""/215, 0xd7}, {&(0x7f0000001c40)=""/13, 0xd}], 0x9, &(0x7f0000001cc0)=""/253, 0xfd}, 0x7}, {{&(0x7f0000001dc0)=@pppoe, 0x80, &(0x7f0000003200)=[{&(0x7f0000001e80)=""/190, 0xbe}, {&(0x7f0000001f40)=""/227, 0xe3}, {&(0x7f0000005800)=""/4096, 0x1000}, {&(0x7f0000003040)=""/129, 0x81}, {&(0x7f0000003100)=""/168, 0xa8}, {&(0x7f00000031c0)=""/8, 0x8}], 0x6, &(0x7f0000006800)=""/4103, 0x1007}, 0x9}, {{0x0, 0x0, &(0x7f0000003480)=[{&(0x7f00000056c0)=""/107, 0x6b}, {&(0x7f0000005740)=""/178, 0xb2}, {&(0x7f00000005c0)=""/62, 0x3e}, {&(0x7f00000033c0)=""/20, 0x14}, {&(0x7f0000003400)=""/102, 0x66}, {&(0x7f0000004500)=""/163, 0xa3}], 0x6, &(0x7f0000002040)=""/4096, 0x1000}, 0x7}], 0x3, 0x1a000, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$KVM_GET_PIT2(0xffffffffffffffff, 0x8070ae9f, 0x0) set_mempolicy(0x2, &(0x7f0000000080)=0x51e1, 0x3ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x401c2, 0x0) ftruncate(r3, 0x8800000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r4, &(0x7f00000034c0)=[{{0x0, 0x0, &(0x7f0000001e40)=[{&(0x7f0000000b80)=""/4096, 0x1000}, {&(0x7f0000001b80)=""/112, 0x70}], 0x2}, 0x8}], 0x1, 0x700, 0x0) 1.126097228s ago: executing program 3 (id=142): bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0xff00000000000000}}, 0x59) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f00000007c0)={0x16, 0x4, 0x70}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)=ANY=[@ANYBLOB="01000000000000008c02"]) 1.048804847s ago: executing program 2 (id=143): socket$inet6_sctp(0xa, 0x1, 0x84) syz_open_dev$vcsa(&(0x7f0000000000), 0x1, 0x1a1300) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 1.026191006s ago: executing program 4 (id=144): r0 = socket$kcm(0x2b, 0x1, 0x0) sendmsg$inet(r0, &(0x7f0000000240)={&(0x7f00000000c0)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x32}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x200048cc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2, 0x0, 0x5}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x10}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x10}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x78}, 0x1, 0x0, 0x0, 0x40010}, 0x0) close(r0) 212.935309ms ago: executing program 1 (id=145): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="180200000000000000000000000000001801"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = syz_io_uring_setup(0x1458, &(0x7f00000004c0)={0x0, 0x4, 0x10180, 0x2000, 0x3ab}, &(0x7f0000000100)=0x0, &(0x7f0000000380)=0x0) r3 = socket(0x28, 0x5, 0x0) r4 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r4, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r4, 0x4) connect$vsock_stream(r3, &(0x7f0000000080), 0x10) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000005000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, 0x2}, 0x94) close(r5) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x18, 0x6, &(0x7f00000001c0)=ANY=[@ANYBLOB="180000000000000000000000ffffff80e500020000000000c500fcff000000007f00feffd100000095"], &(0x7f00000000c0)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='virtio_transport_alloc_pkt\x00', r5}, 0x18) sendmmsg(r3, &(0x7f0000000b40)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000380)="1b", 0x1}], 0x1}}], 0x1, 0x0) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB='9'], 0x38}}, 0x4000) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r6, &(0x7f0000000180)=ANY=[], 0x118) creat(&(0x7f0000000000)='./file0\x00', 0xd931d3864d39ddd8) socket$inet6_mptcp(0xa, 0x1, 0x106) r7 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x1) r8 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) r9 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x8) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r9, 0x0) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, r8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$qrtrtun(r8, &(0x7f0000000300)="ca0e808bb35bdabb", 0x8) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r10, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)=[0x7], &(0x7f0000000240)=[0x2], 0x0, 0x1}}, 0x40) mmap$xdp(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1f, 0x12, r7, 0x80000000) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r6, 0x0) mount(&(0x7f0000000000)=@loop={'/dev/loop', 0x0}, &(0x7f0000000080)='./cgroup\x00', &(0x7f00000000c0)='hfsplus\x00', 0x18, &(0x7f0000000100)='barrier') syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_SPLICE={0x1e, 0x20, 0x0, @fd_index=0x1, 0x80, {}, 0x4, 0x5}) io_uring_enter(r0, 0x2d3e, 0xfffffffd, 0x0, 0x0, 0x0) syz_usb_connect(0x4, 0x364, &(0x7f0000000540)={{0x12, 0x1, 0x310, 0xb8, 0x95, 0x55, 0x20, 0x694, 0x1, 0xebf9, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x352, 0x1, 0x5, 0x7, 0xc0, 0x2, [{{0x9, 0x4, 0xe1, 0x4, 0xd, 0x96, 0x15, 0x80, 0x40, [@uac_as={[@as_header={0x7, 0x24, 0x1, 0x65, 0x9, 0x1001}, @format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0xf, 0x3, 0x6, 0x3, "10a149e32235"}, @as_header={0x7, 0x24, 0x1, 0x1, 0x8, 0x5}, @as_header={0x7, 0x24, 0x1, 0x3, 0x1, 0x1002}, @as_header={0x7, 0x24, 0x1, 0x4, 0x8, 0x2}]}, @uac_control={{0xa, 0x24, 0x1, 0xfff8, 0x7f}, [@feature_unit={0x11, 0x24, 0x6, 0x4, 0x0, 0x5, [0x6, 0x7, 0x4, 0x4, 0xa], 0x9}, @output_terminal={0x9, 0x24, 0x3, 0x2, 0x60a, 0x4, 0x2}, @extension_unit={0xa, 0x24, 0x8, 0x4, 0x5, 0x0, "9cf191"}, @processing_unit={0x9, 0x24, 0x7, 0x3, 0x1, 0xc0, "fce3"}, @feature_unit={0x13, 0x24, 0x6, 0x4, 0x5, 0x6, [0x8, 0x3, 0xa, 0x1, 0x2, 0x3], 0x5}]}], [{{0x9, 0x5, 0xc, 0xd, 0x3ff, 0x9, 0x6}}, {{0x9, 0x5, 0xd, 0x1c, 0x200, 0x3, 0x40, 0xd, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x6, 0xffff}]}}, {{0x9, 0x5, 0xb, 0x4, 0x400, 0x1, 0x3, 0x6, [@generic={0xb4, 0xe, "b55b780aa5d3e770ea0002bb1966ce28d2b225ed8e89d83880165dc1d6c3e9c15c0f4a578038adb9d04ab7a8d79a8462cbfd900053e36f16dd19d48bb94b1e32e1b89ec91f5354847b8ac1af3b70a829c0a19da39ce353a74b288f4be7e921bed36ccd06135676c64a2c203abfca71a7fe5934adf8792fc302d153fc3bde5329f098c201b25f9b9d0b65906da348b64e53342c5278239c9865ab8a0b9835080b11695878fb0818673fc35ca23127b237bce2"}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0xd, 0x8}]}}, {{0x9, 0x5, 0x1, 0x10, 0x200, 0x6, 0x8, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0x86, 0xf5}, @generic={0x75, 0xb, "1ab5029676b4a1bc77927b21aba3409fede9a11928f1bb31f717b9be26990e9583972466d0e48babc8c34606ee73edf587b8fb8391ff483a681b196835a0d35eb90e8f111db9fc08c8e63f2cbdbb4d4bbc1db1c2939a2205dc4ce03c2680737856dd606be15e5b00a4a2f374eee7035c0b0ab0"}]}}, {{0x9, 0x5, 0x3, 0x0, 0x40, 0x0, 0xc0, 0x9}}, {{0x9, 0x5, 0x2, 0xc, 0x10, 0x1, 0x30, 0xc, [@generic={0x9, 0xe, "fb416260b50247"}]}}, {{0x9, 0x5, 0x80, 0x10, 0x400, 0xe, 0xf1, 0x7}}, {{0x9, 0x5, 0x0, 0x3, 0x3b7, 0x2, 0xff, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x5d, 0xf}]}}, {{0x9, 0x5, 0xb, 0x4, 0x3ff, 0x4, 0x2, 0x6, [@generic={0xf5, 0x23, "2bd084cd864e6919c2059038567d9dfe5180d5511706377d3a2eb06b49b16341f1e5ffa52b384bbfd8ca2861c3f5b7023a6fc5ffb9f48fb49e362ecb1fb80feffa74ad9ba1d4a6c3b388d6189d230a288f5e125ec394952c10c9ca39c981eeaa30a768ce18982569b7844c4692784ba33afc3b631f42fbb9df2660f1120873a1cda29b2bd7487deb4a043501cdd3b630ee5bdae4c5493bd4578f01389ef60c911ca6ac20918364104d049ca7833ee8d75b75c1c22c02d70910a556dbee3191daa2be72458f10085c4d6e32a50037ae869bb1a16d92f48074d5531a447b4e712783d00a572521f6109cd7f28664c355e1a9244c"}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0xd2, 