last executing test programs: 1m35.877042013s ago: executing program 3 (id=21): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000080)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5ce000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000002a80)=""/102392, 0x18ff8) r4 = socket$inet_tcp(0x2, 0x1, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r5, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r4}, 0x20) recvmmsg(r4, &(0x7f0000000c80)=[{{0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f00000001c0)=""/177, 0xb1}], 0x1}, 0x3}], 0x1, 0x40000161, 0x0) 1m33.009909576s ago: executing program 3 (id=23): openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000880), 0x40, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./gadget\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019440)=""/102400, 0x19000) write(0xffffffffffffffff, &(0x7f0000000000)="000000000902190003010080320904000001ff000000070581024000000902190001012f9b67da02dc21008032090400fa00ff0000c512005890300705810200020012fbfd020000", 0x48) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000040)={0x14, 0x1, 0x3, "2742528909000000ce0198666a0084feea0be6b8a80052d763e61f9d13f019e3"}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x4, &(0x7f00000000c0)=[{0x45, 0x1, 0x2, 0xfffffffc}, {0x61}, {0x0, 0x0, 0x0, 0x5b4c}, {0x6}]}) syz_init_net_socket$x25(0x9, 0x5, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r4 = socket$nl_route(0x10, 0x3, 0x0) fcntl$F_GET_RW_HINT(r4, 0x40f, &(0x7f0000000040)) 1m29.205500893s ago: executing program 3 (id=24): sendmsg$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x2, 0x1, 0x23, 0x0, 0x1, 0x3}, 0x50) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@rights={{0x10}}, @cred={{0x1c}}, @rights={{0x10}}, @rights={{0x10}}], 0x50}, 0x40000002) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="180100001700000000000000ff00000085000000a800000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008002010b70400000000000085000000c300000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x36, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000340)={r3}, 0xc) 1m24.813445862s ago: executing program 3 (id=32): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r0, 0x1000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = fsopen(&(0x7f0000000080)='sysfs\x00', 0x0) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$IEEE802154_SCAN_REQ(0xffffffffffffffff, &(0x7f0000002980)={0x0, 0x0, &(0x7f0000002940)={&(0x7f0000000000)={0x14, r6, 0x1, 0x2070bd2c, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x161b060f1436d4f2}, 0x4000820) setsockopt$inet_tcp_int(r5, 0x6, 0x3, &(0x7f00000001c0)=0x1, 0x4) read$FUSE(0xffffffffffffffff, &(0x7f0000000600)={0x2020, 0x0, 0x0}, 0x2020) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0xc) setresuid(r8, r8, 0xee01) r9 = getgid() write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000002640)={0xa0, 0x0, r7, {{0x2, 0x3, 0x4, 0xffffffff, 0x4, 0x9, {0x8, 0xf4, 0x659d, 0x3ff, 0x40, 0xffffffff80000000, 0x5, 0x7, 0xd90, 0x2000, 0x9, r8, r9, 0x5, 0xfffffffb}}, {0x0, 0x11}}}, 0xa0) fsconfig$FSCONFIG_SET_FD(r4, 0x5, 0x0, 0x0, 0xffffffffffffffff) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) fchdir(0xffffffffffffffff) 1m23.380797207s ago: executing program 3 (id=35): openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000880), 0x40, 0x0) mount(0x0, &(0x7f0000000140)='./gadget\x00', &(0x7f0000000180)='gadgetfs\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019440)=""/102400, 0x19000) write(0xffffffffffffffff, &(0x7f0000000000)="000000000902190003010080320904000001ff000000070581024000000902190001012f9b67da02dc21008032090400fa00ff0000c512005890300705810200020012fbfd020000", 0x48) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000040)={0x14, 0x1, 0x3, "2742528909000000ce0198666a0084feea0be6b8a80052d763e61f9d13f019e3"}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x4, &(0x7f00000000c0)=[{0x45, 0x1, 0x2, 0xfffffffc}, {0x61}, {0x0, 0x0, 0x0, 0x5b4c}, {0x6}]}) syz_init_net_socket$x25(0x9, 0x5, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r4 = socket$nl_route(0x10, 0x3, 0x0) fcntl$F_GET_RW_HINT(r4, 0x40f, &(0x7f0000000040)) 1m21.232422939s ago: executing program 3 (id=36): r0 = open(&(0x7f00000000c0)='./file0\x00', 0x108843, 0x9a) socket$inet_tcp(0x2, 0x1, 0x0) socket$kcm(0x10, 0x2, 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000400)={@initdev, @remote}, &(0x7f0000000440)=0xc) sendmsg$nl_route_sched(r0, &(0x7f0000000500)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000004c0)={0x0}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xb, 0xa2b9, 0x6, 0x6, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x6, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x0, 0x8a, 0x79, 0x2, 0x10080, 0xfffffffe, 0x83f4, 0x129, 0x1, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007b, 0xffffffff, 0x1, 0x2], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x7, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x6, 0x2e6bf783, 0x80000001, 0x5, 0x40000005, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4e, 0x2000104, 0x1, 0x9, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x100006, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x9, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x80000000, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x2, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$NFNL_MSG_CTHELPER_DEL(r0, &(0x7f0000000380)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, 0x2, 0x9, 0x101, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x5}, @NFCTH_TUPLE={0x4}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0x7fffffff}}, @NFCTH_TUPLE={0x50, 0x2, [@CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x13}}, {0x14, 0x4, @loopback}}}]}, @NFCTH_STATUS={0x8, 0x6, 0x1, 0x0, 0x1}]}, 0x90}, 0x1, 0x0, 0x0, 0x44800}, 0x4004054) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) ioctl$sock_bt_bnep_BNEPCONNADD(0xffffffffffffffff, 0x400442c8, &(0x7f00000001c0)={r5, 0x1, 0x2}) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000000)={[0x2000000035, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x5, 0xf2, 0xd, 0x7fffffffffffe, 0xcd3, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r6 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r7 = dup(r6) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) 1m4.662958278s ago: executing program 32 (id=36): r0 = open(&(0x7f00000000c0)='./file0\x00', 0x108843, 0x9a) socket$inet_tcp(0x2, 0x1, 0x0) socket$kcm(0x10, 0x2, 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$inet_mreqn(r0, 0x0, 0x20, &(0x7f0000000400)={@initdev, @remote}, &(0x7f0000000440)=0xc) sendmsg$nl_route_sched(r0, &(0x7f0000000500)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000004c0)={0x0}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xb, 0xa2b9, 0x6, 0x6, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x6, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x0, 0x8a, 0x79, 0x2, 0x10080, 0xfffffffe, 0x83f4, 0x129, 0x1, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007b, 0xffffffff, 0x1, 0x2], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x7, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x6, 0x2e6bf783, 0x80000001, 0x5, 0x40000005, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4e, 0x2000104, 0x1, 0x9, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x100006, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x9, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x80000000, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x2, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$NFNL_MSG_CTHELPER_DEL(r0, &(0x7f0000000380)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x90, 0x2, 0x9, 0x101, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x5}, @NFCTH_TUPLE={0x4}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0x7fffffff}}, @NFCTH_TUPLE={0x50, 0x2, [@CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x13}}, {0x14, 0x4, @loopback}}}]}, @NFCTH_STATUS={0x8, 0x6, 0x1, 0x0, 0x1}]}, 0x90}, 0x1, 0x0, 0x0, 0x44800}, 0x4004054) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) ioctl$sock_bt_bnep_BNEPCONNADD(0xffffffffffffffff, 0x400442c8, &(0x7f00000001c0)={r5, 0x1, 0x2}) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000000)={[0x2000000035, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x5, 0xf2, 0xd, 0x7fffffffffffe, 0xcd3, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r6 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r7 = dup(r6) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) 35.478538752s ago: executing program 1 (id=107): sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, 0x0, 0x137) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='mountinfo\x00') sendfile(r0, r0, &(0x7f0000000000)=0x2eb4, 0x2000007ff) ioctl$TCSETS(0xffffffffffffffff, 