last executing test programs: 15.029694447s ago: executing program 2 (id=3): mremap(&(0x7f0000241000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) write$binfmt_elf32(0xffffffffffffffff, &(0x7f0000000040)=ANY=[], 0x82) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x89f0, &(0x7f0000000900)={'ip6gre0\x00', @random='\x00\x00\x00 \x00'}) r1 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000000540)=0x1, 0x4) sendto$inet(r1, 0x0, 0x0, 0x0, &(0x7f0000000100)={0x2, 0x0, @private=0xa010102}, 0x10) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000040), 0x20) gettid() timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x989680}}, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/power/pm_print_times', 0x149a82, 0x0) write$cgroup_int(r2, &(0x7f0000000040), 0x12) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, &(0x7f0000000080)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000582000/0x2000)=nil, 0x800000}) socket$inet(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e23, @multicast1}, 0x10) write$P9_RLERROR(r2, &(0x7f00000001c0)=ANY=[@ANYBLOB="1100000007010008006465766c696e6bd0"], 0x11) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003b000b05d25a806c8c6394f90424fc60100005000a000200053582c137153e3704000180fc0b09000c00", 0x33fe0}], 0x1}, 0x0) 14.438522636s ago: executing program 2 (id=9): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0x17, &(0x7f00000000c0)=0x7e6, 0x9) setsockopt$inet_int(r0, 0x0, 0x7, &(0x7f0000000180)=0x6, 0x4) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_RINGS_SET(r1, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000100)={0x3c, r2, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_RINGS_RX={0x8, 0x6, 0x7}, @ETHTOOL_A_RINGS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan1\x00'}]}, @ETHTOOL_A_RINGS_RX_MINI={0x8}]}, 0x3c}}, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, &(0x7f0000000040)) add_key$fscrypt_v1(&(0x7f0000000040), 0x0, 0x0, 0x0, 0xfffffffffffffffd) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_PIT(r4, 0x8048ae66, &(0x7f0000000080)={[{0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4, 0x0, 0x0, 0x0, 0x0, 0xc}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f00000003c0)={[0x0, 0x2, 0x0, 0x40, 0x0, 0x0, 0x2004cb, 0x0, 0x0, 0x0, 0x5], 0x0, 0x202}) ioctl$KVM_SET_PIT2(r4, 0x4070aea0, &(0x7f0000000240)={[{0x0, 0x8, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x65, 0x0, 0x10}, {0x6, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd, 0x0, 0x0, 0x3}, {0x2df, 0x0, 0x4, 0x0, 0xfc, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0xc3da}], 0xfffffffd}) ioctl$KVM_SET_VAPIC_ADDR(r5, 0x4008ae93, &(0x7f0000000000)=0x8000000) ioctl$KVM_RUN(r5, 0xae80, 0x0) recvmsg(r0, &(0x7f00000018c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001880)=""/17, 0x11}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @link_local, @void, {@ipv4={0x800, @udp={{0x6, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty, {[@rr={0x7, 0x3, 0x82}]}}, {0x0, 0x4e20, 0x10, 0x0, @gue={{0x2}}}}}}}, 0x0) r6 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5ac, 0x8241, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_control_io(r6, &(0x7f00000003c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB="000008000000080482"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_control_io(r6, 0x0, 0xfffffffffffffffc) syz_usb_connect$uac1(0x4, 0x94, &(0x7f00000002c0)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x20, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x82, 0x3, 0x1, 0x40, 0x80, 0x1, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x1000, 0xe}, [@output_terminal={0x9, 0x24, 0x3, 0x4, 0x101, 0x6, 0x3, 0x19}, @output_terminal={0x9, 0x24, 0x3, 0x2, 0x101, 0x2, 0x1}, @selector_unit={0x7, 0x24, 0x5, 0x5, 0x41, "fe1a"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x0, 0x8, 0x9, {0x7, 0x25, 0x1, 0x1, 0x3, 0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x4, 0x2, 0xfe, 0x75, 'Z', '`'}]}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x2, 0x80, 0x48, {0x7, 0x25, 0x1, 0x1, 0xc, 0x400}}}}}}}]}}, &(0x7f0000000380)={0xa, &(0x7f0000000140)={0xa, 0x6, 0x300, 0xd8, 0xfc, 0x28, 0x40, 0xb}, 0x4b, &(0x7f0000000480)={0x5, 0xf, 0x4b, 0x6, [@ssp_cap={0x10, 0x10, 0xa, 0xf5, 0x1, 0x6a, 0x0, 0x80, [0x0]}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0xb, 0x9, 0x7, 0x1}, @ss_container_id={0x14, 0x10, 0x4, 0x2, "f018862e768c3ca69223b797fc5df9e6"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x0, 0x6, 0x6f, 0xf1, 0x9}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0xa, 0x9, 0x3, 0x3}, @ptm_cap={0x3}]}, 0x2, [{0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x180a}}, {0x93, &(0x7f0000000500)=@string={0x93, 0x3, "3dfc25cbd5448c7895d023da17b8a6d41eb3e9e3e3f80eba8f57b566bf410ef00f7e12d81d5a0fd56cdbce678ac475b81557a1e5320912c395408663002989ef8343984dd6fc684cec1335fec32b0d5bf8b90bc1d1422d3f3a2c08de375ba9b258004d366d6854e44d8d94c245896ea0a857ffcc2735f48764acc67aff135756789f20d1467fea995d6322745351142b27"}}]}) r7 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) ioctl$HIDIOCGUSAGE(r7, 0xd01c4813, 0x0) 14.395414122s ago: executing program 1 (id=2): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$inet(0x2, 0xa, 0x0) setsockopt$sock_int(r2, 0x1, 0x2c, &(0x7f0000000040)=0x3, 0x4) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x2c, &(0x7f0000000140)={0x0, 0x0}, 0x10) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r3, &(0x7f0000000180)=ANY=[@ANYBLOB="5245434c45560a50484f4e454f55540a535045414b455220274344272030303030303030303030303030303030303030300a4449474954414c32202706006e6520436170745572652720303030303030343030303030"], 0xb8) r4 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card0/oss_mixer\x00', 0x0, 0x0) dup3(r4, r3, 0x20) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000340)={[{0x1a7c, 0x2, 0x8, 0x26, 0x6, 0x3, 0x0, 0x62, 0x1, 0x9, 0xf3, 0x50, 0x1}, {0x8, 0x2, 0x0, 0x20, 0x3, 0x4, 0x52, 0x9, 0x3f, 0x1, 0x9, 0x44, 0x7fff}, {0x3, 0x6, 0x1, 0xa, 0x3, 0x3, 0x2, 0x3, 0x12, 0xb, 0x0, 0x3, 0x1}], 0x9}) ioctl$KVM_RUN(r5, 0xae80, 0x0) 13.98874247s ago: executing program 1 (id=11): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x2, 0x0, &(0x7f00000002c0)=[@request_death={0x400c6313, 0x3}], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) r3 = dup3(r2, r0, 0x0) futex(&(0x7f000000cffc)=0x1, 0x6, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0x5, 0x0, 0x0, &(0x7f0000048000), 0x4000000) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) syz_open_dev$usbfs(&(0x7f0000000100), 0x203, 0x8401) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYRES8, @ANYRESDEC], 0x28}}, 0x20080011) r6 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x3, 0x0) ppoll(&(0x7f0000000080)=[{r4}, {r6, 0x8008}], 0x333, 0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$UFFDIO_WRITEPROTECT(r3, 0xc018aa06, &(0x7f0000000140)={{&(0x7f0000ffe000/0x2000)=nil, 0x2000}, 0xdc0945915bce50e5}) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000480)={0x4c, 0x0, &(0x7f0000000580)=[@acquire, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 13.030792495s ago: executing program 1 (id=12): syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000459bb2405804035000000000000109021b00011100000009040000019569", @ANYRES32], 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000240)}, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000200)='/sys/fs/bpf', 0x0, 0x0) openat$cgroup_ro(r0, &(0x7f0000000040)='io.stat\x00', 0x275a, 0x0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="380000001000"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000180012800c0001006d6163766c616e001800028004000580ae442be9ec0f27fe30f5acf9cfef54d568e76d01db82bfef6965e45bebab74f55027d960580f75c8515cde379a77b3b1f749cbdbd06724850afbc10b84da03a43c86285b12e9d661b278a3aea1e05d4d2e3b24a51c79b5b283612c606f06b22da5c3497833f165c5dc34edfb778c3e56f2e6b3f666a3497107fd4a7113e1"], 0x38}}, 0x0) r4 = socket$kcm(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)={0x70, 0x0, 0x0, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_DATA_SEQ={0x5}, @L2TP_ATTR_VLAN_ID={0x6}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0xfffa}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @broadcast}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth0_vlan\x00'}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}]}, 0x70}}, 0x0) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003b000b05d25a806c8c6394f90224fc60100005000a000200053582c137153e37000c0180fc0b10000600", 0x33fe0}], 0x1}, 0x0) sched_setaffinity(0x0, 0x0, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x5, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) bind$inet(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x5) preadv(r5, &(0x7f0000001880)=[{&(0x7f0000001a80)=""/102400, 0x19000}], 0x1, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a24000000000a01010000000000000000050000000900010073797a30000000000400060070000000030a01030000000000000000050000000900010073797a30000000001c0008800c00024000000000000000000c00014000000000000000000900030073797a3200000000280004800800024000000000080001400000000014000300766c616e3000"/167], 0xd0}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000100)={@broadcast, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xc}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x6, 0x0, @empty, @empty}, {{0x4e24, 0x4e26, 0x41424344, 0x41424344, 0x0, 0x0, 0x7, 0xc2, 0x0, 0x0, 0x0, {[@mss={0x2, 0x4, 0xa005}, @sack_perm={0x4, 0x2}]}}}}}}}, 0x0) 11.771835648s ago: executing program 0 (id=17): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000003100)=@gcm_128={{0x303}, "0400", "0d07080d004fcf0000e8ffff1a8600", "cf0d00", "865703b7e43b34e4"}, 