0x3}]}}, {{0x9, 0x5, 0x8, 0x3, 0x10, 0x8, 0x49, 0x6, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0x1, 0x800}]}}, {{0x9, 0x5, 0xf, 0x0, 0x200, 0xc9, 0x6, 0x6}}, {{0x9, 0x5, 0xe, 0x1, 0x3ff, 0xd9, 0x11, 0x8}}, {{0x9, 0x5, 0x0, 0x4, 0x400, 0x6, 0xed, 0x8, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x2}]}}]}}]}}]}}, &(0x7f0000000ac0)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x200, 0xf, 0xff, 0x9, 0x28, 0x5}, 0x10, &(0x7f0000000240)={0x5, 0xf, 0x10, 0x1, [@wireless={0xb, 0x10, 0x1, 0xc, 0x0, 0x2, 0x7f, 0x7}]}, 0x8, [{0x75, &(0x7f0000000280)=@string={0x75, 0x3, "f5d0cc2ebf40c2c3005ae542423ec9a7c48f4aa38f11fdcb5f8eb8175bcb7bb281e37874189822969ea078c6835be9fb8db5330423f697043b9939a6f0c8b67a902e58cc569ee7a7267ab66ee9fa434fa7d77dde9cf00390a4671716ecf4fbdc53ed9acc78a5d25913d6928eee64958ea154ac"}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x2809}}, {0xb1, &(0x7f0000000c80)=ANY=[@ANYBLOB="b10329be91538ca47401a7a5dbc3572b732ea506b6fef6ddaf198ff220723bcb25f64adf155988a846e438a65b0e655361e1a242323831ffcc9d2c10456a550cfa910e753be0d30c945763c7c1bb82a69813456951fcde61dbb92c676cc034793212e7a76498f36615c4dc860b20285406bab44e5c0035901b22e826c84193e5ec717eae24a75894d965a70b8b5458c45e20908d082876cd656ec75d75a2c87836c2b39efaded4c5f10139819b6ae5de39fbe24c281351ece171cdb1b3f2f637880740db276dc5d42a883a3059c11863ac978468fa979cf4b885a6e90c67a23207f0d0dc18d64fd6aebaa82c732a9448d64eea2926af9ca7ca83676a367efd1b5431a5b46bf31b3ae201910ddce4245ce1e4c5d57c0f0de3dec28ebf24caf48542a589a4b387683606"]}, {0x0, 0x0}, {0xf0, &(0x7f0000000b40)=ANY=[@ANYBLOB="f0037d12b96b6e3a4db2947e4321ce8e81050916b18f576eac47c5161b0b5d4b1c9ec64bafe26648a82e0f8d363fc38ebc8435f59b16d7a70f516e8f5d393f9d7073315fa57af5742f1e442dac0d028cf1579d8ec35ee95400d0ec4b3e1d49e3ee3d20b81f58f849c71b870d98e5ec818a8c2b7a9fc47f2816b8ce8c51a77d6d90ca0c71c219a9821aec3336c09dc5c43fbe79834b5a0a880c416d479188edc83e7b8c4474519597005e3b198b3962117259831e45e9e48d9168a139ca548819f06a1790b5f9283a8286fe8f1d32"]}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x447}}, {0x4, &(0x7f00000009c0)=@lang_id={0x4, 0x3, 0x812}}, {0xb9, &(0x7f0000000a00)=@string={0xb9, 0x3, "c0f99c74d4a7e5fe73dd0f66bd364dadfa5190480882a27ae8a8654a71e10f51450664fbf4d19537530b5560be9b6e49e7fd5504c73e32c45ab0f205ab575bb05322d56e629932910bde23c3615c353574afca984b6abe2baaae73867863a174987e17443248e4974f78c3c81dba3ae77fe287cf3545ec44a46f74a8655e9154e49f010c2eb2e4bda5592239340c80de8f66b2d2fabc14acd97e86c26511c66be59a3cdb76ce382e13f86c3e6e380757319bfe7f40768c"}}]}) 212.246333ms ago: executing program 2 (id=146): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2e, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmsg$qrtr(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000300), 0xc, &(0x7f0000000600)=[{&(0x7f0000000440)=""/222, 0xde}, {&(0x7f0000000540)=""/132, 0x84}], 0x2, &(0x7f0000002080)=[{0x100c, 0x0, 0x0, ""/4096}, {0x100c, 0x0, 0x0, ""/4096}, {0x18, 0x0, 0x0, ""/10}, {0x44, 0x0, 0x0, ""/56}, {0x58, 0x0, 0x0, ""/76}], 0x20cc, 0x100}, 0x1c, 0x40010001) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_open_dev$usbfs(&(0x7f0000000080), 0xf, 0x8041) r4 = fsopen(&(0x7f00000000c0)='jffs2\x00', 0x1) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, &(0x7f00000001c0)={0x0, 0x2, "4cf90fba85c830e42a3ca4b10f01bbcb15f3806c4853e7c44a6974759d9f643905a56baa4195fb396d9bfa306999f1586e5d1ca49add100a36b751a7d9fe0b182ebf2c8a0e66f72c1c08260030752f07cd4089473e52885a3c85bacf3ccfac5bb9435fe036dcfccd7254bbd8bce90e2284d29e1f17d6652270fd0abcb8729f16ff602b438bd122a9e09984e2799d0dbfef7533d1a930ea4f4b57605ace45f5815450693650ae122d34aa0c5ca5e793516d156e5a5b34d6c17c40d753426a3d8e15e726d0f2622e873e0cbe63751bb62c68594d4cb0a21b92ad2e80f24a9b290a87ee6779022a0b7f5223e4e8c9f53f501ec8c439724078fdc076a51d50760566"}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x180) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x2004000, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) chdir(&(0x7f00000001c0)='./file0\x00') openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x458002, 0x55) r5 = open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) getdents(r5, 0x0, 0x0) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)={0x34, r6, 0x701, 0x70bd2c, 0x0, {0x45}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000021}, 0x0) ioctl$USBDEVFS_ALLOC_STREAMS(r3, 0x8008551c, &(0x7f0000000000)=ANY=[@ANYRES8=0x0, @ANYRES8=r4]) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) 179.063403ms ago: executing program 0 (id=147): bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r0}, 0x10) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000900000000000000213f0000c50000000e800000850000000e00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='mmap_lock_acquire_returned\x00', r1}, 0x10) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc)=0x2, 0x3, 0x801, 0x0, &(0x7f0000000040), 0xfffffffc) mlock2(&(0x7f0000ff5000/0x9000)=nil, 0x9000, 0x0) mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil) mlock2(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1) mincore(&(0x7f0000ff5000/0x4000)=nil, 0x4000, 0x0) 12.267332ms ago: executing program 2 (id=148): r0 = syz_open_dev$swradio(&(0x7f00000001c0), 0x0, 0x2) mknod$loop(&(0x7f0000000400)='./file0\x00', 0x10, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @private}}, 0x80, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="010000001001000001"], 0x10}, 0x8000) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x6, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x0, 0x5}}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x844}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x4000000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x8400, 0x0) ioctl$FS_IOC_SETFLAGS(r4, 0x40186f40, &(0x7f0000000440)=0x1f) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x2c, 0xd, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) kexec_load(0x0, 0x1, &(0x7f0000000000)=[{0x0, 0x0, 0x7ffdd000, 0x8000}], 0x320000) r6 = socket$inet6(0xa, 0x80002, 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000500)=@raw={'raw\x00', 0x8, 0x3, 0x214, 0xf0, 0x11, 0x148, 0xf0, 0x0, 0x180, 0x2a8, 0x2a8, 0x180, 0x2a8, 0x3, 0x0, {[{{@ip={@broadcast, @multicast2, 0x0, 0xff000000, 'wg1\x00', 'dvmrp0\x00', {}, {}, 0x67, 0x3, 0x2}, 0x0, 0xd0, 0xf0, 0x0, {}, [@common=@ttl={{0x24}, {0x0, 0x9}}, @common=@unspec=@limit={{0x3c}, {0x10001, 0x2, 0xa, 0x8, 0x5, 0x4}}]}, @unspec=@TRACE={0x20}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0xffffffff, 'macvtap0\x00', 'netdevsim0\x00'}, 0x0, 0x70, 0x90}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x270) openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x80882, 0x0) connect$inet6(r6, &(0x7f0000000000)={0xa, 0x0, 0xfffffffd, @local, 0x2}, 0x1c) sendmmsg$inet6(r6, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) read(r0, 0x0, 0x0) ioctl$VIDIOC_ENUM_FMT(r0, 