0x5402, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x3a, &(0x7f0000001c00)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x2, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x18, 0x0, @wg=@data={0x4, 0x7407, 0xfffffffffffffffd}}}}}}, 0x0) syz_create_resource$binfmt(0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) mount$fuse(0x0, 0x0, &(0x7f00000020c0), 0x0, 0x0) umount2(0x0, 0xb) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$dsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0xfffffffffffffffc, 0x8000, 0x2, 0x10001}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x8, 0x0, 0xf, 0x80000006}, 0x0, 0x0) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r3, 0xc058534f, &(0x7f0000000440)={{0xf, 0x1}, 0x1, 0x3, 0x4, {0x0, 0xb}, 0x18, 0x8000040b}) 29.185372488s ago: executing program 1 (id=112): setns(0xc9, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) sendmsg$NL80211_CMD_ASSOCIATE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x40, r1, 0x1, 0x70bd28, 0x25dfdbf9, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_HT_CAPABILITY_MASK={0x1e, 0x94, {0x10, 0x1, 0x0, 0x0, {0x3ea94ec3, 0x2, 0x0, 0x5, 0x0, 0x1, 0x1, 0x1, 0x1}, 0x300, 0xfffffffa, 0x3}}, @NL80211_ATTR_SSID={0x4}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000000}, 0xc00) 28.527028054s ago: executing program 1 (id=116): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f0000000900)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9135a01c95d4a128ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0c", 0x1a1, 0x12, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='veno', 0x4) shutdown(r0, 0x1) 27.959329462s ago: executing program 1 (id=119): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./tracing\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) move_mount(r0, 0x0, 0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x267) 27.367957342s ago: executing program 1 (id=120): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = dup(r0) ioctl$TIOCL_SETSEL(r1, 0x541c, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) arch_prctl$ARCH_SHSTK_ENABLE(0x5001, 0x1) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r4) fspick(0xffffffffffffffff, 0x0, 0x1) r5 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r5, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x1000000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x809}, {0xa, 0x8, 0x0, @empty}, 0x2, {[0x0, 0x1, 0xfffffffe, 0x0, 0xffffffff, 0x8, 0x40]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r5, 0x29, 0xcc, &(0x7f0000000280)={{0xa, 0x0, 0x0, @loopback, 0x8001}, {0xa, 0x0, 0x0, @mcast2}, 0x0, {[0x1, 0x0, 0xfffffffc, 0x0, 0x9]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r5, 0x29, 0xcc, &(0x7f00000001c0)={{0xa, 0x0, 0x0, @local}, {0xa, 0x4e22, 0x800, @empty}, 0x0, {[0x0, 0x8000, 0x0, 0xfffffffc]}}, 0x5c) setsockopt$MRT6_FLUSH(r5, 0x29, 0xd4, &(0x7f0000000340)=0x6, 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="040000000400000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000054986eb424d84f820000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000000850000003300000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 26.301213261s ago: executing program 1 (id=122): openat$sndseq(0xffffff9c, &(0x7f0000000000), 0x0) fsopen(&(0x7f0000000180)='ecryptfs\x00', 0x0) ioctl$TIOCSRS485(0xffffffffffffffff, 0x5437, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) writev(r0, &(0x7f0000000a40)=[{&(0x7f0000000040)="9de24dfccd00", 0x6}], 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0xe8381, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_GET_CLOCK(r0, 0x8030ae7c, &(0x7f0000000140)) syz_open_procfs(0x0, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x10, 0x7fff0000}]}) close_range(r4, 0xffffffffffffffff, 0x0) 24.314955866s ago: executing program 33 (id=122): openat$sndseq(0xffffff9c, &(0x7f0000000000), 0x0) fsopen(&(0x7f0000000180)='ecryptfs\x00', 0x0) ioctl$TIOCSRS485(0xffffffffffffffff, 0x5437, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) writev(r0, &(0x7f0000000a40)=[{&(0x7f0000000040)="9de24dfccd00", 0x6}], 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0xe8381, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_GET_CLOCK(r0, 0x8030ae7c, &(0x7f0000000140)) syz_open_procfs(0x0, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x10, 0x7fff0000}]}) close_range(r4, 0xffffffffffffffff, 0x0) 20.195924128s ago: executing program 0 (id=129): sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, 0x0, 0x137) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='mountinfo\x00') sendfile(r0, r0, &(0x7f0000000000)=0x2eb4, 0x2000007ff) ioctl$TCSETS(0xffffffffffffffff, 0x5402, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x3a, &(0x7f0000001c00)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x2, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x18, 0x0, @wg=@data={0x4, 0x7407, 0xfffffffffffffffd}}}}}}, 0x0) syz_create_resource$binfmt(0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) mount$fuse(0x0, 0x0, &(0x7f00000020c0), 0x0, 0x0) umount2(0x0, 0xb) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$dsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0xfffffffffffffffc, 0x8000, 0x2, 0x10001}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x8, 0x0, 0xf, 0x80000006}, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{0xf, 0x1}, 0x1, 0x3, 0x4, {0x0, 0xb}, 0x18, 0x8000040b}) 18.014393928s ago: executing program 0 (id=131): r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r0, &(0x7f0000000080)={0x2020, 0x0, 0x3, 0x5, 0x1}, 0x8) 17.048298418s ago: executing program 4 (id=133): openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000500), 0x800) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = getpid() syz_pidfd_open(r2, 0x0) setrlimit(0xe, &(0x7f0000000000)={0x10a, 0xc6d1480}) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x40, &(0x7f0000000240)={0x0, 0xfffffffffffffffc, 0xd0, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xa, 0x80000006, 0x400}, 0x0, 0x0) listen(r1, 0x0) 13.364818624s ago: executing program 4 (id=137): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@base={0xb, 0x7, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0xfffffffc}, 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r3, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b7030000000000008500", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x52, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r4}, 0xc) 12.110463516s ago: executing program 4 (id=138): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f0000000900)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9135a01c95d4a128ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0c", 0x1a1, 0x12, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080), 0xffffffffffffffa9, 0xc9100120, 0x0, 0x1500) shutdown(r0, 0x1) 12.016527886s ago: executing program 4 (id=139): openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) syz_emit_ethernet(0x0, 0x0, 0x0) pipe2(0x0, 0x800) 8.817445275s ago: executing program 2 (id=140): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x722, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4043, 0x1ff) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000) r3 = creat(0x0, 0xecf86c37d53049cc) close(r3) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0x0) r4 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f0000000080)="13", 0x1, 0xfffffffffffffffd) r5 = add_key$keyring(&(0x7f0000000480), 0x0, 0x0, 0x0, 0xfffffffffffffffa) add_key(&(0x7f0000000000)='id_legacy\x00', 0x0, &(0x7f00000002c0)="e95d1779f814d0e7ca4fbd150de66f132345d443e4546640b718a07753067e5c1f472e10cd461654c082ff056bddb1a94fdd6906059cef7887ceaf14dbf26d5e8ba2cec51c1b1de485f8d36c7119f3eef99b84f3bb3f67d0f9aa30efd17d0e6f3b2a5e5af36ac110f3cca8c77542cef44481de91351c156409b988f9492aedd56952aa429b6167f7a57d73a8129b35ef42344c9e4858ac77b28756837d2534431a11cda87483a1f362c9ffc9fa4b44adf98a6979390ed5d168bf85aaef3a", 0xbe, r5) keyctl$read(0xb, r4, &(0x7f0000000240)=""/112, 0x349b7f55) execve(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) 8.803687062s ago: executing program 0 (id=141): sendmsg$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100"], 0x128}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x2, 0x1, 0x23, 0x0, 0x1, 0x3}, 0x50) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@rights={{0x10}}, @cred={{0x1c}}, @rights={{0x10}}, @rights={{0x10}}], 0x50}, 0x40000002) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="180100001700000000000000ff00000085000000a800000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008002010b70400000000000085000000c300000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x36, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000340)={r3}, 0xc) 7.43001176s ago: executing program 2 (id=142): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = dup(r0) ioctl$TIOCL_SETSEL(r1, 