0x28) writev(r0, &(0x7f00000030c0)=[{&(0x7f0000000a40)="fb", 0xfd88}], 0x1) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000040)=0x2, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4001, 0x0, @empty}, 0x1c) write$binfmt_script(r1, &(0x7f0000000200), 0xfffffd9d) r2 = socket$inet6(0xa, 0x3, 0x7) sendmmsg$alg(r2, &(0x7f0000000240)=[{0x20000000, 0xff00, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="d8000000000000002900000008"], 0xd8}], 0x1, 0x0) close(r0) 11.274150477s ago: executing program 0 (id=18): r0 = socket$inet_udp(0x2, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, 0x0}}], 0x40000000000012d, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000440)=0x2, 0x4) (async) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) (async) mkdir(&(0x7f0000000140)='./cgroup/../file0\x00', 0x1) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000480)='./cgroup.net/syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000100)='cgroup.procs\x00', 0x2, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000340)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) (async) write$cgroup_pid(r2, &(0x7f00000001c0), 0x12) (async) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_ro(r3, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r4, &(0x7f0000000200)=0x1, 0x12) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) (async) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (async) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r6, 0x0) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x0, 0x0, @private2}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f00000001c0)={r7, @in6={{0xa, 0x4e24, 0x18000000, @private2, 0x1}}, 0x0, 0x0, 0xfffffff9, 0x0, 0xd4, 0x400000}, 0xc1) (async) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r6, 0x84, 0x85, &(0x7f0000000000)={r7, @in={{0x2, 0x4e20, @empty}}, 0x0, 0x8000}, 0x90) (async) r8 = openat$cgroup_ro(r5, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r8, &(0x7f0000000200)=0x1, 0x12) write$cgroup_pid(r8, &(0x7f0000000180), 0x12) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r0}, 0x8) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000180)={'ip6gre0\x00', &(0x7f0000000280)={'syztnl0\x00', 0x0, 0x2f, 0x5, 0x9, 0xbd, 0x44, @ipv4={'\x00', '\xff\xff', @multicast1}, @empty, 0x700, 0x7, 0x100003, 0xaf9}}) (async) r9 = memfd_create(&(0x7f0000001800)='Y\xff\xff\x00\x00\x00\x00\x00K\xb2\x02\x80B\xe9\xe8\xcc\xde\x06\x00l\xa8\x1aJ\xaf\xb2M\xba\xb8_\x05U\xcd<|>\x9e\xec^\x0e\xbe\x18+-\x9b\x893\x02\x00\xa6\x1f+\xb3\xc5\x90z5\xe0\xdfi\xb7\x9f\xb4QW\xc9\xc9\x92\x03\t\x00\x00\x00\x00\x00\xb2\x0f\xee\xbe\f8\xcc\x7f\x00\x00\x00Z\x81\x00\x00\x00\x00\x18I\x13\xf1\xa2x\x04\x81R\xd45R\xae\x84\xcdN\xf7\xf6\b~\xed_M^dQ:\xbc\xafq\x88\x19nSF|;]\xe1A\x8c\x8a\x98\xd7|\xadNaC\xa6\xf9\xa7>c\x84\xd8\xfa\xf1\r\xb1\xfd\xbf!\xc7u\xccP\xdd\x13~\x89\xcf\x85\xca\xa0%\xc6\xc7\x11\x00\x00\x00\x00\x00\x00\x00?M9\\\av~\'\xd9\xb0\xacdya]8\x9d\xb7\v\xf39\xc5{\x9c!\x0f/\xb8g8\xb9\x8d\x19\xe2\xca\x01y\x83\xe7\ng\x87\xd93\xd8\x12\x8cXc5%\x03\x8d`\xdayC\x9b\x9a\xd9c\xe9\xb4\v\x99\x87\xe4\x00\x8a\x8eS\x8e\f\x05YH\xa2\x0e\xbc\x9c\x95\b2Cf6\x9a\xe7\xb9\x86\xbe\xd0\xda\x91\xc1sl\x11PA\x93\xa5\x93\xc8\xf1w\x7fp6z\xbf\xe8[\'u\xb8\xd2$K\x12\rt\x87\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00r\xe2`\xdf\xd2\xb3\xaf\xe9\xc4!Z\xb4&\xa2\x12\xe2i\x91kC$A\xafR\xb3\xff\x1d=\xec\x10\xb4+\x13\'\x92>\x14\x00\a\xb6R\x8b\xdcz\xc3\xd1Y\xd6\xd9;s \xb0\x938\xb7D9\xdcN\xbd\xdbn\xe35\xa7\x02\x9c\xc1\xd9\x13?\xc9\xd7\xab\x9c\xf3\x82\xd1\xee^kk\xce\xdbn\x02\x1f\x80\t\xdbr\xa9\xcc\xf1\xcb\x9f@\x8c\xfc\x02W/p\x97\xb0\xbd\x8f\xdb|n2a\xee\x95u\x83\xca\x8a>}\xd3\xd0\xff6.pa\x17\xe3e\xd2\x7f\xf6\xbc\x9d\x112\x1b\x14p\xa1\xd6u\xefn\xb4\xa3\x05D\x8c\xc5l\xcc\b\xeb\xf42\xe9\xf15\xf3\xf2\xee\xd6\xed\t\xb3\xf7\x1a\x7f\xe6\xb4z\x19\xe1\xb4w\xf7\xa6\xd7\\\xfa\x96\xe2{\xc5\xca\xf3,\x1f]S\xc0\x9fa\xbd\xfa3\x19\x85\xf15\xf4\x184\xa3{\xac\xfd\x9c0\xad\x1b\x88\xdf\x8eb\xb0\xec\xb2\x80\xf0=\x1aBk\x8fi/7\f\x98D\x9d\xca\x9d\xfaq\xefG`\xe2\x9d9w\xef\xe6\x00'/1976, 0x7) mmap(&(0x7f000072a000/0x3000)=nil, 0x3000, 0xa, 0x13, r9, 0x0) (async) r10 = openat$cgroup_ro(r3, &(0x7f0000000300)='blkio.bfq.io_service_time\x00', 0x275a, 0x0) dup3(r9, r10, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x2c011, r10, 0x0) getsockopt$TIPC_SRC_DROPPABLE(r10, 0x10f, 0x80, &(0x7f0000000380), &(0x7f00000003c0)=0x4) 11.099424472s ago: executing program 0 (id=19): r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f00000012c0), 0x6e) r1 = syz_open_dev$loop(&(0x7f0000000080), 0x2eb, 0x10000) ioctl$BLKFRASET(r1, 0x1264, &(0x7f0000000140)=0x5) listen(r0, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) connect$unix(r2, &(0x7f00000004c0)=@file={0x1, './file0\x00'}, 0x6e) r3 = socket$netlink(0x10, 0x3, 0x4) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000280), 0x802, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/crypto\x00', 0x0, 0x0) preadv(r5, &(0x7f0000001500)=[{&(0x7f00000002c0)=""/4078, 0xfee}], 0x1, 0x202, 0x0) r6 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r7 = openat$vmci(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r7, 0x7a7, &(0x7f0000000040)=0xa0000) r8 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[], 0x1c}}, 0x0) syz_emit_vhci(&(0x7f0000000180)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x1, 0x3, 0x10}, @l2cap_cid_le_signaling={{0xc}, @l2cap_conn_param_update_req={{0x12, 0x4, 0x8}, {0x0, 0x4, 0x9, 0x5}}}}, 0x15) ioctl$IOCTL_VMCI_INIT_CONTEXT(r7, 0x7a0, &(0x7f0000000200)) ioctl$IOCTL_VMCI_VERSION2(r6, 0x7a7, &(0x7f00000000c0)=0xa0000) r9 = dup(r6) ioctl$IOCTL_VMCI_INIT_CONTEXT(r9, 0x7a0, &(0x7f0000000140)={@hyper, 0x1}) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) r12 = openat$vmci(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r12, 0x7a5, &(0x7f0000001340)={{@host, 0x7c2}, 0x1, 0x1, 0x2}) sendmsg$ETHTOOL_MSG_STRSET_GET(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000001380)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="05070000000000000000010000001c0002800c00018008000100080000000c0001800800010005000000280001800800030000000000f4ff030000000000140002006261746164763000000000000000000004000300"], 0x5c}}, 0x0) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r9, 0x7a5, &(0x7f0000000100)={{@my=0x0}, 0x1}) ioctl$UI_GET_VERSION(r4, 0x4008556c, &(0x7f0000001400)) write(r3, &(0x7f0000000000)="29000000140005b7ff000000040860eb0101b6ff02159f02c26ed638eeb738256e06a40e07fff0797e", 0x29) 10.820981578s ago: executing program 3 (id=20): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) recvmmsg(r0, &(0x7f00000078c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40000000, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) gettid() r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x107181) ioctl$USBDEVFS_SETCONFIGURATION(r1, 0x80045505, &(0x7f00000001c0)=0xffffffff) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, 0x0, &(0x7f0000000180)) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r5, 0x5452, &(0x7f0000000000)=0xffffffffffffffff) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r5, &(0x7f0000000040)={0x20000004}) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x4, 0x4, 0x9, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) epoll_pwait(r6, &(0x7f0000000300), 0x1, 0xfffffffc, 0x0, 0xfffffffffffffff6) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000200)=0xffffffffffffffff, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = openat$hwrng(0xffffffffffffff9c, 0x0, 0x0, 0x0) preadv(r7, &(0x7f0000000240)=[{0x0}], 0x1, 0x0, 0x0) r8 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSWINSZ(r8, 0x5414, &(0x7f0000000140)={0x7, 0x0, 0x0, 0xffff}) openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000004002, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f00000000c0)={0x0, 0x9, 0x10}, 0xc) prctl$PR_GET_UNALIGN(0x5, &(0x7f0000000000)) 10.744394905s ago: executing program 0 (id=21): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r1, 0x0, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) syz_io_uring_setup(0x1f87, &(0x7f0000000080)={0x0, 0x0, 0x1, 0xffffffff}, 0x0, 0x0) socket(0x1e, 0x4, 0x0) socket(0x1e, 0x4, 0x0) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) r3 = memfd_secret(0x0) fcntl$setlease(r3, 0x400, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000140)={0x1, &(0x7f0000000100)=[{0x6}]}) socket$inet(0x2, 0xa, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) recvmmsg(r2, &(0x7f0000005dc0)=[{{0x0, 0x0, 0x0}}], 0x4000000000002b1, 0x0, 0x0) connect$inet6(r2, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x4ff, 0x0) r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, &(0x7f0000001540)={0x24, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="00220f00000007c9eee2f52b71b9a7abae1000090eccd4f19d3340d8ecaba003cea90ecb1e0eb2a317cdaeb1b79e11b776bf6a64c47732eadae36a90834d7be3cccaf4f8af363b6fc194"], 0x0}, 0x0) r6 = syz_open_dev$hiddev(&(0x7f0000000040), 0x0, 0xca100) ioctl$HIDIOCGUSAGE(r6, 0xc018480b, 0x0) ioctl$HIDIOCGUCODE(r6, 0xc018480d, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) 9.444321861s ago: executing program 3 (id=22): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x2}}, 0x20) r4 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000d40)={0x10c, 0x0, &(0x7f0000000b00)=[@exit_looper, @free_buffer={0x40086303, r4}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f0000000240), 0x0, 0x1, 0x2f}, @fda={0x66646185, 0x7}, @fd={0x66642a85, 0x0, r2}}, &(0x7f0000000300)={0x0, 0x28, 0x48}}}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000640)={@flat=@handle={0x73682a85, 