0xc0585611, &(0x7f00000000c0)={0x0, 0xb, 0x0, "3e58f67896b2f2098200902177392faff604cb7ef87e7610bc39ef64257f5d33"}) 2.237829ms ago: executing program 3 (id=149): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='htcp', 0x7) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) sendto$inet6(r0, &(0x7f0000004080)='a', 0x1, 0x20000045, &(0x7f0000000140)={0xa, 0x2, 0xffff, @loopback, 0x3}, 0x1c) write$P9_RMKNOD(r0, &(0x7f0000000280)={0x14, 0x13, 0x2, {0x4, 0x2}}, 0xfffffe5c) 0s ago: executing program 4 (id=150): r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x239, &(0x7f0000000500)={0x0, 0x1c2a, 0x10100, 0x0, 0xc8, 0x0, r1}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r0, 0x0, 0x0, 0x0, {0x3010}, 0x1}) io_uring_enter(r2, 0x2ded, 0x4000, 0x0, 0x0, 0x0) r5 = socket(0x40000000015, 0x5, 0x0) bind$inet(r5, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000200)="0000000000aa303e97380e90231bdbdaf6a4bd866226b7cdb7c26858c4e4fd703be2f51ed6ddc4a47116ec2db75c7042a22491af0ffea4174a9de3350c0a498396b28c7d1784d04aa38922721cb7816094cb82950fd012efd26d", 0x5a}, {&(0x7f0000000900)="0f198d5aa5caa1c55b84b414797cbdd4e8c576a921a070fc828060506683fd1106a961ac55b5b8ea3342ca7de5559ca2c14e05e42aed8ba14b2c78cb540f71a817d80fbf1945a046ebda494a8048a106a4d49d7f214735ada53397db3b203885ce39ee48d69465935eade21ce36e61826c52c82f038341d9bab5687c740ed3c18897094e7e1391eb84a4052e03c0c7c39ae86d454938f65e284620b99481c33d9f5e5b7a6c0d7548723f55b213c76be37f40c850c38e265758ebd8238257a146d6eced16fd658a784c928fea7a841db1a7fd6520442dae5fc0d3a3d3a5f16fcf6fe4f062ecdad7d0f3c6cd339339533c0ef28ad1e2729907094c3de93c1b1b00ad6df89507000000fb7565d3a8e9eaea020ed173c2179fb03e0944460989240a689c7fe795d310be4e7a6b778a903280dbf426b39c3603c49049980767e31edb997f59785184cbd7b9070400000073c745f71db0906cb51780f908fa61634af8ac85d9f04f3dff0a948e81cd3229a59aaeb00995358155343e3239588a0383e4df109d5ca24276d0d83a27d0e9bf681c1bbea12a6f3c20ad50f63430333bb327eb6ae32fe8809065bce26d2dc2fbb2b48d404637d61fd86852e0e1b6ccc6f75b1107aaa5f60ef45f94e953b3f213c3cb4ca4c716565078c666f84e1a99bb4cb5c7190648132f6ff1f6cb79b93f20752753c938da6241607a742361d995188b23cb4b8269e98e822585695962620673433748e476f7cc3e37db88639c525ff3a502c82c283b00aecfe7734ab369e1ed7c75e27a5a333641817baa3ea37844e20e6266c5095abf9d47ca5f8ad93f1a4d8795daec222ada00d65cf91425fae7939ceaa8d94ec1ab5082e1d251c27b3132119b350e81771f3733be232ffb90c03a818bf458aac3314007c3e35d5e4bed6b897608b01e7e26a54433e5f5c74a2ee3c2fc50067be05a677f122b7dba7010830b879a41b579d44158fb89ea05761d2d369853bea84dfb8081ed7b891dcb3bb3361534fdc5252e4964aed936ad2838e7af14fc65c7c1c6d44c6256f2462ae83cfd6a6b2651da607fe79d345e5080098e9e6e7482cc5c267e00d8d09dcde70b60fe6220fe9530547201664db91cf1885ecc2f106b66cd99131523c99f6102ddd7403791b3a7ac59b256cc4c938fe01740ae4f19b5204ca305b1666b0c2a7e5015d6d530995843adfbac3954306d4cd82257d4d2c3283d45dbae43548fed9879328f114f7c8238ac955391b24614d91be1701ae07c170a9c299fcf3d0ac4cea07e88fbf66b697883af17a06ac3f9954eb2fbd20f101802cd023fc48c5d464c16059cc9dce8558c5322ac7612db0e2725427628c2c41a21f0d2f3962e32f710bf9e216ff1694e8d88c8a81328744b36d9ef9f08c0ea3ccd4f8729e2f00a048162834a95", 0x3f1}, {&(0x7f00000003c0)="128b9306006d4810e5ac5040ad9201847839fc378469d5765b9cc241840896c1498194a7197b45d74a8532b82037b02c9e6045c361eb", 0x36}], 0x3}, 0x0) socket$kcm(0x10, 0x2, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) pselect6(0x40, &(0x7f0000000080)={0x5, 0x0, 0x120000000000, 0x2, 0x500, 0x0, 0x1000001000, 0x49}, 0x0, &(0x7f0000000180)={0x3fe, 0x7, 0x0, 0x9, 0x86, 0x800, 0x80000002}, 0x0, 0x0) kernel console output (not intermixed with test programs): [ 87.086756][ T1903] cfg80211: failed to load regulatory.db Warning: Permanently added '10.128.0.180' (ED25519) to the list of known hosts. [ 90.798443][ T5787] cgroup: Unknown subsys name 'net' [ 91.070471][ T5787] cgroup: Unknown subsys name 'cpuset' [ 91.134850][ T5787] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 93.108727][ T5787] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 97.947900][ T5807] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 97.963166][ T5807] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 97.964952][ T5807] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 97.974013][ T5811] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 97.975466][ T5807] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 97.976634][ T5807] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 97.979562][ T5811] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 97.979828][ T5811] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 97.982130][ T5811] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 97.983487][ T5811] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 98.026561][ T5811] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 98.029882][ T5811] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 98.031190][ T5811] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 98.032654][ T5811] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 98.033642][ T5811] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 98.045029][ T5807] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 98.053857][ T5811] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 98.057451][ T5811] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 98.061118][ T5811] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 98.084876][ T5807] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 98.086157][ T5807] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 98.104884][ T5811] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 98.134477][ T5811] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 98.136485][ T5809] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 98.137393][ T5809] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 99.192628][ T5802] chnl_net:caif_netlink_parms(): no params data found [ 99.265951][ T5812] chnl_net:caif_netlink_parms(): no params data found [ 99.312432][ T5806] chnl_net:caif_netlink_parms(): no params data found [ 99.416113][ T5805] chnl_net:caif_netlink_parms(): no params data found [ 99.421566][ T5803] chnl_net:caif_netlink_parms(): no params data found [ 100.035673][ T5118] Bluetooth: hci1: command tx timeout [ 100.114345][ T5811] Bluetooth: hci2: command tx timeout [ 100.114546][ T5118] Bluetooth: hci0: command tx timeout [ 100.201038][ T5802] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.201318][ T5802] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.201903][ T5802] bridge_slave_0: entered allmulticast mode [ 100.208241][ T5802] bridge_slave_0: entered promiscuous mode [ 100.214356][ T5118] Bluetooth: hci3: command tx timeout [ 100.214487][ T5118] Bluetooth: hci4: command tx timeout [ 100.377214][ T5802] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.377312][ T5802] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.377453][ T5802] bridge_slave_1: entered allmulticast mode [ 100.379256][ T5802] bridge_slave_1: entered promiscuous mode [ 100.380429][ T5812] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.380702][ T5812] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.380886][ T5812] bridge_slave_0: entered allmulticast mode [ 100.383064][ T5812] bridge_slave_0: entered promiscuous mode [ 100.696997][ T5812] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.697120][ T5812] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.697272][ T5812] bridge_slave_1: entered allmulticast mode [ 100.699095][ T5812] bridge_slave_1: entered promiscuous mode [ 100.845363][ T5806] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.845528][ T5806] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.845823][ T5806] bridge_slave_0: entered allmulticast mode [ 100.848104][ T5806] bridge_slave_0: entered promiscuous mode [ 100.995521][ T5805] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.995668][ T5805] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.995791][ T5805] bridge_slave_0: entered allmulticast mode [ 100.997627][ T5805] bridge_slave_0: entered promiscuous mode [ 100.999646][ T5803] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.999862][ T5803] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.000058][ T5803] bridge_slave_0: entered allmulticast mode [ 101.002445][ T5803] bridge_slave_0: entered promiscuous mode [ 101.063689][ T5806] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.063865][ T5806] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.064394][ T5806] bridge_slave_1: entered allmulticast mode [ 101.068366][ T5806] bridge_slave_1: entered promiscuous mode [ 101.076862][ T5802] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 101.155803][ T5805] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.155958][ T5805] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.156168][ T5805] bridge_slave_1: entered allmulticast mode [ 101.158618][ T5805] bridge_slave_1: entered promiscuous mode [ 101.227647][ T5802] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 101.227989][ T5803] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.228097][ T5803] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.228221][ T5803] bridge_slave_1: entered allmulticast mode [ 101.229906][ T5803] bridge_slave_1: entered promiscuous mode [ 101.236232][ T5812] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 101.648273][ T5812] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 101.729208][ T5806] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 101.948399][ T5805] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 101.951230][ T5806] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 101.952914][ T5802] team0: Port device team_slave_0 added [ 101.959340][ T5803] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.048169][ T5805] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.114487][ T5811] Bluetooth: hci1: command tx timeout [ 102.117467][ T5802] team0: Port device team_slave_1 added [ 102.120543][ T5803] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.122477][ T5812] team0: Port device team_slave_0 added [ 102.194844][ T5811] Bluetooth: hci2: command tx timeout [ 102.194851][ T5118] Bluetooth: hci0: command tx timeout [ 102.274384][ T5118] Bluetooth: hci4: command tx timeout [ 102.274396][ T5811] Bluetooth: hci3: command tx timeout [ 102.438903][ T5812] team0: Port device team_slave_1 added [ 102.527403][ T5806] team0: Port device team_slave_0 added [ 102.767038][ T5805] team0: Port device team_slave_0 added [ 102.769454][ T5806] team0: Port device team_slave_1 added [ 103.037103][ T5802] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 103.037117][ T5802] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.037131][ T5802] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 103.040500][ T5803] team0: Port device team_slave_0 added [ 103.127347][ T5805] team0: Port device team_slave_1 added [ 103.185896][ T5802] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 103.185909][ T5802] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.185929][ T5802] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 103.187902][ T5803] team0: Port device team_slave_1 added [ 103.188876][ T5812] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 103.188885][ T5812] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.188899][ T5812] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 103.486133][ T5812] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 103.486151][ T5812] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.486174][ T5812] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 103.577009][ T5806] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 103.577029][ T5806] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.577055][ T5806] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 103.715646][ T5806] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 103.715666][ T5806] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.715694][ T5806] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 103.717044][ T5805] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 103.717058][ T5805] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.717075][ T5805] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 103.720186][ T5803] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 103.720202][ T5803] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.720228][ T5803] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 103.886011][ T5805] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 103.886026][ T5805] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.886042][ T5805] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 103.887093][ T5803] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 103.887106][ T5803] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.887119][ T5803] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.103017][ T5802] hsr_slave_0: entered promiscuous mode [ 104.104914][ T5802] hsr_slave_1: entered promiscuous mode [ 104.194307][ T5118] Bluetooth: hci1: command tx timeout [ 104.273816][ T5812] hsr_slave_0: entered promiscuous mode [ 104.274372][ T5118] Bluetooth: hci0: command tx timeout [ 104.275905][ T5812] hsr_slave_1: entered promiscuous mode [ 104.277042][ T5812] debugfs: 'hsr0' already exists in 'hsr' [ 104.277140][ T5812] Cannot create hsr debugfs directory [ 104.284274][ T5118] Bluetooth: hci2: command tx timeout [ 104.354603][ T5118] Bluetooth: hci3: command tx timeout [ 104.354617][ T5811] Bluetooth: hci4: command tx timeout [ 104.561595][ T5806] hsr_slave_0: entered promiscuous mode [ 104.562634][ T5806] hsr_slave_1: entered promiscuous mode [ 104.563276][ T5806] debugfs: 'hsr0' already exists in 'hsr' [ 104.563294][ T5806] Cannot create hsr debugfs directory [ 104.731741][ T5805] hsr_slave_0: entered promiscuous mode [ 104.732752][ T5805] hsr_slave_1: entered promiscuous mode [ 104.733504][ T5805] debugfs: 'hsr0' already exists in 'hsr' [ 104.733524][ T5805] Cannot create hsr debugfs directory [ 104.842542][ T5803] hsr_slave_0: entered promiscuous mode [ 104.843480][ T5803] hsr_slave_1: entered promiscuous mode [ 104.846153][ T5803] debugfs: 'hsr0' already exists in 'hsr' [ 104.846180][ T5803] Cannot create hsr debugfs directory [ 106.274568][ T5811] Bluetooth: hci1: command