0x541c, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000032680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) arch_prctl$ARCH_SHSTK_ENABLE(0x5001, 0x1) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r4) fspick(0xffffffffffffffff, 0x0, 0x1) r5 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r5, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x1000000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x809}, {0xa, 0x8, 0x0, @empty}, 0x2, {[0x0, 0x1, 0xfffffffe, 0x0, 0xffffffff, 0x8, 0x40]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r5, 0x29, 0xcc, &(0x7f0000000280)={{0xa, 0x0, 0x0, @loopback, 0x8001}, {0xa, 0x0, 0x0, @mcast2}, 0x0, {[0x1, 0x0, 0xfffffffc, 0x0, 0x9]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r5, 0x29, 0xcc, &(0x7f00000001c0)={{0xa, 0x0, 0x0, @local}, {0xa, 0x4e22, 0x800, @empty}, 0x0, {[0x0, 0x8000, 0x0, 0xfffffffc]}}, 0x5c) setsockopt$MRT6_FLUSH(r5, 0x29, 0xd4, &(0x7f0000000340)=0x6, 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="040000000400000004"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{}, 0x0, 0x0}, 0x20) 7.293693809s ago: executing program 0 (id=143): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpid() syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r1 = syz_open_dev$admmidi(&(0x7f00000002c0), 0x20, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r1, 0xc0305710, &(0x7f00000001c0)={0x1, 0x7e, 0x22, 0x0, 0x407}) 7.289257677s ago: executing program 4 (id=144): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x3a09007, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) pivot_root(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)='./file0\x00') 6.363943683s ago: executing program 2 (id=145): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x81, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100), &(0x7f00000001c0), 0x10f0, r2}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000004c0)={r2, &(0x7f0000000380), &(0x7f0000000480)}, 0x20) ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f00000000c0)={0x1, 0x0, [{0x6, 0x4, 0x0, 0x0, @adapter={0xfffffffffffffffb, 0x4, 0x0, 0x0, 0x7}}]}) ioctl$KVM_RUN(r3, 0xae80, 0x0) eventfd2(0xae37, 0x80801) r4 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000200)='veth0\x00', 0x6) bind$llc(r4, 0x0, 0x0) syz_emit_ethernet(0x15, &(0x7f0000000100)=ANY=[], 0x0) syz_usb_connect(0x5, 0x27, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000b75c7f40470501026411010203010902120001000000000904"], 0x0) r5 = open(0x0, 0x80ff, 0x88) fcntl$setlease(r5, 0x400, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x88040, 0x0) fcntl$setlease(r6, 0x400, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x18) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r7, 0xffffffffffffffff, 0x0) 4.582703675s ago: executing program 0 (id=146): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@base={0xb, 0x7, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0xfffffffc}, 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r3, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b7030000000000008500", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x52, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r4}, 0xc) 3.319556689s ago: executing program 2 (id=147): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e21, @local}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='veno', 0x4) recvfrom$inet(r0, &(0x7f0000000080), 0xffffffffffffffa9, 0xc9100120, 0x0, 0x1500) shutdown(r0, 0x1) 3.00205331s ago: executing program 4 (id=148): sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair(0x1, 0x1, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ef) lsetxattr$security_capability(&(0x7f0000000340)='./file1\x00', &(0x7f00000002c0), &(0x7f0000000740)=@v3={0x3000000, [{0x101, 0x3}, {0x5, 0x1ff}]}, 0x18, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c8) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x207) mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) truncate(&(0x7f0000000140)='./file0/file1\x00', 0xe2) 2.970287116s ago: executing program 2 (id=149): syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r3 = syz_clone(0x0, 0x0, 0x29, 0x0, 0x0, 0x0) ptrace(0x10, r3) ptrace(0x8, r3) wait4(0x0, 0x0, 0x0, 0x0) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r4, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r4, 0x0, 0x0, 0x2000077c, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) write(r4, &(0x7f0000001f00)="ef97646110265cf65eda0c997a00976ca6b72e643a4d71f06f4e112955fa9b595e718de352b21791dd333109ee5f4b0fb02caaf507c2e7aaf9adb3662a145451969da96427a09e58c069ef95473af4dfefeed6e3ecc1e724936fecd6c2d606b30eeb8c15e39738cf1338fc4643c5a3f0b5775b1834a7dd01e491668a1139efd38a9f014a061561e5bbde8983024934a37349907a9629c8e7ed11c31f288d48baed9dfb44bd33dba6bd292aad455d53d0c6f09126918f54e663d71c3506756e3eca40c1c7d2b3173d11d86322843bc6ee4beeff184bfeb2f15cfd1ae189bb68995feab724d720656d528d8b67823c02941343f1f478e74a152bdc0a55b2ce0c3dfb338c25e4b63a3a3063c240ea4a0712507fad227c65b7da6ed66f943a61c724a0db0d774b994b4fc8ddc44a10c32f59e555e5d1b07195df685079189c3140956b641b5617e9bab446bc57bd614e99827f8e1797ec6d59fc7cf1057bd947f233de", 0x161) r5 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpuacct.usage_user\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9, 0x13, r5, 0x0) sendto$inet(r4, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) 1.610680937s ago: executing program 2 (id=150): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x7c, 0x208100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x101000, 0x0) r1 = syz_open_procfs$pagemap(0x0, &(0x7f0000000340)) readv(r1, 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) ioctl$XFS_IOC_GETBMAP(r0, 0xc0205826, 0x0) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x1ff) bpf$PROG_LOAD(0x5, 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./tracing\x00', &(0x7f0000000280)='tracefs\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='smaps\x00') lseek(r3, 0x1000000, 0x0) write(0xffffffffffffffff, &(0x7f0000000800)='0', 0x1) r4 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x2012, r4, 0x0) ioctl$SG_SET_RESERVED_SIZE(r4, 0x2275, &(0x7f0000000340)=0xc291) add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000140)="1f", 0x1, 0xfffffffffffffffe) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) syslog(0x4, &(0x7f0000000000)=""/19, 0xb12288e90d7c8384) add_key$user(&(0x7f0000006400), &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0, 0x0) socket(0x15, 0x5, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) writev(0xffffffffffffffff, &(0x7f0000000300)=[{&(0x7f0000000340)="580000001400192340834b80040d8c560a117436c379000000000000000058000b4824ca945f6400940f6a0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100090c100000000000204e0000", 0x58}], 0x1) 0s ago: executing program 0 (id=151): sendmsg$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100"], 0x128}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x2, 0x1, 0x23, 0x0, 0x1, 0x3}, 0x50) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@rights={{0x10}}, @cred={{0x1c}}, @rights={{0x10}}, @rights={{0x10}}], 0x50}, 0x40000002) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="180100001700000000000000ff00000085000000a800000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008002010b70400000000000085000000c300000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x36, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000340)={r3}, 0xc) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.127' (ED25519) to the list of known hosts. [ 92.427938][ T44] cfg80211: failed to load regulatory.db [ 93.442885][ T5576] cgroup: Unknown subsys name 'net' [ 93.684107][ T5576] cgroup: Unknown subsys name 'cpuset' [ 93.737068][ T5576] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 95.809895][ T5576] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 98.669816][ T60] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 98.706789][ T5594] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 98.737518][ T5592] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 98.763112][ T5592] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 98.775469][ T5596] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 98.785032][ T5596] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 98.799662][ T5596] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 98.811967][ T5596] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 98.827701][ T5596] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 98.828797][ T5596] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 98.831280][ T5596] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 98.832488][ T5600] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 98.833707][ T5600] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 