0x1000, 0x3}, @fd={0x66642a85, 0x0, r1}, @flat=@weak_binder={0x77622a85, 0x1000, 0x1}}, &(0x7f0000000440)={0x0, 0x18, 0x30}}}, @increfs, @acquire, @acquire={0x40046305, 0x3}, @increfs={0x40046304, 0x202}, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000a40)={@flat=@binder={0x73622a85, 0x1101, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000840)=""/248, 0xf8, 0x0, 0x19}, @ptr={0x70742a85, 0x0, &(0x7f0000000940)=""/217, 0xd9, 0x1, 0xd}}, &(0x7f0000000ac0)={0x0, 0x18, 0x40}}}, @release={0x40046306, 0x2}], 0x92, 0x0, &(0x7f0000000c80)="29b5b465a4e36afca556e3715f1f7327ba47f399846221bfc47c9e87296e4ac88db88628672b3afcea102461226efb3397091d672580bd1e7efffc908175fd584e0c31adf2e0de1bd0f4108cd0976d46394eab6394dbb56e55e641b8e16031f3a7c18e728b6a817a021df7049c5e89e00461cc4c91b571d1a250c954c4dc738d0af754b730e36e124a4f9a2d60ac5f5e1a2a"}) write$RDMA_USER_CM_CMD_RESOLVE_IP(r2, &(0x7f0000000180)={0x3, 0x40, 0xfa02, {{0x6000000, 0x0, 0x0, @mcast1}, {0x2, 0x0, 0x0, @empty}, r3}}, 0x48) r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581", @ANYRES16], 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220f000000079b4d3948859f0b6d011fe4b2"], 0x0}, 0x0) syz_usb_control_io$hid(r5, 0x0, &(0x7f0000000500)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="2001010000009f"], 0x0}) r6 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x0) ioctl$HIDIOCGUSAGE(r6, 0xd01c4813, 0x0) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) r8 = syz_io_uring_setup(0x6909, &(0x7f0000000340)={0x0, 0xcf1, 0x10100, 0x0, 0xbb}, &(0x7f0000000140)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r9, r10, &(0x7f0000000200)=@IORING_OP_TIMEOUT={0xb, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0x77359400}}) io_uring_enter(r8, 0x184c, 0x0, 0x0, 0x0, 0x0) r11 = io_uring_setup(0x7058, &(0x7f0000000040)={0x0, 0x3dad, 0x0, 0x1}) r12 = io_uring_register$IORING_REGISTER_PERSONALITY(r11, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r8, 0x18, 0x20000000, r12) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f00000003c0)={0x53, 0x0, &(0x7f00000005c0)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x70, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0x1, &(0x7f00000006c0)=""/191, 0xbf, 0x1, 0x39}, @fd={0x66642a85, 0x0, r0}, @fda={0x66646185, 0x1, 0x2, 0x3e}}, &(0x7f0000000240)={0x0, 0x28, 0x40}}, 0x1000}], 0x0, 0x0, 0x0}) dup3(r7, r0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r13 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r13, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r13, &(0x7f000000e280)={0x2020, 0x0, 0x0}, 0x2020) mknod$loop(&(0x7f00000002c0)='./file0/../file0/file0\x00', 0x0, 0x0) write$FUSE_INIT(r13, &(0x7f0000000380)={0x50, 0x0, r14}, 0x50) 5.638416749s ago: executing program 3 (id=24): r0 = syz_usb_connect(0x5, 0x36, &(0x7f0000000500)=ANY=[@ANYRESOCT, @ANYBLOB="ce7c6b842616fa2960a734aae760e591ac24", @ANYRES16, @ANYRES32, @ANYRES32=0x0, @ANYRESHEX, @ANYRESDEC, @ANYRESHEX, @ANYRESHEX, @ANYRESHEX], 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000240)=ANY=[@ANYBLOB="010000000000000000000000000000000000000000ffff00"/48]) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYRESHEX=r2]) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="00000080", @ANYRES16=r4, @ANYBLOB="0100000000000000000008000000080009000200000008000b"], 0x24}}, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c0000001500010000000000000000000100000008000100", @ANYRES16], 0x1c}}, 0x0) r8 = memfd_create(&(0x7f0000000880)='D\xa3\xd5Wj\x00\x00x0\xc1\xac\x1a\x1a\vG\xa9~vB\xbc\t\x00\x00\x00VoA\xaa\xbc\xee[\xe1\xa2\xe0\xff\x04\x00\x00\x00\\i\xcf\t\xb0\xa9 +H/\x1a\xe7\x95\xce\"\"\xbd\xf9!\xfd\xa4\xcaN\x84\xadS\x8bqE\x99\x01t\xb1\x1f|\x99PL\x92\x8f\xc2\xf9\xcd\x8cj\x03X\x05\x17mwI\xf0\x01\xe5z\xcdJ)\xc7\xfa)\xaa}\xef\xbb\xf5\xcd\xb1o5\x18\xd6\v\x85q\x98\x9bB\xb9\xea\xe7\xff\x7f\x00\x00T\xc0\xd2\t?\bp8\xc6\xe5\x06P\xc11\f^\x7f\x9f\x15\x1e\xf2\x18\r\xad\b\xe0\x96NH\x85\r+\xfc\xb3\xdd\xddhgY\xd3\x9b\b-G\xb1\xdaS\x81\xb2\x93\xb83\x8a\x94*\x8d\\\b\x030\xa1\xc0\xf9&\xd3M\xf6\n\xff\x83k\xe6\x06\x00a\x16\xbd\x1a\xb2w\bb\x83\x10\xc2\x84\xd1\xd7\x1d\x1dzz\xaf\xe3\xdc\xe4\x1f\xe9B4\x80tW\f\x11K*\xd9s\x90\x8eZ\xec\x9f\x99B*\\\xac\xbfD\xe3^\xeb\x81\xdc\x8f\x8a[Q\x12\xed0\xa5\xd3\xbd\x01@?\xa1\xd4\xb2\x02d\xa5\x15\xe0\x97\xe6\x98E:\x99sf\x1a\x87\x8e\xf7D!\x8b@\x92z\xb0\xb3*\x1b4J.\x8c\xc0\x9e2\x88\xb1=h\x1eX\xdd\xfe\xf0\xe1\xba\rK2\xb2[2B3\xeb(:3$\xf5\xb4S\v\x81\x19\x80\r\xfbO\a7>\x05\xe1\x8c\x84\xfe\xd8]\x15\x98\x06\x89)\x8fz\x9ez\xf2>cT\xe6\x0e\xf8\x03\xbe\xbd\xbb\x18\x16n\x8d\xe74Nv\x87-\xb5\xb5\xe0\xe7[\xd4.\xbcnX\x17\xc5\xdd^\x0f\x0e\x80fi,\x96kX\xf0c\x1b\"k?t\xa0\xc2\xedO5`\xa16\xda\xa3\xb0\x1f*;\x7f\t\x00\x00\x00\xd9\x85,\x97OF\x91\xc6\x8b\xb3c\x0e\x03fX\xf5\xce$\xebV\xf9\x9fv\xae\nt\xaa\x04\x81\xb3Xt\bK\x8b\x8e\xf9.;\xc0\xc1\xe1\xfa\x18\xca\x92Q\xaaf\x84\xf8\xf0\xcb\a\x92\xd6C\x18\xcaj,~\xc3z\x91\xed\xc4\xd9p\x16l\xbbM\t\x8a\x8e\xdfL\xfdWb\x1e\x9b\xac', 0x2) write(r8, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x11, r8, 0x0) r9 = dup3(r6, r8, 0x0) fchdir(r9) r10 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) syz_open_dev$dri(&(0x7f0000000100), 0x0, 0x0) ioctl$DRM_IOCTL_SET_VERSION(0xffffffffffffffff, 0xc0106407, &(0x7f0000000280)={0xfffffff9, 0xffff, 0x0, 0xfffffffe}) r11 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r12 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000140), 0x42c00) readv(r12, &(0x7f00000000c0), 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r11, 0x4018620d, &(0x7f0000000100)) syz_usb_ep_write(r0, 0x9, 0x84, &(0x7f00000001c0)="555f4090f35aad425d5fa009bc4fc58a6dc3558819c67d0d633804937680f88a16a0bdfe6c3497a66923150d8d2689c1b43d4b656a63328b3b13565614347c1396978fc27856fc980f9d587aadd4b5daba1a58058ade4e2fe60678563bb0c3194c3d6682594c61ef28bd3521ab1ebfc0b12ad67b6f5cd1b1a751c58784c85db03ac8c7a9") bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000440)=ANY=[@ANYRESDEC=r0, @ANYRESHEX=r1, @ANYRESOCT=r10, @ANYRES32=0x0], 0x20) r13 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r13, 0xc0306201, &(0x7f0000000080)={0x28, 0x0, &(0x7f00000002c0)=[@increfs, @increfs_done, @dead_binder_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x40046305, 0x2}], 0x0, 0x0, 0x0}) ioctl$sock_inet_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000180)) 5.399939281s ago: executing program 0 (id=26): syz_open_dev$ttys(0xc, 0x2, 0x1) creat(&(0x7f0000000240)='./file0\x00', 0x80) r0 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000000)=0x8, 0x4) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000001b40), 0x4) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r2, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a4c000000060a0b040000000000000000020000001800048000000000000000006d617371000000000400028009000100737d7a30000000000900020073797a3200000000050007400000001100010000000000000000000000000a0000000000"], 0x74}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_usb_connect(0x2, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="120100004366b408c70b0800c84f0102030109022d00010000000009040000032eb47d000905f9ffffff00000009050f47"], 0x0) syz_usb_disconnect(r4) syz_usb_connect(0x5, 0x1b, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x55, 0x4d, 0x3e, 0x20, 0xbfd, 0x111, 0xad03, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9, 0x0, 0x0, 0x0, 0x0, 0x4}}]}}, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="020a00000600000000000000000004000400030005020000ff7f000000000000010100000000000007000000030000"], 0x30}}, 0x0) r7 = socket$inet_dccp(0x2, 0x6, 0x0) r8 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_TRIM(r8, &(0x7f0000001a00)={&(0x7f00000015c0)={0x10, 0x0, 0x0, 0x1}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x40805) connect$inet(r7, &(0x7f0000e5c000)={0x2, 0x4e20, @loopback=0x7f000002}, 0x10) getsockopt$inet_int(r7, 0x10d, 0xdd, &(0x7f0000000000), &(0x7f0000000080)=0x4) sendmmsg(r1, &(0x7f0000001a40)=[{{&(0x7f00000000c0)=@rc={0x1f, @none, 0x8}, 0x80, 0x0}}, {{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0xfffff633, @local, 0x0, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000001b80)=ANY=[@ANYBLOB="0010000000000000150100000800000055b90e0544e2cf7652da1a852d5c73f854c61b190297c636a8cd421ff21cf19805e289ddfa9f707dfe94c3b6b4bfb5ef0039c8671048e531f90d8269de54c73a15b9d6a22d72f21e9ed3ab3be286e2b6796e7d0f343af3c33ade250caf0503717f90f8346f4652bc65ddb4ed6c4c1405b9c4da3b7fb34d9ce722bbe5b616ee76a3a5c3017e429b77f36b4d723e4264f38a2cae5eacf1780ef9752902358001eec938b8a7a23aaa34015a8053a8ee00a27f6603affbdb07a5f03714f0304a34063d1241bd1616b35749fd647b5fd0f6d5317631d1032007ea4d8b447e7f1829c44b4c3bd1052a595cafff0f8013a4c1633e6660a0dc8be9c5d64224ecaae088a32b289779fc863c2f26b161d843171ddabe9ebe92c2f47669259f44c1f1736ae1fa0c9cf311cae455ddd8d70fcf710c1b648b973188840db49989f747beb19b27adfad575abea93b9e7e1e3919d9b1bd7f945257b18397c717f58fb7b0e7413f659cbd9423585c3febc88f56e7d00def02ebf5bbd31f58d437d5149abcdf2c7841ec86fa4469125fd47dcb555a1b4f1e89dcab9ef84c6e9c3a5f05f162578d09f005bcb873d6a7ac49859f30e634eada04c23c15d1879ba6d9388dd4e7909c66ed74d85a67afc3e78af990f6d811bb8272ce9d23ecf35d91ad0f2fa63eea46ca342a5a789ec3d0ed401f9abeccd455fdb7a4848422258edded2a24d71a438f9e1f09c78f165433af4d9c61f001ddf03cc77e8935b1f8919ad3dae6bae963fc422263815f4f545ea341c7b20027ef267126aad3154bbc7352e4ac5797fc049146c4c7c3888737a9a9c0926756e55ee58cce181fa974eb5a740871cc211982c917090074b695de8afce4b99de28d8816d68bd75e5dbdafbbc6bcbffa7e88a6f99e3d3b89c555da2728bd84007fe6b82e1c7bde62f7fec2cc21f0bc94593aa68ef06a1736ce66277e58796502c419c082f490d7e6affc2302eb5a2bd65a21466c02c30445730a46b351f4b4776499b8d0f7f32b289055ac