tx timeout [ 106.354294][ T5811] Bluetooth: hci2: command tx timeout [ 106.354336][ T5811] Bluetooth: hci0: command tx timeout [ 106.434603][ T5118] Bluetooth: hci4: command tx timeout [ 106.435274][ T5118] Bluetooth: hci3: command tx timeout [ 106.529891][ T5802] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 106.555532][ T5802] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 106.590962][ T5802] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 106.643594][ T5802] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 106.746773][ T5803] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 106.796186][ T5803] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 106.832199][ T5803] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 106.862278][ T5803] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 106.990222][ T5812] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 107.044531][ T5812] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 107.083985][ T5812] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 107.128084][ T5812] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 107.279852][ T5805] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 107.339398][ T5805] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 107.364664][ T5805] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 107.418187][ T5805] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 107.579557][ T5806] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 107.621983][ T5802] 8021q: adding VLAN 0 to HW filter on device bond0 [ 107.638667][ T5806] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 107.672783][ T5806] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 107.727266][ T5806] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 107.850584][ T5802] 8021q: adding VLAN 0 to HW filter on device team0 [ 107.883225][ T5803] 8021q: adding VLAN 0 to HW filter on device bond0 [ 107.900664][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.901195][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.945734][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.947929][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.002810][ T5803] 8021q: adding VLAN 0 to HW filter on device team0 [ 108.044991][ T5812] 8021q: adding VLAN 0 to HW filter on device bond0 [ 108.051413][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.051554][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 108.098316][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.098457][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.162579][ T5812] 8021q: adding VLAN 0 to HW filter on device team0 [ 108.181933][ T5805] 8021q: adding VLAN 0 to HW filter on device bond0 [ 108.217128][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.217334][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 108.271003][ T3468] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.271211][ T3468] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.333747][ T5805] 8021q: adding VLAN 0 to HW filter on device team0 [ 108.380216][ T4578] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.380412][ T4578] bridge0: port 1(bridge_slave_0) entered forwarding state [ 108.400523][ T5806] 8021q: adding VLAN 0 to HW filter on device bond0 [ 108.428396][ T3468] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.428562][ T3468] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.566155][ T5806] 8021q: adding VLAN 0 to HW filter on device team0 [ 108.626232][ T4578] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.626538][ T4578] bridge0: port 1(bridge_slave_0) entered forwarding state [ 108.680926][ T3584] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.687045][ T3584] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.805883][ T5802] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.220243][ T5803] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.256387][ T5802] veth0_vlan: entered promiscuous mode [ 109.293949][ T5812] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.353729][ T5802] veth1_vlan: entered promiscuous mode [ 109.503009][ T5805] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.622821][ T5802] veth0_macvtap: entered promiscuous mode [ 109.691699][ T5803] veth0_vlan: entered promiscuous mode [ 109.708494][ T5802] veth1_macvtap: entered promiscuous mode [ 109.731500][ T5806] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.757409][ T5803] veth1_vlan: entered promiscuous mode [ 109.821124][ T5802] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.853700][ T5802] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 109.881808][ T5805] veth0_vlan: entered promiscuous mode [ 109.909548][ T43] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.920572][ T43] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.937133][ T43] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.953602][ T43] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.967529][ T5805] veth1_vlan: entered promiscuous mode [ 109.970057][ T5803] veth0_macvtap: entered promiscuous mode [ 110.043669][ T5803] veth1_macvtap: entered promiscuous mode [ 110.055265][ T5812] veth0_vlan: entered promiscuous mode [ 110.102520][ T5806] veth0_vlan: entered promiscuous mode [ 110.222992][ T5812] veth1_vlan: entered promiscuous mode [ 110.247848][ T5806] veth1_vlan: entered promiscuous mode [ 110.261221][ T5803] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.309862][ T5803] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.342733][ T5805] veth0_macvtap: entered promiscuous mode [ 110.353142][ T3468] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.353166][ T3468] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.380853][ T3468] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.393354][ T3468] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.407453][ T3468] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.410542][ T5805] veth1_macvtap: entered promiscuous mode [ 110.413297][ T3468] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.515424][ T3468] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.515449][ T3468] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.533377][ T5812] veth0_macvtap: entered promiscuous mode [ 110.629186][ T5806] veth0_macvtap: entered promiscuous mode [ 110.643494][ T5805] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.678102][ T5812] veth1_macvtap: entered promiscuous mode [ 110.731729][ T5805] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.751353][ T5806] veth1_macvtap: entered promiscuous mode [ 110.800469][ T3468] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.804701][ T3890] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.804720][ T3890] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.828189][ T3468] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.833249][ T3468] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.843443][ T5812] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.853707][ T3468] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.950598][ T5812] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.978690][ T3890] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.978714][ T3890] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.989719][ T5806] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.081773][ T3584] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.086701][ T3584] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.088461][ T3584] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.151439][ T5806] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.153452][ T3584] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.254205][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 111.344174][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 111.344231][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 111.691661][ T43] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.215703][ T43] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.287502][ T43] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.496142][ T43] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.559811][ T4578] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.559833][ T4578] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.835104][ T43] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.835126][ T43] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 112.959126][ T1355] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 112.959148][ T1355] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.209230][ T168] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.209255][ T168] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.504137][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 113.564117][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 113.566627][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 113.664148][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 113.764211][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 113.864110][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 113.964158][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 118.546379][ C0] vkms_vblank_simulate: vblank timer overrun [ 118.590656][ T3584] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 118.590678][ T3584] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 119.324409][ C0] vkms_vblank_simulate: vblank timer overrun [ 119.630543][ C0] vkms_vblank_simulate: vblank timer overrun [ 119.826994][ T5955] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12'. [ 120.666679][ T1355] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 120.666703][ T1355] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.084377][ T5961] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 121.084407][ T5961] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 121.661755][ T5963] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 121.661786][ T5963] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 121.996032][ T5963] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 121.996069][ T5963] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 122.233714][ T5961] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 122.233743][ T5961] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 122.514502][ T5961] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 122.514530][ T5961] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 122.953549][ T5961] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 122.953574][ T5961] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 123.147011][ T5975] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 123.240784][ T5973] Zero length message leads to an empty skb [ 123.259805][ T5961] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 123.259824][ T5961] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 125.085795][ T5993] random: crng reseeded on system resumption [ 125.208545][ T6010] netlink: 'syz.3.25': attribute type 1 has an invalid length. [ 125.208573][ T6010] netlink: 236 bytes leftover after parsing attributes in process `syz.3.25'. [ 125.432439][ T6013] syz.3.26 uses obsolete (PF_INET,SOCK_PACKET) [ 126.830655][ C1] vkms_vblank_simulate: vblank timer overrun [ 126.986637][ C1] vkms_vblank_simulate: vblank timer overrun [ 127.025509][ C1] vkms_vblank_simulate: vblank timer overrun [ 127.185966][ C1] vkms_vblank_simulate: vblank timer overrun [ 127.262736][ C1] vkms_vblank_simulate: vblank timer overrun [ 127.344763][ C1] vkms_vblank_simulate: vblank timer overrun [ 127.433140][ C1] vkms_vblank_simulate: vblank timer overrun [ 127.571228][ C1] vkms_vblank_simulate: vblank timer overrun [ 128.200734][ C1] vkms_vblank_simulate: vblank timer overrun [ 128.980904][ C1] vkms_vblank_simulate: vblank timer overrun [ 129.588870][ C1] vkms_vblank_simulate: vblank timer overrun [ 129.804519][ C1] vkms_vblank_simulate: vblank timer overrun [ 130.130065][ C1] vkms_vblank_simulate: vblank timer overrun [ 130.309680][ C1] vkms_vblank_simulate: vblank timer overrun [ 132.065959][ C1] vkms_vblank_simulate: vblank timer overrun [ 132.301964][ T6072] netlink: 28 bytes leftover after parsing attributes in process `syz.4.44'. [ 132.529730][ C1] vkms_vblank_simulate: vblank timer overrun [ 132.678240][ C1] vkms_vblank_simulate: vblank timer overrun [ 133.193473][ C1] vkms_vblank_simulate: vblank timer overrun [ 133.217025][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.217147][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.557261][ T6078] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 133.939938][ T6081] binder: 6080:6081 ioctl c0306201 0 returned -14 [ 134.221098][ C1] vkms_vblank_simulate: vblank timer overrun [ 135.255746][ C1] vkms_vblank_simulate: vblank timer overrun [ 135.771691][ C1] vkms_vblank_simulate: vblank timer overrun [ 136.430429][ C1] vkms_vblank_simulate: vblank timer overrun [ 137.441111][ T6096] netlink: 4 bytes leftover after parsing attributes in process `syz.1.50'. [ 137.752833][ T6108] netlink: 4 bytes leftover after parsing attributes in process `syz.3.54'. [ 138.920842][ C0] vkms_vblank_simulate: vblank timer overrun [ 140.963778][ C0] vkms_vblank_simulate: vblank timer overrun [ 141.036095][ C0] vkms_vblank_simulate: vblank timer overrun [ 141.312128][ C0] vkms_vblank_simulate: vblank timer overrun [ 143.019625][ T5813] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 143.066017][ T6158] netlink: 4 bytes leftover after parsing attributes in process `syz.3.71'. [ 143.224229][ T5813] usb 2-1: Using ep0 maxpacket: 8 [ 143.256241][ T5813] usb 2-1: New USB device found, idVendor=12d1, idProduct=fae2, bcdDevice=70.8b [ 143.256273][ T5813] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 143.256293][ T5813] usb 2-1: Product: syz [ 143.256308][ T5813] usb 2-1: Manufacturer: syz [ 143.256322][ T5813] usb 2-1: SerialNumber: syz [ 143.315061][ T5813] usb 2-1: config 0 descriptor?? [ 143.351299][ T5813] option 2-1:0.0: GSM modem (1-port) converter detected [ 143.428847][ T6164] qnx6: unable to read the first superblock [ 143.429230][ T6164] qnx6: unable to read the first superblock [ 143.429240][ T6164] qnx6: unable to read the first superblock [ 143.690369][ T1903] usb 2-1: USB disconnect, device number 2 [ 143.782566][ T6169] lo speed is unknown, defaulting to 1000 [ 143.782677][ T6169] lo speed is unknown, defaulting to 1000 [ 143.872047][ T6169] lo speed is unknown, defaulting to 1000 [ 143.889895][ T1903] option 2-1:0.0: device disconnected [ 144.044325][ T6169] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 144.393063][ C0] vkms_vblank_simulate: vblank timer overrun [ 144.484546][ T6169] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 147.122966][ T6169] lo speed is unknown, defaulting to 1000 [ 147.179401][ T6169] lo speed is unknown, defaulting to 1000 [ 147.206876][ T6169] lo speed is unknown, defaulting to 1000 [ 147.233996][ T6169] lo speed is unknown, defaulting to 1000 [ 147.252174][ T6169] lo speed is unknown, defaulting to 1000 [ 148.274134][ T6215] process 'syz.1.91' launched '/dev/fd/8' with NULL argv: empty string added [ 148.546261][ T6222] siw: device registration error -23 [ 150.882188][ T6241] block nbd3: NBD_DISCONNECT [ 150.898923][ T6233] wlan0 speed is unknown, defaulting to 1000 [ 150.913902][ T6233] wlan0 speed is unknown, defaulting to 1000 [ 150.922300][ T6233] wlan0 speed is unknown, defaulting to 1000 [ 150.966023][ T6233] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 150.975890][ T6245] netlink: 4 bytes leftover after parsing attributes in process `syz.2.100'. [ 151.430496][ T6233] wlan0 speed is unknown, defaulting to 1000 [ 151.464375][ T6233] wlan0 speed is unknown, defaulting to 1000 [ 151.482688][ T6233] wlan0 speed is unknown, defaulting to 1000 [ 151.487796][ T6252] netlink: 4 bytes leftover after parsing attributes in process `syz.0.104'. [ 152.365473][ T6233] wlan0 speed is unknown, defaulting to 1000 [ 152.368925][ T6233] wlan0 speed is unknown, defaulting to 1000 [ 152.372597][ T6263] lo speed is unknown, defaulting to 1000 [ 152.403578][ T6263] lo speed is unknown, defaulting to 1000 [ 152.411532][ T6263] lo speed is unknown, defaulting to 1000 [ 152.498941][ T6263] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 152.680311][ T6263] lo speed is unknown, defaulting to 1000 [ 152.682089][ T6263] lo speed is unknown, defaulting to 1000 [ 152.734900][ T6263] lo speed is unknown, defaulting to 1000 [ 153.851840][ T6263] lo speed is unknown, defaulting to 1000 [ 153.853599][ T6263] lo speed is unknown, defaulting to 1000 [ 155.089243][ T6275] 9pnet_fd: Insufficient options for proto=fd [ 156.968597][ T6271] block nbd0: shutting down sockets [ 157.406118][ T5881] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 157.556876][ T6295] netlink: 4 bytes leftover after parsing attributes in process `syz.1.117'. [ 157.604342][ T5881] usb 1-1: Using ep0 maxpacket: 8 [ 157.626247][ T5881] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 157.626267][ T5881] usb 1-1: config 0 has no interface number 0 [ 157.626297][ T5881] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 157.626310][ T5881] usb 1-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 157.626324][ T5881] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 157.626339][ T5881] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 157.626378][ T5881] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 157.626391][ T5881] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 157.717713][ T5881] usb 1-1: config 0 descriptor?? [ 157.774648][ T5881] ldusb 1-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 158.071450][ T31] usb 1-1: USB disconnect, device number 2 [ 158.118566][ T31] ldusb 1-1:0.55: LD USB Device #0 now disconnected [ 158.602785][ C0] vkms_vblank_simulate: vblank timer overrun [ 158.785911][ T6308] warning: `syz.1.122' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 161.795224][ T6326] block nbd0: NBD_DISCONNECT [ 162.544285][ T6333] netlink: 8 bytes leftover after parsing attributes in process `syz.1.129'. [ 162.544322][ T6333] netlink: 'syz.1.129': attribute type 21 has an invalid length. [ 162.804207][ T5813] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 162.959414][ T5813] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 162.959447][ T5813] usb 3-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 162.959466][ T5813] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 162.959523][ T5813] usb 3-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 162.959559][ T5813] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 162.959584][ T5813] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 163.172380][ T5813] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 163.172412][ T5813] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 163.172431][ T5813] usb 3-1: Product: syz [ 163.172444][ T5813] usb 3-1: Manufacturer: syz [ 163.227648][ T6338] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 163.273806][ T5813] cdc_wdm 3-1:1.0: skipping garbage [ 163.273830][ T5813] cdc_wdm 3-1:1.0: skipping garbage [ 163.289714][ T5813] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 163.289737][ T5813] cdc_wdm 3-1:1.0: Unknown control protocol [ 163.480045][ T6346] netlink: 32 bytes leftover after parsing attributes in process `syz.0.134'. [ 163.522470][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 163.522578][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 163.522922][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 163.522943][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 163.523224][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 163.523255][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 163.523504][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 163.523524][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 163.523770][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 163.523790][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 163.524081][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 163.524100][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 163.524346][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 163.524367][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 163.524613][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 163.524633][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 163.524878][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 163.524898][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 163.525531][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 163.525551][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 163.667976][ T5813] usb 3-1: USB disconnect, device number 2 [ 163.668075][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 164.191735][ T6358] block nbd3: NBD_DISCONNECT [ 165.369977][ T6371] syz.4.144 (6371) used greatest stack depth: 18376 bytes left [ 165.815576][ T6376] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 [ 165.815601][ T6376] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6376, name: syz.1.145 [ 165.815619][ T6376] preempt_count: 1, expected: 0 [ 165.815630][ T6376] RCU nest depth: 2, expected: 2 [ 165.815640][ T6376] 5 locks held by syz.1.145/6376: [ 165.815653][ T6376] #0: ffff888040690350 (sk_lock-AF_VSOCK){+.+.}-{0:0}, at: vsock_connectible_sendmsg+0x189/0x1040 [ 165.815728][ T6376] #1: ffffffff8d7aa4c0 (rcu_read_lock){....