98.833991][ T5600] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 98.834106][ T5596] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 98.839453][ T5596] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 98.852048][ T5596] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 98.854152][ T5596] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 98.865266][ T5598] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 98.866059][ T5598] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 99.126105][ T5598] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 99.144959][ T5598] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 99.155511][ T5598] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 99.165734][ T5598] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 99.179579][ T5598] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 101.108444][ T5594] Bluetooth: hci2: command tx timeout [ 101.108472][ T5598] Bluetooth: hci1: command tx timeout [ 101.108891][ T60] Bluetooth: hci0: command tx timeout [ 101.186401][ T5594] Bluetooth: hci4: command tx timeout [ 101.266419][ T5594] Bluetooth: hci3: command tx timeout [ 102.170191][ T5589] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.171489][ T5589] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.171871][ T5589] bridge_slave_0: entered allmulticast mode [ 102.174235][ T5589] bridge_slave_0: entered promiscuous mode [ 102.213256][ T5587] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.213386][ T5587] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.213594][ T5587] bridge_slave_0: entered allmulticast mode [ 102.215739][ T5587] bridge_slave_0: entered promiscuous mode [ 102.280923][ T5591] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.281052][ T5591] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.281224][ T5591] bridge_slave_0: entered allmulticast mode [ 102.283355][ T5591] bridge_slave_0: entered promiscuous mode [ 102.303683][ T5589] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.304093][ T5589] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.304733][ T5589] bridge_slave_1: entered allmulticast mode [ 102.338816][ T5589] bridge_slave_1: entered promiscuous mode [ 102.340369][ T5587] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.340474][ T5587] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.340608][ T5587] bridge_slave_1: entered allmulticast mode [ 102.342526][ T5587] bridge_slave_1: entered promiscuous mode [ 102.387375][ T5590] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.387494][ T5590] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.388056][ T5590] bridge_slave_0: entered allmulticast mode [ 102.391002][ T5590] bridge_slave_0: entered promiscuous mode [ 102.392999][ T5591] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.393143][ T5591] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.393681][ T5591] bridge_slave_1: entered allmulticast mode [ 102.395712][ T5591] bridge_slave_1: entered promiscuous mode [ 102.487045][ T5588] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.487227][ T5588] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.487358][ T5588] bridge_slave_0: entered allmulticast mode [ 102.489385][ T5588] bridge_slave_0: entered promiscuous mode [ 102.492208][ T5590] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.492389][ T5590] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.492692][ T5590] bridge_slave_1: entered allmulticast mode [ 102.495037][ T5590] bridge_slave_1: entered promiscuous mode [ 102.592914][ T5588] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.593071][ T5588] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.593674][ T5588] bridge_slave_1: entered allmulticast mode [ 102.595799][ T5588] bridge_slave_1: entered promiscuous mode [ 102.664879][ T5589] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.680912][ T5587] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.730317][ T5591] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.733718][ T5589] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.741924][ T5587] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.782566][ T5590] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.785652][ T5591] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.841993][ T5588] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 102.844972][ T5590] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.922055][ T5588] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.978082][ T5589] team0: Port device team_slave_0 added [ 102.982258][ T5587] team0: Port device team_slave_0 added [ 103.029435][ T5591] team0: Port device team_slave_0 added [ 103.031926][ T5589] team0: Port device team_slave_1 added [ 103.034078][ T5587] team0: Port device team_slave_1 added [ 103.069687][ T5590] team0: Port device team_slave_0 added [ 103.072021][ T5591] team0: Port device team_slave_1 added [ 103.117071][ T5588] team0: Port device team_slave_0 added [ 103.119688][ T5590] team0: Port device team_slave_1 added [ 103.180288][ T5588] team0: Port device team_slave_1 added [ 103.186509][ T5594] Bluetooth: hci1: command tx timeout [ 103.186548][ T5594] Bluetooth: hci2: command tx timeout [ 103.186574][ T5594] Bluetooth: hci0: command tx timeout [ 103.231159][ T5589] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 103.231174][ T5589] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.231202][ T5589] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 103.234121][ T5587] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 103.234138][ T5587] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.234166][ T5587] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 103.266321][ T60] Bluetooth: hci4: command tx timeout [ 103.347571][ T5591] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 103.347592][ T5591] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.347620][ T5591] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 103.350802][ T5589] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 103.350820][ T5589] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.350848][ T5589] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 103.353474][ T5587] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 103.353486][ T5587] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.353506][ T5587] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 103.356462][ T60] Bluetooth: hci3: command tx timeout [ 103.480861][ T5590] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 103.480924][ T5590] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.480998][ T5590] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 103.496755][ T5591] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 103.496841][ T5591] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.496917][ T5591] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 103.595516][ T5588] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 103.595531][ T5588] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 103.595550][ T5588] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 104.098274][ T5590] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 104.098291][ T5590] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.098311][ T5590] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.102314][ T5588] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 104.102329][ T5588] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 104.102348][ T5588] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.326603][ T5589] hsr_slave_0: entered promiscuous mode [ 104.328021][ T5589] hsr_slave_1: entered promiscuous mode [ 104.336097][ T5587] hsr_slave_0: entered promiscuous mode [ 104.342244][ T5587] hsr_slave_1: entered promiscuous mode [ 104.345206][ T5587] debugfs: 'hsr0' already exists in 'hsr' [ 104.345560][ T5587] Cannot create hsr debugfs directory [ 104.393064][ T5591] hsr_slave_0: entered promiscuous mode [ 104.394084][ T5591] hsr_slave_1: entered promiscuous mode [ 104.394835][ T5591] debugfs: 'hsr0' already exists in 'hsr' [ 104.394863][ T5591] Cannot create hsr debugfs directory [ 104.467455][ T5590] hsr_slave_0: entered promiscuous mode [ 104.470648][ T5590] hsr_slave_1: entered promiscuous mode [ 104.471419][ T5590] debugfs: 'hsr0' already exists in 'hsr' [ 104.471437][ T5590] Cannot create hsr debugfs directory [ 104.497280][ T5588] hsr_slave_0: entered promiscuous mode [ 104.507135][ T5588] hsr_slave_1: entered promiscuous mode [ 104.507909][ T5588] debugfs: 'hsr0' already exists in 'hsr' [ 104.507937][ T5588] Cannot create hsr debugfs directory [ 105.267839][ T60] Bluetooth: hci0: command tx timeout [ 105.267874][ T60] Bluetooth: hci2: command tx timeout [ 105.267895][ T60] Bluetooth: hci1: command tx timeout [ 105.346578][ T5594] Bluetooth: hci4: command tx timeout [ 105.426560][ T5594] Bluetooth: hci3: command tx timeout [ 105.692793][ T5587] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 105.760874][ T5587] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 105.789585][ T5587] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 105.820442][ T5587] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 105.834154][ T5587] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 105.877987][ T5587] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 105.903543][ T5587] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 105.934810][ T5587] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 106.085731][ T5589] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 106.123279][ T5589] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 106.138638][ T5589] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 106.171805][ T5589] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 106.187269][ T5589] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 106.221582][ T5589] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 106.278220][ T5589] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 106.299537][ T5589] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 106.505161][ T5590] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 106.540155][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 106.560881][ T5590] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 106.600884][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 106.625702][ T5590] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 106.662508][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 106.696665][ T5590] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 106.742298][ T5590] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 106.945199][ T5588] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 106.983482][ T5588] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 107.000393][ T5588] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 107.039960][ T5588] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 107.069549][ T5588] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 107.102005][ T5588] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 107.120279][ T5588] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 107.152933][ T5588] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 107.172387][ T5587] 8021q: adding VLAN 0 to HW filter on device bond0 [ 107.320452][ T5591] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 107.348361][ T60] Bluetooth: hci2: command tx timeout [ 107.348405][ T60] Bluetooth: hci0: command tx timeout [ 107.348450][ T5594] Bluetooth: hci1: command tx timeout [ 107.380383][ T5591] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 107.401550][ T5591] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 107.426706][ T5594] Bluetooth: hci4: command tx timeout [ 107.432765][ T5591] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 107.452900][ T5587] 8021q: adding VLAN 0 to HW filter on device team0 [ 107.475267][ T5591] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 107.507117][ T5594] Bluetooth: hci3: command tx timeout [ 107.529439][ T5591] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 107.535139][ T5591] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 107.574263][ T5591] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 107.620382][ T3388] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.620785][ T3388] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.694148][ T3388] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.694246][ T3388] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.742734][ T5589] 8021q: adding VLAN 0 to HW filter on device bond0 [ 107.878014][ T5589] 8021q: adding VLAN 0 to HW filter on device team0 [ 107.948136][ T682] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.948543][ T682] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.973128][ T5590] 8021q: adding VLAN 0 to HW filter on device bond0 [ 108.045486][ T1468] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.045611][ T1468] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.174375][ T5590] 8021q: adding VLAN 0 to HW filter on device team0 [ 108.234317][ T67] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.234645][ T67] bridge0: port 1(bridge_slave_0) entered forwarding state [ 108.287935][ T5588] 8021q: adding VLAN 0 to HW filter on device bond0 [ 108.324791][ T1468] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.324937][ T1468] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.485780][ T5588] 8021q: adding VLAN 0 to HW filter on device team0 [ 108.505652][ T5591] 8021q: adding VLAN 0 to HW filter on device bond0 [ 108.580058][ T67] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.580243][ T67] bridge0: port 1(bridge_slave_0) entered forwarding state [ 108.712540][ T67] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.728587][ T67] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.845992][ T5591] 8021q: adding VLAN 0 to HW filter on device team0 [ 108.914027][ T682] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.914275][ T682] bridge0: port 1(bridge_slave_0) entered forwarding state [ 109.032023][ T682] bridge0: port 2(bridge_slave_1) entered blocking state [ 109.034720][ T682] bridge0: port 2(bridge_slave_1) entered forwarding state [ 109.481144][ T5587] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.959621][ T5589] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.993597][ T5587] veth0_vlan: entered promiscuous mode [ 110.122342][ T5587] veth1_vlan: entered promiscuous mode [ 110.580384][ T5590] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 110.623656][ T5587] veth0_macvtap: entered promiscuous mode [ 110.675036][ T5587] veth1_macvtap: entered promiscuous mode [ 110.830292][ T5587] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.888027][ T5587] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.990176][ T5588] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 111.033161][ T5590] veth0_vlan: entered promiscuous mode [ 111.150090][ T5589] veth0_vlan: entered promiscuous mode [ 111.231898][ T5590] veth1_vlan: entered promiscuous mode [ 111.254351][ T5591] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 111.430290][ T5589] veth1_vlan: entered promiscuous mode [ 111.604768][ T5588] veth0_vlan: entered promiscuous mode [ 111.645878][ T3358] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.645900][ T3358] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.690458][ T5590] veth0_macvtap: entered promiscuous mode [ 111.793227][ T5590] veth1_macvtap: entered promiscuous mode [ 111.816617][ T5588] veth1_vlan: entered promiscuous mode [ 111.820317][ T5589] veth0_macvtap: entered promiscuous mode [ 111.849188][ T1468] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.849213][ T1468] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.901275][ T5589] veth1_macvtap: entered promiscuous mode [ 111.940297][ T5591] veth0_vlan: entered promiscuous mode [ 112.021738][ T5590] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 112.062598][ T5591] veth1_vlan: entered promiscuous mode [ 112.079351][ T5590] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 112.086102][ T5589] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 112.180724][ T5589] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 112.262179][ T5588] veth0_macvtap: entered promiscuous mode [ 112.397843][ T5588] veth1_macvtap: entered promiscuous mode [ 112.888707][ T5591] veth0_macvtap: entered promiscuous mode [ 112.917853][ T5588] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 113.279661][ T5591] veth1_macvtap: entered promiscuous mode [ 113.296555][ T5588] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 113.445190][ T3414] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.445221][ T3414] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.666804][ T682] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.666832][ T682] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.704233][ T5782] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4'. [ 113.744840][ T682] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.834943][ T5591] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 114.315032][ T1468] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.315058][ T1468] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 114.359835][ T5591] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 114.561649][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 114.561675][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 117.034256][ T1468] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 117.034281][ T1468] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 117.765971][ T3388] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 117.766001][ T3388] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 