798269b6a7fc68470915bcdefeb50816badcd861e6439a55297f6d0f004537b644b07492afbe06dcf34281332efea7dcc8dee3852f6f55fa5db7948f34c74cc6de92a2cedb7504a51e640dfb8a5aa71d2e163aba12acb7f8d15f699570a1814fc2f38c060fa9f1aa8b7b25ea57f377f1523e42d59468c2381ac53d3ade81d14145c3f71df2d121f4fde9283f579fbf61e8be5cef1e8f40628b506500f4f9a0d5dd452d56e905bd09b426367745968f7a6be519944a20e7759968afd6f6be925da6b560c14d088c5af07aa8fc2935cdb6a7fe6aa01ef5be32ec53fe84cc7ef8520dee864e092cc3bb6b0fe8915e7c09f85852eea3d982ce3a3f257efeb8b02882632afb27194f3433b62122d47a156cf9680c5e00350c0207b75582e2587df70166a2e52bde5348ab176f298519b7841bef528e4603d395f2f1a6f804bd5900863373a207716a16fff2513b2c7cd9ac6700be698c43b5a386b02791229b1f775df4bedb155a505186feb30579c41e1f65623d131316b4cc8e5798331faa7e8a1906cf3f6877bcbebc51d639cef4b9f82584e511938fe2d30fe52aa096c88d41a803739227c5d968a46edd82c8925438f5348086e518e92d9c20255cd14a6ad24bedced9b5fbd22cfc06e03d77aa7f35c9f74076032893fddb408d48c11bc2aab9112c06dc6c300f30fc036d0ef97304d6ed0ac34febebba4bc2318bbfefac29b9b42f1faeae580b6523cd62aa788e1602b99bd87f378935fc61d2acf14772042fb599fd0aa49e36a886a7cfaa2926d41e7fcf1c5a2ea27d192e1bf0016bb9b3a71edaacba1c6df4dc5ef46a0c5a305347399578568ee603dfd0ea5456450d3f48e093281034402dfa8fd5d4702150278e08c1974cfbadeaa6b07e10047a0945c5aa22a1b5b2d4cba9719a29663ea92656e1d5b2c497d712a90a097ab903bbf6bef41797d06ef4f7881e4928ac1123246ed619ae4c4a62916175be37284933e588c8280c9cf4b2eac8279b5b47394dd2d39e2c01bf5a54a45506cc2d78597bc07b9dfe6e68e45a98ebb478cc9050cb3493676e0b255baca28a91510461f8aa58e21c1a61ac5598e56e71f8a8d1566f16959ecdb359df95cda4ddd3a459691adbbcb82a5d2587b3e436770aded6270538bc2e103a0c0062c1230c853c8c191188e1fd060d1586e25dd81916ad5e7d75b20c0a0d8e863ceaa82401dde322cc72c2c66224bc81a5c319ca00f3bede6ba1f697553ea35d1c3657d54012b83cee18519e20fdfd759044590215da0329bbfe2535283868b58958c7bd4079aed6bf4f2f59ca93dd342ebed7050a3535e792a023077d5d93eb96128bb7afbf7bc3cb9871292db13f08ac9bf990147b280b36589947b5db3b1341b13142605aaaf5b5c366d992dd84896c0901063b409b222241a15560af81fe5bc75a7e06650f851da27338070995c0feb4410168142996b6319f8d62a2ff7a9573351593ced9f33c38ab04547883af2bfc81d4950b5b4ed89ee4c30d3e2d85c9759f24b3bfcbeaa8d1be49d834fc964c0fa3bd267984360f2de865fcb045f901313e2009a4d69cfa972f662b19ac2cee484fcbf164886ba0e2857c524aa3e41adbbf8b9cbdf4f6407fd1bc31424947eb42eede8d0fbcd153c226d15d4d481c181d5d771e05db6ee36fa5340fd4f285237e2526b1ba75f917128658ff42ea6c1a228ea7ff6e8b8ae4c1f9039a956dc82bc40d1b8d743f9d23e31679eab4fe2ab69742aa0e348fa2047c2e436a6"], 0x1100}}, {{0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000140)="fb668c2adcc3fcb3c78bca2f6ef3376eda6aee8c39a6e1af09f3c179e632759d70c9fb36f6a82986b4cc952868bdeb09cadf31797d461eff582e4b135303a57f9f0e2c2a87bbb4c12065b41bc5ec33fea93e00dd79729c007edebdf1b38d5b5d7506fde15f13ba39ad134a73b706b5eb6cf89fa854f04b214ed05a70cbdb3811b53e", 0x82}, {&(0x7f0000000280)="ec505fffd894adff29ac9e5e7b7398cf4dacfca342cc", 0x16}, {&(0x7f00000016c0)="e6472509fe352fa5b6ffbd87fdb1d5aa27782dac91fb41af68f29d98c99ecb5fcc7feafd18d746954cf5069a051d950fb125322f03996b5fe0aa5ace9aa3ea2b36a35fcd77c3f483f88990", 0x4b}], 0x3}}], 0x3, 0x2c048051) syz_emit_ethernet(0x4a, &(0x7f0000000440)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa0086dd6000000000140600fe8000000000000000000000000000aafe8000"/51, @ANYRES32=0x41424344, @ANYBLOB], 0x0) 5.101268983s ago: executing program 1 (id=27): syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000100900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000010000000000000000000a28000000000a0101804bc9555e1affd5020000000900010001797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a300000000009000300737975320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000030a03008469000000000000020000000c00024000000000000000030900010073797a30"], 0x54}}, 0x0) recvmmsg(r0, &(0x7f0000001640)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000004c0)=""/4096, 0x1e28}, {&(0x7f00000000c0)=""/250, 0x8}], 0x2, 0x0, 0xd64}}], 0x300, 0x34000, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000007c0)={0x5c, r3, 0x1, 0x0, 0x0, {}, [@WGDEVICE_A_PEERS={0x34, 0x8, 0x0, 0x1, [{0x30, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}, @WGPEER_A_FLAGS={0x8, 0x3, 0xf}]}]}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4004840}, 0x40000) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r0, 0x80089419, 0x0) 5.091139575s ago: executing program 4 (id=28): r0 = socket(0x1e, 0x4, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r0, 0x10f, 0x81, &(0x7f0000000480), 0x4) recvmmsg(r0, &(0x7f0000006000)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000540)=""/259, 0x103}], 0x1, &(0x7f0000000100)=""/91, 0x5b}, 0x2}], 0x1, 0x40, 0x0) r1 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x802) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/cgroup', 0x70000, 0x0) lseek(r2, 0x0, 0x1) ioctl$KVM_SET_CLOCK(r2, 0x4030ae7b, &(0x7f0000000080)={0x6, 0x4, 0x8, 0x8000000000000000, 0x9}) openat$dir(0xffffffffffffff9c, 0x0, 0x40, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='fd', @ANYRESHEX, @ANYBLOB=',rootmode=0000000000000000010', @ANYRESDEC=0x0]) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_G_FMT(r3, 0xc0285628, &(0x7f0000000080)={0x3, @win={{0x8, 0x0, 0x8, 0x2}, 0x0, 0x7, &(0x7f0000000040)={{0x0, 0x0, 0x0, 0xfffffffe}}, 0x1, 0x0}}) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000040)="aefdda9d240303005a90f57f07703aeff0f64eb9ee07962c220a2e11b44e65d76641cb010852f426072a", 0x2a}], 0x1) read(r1, &(0x7f0000001480)=""/4096, 0x1000) sendmsg$tipc(r0, &(0x7f0000000200)={&(0x7f0000000c00)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x4}}, 0x10, &(0x7f0000000340)=[{&(0x7f0000000380)='[', 0x101d0}], 0x1}, 0x0) 4.800602424s ago: executing program 4 (id=29): socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x458, 0x87, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x4}}}}]}}]}}, 0x0) syz_usb_connect$uac1(0x0, 0x71, &(0x7f0000000a00)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5f, 0x3, 0x1, 0x0, 0x0, 0x0, {{}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}}}}]}}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0xffffffff, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x17) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) pipe(&(0x7f0000000240)) syz_io_uring_setup(0x6563, &(0x7f0000000780)={0x0, 0x0, 0x10100}, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000002100)='numa_maps\x00') syz_io_uring_setup(0x39, &(0x7f0000000580)={0x0, 0xe7b7, 0x13500}, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000840)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="93630100200501001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r3, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r2], 0x4c}}, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000180)={@multicast, @empty, @val={@val={0x88a8, 0x1, 0x1, 0x3}, {0x8100, 0x5, 0x1, 0x3}}, {@canfd={0xd, {{0x0, 0x1, 0x1, 0x1}, 0x7, 0x2, 0x0, 0x0, "7bfd86ec1b74cd624bd3829c35ea9545329943bce617f72ee30b8e79cab9ffd482ed8ba6ae6208ba4ba335a71c6669c29ab46a1c4637b3f148eb067c9a5936ed"}}}}, &(0x7f0000000000)={0x1, 0x4, [0xe0e, 0xb6c, 0xb4f, 0xa0f]}) 3.995246943s ago: executing program 1 (id=30): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_X86_APIC_BUS_CYCLES_NS(r1, 0x4068aea3, &(0x7f0000000000)={0xed, 0x0, 0xffffffffffff9a42}) syz_usb_connect(0x5, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x64, 0xf1, 0xf4, 0x40, 0x10cf, 0x8065, 0x9179, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xff, 0x0, 0x2, 0x20, 0x47, 0x38, 0x0, [], [{{0x9, 0x5, 0x6, 0x2, 0x200}}, {{0x9, 0x5, 0x82, 0x2}}]}}]}}]}}, 0x0) 1.774275614s ago: executing program 0 (id=32): execve(0x0, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000000)={'sit0\x00', &(0x7f00000002c0)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x40000, 0x0, {{0x1e, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast, @remote, {[@timestamp={0x44, 0x14, 0x0, 0x0, 0x0, [0x401, 0x0, 0x5, 0x0]}, @timestamp_prespec={0x44, 0x34, 0xc0, 0x3, 0x0, [{@multicast1, 0x5}, {@dev, 0x659}, {@broadcast, 0x8000}, {@empty}, {@multicast1, 0xffd200}, {@private=0xfffffffd}]}, @timestamp_prespec={0x44, 0xc, 0x0, 0x3, 0x4, [{@private=0xa010101}]}, @noop, @noop, @lsrr={0x83, 0xb, 0x0, [@private, @rand_addr]}]}}}}}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000240), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x280000b, 0x28011, r2, 0x0) r3 = dup(r1) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000300)=[@text64={0x40, 0x0}], 0xffff, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0xa, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0xd000}) ioctl$KVM_NMI(r4, 0xae9a) ioctl$KVM_RUN(r4, 0xae80, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x34, 0x0, 0x1, 0x0, 0x0, {0x10}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_COALESCE_RX_MAX_FRAMES_LOW={0x8}]}, 0x34}}, 0x0) r5 = creat(0x0, 0x10) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_usb_connect(0x2, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0) sendmsg$NL80211_CMD_VENDOR(r5, &(0x7f0000000600)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES16=0x0, @ANYBLOB="000128bd7000fddbdf25670000000c00990009000000280000008d00c50055671600ccb861d630dca039e4c36ef2d0d8fa2a514ee17ca7b09c529cab882fabd21aa510407f7395f137afef9e61e39e8956e0bbc9f5befd47a456ace525f94f764409b371b8df616c2857ce649e877458894bb520992edc5021cceadbf016271a170de9eaa0f02732ce8c8ef8409abbed3ec8949dc17804a428b133bf90e885fa4a6ffc3142df340000009100c5000003a6a281abef086dfce9ca3cf033b1f52f3ff81accf06f42413f88586cf54e5d12334bf40cc22611926abb55d1a178e5e6d268629fa0b9a539337730adb1660f639d68c2558ce90b7b0c0950c8f742f87d7755b16f6df4beea87a677e76d097f1487512669716741a81a4692efd9ec9c39cdf6cb3ae90d9092b789e5d4f5426ebb2ab52afa230cb151faad260000000400c500"], 