}-{1:3}, at: bpf_trace_run9+0x1ec/0x500 [ 165.815783][ T6376] #2: ffff8880b8932c88 ((stream_local_lock)){+.+.}-{3:3}, at: __bpf_stream_push_str+0x211/0xbe0 [ 165.815844][ T6376] #3: ffffffff8d7aa4c0 (rcu_read_lock){....}-{1:3}, at: rt_spin_trylock+0x10d/0x2b0 [ 165.815904][ T6376] #4: ffff8880b893f6e8 (&s->lock_key#5){+.+.}-{3:3}, at: ___slab_alloc+0x12f/0x13f0 [ 165.815969][ T6376] Preemption disabled at: [ 165.815974][ T6376] [<0000000000000000>] 0x0 [ 165.816002][ T6376] CPU: 1 UID: 0 PID: 6376 Comm: syz.1.145 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 165.816026][ T6376] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 165.816037][ T6376] Call Trace: [ 165.816047][ T6376] [ 165.816056][ T6376] dump_stack_lvl+0x189/0x250 [ 165.816087][ T6376] ? __pfx_dump_stack_lvl+0x10/0x10 [ 165.816115][ T6376] ? __pfx__printk+0x10/0x10 [ 165.816147][ T6376] ? print_lock_name+0xde/0x100 [ 165.816182][ T6376] __might_resched+0x44b/0x5d0 [ 165.816222][ T6376] ? __pfx___might_resched+0x10/0x10 [ 165.816250][ T6376] ? ___slab_alloc+0x12f/0x13f0 [ 165.816292][ T6376] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 165.816325][ T6376] ? lockdep_hardirqs_on+0x9c/0x150 [ 165.816365][ T6376] rt_spin_lock+0xc7/0x3e0 [ 165.816398][ T6376] ? __pfx_rt_spin_lock+0x10/0x10 [ 165.816425][ T6376] ? __lock_acquire+0xab9/0xd20 [ 165.816460][ T6376] ___slab_alloc+0x12f/0x13f0 [ 165.816496][ T6376] ? __set_page_owner+0x25c/0x490 [ 165.816525][ T6376] __slab_alloc+0xc6/0x1f0 [ 165.816551][ T6376] ? __set_page_owner+0x25c/0x490 [ 165.816577][ T6376] __kmalloc_cache_noprof+0xec/0x6c0 [ 165.816602][ T6376] ? __set_page_owner+0x25c/0x490 [ 165.816629][ T6376] __set_page_owner+0x25c/0x490 [ 165.816655][ T6376] ? __pfx___set_page_owner+0x10/0x10 [ 165.816677][ T6376] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 165.816717][ T6376] post_alloc_hook+0x240/0x2a0 [ 165.816746][ T6376] get_page_from_freelist+0x28c0/0x2960 [ 165.816795][ T6376] ? lockdep_unlock+0x89/0x120 [ 165.816822][ T6376] ? __lock_acquire+0xab9/0xd20 [ 165.816871][ T6376] alloc_frozen_pages_nolock_noprof+0xbc/0x150 [ 165.816914][ T6376] alloc_pages_nolock_noprof+0xa/0x30 [ 165.816945][ T6376] bpf_stream_page_replace+0x19/0x1e0 [ 165.816978][ T6376] __bpf_stream_push_str+0x35c/0xbe0 [ 165.817018][ T6376] ? __pfx___bpf_stream_push_str+0x10/0x10 [ 165.817064][ T6376] bpf_stream_stage_printk+0x14e/0x1c0 [ 165.817092][ T6376] ? __pfx_find_from_stack_cb+0x10/0x10 [ 165.817118][ T6376] ? arch_bpf_stack_walk+0x112/0x170 [ 165.817150][ T6376] ? __pfx_bpf_stream_stage_printk+0x10/0x10 [ 165.817190][ T6376] ? lockdep_hardirqs_on+0x9c/0x150 [ 165.817234][ T6376] bpf_prog_report_may_goto_violation+0xc4/0x190 [ 165.817281][ T6376] ? __pfx_bpf_prog_report_may_goto_violation+0x10/0x10 [ 165.817316][ T6376] ? irqentry_exit+0x74/0x90 [ 165.817353][ T6376] ? read_tsc+0x9/0x20 [ 165.817387][ T6376] bpf_check_timed_may_goto+0xaa/0xb0 [ 165.817422][ T6376] arch_bpf_timed_may_goto+0x21/0x40 [ 165.817458][ T6376] bpf_prog_262a74d054ad2993+0x53/0x5f [ 165.817480][ T6376] bpf_trace_run9+0x2de/0x500 [ 165.817505][ T6376] ? bpf_trace_run9+0x1ec/0x500 [ 165.817527][ T6376] ? __pfx_bpf_trace_run9+0x10/0x10 [ 165.817583][ T6376] __bpf_trace_virtio_transport_alloc_pkt+0x2d7/0x340 [ 165.817626][ T6376] ? __pfx___bpf_trace_virtio_transport_alloc_pkt+0x10/0x10 [ 165.817650][ T6376] ? kmem_cache_alloc_node_noprof+0x291/0x6e0 [ 165.817708][ T6376] ? skb_copy_datagram_from_iter_full+0x122/0x170 [ 165.817758][ T6376] virtio_transport_alloc_skb+0x10cc/0x1130 [ 165.817812][ T6376] ? __pfx_virtio_transport_alloc_skb+0x10/0x10 [ 165.817842][ T6376] ? rt_spin_unlock+0x150/0x200 [ 165.817883][ T6376] virtio_transport_send_pkt_info+0x6be/0x1100 [ 165.817925][ T6376] ? rt_spin_unlock+0x150/0x200 [ 165.817959][ T6376] ? virtio_transport_seqpacket_enqueue+0xba/0x1f0 [ 165.817988][ T6376] virtio_transport_seqpacket_enqueue+0x166/0x1f0 [ 165.818014][ T6376] ? rt_spin_lock+0x1c1/0x3e0 [ 165.818044][ T6376] ? __pfx_virtio_transport_seqpacket_enqueue+0x10/0x10 [ 165.818079][ T6376] ? rt_spin_unlock+0x150/0x200 [ 165.818113][ T6376] ? rt_spin_unlock+0x161/0x200 [ 165.818146][ T6376] vsock_connectible_sendmsg+0xabf/0x1040 [ 165.818202][ T6376] ? __pfx_vsock_connectible_sendmsg+0x10/0x10 [ 165.818242][ T6376] ? __pfx_woken_wake_function+0x10/0x10 [ 165.818286][ T6376] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 165.818311][ T6376] ? __pfx_vsock_connectible_sendmsg+0x10/0x10 [ 165.818348][ T6376] __sock_sendmsg+0x21c/0x270 [ 165.818381][ T6376] ____sys_sendmsg+0x534/0x820 [ 165.818412][ T6376] ? __pfx_____sys_sendmsg+0x10/0x10 [ 165.818447][ T6376] ? import_iovec+0x74/0xa0 [ 165.818479][ T6376] ___sys_sendmsg+0x21f/0x2a0 [ 165.818505][ T6376] ? __pfx____sys_sendmsg+0x10/0x10 [ 165.818572][ T6376] ? __fget_files+0x2a/0x420 [ 165.818596][ T6376] ? __fget_files+0x3a6/0x420 [ 165.818633][ T6376] __sys_sendmmsg+0x22d/0x430 [ 165.818663][ T6376] ? __pfx___sys_sendmmsg+0x10/0x10 [ 165.818698][ T6376] ? __pfx_do_futex+0x10/0x10 [ 165.818776][ T6376] __x64_sys_sendmmsg+0xa0/0xc0 [ 165.818802][ T6376] do_syscall_64+0xfa/0xfa0 [ 165.818833][ T6376] ? lockdep_hardirqs_on+0x9c/0x150 [ 165.818867][ T6376] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.818890][ T6376] ? clear_bhb_loop+0x60/0xb0 [ 165.818919][ T6376] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.818941][ T6376] RIP: 0033:0x7f1de047efc9 [ 165.818961][ T6376] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 165.818979][ T6376] RSP: 002b:00007f1dde6de038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 165.819002][ T6376] RAX: ffffffffffffffda RBX: 00007f1de06d5fa0 RCX: 00007f1de047efc9 [ 165.819017][ T6376] RDX: 0000000000000001 RSI: 0000200000000b40 RDI: 0000000000000004 [ 165.819031][ T6376] RBP: 00007f1de0501f91 R08: 0000000000000000 R09: 0000000000000000 [ 165.819045][ T6376] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 165.819058][ T6376] R13: 00007f1de06d6038 R14: 00007f1de06d5fa0 R15: 00007ffcc46967e8 [ 165.819099][ T6376] [ 165.994602][ T37] audit: type=1804 audit(1760791108.045:2): pid=6379 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.1.145" name="/newroot/28/file0" dev="tmpfs" ino=175 res=1 errno=0 [ 166.897298][ T6390] ubi31: attaching mtd0 [ 166.921140][ T6390] ubi31: scanning is finished [ 166.921165][ T6390] ubi31: empty MTD device detected [ 167.584856][ T6390] ubi31: attached mtd0 (name "mtdram test device", size 0 MiB) [ 167.584886][ T6390] ubi31: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 167.584905][ T6390] ubi31: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 167.584921][ T6390] ubi31: VID header offset: 64 (aligned 64), data offset: 128 [ 167.584938][ T6390] ubi31: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 167.584954][ T6390] ubi31: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 167.584973][ T6390] ubi31: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 1574389324 [ 167.584994][ T6390] ubi31: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 167.586723][ T6395] ubi31: background thread "ubi_bgt31d" started, PID 6395