118.759038][ T1012] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 118.759053][ T3358] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 118.759072][ T3358] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 118.785413][ T3358] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 118.976658][ T3358] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.236249][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 119.246247][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 119.256251][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 119.266256][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 119.276254][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 119.286263][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 119.296254][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 119.306255][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 119.316255][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 119.326255][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 121.431847][ T67] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.431874][ T67] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.476067][ T67] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.010705][ T193] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 122.919150][ T3388] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 125.020180][ T193] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 125.121767][ T682] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 125.121982][ T682] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 125.122163][ T682] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 125.157125][ T3388] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 125.162553][ T682] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 125.193281][ T682] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 125.193488][ T682] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 125.193624][ T682] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 125.193980][ T682] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 125.670373][ T3388] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 125.673353][ T682] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 125.673880][ T682] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.156762][ T5846] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 128.680142][ T36] audit: type=1326 audit(1787455668.201:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5847 comm="syz.3.23" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f1dc07be0d9 code=0x0 [ 128.743895][ T5849] syz.0.1 uses obsolete (PF_INET,SOCK_PACKET) [ 132.574803][ T5863] Zero length message leads to an empty skb [ 133.154414][ T1237] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 133.424111][ T1237] usb 1-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 134.449154][ T1330] ieee802154 phy0 wpan0: encryption failed: -22 [ 134.449314][ T1330] ieee802154 phy1 wpan1: encryption failed: -22 [ 134.517096][ T1237] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 134.517131][ T1237] usb 1-1: Product: syz [ 134.517147][ T1237] usb 1-1: Manufacturer: syz [ 134.517163][ T1237] usb 1-1: SerialNumber: syz [ 134.843807][ T1237] usb 1-1: config 0 descriptor?? [ 135.328267][ T1237] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 135.694024][ T1237] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 135.763841][ T1237] dvbdev: DVB: registering new adapter (Nebula Electronics uDigiTV DVB-T USB2.0)) [ 135.763946][ T1237] usb 1-1: media controller created [ 135.827897][ T1237] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 136.135115][ T1237] DVB: Unable to find symbol mt352_attach() [ 136.501695][ T1237] DVB: Unable to find symbol nxt6000_attach() [ 136.501717][ T1237] dvb-usb: no frontend was attached by 'Nebula Electronics uDigiTV DVB-T USB2.0)' [ 136.573358][ T1237] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input5 [ 137.610445][ T1237] dvb-usb: schedule remote query interval to 1000 msecs. [ 137.610477][ T1237] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) successfully initialized and connected. [ 137.610900][ T1237] dvb-usb: bulk message failed: -22 (7/0) [ 137.610924][ T1237] dvb-usb: bulk message failed: -22 (7/0) [ 137.852651][ T1237] usb 1-1: USB disconnect, device number 2 [ 139.241691][ T36] audit: type=1326 audit(1787455678.191:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=5906 comm="syz.3.35" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f1dc07be0d9 code=0x0 [ 139.927982][ T5916] netlink: 'syz.2.34': attribute type 1 has an invalid length. [ 139.928010][ T5916] netlink: 228 bytes leftover after parsing attributes in process `syz.2.34'. [ 143.046321][ T1237] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0 successfully deinitialized and disconnected. [ 146.352910][ T5942] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 146.352941][ T5942] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 146.394974][ T5955] netlink: 'syz.1.47': attribute type 1 has an invalid length. [ 146.395002][ T5955] netlink: 228 bytes leftover after parsing attributes in process `syz.1.47'. [ 149.381790][ T5594] Bluetooth: hci2: command 0x0c1a tx timeout [ 155.807849][ T5975] evm: overlay not supported [ 156.644399][ T5942] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 156.644433][ T5942] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 156.965212][ T5942] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 156.965240][ T5942] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 157.247382][ T5942] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 157.247409][ T5942] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 157.460537][ T5942] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 157.460564][ T5942] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 157.803310][ T60] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 157.854206][ T60] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 157.857715][ T60] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 157.908322][ T60] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 157.957795][ T60] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 158.039894][ T5594] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 158.041195][ T5594] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 158.041653][ T5594] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 158.043360][ T5594] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 158.044862][ T5594] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 158.241205][ T5997] binder: 5996:5997 ioctl c0306201 0 returned -14 [ 158.274140][ T5997] binder: BINDER_SET_CONTEXT_MGR already set [ 158.274158][ T5997] binder: 5996:5997 ioctl 4018620d 200000004a80 returned -16 [ 158.616465][ T199] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 158.797910][ T199] usb 5-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 158.799733][ T199] usb 5-1: config 0 has an invalid interface number: 41 but max is 0 [ 158.799763][ T199] usb 5-1: config 0 has no interface number 0 [ 158.799817][ T199] usb 5-1: config 0 interface 41 has no altsetting 0 [ 158.856408][ T199] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 158.856441][ T199] usb 5-1: Product: syz [ 158.856457][ T199] usb 5-1: Manufacturer: syz [ 158.856473][ T199] usb 5-1: SerialNumber: syz [ 159.523823][ T199] usb 5-1: config 0 descriptor?? [ 160.206051][ T60] Bluetooth: hci5: command tx timeout [ 160.915400][ T199] CoreChips 5-1:0.41 (unnamed net_device) (uninitialized): sr_get_phy_addr : Error reading PHYID register:ffffffe0 [ 161.614414][ T2206] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 161.778112][ T6036] ======================================================= [ 161.778112][ T6036] WARNING: The mand mount option has been deprecated and [ 161.778112][ T6036] and is ignored by this kernel. Remove the mand [ 161.778112][ T6036] option from the mount to silence this warning. [ 161.778112][ T6036] ======================================================= [ 161.877687][ T6037] overlayfs: overlapping lowerdir path [ 162.227215][ T60] Bluetooth: hci5: command tx timeout [ 162.231659][ T2206] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 162.318389][ T199] CoreChips 5-1:0.41 (unnamed net_device) (uninitialized): Failed to send software reset:ffffffb9 [ 162.318428][ T199] CoreChips 5-1:0.41 (unnamed net_device) (uninitialized): Failed to reset PHY: -71 [ 162.319118][ T199] CoreChips 5-1:0.41: probe with driver CoreChips failed with error -71 [ 164.209914][ T36] audit: type=1326 audit(1787455702.481:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6039 comm="syz.0.72" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f848dc9e0d9 code=0x0 [ 164.230536][ T199] usb 5-1: USB disconnect, device number 2 [ 