0x148}, 0x1, 0x0, 0x0, 0x4000000}, 0x800) syz_usb_connect(0x5, 0x5f, &(0x7f0000000140)=ANY=[], 0x0) r6 = openat$ptmx(0xffffffffffffff9c, 0x0, 0xc4040, 0x0) ioctl$TCXONC(r6, 0x540a, 0x4) bind$alg(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004080}, 0x0) 1.773675472s ago: executing program 3 (id=33): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$kcm(0xa, 0x922000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f00000000c0), 0x4) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000300)=ANY=[], 0x9c}}, 0x0) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f00000007c0)=@l2tp6={0xa, 0x0, 0x0, @mcast1, 0x4}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000780)="f4000900062b2c25fe80000000000000dc8b850f238466cc00007a000000ad6e911b51818462b4003a", 0x29}], 0x1}, 0x0) syz_emit_ethernet(0x32, &(0x7f0000000000)={@link_local, @random="1d5da714014a", @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x32, 0x0, @empty, @empty=0xeaffffff}, {0x0, 0x0, 0x10, 0x0, @gue={{0x2}}}}}}}, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @empty}], 0x1c) sendto$inet6(r0, &(0x7f0000000080)="e9", 0x1, 0x0, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000100)={0x1, 0x0, 0x0, 0x2, 0x7, 0x5, 0x9, 0x8}, 0x20) 1.356368615s ago: executing program 3 (id=34): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20010004, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x3daa76c8, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x9) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000980)=ANY=[@ANYBLOB="84000000", @ANYRES16=r5, @ANYBLOB="010000000000fbdbdf250100000008000200000000000500050000000000080003000100000048000180050002002000000006000100020000000800060003000000080003"], 0x84}, 0x1, 0x210a0}, 0x0) 1.348486191s ago: executing program 4 (id=35): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/binder0\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ppoll(&(0x7f0000000600)=[{r3}], 0x1, 0x0, 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000480)={0x4c, 0x0, &(0x7f0000000580)=[@acquire, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 995.02025ms ago: executing program 3 (id=36): setsockopt$inet6_IPV6_HOPOPTS(0xffffffffffffffff, 0x29, 0x4d, 0x0, 0x28) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[], 0x4c}}, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0xe) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000180)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x1}}, '\x00'}) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0xa8040, 0x0) ioctl$EVIOCGPROP(r1, 0x40047438, &(0x7f0000000180)=""/242) ioctl$PPPIOCGFLAGS1(r1, 0x40047452, &(0x7f0000000100)) r2 = socket(0x11, 0x800000003, 0x0) r3 = socket(0x10, 0x3, 0x0) syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f00000000c0)={0x0, 0x9}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r2, 0x84, 0x70, &(0x7f0000000240)={r5, @in6={{0xa, 0x4e23, 0x2, @mcast2, 0xfffffffd}}, [0x3, 0x29, 0x2000000004, 0x7fff, 0x40, 0x7, 0x7, 0x1001, 0x68, 0x5, 0x8, 0x3, 0x2, 0x1000000004, 0x5]}, &(0x7f0000000340)=0x100) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = syz_usb_connect$cdc_ecm(0x6, 0x67, &(0x7f0000000400)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x55, 0x1, 0x1, 0x7, 0x0, 0x7, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x2, 0x6, 0x0, 0x40, {{0x7, 0x24, 0x6, 0x0, 0x0, "1d0c"}, {0x5, 0x24, 0x0, 0x7}, {0xd, 0x24, 0xf, 0x1, 0x9, 0x9, 0x787, 0x57}, [@country_functional={0xa, 0x24, 0x7, 0xea, 0x9386, [0x1, 0x4]}, @obex={0x5, 0x24, 0x15, 0x1000}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x3, 0x1, 0x6}}], {{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x1, 0xab, 0x2}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0xde, 0xa, 0xc}}}}}]}}]}}, &(0x7f0000000580)={0xa, &(0x7f0000000380)={0xa, 0x6, 0x0, 0xf9, 0x2, 0x4, 0x40, 0x6}, 0x12, &(0x7f0000000480)={0x5, 0xf, 0x12, 0x2, [@ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0x1, 0x6}]}, 0x2, [{0x4, &(0x7f00000004c0)=@string={0x4, 0x3, 'Na'}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x2c33}}]}) syz_usb_control_io$cdc_ecm(r7, &(0x7f0000000740)={0x14, &(0x7f0000000640)={0x0, 0x1, 0xe3, {0xe3, 0xc, "448dbd589da3d27f17fb72d77a4fa3dc84d33e5f101a862157f98e37078832595fceb2645748d9648a34be9721d9b2c4e0a5bd86088510ba63e86cbec1f97c2de14732b7287984ab21d33ca48883f9f35375a0d3e6dd684c27a61b645e51cdf37e914d398296506384541eef707a4e724f7449963ab6fdac10d95e080f541caea676c825ad776980ada122e75766ba1df080525f0e06e3640c69cf9e560c438f497d5ccb82e84c80737522285971464237eefdcceeff54e005233550d99e9f750233f0183778fdc0750d6a0b230b253f08ebeb0aa894494e0c182c28e9b1fe9f4f"}}, &(0x7f00000005c0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000008c0)={0x1c, &(0x7f0000000780)={0x40, 0x11, 0x8a, "f60e2e8a4496dfe9be0e2236d2702f0dfe7b4a763a8d6b5fe80bde4cae60bc7b721e13b21ef107d3229388bd09b5ddb9ee7e396dceca618625fca706299cdc3c74c5d86e9f9a47f1d1ace6169145466861dcca04b44d1ac093fede878857930d79f3a975d41968e25727916da8d86a9649b2b29559cb2aaf86539a31c999b3b5ba23be62ec5afa174c81"}, &(0x7f0000000840)={0x0, 0xa, 0x1, 0x7}, &(0x7f0000000880)={0x0, 0x8, 0x1, 0x5}}) sendmsg$IPCTNL_MSG_EXP_GET(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="580000000102010300000000000000000a00000006000740000000003c0001802c000180140003"], 0x58}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0xfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbe, 0x0, 0xc], 0x1, [0x4, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa29], [0x0, 0x4, 0x0, 0x1000, 0x0, 0x2]}}}}]}, 0x88}}, 0x40010) setsockopt$inet6_IPV6_HOPOPTS(0xffffffffffffffff, 0x29, 0x4d, 0x0, 0x28) (async) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) (async) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[], 0x4c}}, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) (async) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0xe) (async) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000180)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x1}}, '\x00'}) (async) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0xa8040, 0x0) (async) ioctl$EVIOCGPROP(r1, 0x40047438, &(0x7f0000000180)=""/242) (async) ioctl$PPPIOCGFLAGS1(r1, 0x40047452, &(0x7f0000000100)) (async) socket(0x11, 0x800000003, 0x0) (async) socket(0x10, 0x3, 0x0) (async) syz_open_dev$ptys(0xc, 0x3, 0x1) (async) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000600)) (async) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f00000000c0)={0x0, 0x9}, &(0x7f0000000100)=0x8) (async) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r2, 0x84, 0x70, &(0x7f0000000240)={r5, @in6={{0xa, 0x4e23, 0x2, @mcast2, 0xfffffffd}}, [0x3, 0x29, 0x2000000004, 0x7fff, 0x40, 0x7, 0x7, 0x1001, 0x68, 0x5, 0x8, 0x3, 0x2, 0x1000000004, 0x5]}, &(0x7f0000000340)=0x100) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) syz_usb_connect$cdc_ecm(0x6, 0x67, &(0x7f0000000400)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x55, 0x1, 0x1, 0x7, 0x0, 0x7, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x2, 0x6, 0x0, 0x40, {{0x7, 0x24, 0x6, 0x0, 0x0, "1d0c"}, {0x5, 0x24, 0x0, 0x7}, {0xd, 0x24, 0xf, 0x1, 0x9, 0x9, 0x787, 0x57}, [@country_functional={0xa, 0x24, 0x7, 0xea, 0x9386, [0x1, 0x4]}, @obex={0x5, 0x24, 0x15, 0x1000}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x3, 0x1, 0x6}}], {{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x1, 0xab, 0x2}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0xde, 0xa, 0xc}}}}}]}}]}}, &(0x7f0000000580)={0xa, &(0x7f0000000380)={0xa, 0x6, 0x0, 0xf9, 0x2, 0x4, 0x40, 0x6}, 0x12, &(0x7f0000000480)={0x5, 0xf, 0x12, 0x2, [@ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x0, 0x1, 0x6}]}, 0x2, [{0x4, &(0x7f00000004c0)=@string={0x4, 0x3, 'Na'}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x2c33}}]}) (async) syz_usb_control_io$cdc_ecm(r7, &(0x7f0000000740)={0x14, &(0x7f0000000640)={0x0, 0x1, 0xe3, {0xe3, 0xc, "448dbd589da3d27f17fb72d77a4fa3dc84d33e5f101a862157f98e37078832595fceb2645748d9648a34be9721d9b2c4e0a5bd86088510ba63e86cbec1f97c2de14732b7287984ab21d33ca48883f9f35375a0d3e6dd684c27a61b645e51cdf37e914d398296506384541eef707a4e724f7449963ab6fdac10d95e080f541caea676c825ad776980ada122e75766ba1df080525f0e06e3640c69cf9e560c438f497d5ccb82e84c80737522285971464237eefdcceeff54e005233550d99e9f750233f0183778fdc0750d6a0b230b253f08ebeb0aa894494e0c182c28e9b1fe9f4f"}}, &(0x7f00000005c0)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f00000008c0)={0x1c, &(0x7f0000000780)={0x40, 0x11, 0x8a, "f60e2e8a4496dfe9be0e2236d2702f0dfe7b4a763a8d6b5fe80bde4cae60bc7b721e13b21ef107d3229388bd09b5ddb9ee7e396dceca618625fca706299cdc3c74c5d86e9f9a47f1d1ace6169145466861dcca04b44d1ac093fede878857930d79f3a975d41968e25727916da8d86a9649b2b29559cb2aaf86539a31c999b3b5ba23be62ec5afa174c81"}, &(0x7f0000000840)={0x0, 0xa, 0x1, 0x7}, &(0x7f0000000880)={0x0, 0x8, 0x1, 0x5}}) (async) sendmsg$IPCTNL_MSG_EXP_GET(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="580000000102010300000000000000000a00000006000740000000003c0001802c000180140003"], 0x58}}, 0x0) (async) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0xfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbe, 0x0, 0xc], 0x1, [0x4, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa29], [0x0, 0x4, 0x0, 0x1000, 0x0, 0x2]}}}}]}, 0x88}}, 0x40010) (async) 269.084782ms ago: executing program 4 (id=37): unshare(0x400) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0x48) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r1, 0x40505330, &(0x7f0000000100)={{0x3, 0x81}, {0xe}, 0x0, 0x7, 0xdd}) 152.917081ms ago: executing program 4 (id=38): r0 = socket$nl_audit(0x10, 0x3, 0x9) close(r0) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/class/ieee80211', 0x0, 0x0) fchdir(r1) open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x6b) 0s ago: executing program 4 (id=39): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = syz_io_uring_setup(0x239, &(0x7f0000000300)={0x0, 0x200000, 0x10100}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_usb_connect(0x0, 0x51, &(0x7f0000000000)=ANY=[@ANYBLOB="120100009209c840fd0b150161cb0102030109023f00"], 0x0) r5 = syz_open_dev$sndctrl(&(0x7f00000007c0), 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r5, 0xc10c5541, &(0x7f0000000000)=0x2) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x2c, &(0x7f0000000000)='/proc/sys/net/\x00\x00v4\x00\x00s/\x92ync_\x00le\xf44.