164.306305][ T60] Bluetooth: hci5: command tx timeout [ 166.031273][ T2206] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 166.388037][ T60] Bluetooth: hci5: command tx timeout [ 166.963148][ T2206] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 167.855899][ T36] audit: type=1326 audit(1787455707.051:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6071 comm="syz.0.83" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f848dc9e0d9 code=0x0 [ 168.278182][ T6081] futex_wake_op: syz.1.82 tries to shift op by -1; fix this program [ 168.408142][ T6081] usb usb7: check_ctrlrecip: process 6081 (syz.1.82) requesting ep 01 but needs 81 [ 168.408228][ T6081] usb usb7: usbfs: process 6081 (syz.1.82) did not claim interface 0 before use [ 169.276402][ T199] usb 5-1: new full-speed USB device number 3 using dummy_hcd [ 169.453275][ T199] usb 5-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 169.466890][ T199] usb 5-1: config 0 has an invalid interface number: 41 but max is 0 [ 169.466924][ T199] usb 5-1: config 0 has no interface number 0 [ 169.466978][ T199] usb 5-1: config 0 interface 41 has no altsetting 0 [ 169.550862][ T199] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 169.550896][ T199] usb 5-1: Product: syz [ 169.550913][ T199] usb 5-1: Manufacturer: syz [ 169.550930][ T199] usb 5-1: SerialNumber: syz [ 169.640537][ T199] usb 5-1: config 0 descriptor?? [ 170.547078][ T199] CoreChips 5-1:0.41 (unnamed net_device) (uninitialized): sr_get_phy_addr : Error reading PHYID register:ffffffe0 [ 170.962113][ T5706] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 171.677218][ T5706] usb 1-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 171.682306][ T5706] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 171.682340][ T5706] usb 1-1: Product: syz [ 171.682356][ T5706] usb 1-1: Manufacturer: syz [ 171.682372][ T5706] usb 1-1: SerialNumber: syz [ 171.734326][ T5706] usb 1-1: config 0 descriptor?? [ 171.833911][ T5706] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 171.877432][ T5706] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 171.878297][ T5706] dvbdev: DVB: registering new adapter (Nebula Electronics uDigiTV DVB-T USB2.0)) [ 171.878353][ T5706] usb 1-1: media controller created [ 171.932795][ T5706] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 172.064362][ T5706] DVB: Unable to find symbol mt352_attach() [ 172.209819][ T5706] DVB: Unable to find symbol nxt6000_attach() [ 172.209839][ T5706] dvb-usb: no frontend was attached by 'Nebula Electronics uDigiTV DVB-T USB2.0)' [ 172.297501][ T5706] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb1/1-1/input/input6 [ 172.302707][ T5706] dvb-usb: schedule remote query interval to 1000 msecs. [ 172.302736][ T5706] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) successfully initialized and connected. [ 172.302755][ T5706] dvb-usb: bulk message failed: -22 (7/0) [ 172.302773][ T5706] dvb-usb: bulk message failed: -22 (7/0) [ 172.370263][ T5706] usb 1-1: USB disconnect, device number 3 [ 172.528302][ T199] CoreChips 5-1:0.41 (unnamed net_device) (uninitialized): Failed to send software reset:ffffffb9 [ 172.528337][ T199] CoreChips 5-1:0.41 (unnamed net_device) (uninitialized): Failed to reset PHY: -71 [ 172.528653][ T199] CoreChips 5-1:0.41: probe with driver CoreChips failed with error -71 [ 172.752898][ T199] usb 5-1: USB disconnect, device number 3 [ 173.648233][ T5706] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0 successfully deinitialized and disconnected. [ 174.144985][ T2206] bridge_slave_1: left allmulticast mode [ 174.145119][ T2206] bridge_slave_1: left promiscuous mode [ 174.299160][ T2206] bridge0: port 2(bridge_slave_1) entered disabled state [ 178.531725][ T2206] bridge_slave_0: left allmulticast mode [ 178.531766][ T2206] bridge_slave_0: left promiscuous mode [ 178.532044][ T2206] bridge0: port 1(bridge_slave_0) entered disabled state [ 183.790082][ T2206] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 183.897247][ T2206] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 183.956022][ T2206] bond0 (unregistering): Released all slaves [ 184.366193][ T6147] netlink: 'syz.1.104': attribute type 1 has an invalid length. [ 184.366220][ T6147] netlink: 228 bytes leftover after parsing attributes in process `syz.1.104'. [ 186.649719][ T5983] bridge0: port 1(bridge_slave_0) entered blocking state [ 186.649919][ T5983] bridge0: port 1(bridge_slave_0) entered disabled state [ 186.650159][ T5983] bridge_slave_0: entered allmulticast mode [ 188.666418][ T5983] bridge_slave_0: entered promiscuous mode [ 191.853179][ T5983] bridge0: port 2(bridge_slave_1) entered blocking state [ 191.853304][ T5983] bridge0: port 2(bridge_slave_1) entered disabled state [ 191.853498][ T5983] bridge_slave_1: entered allmulticast mode [ 191.884184][ T5983] bridge_slave_1: entered promiscuous mode [ 192.702197][ T5983] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 192.739588][ T5983] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 193.188779][ T5983] team0: Port device team_slave_0 added [ 193.234757][ T5983] team0: Port device team_slave_1 added [ 193.501306][ T6212] futex_wake_op: syz.2.118 tries to shift op by -1; fix this program [ 194.732071][ T5251] 8021q: adding VLAN 0 to HW filter on device eth1 [ 194.801122][ T1330] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.801177][ T1330] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.875364][ T5983] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 194.875379][ T5983] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 194.875399][ T5983] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 195.182576][ T5983] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 195.182635][ T5983] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 195.182712][ T5983] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 198.158628][ T2206] hsr_slave_0: left promiscuous mode [ 198.218178][ T2206] hsr_slave_1: left promiscuous mode [ 198.225570][ T2206] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 198.225636][ T2206] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 198.326044][ T2206] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 198.326066][ T2206] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 198.670239][ T5594] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 198.720615][ T5594] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 198.725566][ T5594] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 198.750307][ T5594] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 198.764157][ T5594] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 199.040602][ T2206] veth1_macvtap: left promiscuous mode [ 199.040928][ T2206] veth0_macvtap: left promiscuous mode [ 199.071748][ T2206] veth1_vlan: left promiscuous mode [ 199.097818][ T2206] veth0_vlan: left promiscuous mode [ 200.882587][ T60] Bluetooth: hci0: command tx timeout [ 201.239139][ T5722] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 201.638258][ T2206] team0 (unregistering): Port device team_slave_1 removed [ 201.747619][ T2206] team0 (unregistering): Port device team_slave_0 removed [ 201.876962][ T5722] usb 3-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 202.074840][ T5722] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 202.074875][ T5722] usb 3-1: Product: syz [ 202.074892][ T5722] usb 3-1: Manufacturer: syz [ 202.074908][ T5722] usb 3-1: SerialNumber: syz [ 202.325057][ T5722] usb 3-1: config 0 descriptor?? [ 202.874006][ T5722] usb 3-1: can't set config #0, error -71 [ 202.891263][ T5983] hsr_slave_0: entered promiscuous mode [ 202.907447][ T5722] usb 3-1: USB disconnect, device number 2 [ 202.949843][ T60] Bluetooth: hci0: command tx timeout [ 202.967337][ T5983] hsr_slave_1: entered promiscuous mode [ 202.984442][ T5983] debugfs: 'hsr0' already exists in 'hsr' [ 202.985436][ T5983] Cannot create hsr debugfs directory [ 205.028212][ T60] Bluetooth: hci0: command tx timeout [ 207.116430][ T5594] Bluetooth: hci0: command tx timeout [ 207.385501][ T5251] 8021q: adding VLAN 0 to HW filter on device eth2 [ 211.244042][ T2206] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 211.569418][ T6263] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 211.569445][ T6263] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 211.768734][ T2206] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 211.799155][ T6263] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 211.799185][ T6263] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 212.711112][ T6332] process 'syz.2.140' launched './file1' with NULL argv: empty string added [ 213.785955][ T2206] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 215.742462][ T31] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 216.010532][ T5251] 8021q: adding VLAN 0 to HW filter on device eth3 [ 216.187561][ T31] usb 3-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 216.225299][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 216.225333][ T31] usb 3-1: Product: syz [ 216.225349][ T31] usb 3-1: Manufacturer: syz [ 216.225365][ T31] usb 3-1: SerialNumber: syz [ 216.280639][ T31] usb 3-1: config 0 descriptor?? [ 216.300338][ T31] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 216.323541][ T31] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 216.324498][ T31] dvbdev: DVB: registering new adapter (Nebula Electronics uDigiTV DVB-T USB2.0)) [ 216.324560][ T31] usb 3-1: media controller created [ 216.405777][ T31] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 216.543648][ T31] DVB: Unable to find symbol mt352_attach() [ 216.664202][ T31] DVB: Unable to find symbol nxt6000_attach() [ 216.664223][ T31] dvb-usb: no frontend was attached by 'Nebula Electronics uDigiTV DVB-T USB2.0)' [ 216.690657][ T31] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input7 [ 216.755645][ T31] dvb-usb: schedule remote query interval to 1000 msecs. [ 216.755674][ T31] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) successfully initialized and connected. [ 216.755692][ T31] dvb-usb: bulk message failed: -22 (7/0) [ 216.755710][ T31] dvb-usb: bulk message failed: -22 (7/0) [ 216.848754][ T31] usb 3-1: USB disconnect, device number 3 [ 216.855045][ T2206] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 217.410455][ T60] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 217.481656][ T60] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 217.482913][ T60] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 217.508713][ T60] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 217.509747][ T60] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 217.680811][ T31] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0 successfully deinitialized and disconnected. [ 217.773994][ T6360] overlayfs: overlapping lowerdir path [ 219.586264][ T60] Bluetooth: hci3: command tx timeout [ 219.666350][ T1245] Bluetooth: hci3: Opcode 0x0c1a failed: -110 [ 219.666381][ T1245] Bluetooth: hci3: Error when powering off device on rfkill (-110) [ 221.666343][ C1] ------------[ cut here ]------------ [ 221.666359][ C1] workqueue: cannot queue hci_cmd_timeout on wq hci3 [ 221.666411][ C1] WARNING: kernel/workqueue.c:2353 at __queue_work+0xdc4/0x1120, CPU#1: ktimers/1/29 [ 221.666453][ C1] Modules linked in: [ 221.666503][ C1] CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 221.666531][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 221.666544][ C1] RIP: 0010:__queue_work+0xde1/0x1120 [ 221.666580][ C1] Code: 81 c3 68 01 00 00 4c 8d 35 fc 5b 26 0e 48 89 f8 48 c1 e8 03 42 80 3c 20 00 74 05 e8 f9 bc a3 00 49 8b 77 18 4c 89 f7 48 89 da <67> 48 0f b9 3a 4c 89 f8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ff [ 221.666600][ C1] RSP: 0018:ffffc90000a3f988 EFLAGS: 00010046 [ 221.666620][ C1] RAX: 1ffff1100c265953 RBX: ffff88803352a968 RCX: ffff88801d2c3e00 [ 221.666638][ C1] RDX: ffff88803352a968 RSI: ffffffff8a419e20 RDI: ffffffff8fb41250 [ 221.666657][ C1] RBP: 0000000000000100 R08: 0000000000000100 R09: 0000000000000100 [ 221.666672][ C1] R10: dffffc0000000000 R11: ffffffff818dbd80 R12: dffffc0000000000 [ 221.666689][ C1] R13: 0000000000000008 R14: ffffffff8fb41250 R15: ffff88806132ca80 [ 221.666707][ C1] FS: 0000000000000000(0000) GS:ffff888125cf4000(0000) knlGS:0000000000000000 [ 221.666727][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 221.666744][ C1] CR2: 0000200000001de2 CR3: 000000002a6c6000 CR4: 00000000003526f0 [ 221.666770][ C1] Call Trace: [ 221.666778][ C1] [ 221.666790][ C1] ? call_timer_fn+0xd5/0x5f0 [ 221.666828][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 221.666873][ C1] call_timer_fn+0x18d/0x5f0 [ 221.666904][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 221.666935][ C1] ? call_timer_fn+0xd5/0x5f0 [ 221.666975][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 221.667012][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 221.667042][ C1] ? do_raw_spin_unlock+0xf5/0x200 [ 221.667078][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 221.667110][ C1] __run_timer_base+0x73c/0x9b0 [ 221.667155][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 221.667188][ C1] ? __local_bh_disable_ip+0x3d/0x420 [ 221.667228][ C1] run_timer_softirq+0xb7/0x170 [ 221.667257][ C1] handle_softirqs+0x1da/0x6d0 [ 221.667298][ C1] ? smpboot_thread_fn+0x4e/0xa70 [ 221.667329][ C1] run_ktimerd+0x6a/0x100 [ 221.667362][ C1] smpboot_thread_fn+0x565/0xa70 [ 221.667397][ C1] ? smpboot_thread_fn+0x4e/0xa70 [ 221.667439][ C1] kthread+0x38b/0x470 [ 221.667477][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 221.667508][ C1] ? __pfx_kthread+0x10/0x10 [ 221.667544][ C1] ret_from_fork+0x514/0xb70 [ 221.667583][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 221.667617][ C1] ? __switch_to+0xc89/0x1420 [ 221.667644][ C1] ? __pfx_kthread+0x10/0x10 [ 221.667671][ C1] ret_from_fork_asm+0x1a/0x30 [ 221.667702][ C1] [ 221.667720][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 221.667733][ C1] CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 221.667753][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 221.667763][ C1] Call Trace: [ 221.667771][ C1] [ 221.667777][ C1] vpanic+0x56d/0xa60 [ 221.667795][ C1] ? __pfx__printk+0x10/0x10 [ 221.667816][ C1] ? __pfx_vpanic+0x10/0x10 [ 221.667842][ C1] ? is_bpf_text_address+0x292/0x2b0 [ 221.667865][ C1] ? is_bpf_text_address+0x26/0x2b0 [ 221.667894][ C1] panic+0xc5/0xd0 [ 221.667920][ C1] ? __pfx_panic+0x10/0x10 [ 221.667955][ C1] ? ret_from_fork_asm+0x1a/0x30 [ 221.667986][ C1] __warn+0x315/0x4c0 [ 221.668001][ C1] ? __queue_work+0xdc4/0x1120 [ 221.668032][ C1] ? __queue_work+0xdc4/0x1120 [ 221.668054][ C1] __report_bug+0x276/0x570 [ 221.668086][ C1] ? __queue_work+0xdc4/0x1120 [ 221.668110][ C1] ? __pfx___report_bug+0x10/0x10 [ 221.668133][ C1] ? __pfx_hci_cmd_timeout+0x10/0x10 [ 221.668157][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 221.668185][ C1] ? look_up_lock_class+0x57/0x110 [ 221.668211][ C1] ? register_lock_class+0x31/0x2e0 [ 221.668230][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 221.668263][ C1] report_bug_entry+0x19b/0x290 [ 221.668291][ C1] ? __queue_work+0xde1/0x1120 [ 221.668314][ C1] ? __queue_work+0xde6/0x1120 [ 221.668337][ C1] handle_bug+0xce/0x200 [ 221.668368][ C1] exc_invalid_op+0x1a/0x50 [ 221.668398][ C1] asm_exc_invalid_op+0x1a/0x20 [ 221.668419][ C1] RIP: 0010:__queue_work+0xde1/0x1120 [ 221.668447][ C1] Code: 81 c3 68 01 00 00 4c 8d 35 fc 5b 26 0e 48 89 f8 48 c1 e8 03 42 80 3c 20 00 74 05 e8 f9 bc a3 00 49 8b 77 18 4c 89 f7 48 89 da <67> 48 0f b9 3a 4c 89 f8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ff [ 221.668465][ C1] RSP: 0018:ffffc90000a3f988 EFLAGS: 00010046 [ 221.668485][ C1] RAX: 1ffff1100c265953 RBX: ffff88803352a968 RCX: ffff88801d2c3e00 [ 221.668499][ C1] RDX: ffff88803352a968 RSI: ffffffff8a419e20 RDI: ffffffff8fb41250 [ 221.668514][ C1] RBP: 0000000000000100 R08: 0000000000000100 R09: 0000000000000100 [ 221.668527][ C1] R10: dffffc0000000000 R11: ffffffff818dbd80 R12: dffffc0000000000 [ 221.668542][ C1] R13: 0000000000000008 R14: ffffffff8fb41250 R15: ffff88806132ca80 [ 221.668561][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 221.668592][ C1] ? __pfx_hci_cmd_timeout+0x10/0x10 [ 221.668620][ C1] ? __queue_work+0xd9a/0x1120 [ 221.668645][ C1] ? call_timer_fn+0xd5/0x5f0 [ 221.668671][ C1] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 221.668703][ C1] call_timer_fn+0x18d/0x5f0 [ 221.668726][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 221.668747][ C1] ? call_timer_fn+0xd5/0x5f0 [ 221.668769][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 221.668798][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 221.668822][ C1] ? do_raw_spin_unlock+0xf5/0x200 [ 221.668852][ C1] ? __pfx_delayed_work_timer_fn+0x10/0x10 [ 221.668879][ C1] __run_timer_base+0x73c/0x9b0 [ 221.668911][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 221.668936][ C1] ? __local_bh_disable_ip+0x3d/0x420 [ 221.668977][ C1] run_timer_softirq+0xb7/0x170 [ 221.669003][ C1] handle_softirqs+0x1da/0x6d0 [ 221.669038][ C1] ? smpboot_thread_fn+0x4e/0xa70 [ 221.669063][ C1] run_ktimerd+0x6a/0x100 [ 221.669091][ C1] smpboot_thread_fn+0x565/0xa70 [ 221.669121][ C1] ? smpboot_thread_fn+0x4e/0xa70 [ 221.669159][ C1] kthread+0x38b/0x470 [ 221.669190][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 221.669216][ C1] ? __pfx_kthread+0x10/0x10 [ 221.669247][ C1] ret_from_fork+0x514/0xb70 [ 221.669281][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 221.669314][ C1] ? __switch_to+0xc89/0x1420 [ 221.669340][ C1] ? __pfx_kthread+0x10/0x10 [ 221.669367][ C1] ret_from_fork_asm+0x1a/0x30 [ 221.669398][ C1] [ 221.670099][ C1] Kernel Offset: disabled