\xab%nN\xd4\xa2\x88\x00\xd1l,'}, 0x30) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) fchdir(r6) openat$cgroup_ro(r6, &(0x7f0000000080)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x0, 0x0) r7 = socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x0, 0x11, r7, 0x0) r8 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) getdents64(r8, &(0x7f0000002ec0)=""/4096, 0x1000) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r2, 0x2def, 0x4000, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x1, 0x5) r9 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, 0x0) timer_settime(0x0, 0x0, 0x0, 0x0) syz_usb_connect(0x0, 0x49, &(0x7f0000002dc0)=ANY=[@ANYBLOB="12010000a52bfb0821048f79548601020301090237000100000000090400000002fe1700052406000105240016000d240f01000000000000000000062c1a0000000424"], 0x0) readv(r9, &(0x7f0000000200)=[{&(0x7f0000003140)=""/4096, 0x8}], 0xe) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4dd308", 0x14, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) r10 = socket$inet(0x2, 0x3, 0x6) ioctl$sock_inet_SIOCSARP(r10, 0x8955, &(0x7f0000000000)={{0x2, 0x4e22, @multicast2}, {0x6, @local}, 0x68, {0x2, 0x4e23, @empty}}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.195' (ED25519) to the list of known hosts. [ 59.870346][ T5220] cgroup: Unknown subsys name 'net' [ 59.969819][ T5220] cgroup: Unknown subsys name 'cpuset' [ 59.978761][ T5220] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 61.551733][ T5220] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 65.000962][ T5235] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 65.009213][ T5235] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 65.018143][ T5235] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 65.025828][ T5235] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 65.034724][ T5235] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 65.043364][ T5246] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 65.049814][ T5244] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 65.058904][ T5244] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 65.067512][ T5244] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 65.076219][ T5246] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 65.076404][ T5244] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 65.091210][ T5246] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 65.091975][ T5244] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 65.106082][ T5244] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 65.108981][ T5245] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 65.121756][ T5245] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 65.122428][ T5244] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 65.129268][ T5246] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 65.137392][ T5247] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 65.146149][ T5245] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 65.150961][ T5247] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 65.157483][ T5246] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 65.164857][ T5247] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 65.171897][ T5245] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 65.186284][ T5246] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 65.195869][ T55] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 65.206920][ T55] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 65.239183][ T5246] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 65.247058][ T5246] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 65.254433][ T5246] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 65.698540][ T5252] chnl_net:caif_netlink_parms(): no params data found [ 65.710231][ T5249] chnl_net:caif_netlink_parms(): no params data found [ 65.838154][ T5250] chnl_net:caif_netlink_parms(): no params data found [ 65.849824][ T5248] chnl_net:caif_netlink_parms(): no params data found [ 65.923040][ T5251] chnl_net:caif_netlink_parms(): no params data found [ 65.985194][ T5252] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.993251][ T5252] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.001052][ T5252] bridge_slave_0: entered allmulticast mode [ 66.008464][ T5252] bridge_slave_0: entered promiscuous mode [ 66.030363][ T5249] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.037544][ T5249] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.044913][ T5249] bridge_slave_0: entered allmulticast mode [ 66.052328][ T5249] bridge_slave_0: entered promiscuous mode [ 66.077387][ T5252] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.084508][ T5252] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.095323][ T5252] bridge_slave_1: entered allmulticast mode [ 66.103324][ T5252] bridge_slave_1: entered promiscuous mode [ 66.149836][ T5249] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.157428][ T5249] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.164713][ T5249] bridge_slave_1: entered allmulticast mode [ 66.172626][ T5249] bridge_slave_1: entered promiscuous mode [ 66.241791][ T5249] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.251164][ T5248] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.259552][ T5248] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.267065][ T5248] bridge_slave_0: entered allmulticast mode [ 66.273786][ T5248] bridge_slave_0: entered promiscuous mode [ 66.282738][ T5252] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.295910][ T5252] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.323562][ T5250] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.331659][ T5250] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.342387][ T5250] bridge_slave_0: entered allmulticast mode [ 66.350277][ T5250] bridge_slave_0: entered promiscuous mode [ 66.359714][ T5250] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.367083][ T5250] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.374305][ T5250] bridge_slave_1: entered allmulticast mode [ 66.382428][ T5250] bridge_slave_1: entered promiscuous mode [ 66.390703][ T5249] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.419483][ T5248] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.426890][ T5248] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.434279][ T5248] bridge_slave_1: entered allmulticast mode [ 66.441632][ T5248] bridge_slave_1: entered promiscuous mode [ 66.465554][ T5251] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.472921][ T5251] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.480513][ T5251] bridge_slave_0: entered allmulticast mode [ 66.487438][ T5251] bridge_slave_0: entered promiscuous mode [ 66.509485][ T5249] team0: Port device team_slave_0 added [ 66.529411][ T5252] team0: Port device team_slave_0 added [ 66.535688][ T5251] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.543882][ T5251] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.551470][ T5251] bridge_slave_1: entered allmulticast mode [ 66.559041][ T5251] bridge_slave_1: entered promiscuous mode [ 66.583778][ T5249] team0: Port device team_slave_1 added [ 66.601903][ T5252] team0: Port device team_slave_1 added [ 66.628013][ T5251] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.640945][ T5250] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.676570][ T5248] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 66.695935][ T5251] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.718345][ T5250] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.736957][ T5249] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 66.744024][ T5249] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.770466][ T5249] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 66.784564][ T5248] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 66.796717][ T5252] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 66.803681][ T5252] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.833441][ T5252] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 66.863349][ T5249] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 66.870584][ T5249] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.897687][ T5249] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 66.923587][ T5252] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 66.930938][ T5252] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.957935][ T5252] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 66.971920][ T5251] team0: Port device team_slave_0 added [ 66.980316][ T5251] team0: Port device team_slave_1 added [ 66.988727][ T5250] team0: Port device team_slave_0 added [ 66.998582][ T5250] team0: Port device team_slave_1 added [ 67.028124][ T5248] team0: Port device team_slave_0 added [ 67.071217][ T5248] team0: Port device team_slave_1 added [ 67.088238][ T5250] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 67.095246][ T5250] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 67.122228][ T5250] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 67.137594][ T5249] hsr_slave_0: entered promiscuous mode [ 67.144018][ T5249] hsr_slave_1: entered promiscuous mode [ 67.172012][ T5251] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 67.179277][ T5251] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 67.205633][ T5251] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 67.217148][ T5240] Bluetooth: hci4: command tx timeout [ 67.217153][ T5246] Bluetooth: hci1: command tx timeout [ 67.226411][ T5246] Bluetooth: hci0: command tx timeout [ 67.231520][ T5251] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 67.240877][ T5251] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 67.267056][ T5251] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 67.279137][ T5250] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 67.286565][ T5250] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 67.297332][ T5240] Bluetooth: hci3: command tx timeout [ 67.318177][ T5246] Bluetooth: hci2: command tx timeout [ 67.319284][ T5250] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 67.379058][ T5252] hsr_slave_0: entered promiscuous mode [ 67.387457][ T5252] hsr_slave_1: entered promiscuous mode [ 67.393618][ T5252] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 67.401928][ T5252] Cannot create hsr debugfs directory [ 67.421079][ T5248] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 67.432041][ T5248] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 67.462631][ T5248] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 67.475149][ T5248] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 67.483119][ T5248] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 67.509773][ T5248] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 67.583134][ T5251] hsr_slave_0: entered promiscuous mode [ 67.589531][ T5251] hsr_slave_1: entered promiscuous mode [ 67.597860][ T5251] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 67.605720][ T5251] Cannot create hsr debugfs directory [ 67.629472][ T5250] hsr_slave_0: entered promiscuous mode [ 67.635731][ T5250] hsr_slave_1: entered promiscuous mode [ 67.643096][ T5250] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 67.650873][ T5250] Cannot create hsr debugfs directory [ 67.724321][ T5248] hsr_slave_0: entered promiscuous mode [ 67.730940][ T5248] hsr_slave_1: entered promiscuous mode [ 67.737398][ T5248] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 67.745004][ T5248] Cannot create hsr debugfs directory [ 68.042495][ T5249] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 68.058489][ T5249] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 68.075410][ T5249] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 68.091521][ T5249] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 68.140320][ T5252] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 68.154972][ T5252] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 68.164786][ T5252] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 68.178061][ T5252] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 68.238744][ T5250] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 68.266172][ T5250] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 68.295777][ T5250] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 68.313057][ T5250] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 68.380139][ T5251] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 68.393645][ T5251] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 68.404458][ T5251] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 68.430544][ T5251] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 68.455553][ T5249] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.538153][ T5249] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.554756][ T5248] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 68.564642][ T5248] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 68.582827][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.590210][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.607361][ T5248] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 68.628712][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.635844][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.654815][ T5252] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.671982][ T5248] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 68.717497][ T5252] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.773798][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.781058][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.790298][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.797469][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.843696][ T5250] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.890746][ T5251] 8021q: adding VLAN 0 to HW filter on device bond0 [ 68.952770][ T5251] 8021q: adding VLAN 0 to HW filter on device team0 [ 68.982120][ T5250] 8021q: adding VLAN 0 to HW filter on device team0 [ 69.013215][ T2886] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.020406][ T2886] bridge0: port 1(bridge_slave_0) entered forwarding state [ 69.041991][ T2950] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.049296][ T2950] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.067909][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.075049][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 69.090271][ T5249] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.112206][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.119396][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.143218][ T5252] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.259972][ T5249] veth0_vlan: entered promiscuous mode [ 69.278076][ T5248] 8021q: adding VLAN 0 to HW filter on device bond0 [ 69.297870][ T5240] Bluetooth: hci0: command tx timeout [ 69.297925][ T5246] Bluetooth: hci1: command tx timeout [ 69.308269][ T5240] Bluetooth: hci4: command tx timeout [ 69.339206][ T5248] 8021q: adding VLAN 0 to HW filter on device team0 [ 69.363859][ T2886] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.371037][ T2886] bridge0: port 1(bridge_slave_0) entered forwarding state [ 69.387118][ T5250] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.387730][ T5240] Bluetooth: hci3: command tx timeout [ 69.393991][ T5246] Bluetooth: hci2: command tx timeout [ 69.410152][ T5249] veth1_vlan: entered promiscuous mode [ 69.424171][ T2886] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.431392][ T2886] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.459853][ T5252] veth0_vlan: entered promiscuous mode [ 69.489254][ T5252] veth1_vlan: entered promiscuous mode [ 69.514181][ T5251] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.565724][ T5249] veth0_macvtap: entered promiscuous mode [ 69.604730][ T5249] veth1_macvtap: entered promiscuous mode [ 69.617492][ T5250] veth0_vlan: entered promiscuous mode [ 69.632647][ T5249] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 69.659637][ T5249] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 69.677712][ T5249] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.687373][ T5249] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.698654][ T5249] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.708068][ T5249] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.742142][ T5251] veth0_vlan: entered promiscuous mode [ 69.750781][ T5250] veth1_vlan: entered promiscuous mode [ 69.774952][ T5252] veth0_macvtap: entered promiscuous mode [ 69.794645][ T5251] veth1_vlan: entered promiscuous mode [ 69.822272][ T5252] veth1_macvtap: entered promiscuous mode [ 69.889859][ T5251] veth0_macvtap: entered promiscuous mode [ 69.924981][ T5248] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.933678][ T5251] veth1_macvtap: entered promiscuous mode [ 69.968651][ T5252] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 69.979791][ T5252] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 69.992075][ T5252] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.002126][ T5250] veth0_macvtap: entered promiscuous mode [ 70.032244][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.034143][ T5250] veth1_macvtap: entered promiscuous mode [ 70.041756][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.074506][ T5252] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 70.091568][ T5252] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.103796][ T5252] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.114032][ T5251] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 70.129427][ T5251] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.140095][ T5251] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 70.150922][ T5251] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.163616][ T5251] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.203249][ T5251] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 70.214191][ T5251] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.226836][ T5251] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 70.237827][ T5251] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.249617][ T5251] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.263942][ T5252] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.273367][ T5252] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.283940][ T5252] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.292737][ T5252] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.318619][ T5250] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 70.329343][ T5250] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.341854][ T5250] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 70.352424][ T5250] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.362490][ T5250] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 70.373009][ T5250] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.384243][ T5250] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.394082][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.411080][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.417208][ T5251] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.428413][ T5251] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.438494][ T5251] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.447623][ T5251] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.477982][ T5250] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 70.490831][ T5250] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.504263][ T5250] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 70.516264][ T5250] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.526555][ T5250] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 70.537439][ T5250] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.549170][ T5250] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.585491][ T5249] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 70.604421][ T5250] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.614088][ T5250] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.623453][ T5250] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.632312][ T5250] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.644288][ T5248] veth0_vlan: entered promiscuous mode [ 70.678944][ T5248] veth1_vlan: entered promiscuous mode [ 70.746461][ T53] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.754516][ T53] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.840982][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.853041][ T5248] veth0_macvtap: entered promiscuous mode [ 70.856243][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.862924][ T5248] veth1_macvtap: entered promiscuous mode [ 70.884811][ T5248] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 70.895467][ T5248] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.906441][ T5248] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 70.917277][ T5248] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.927670][ T5248] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 70.938364][ T5248] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.948546][ T5248] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 70.959883][ T5248] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.972020][ T5248] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.015475][ T5289] netlink: 210620 bytes leftover after parsing attributes in process `syz.4.5'. [ 71.026872][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.034730][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.048207][ T5289] openvswitch: netlink: ufid size 2296 bytes exceeds the range (1, 16) [ 71.049768][ T5248] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 71.068275][ T5248] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.078626][ T5248] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 71.089468][ T5248] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.099645][ T5248] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 71.110248][ T5248] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.120438][ T5248] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 71.131539][ T5248] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.143254][ T5248] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.154209][ T5248] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.163125][ T5248] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.171974][ T5248] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.180828][ T5248] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.300150][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.345656][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.346592][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.353969][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.377154][ T5246] Bluetooth: hci1: command tx timeout [ 71.382738][ T5246] Bluetooth: hci4: command tx timeout [ 71.384299][ T5240] Bluetooth: hci0: command tx timeout [ 71.405811][ T5297] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1'. [ 71.434055][ T5297] vlan2: entered promiscuous mode [ 71.443552][ T5297] vlan2: entered allmulticast mode [ 71.458137][ T5286] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 71.466205][ T5240] Bluetooth: hci2: command tx timeout [ 71.471780][ T5246] Bluetooth: hci3: command tx timeout [ 71.535881][ T2886] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.549026][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.554718][ T2886] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.565260][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.626456][ T5286] usb 5-1: device descriptor read/64, error -71 [ 71.674935][ T1265] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.684500][ T1265] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.814088][ T5299] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.3'. [ 71.866457][ T5286] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 71.880808][ T5299] openvswitch: netlink: ufid size 3064 bytes exceeds the range (1, 16) [ 71.933933][ T5299] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 71.944972][ T2925] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.973770][ T5310] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 71.995479][ T2925] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.048358][ T5312] syz.3.4 uses obsolete (PF_INET,SOCK_PACKET) [ 72.066762][ T5286] usb 5-1: device descriptor read/64, error -71 [ 72.179595][ T5286] usb usb5-port1: attempt power cycle [ 72.186424][ T5295] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 72.353934][ T5295] usb 1-1: Using ep0 maxpacket: 8 [ 72.371032][ T5295] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 72.406860][ T5295] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 72.436656][ T5295] usb 1-1: New USB device found, idVendor=0e8f, idProduct=0012, bcdDevice= 0.00 [ 72.454829][ T5295] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 72.472885][ T5295] usb 1-1: config 0 descriptor?? [ 72.556159][ T5286] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 72.598921][ T5286] usb 5-1: device descriptor read/8, error -71 [ 72.619209][ T5324] binder: 5323:5324 ioctl c0306201 20000240 returned -22 [ 72.706438][ T5284] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 72.752710][ T5326] binder: 5323:5326 ioctl c018aa06 20000140 returned -22 [ 72.797148][ T5287] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 72.856240][ T5286] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 72.871773][ T5284] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA4, changing to 0x84 [ 72.883985][ T5284] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 72.890076][ T5286] usb 5-1: device descriptor read/8, error -71 [ 72.908534][ T5284] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 0 [ 72.919428][ T5284] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 72.933178][ T5284] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 72.961667][ T5284] usb 4-1: New USB device found, idVendor=1bc7, idProduct=1040, bcdDevice=b5.b1 [ 72.975417][ T5284] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 72.976110][ T5287] usb 3-1: Using ep0 maxpacket: 16 [ 72.995052][ T5287] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 73.001768][ T5284] usb 4-1: Product: syz [ 73.006448][ T5287] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 73.021786][ T5286] usb usb5-port1: unable to enumerate USB device [ 73.024686][ T5284] usb 4-1: Manufacturer: syz [ 73.029409][ T5287] usb 3-1: New USB device found, idVendor=05ac, idProduct=8241, bcdDevice= 0.00 [ 73.043003][ T5287] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 73.045627][ T5284] usb 4-1: SerialNumber: syz [ 73.061882][ T5287] usb 3-1: config 0 descriptor?? [ 73.088399][ T5284] usb 4-1: config 0 descriptor?? [ 73.105101][ T5284] option 4-1:0.0: GSM modem (1-port) converter detected [ 73.323970][ T5322] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 73.334394][ T5322] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 73.456322][ T5246] Bluetooth: hci4: command tx timeout [ 73.457005][ T5240] Bluetooth: hci1: command tx timeout [ 73.468170][ T5246] Bluetooth: hci0: command tx timeout [ 73.536566][ T5240] Bluetooth: hci2: command tx timeout [ 73.538340][ T5246] Bluetooth: hci3: command tx timeout [ 73.544401][ T5287] input: HID 05ac:8241 as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:05AC:8241.0001/input/input5 [ 73.647072][ T5295] usbhid 1-1:0.0: can't add hid device: -71 [ 73.660424][ T5295] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 73.664140][ T5287] appleir 0003:05AC:8241.0001: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 05ac:8241] on usb-dummy_hcd.2-1/input0 [ 73.691787][ T5295] usb 1-1: USB disconnect, device number 2 [ 73.846204][ T8] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 73.904906][ T5236] usb 4-1: USB disconnect, device number 2 [ 73.920314][ T5236] option 4-1:0.0: device disconnected [ 74.009579][ T8] usb 2-1: config 17 has an invalid descriptor of length 255, skipping remainder of the config [ 74.026336][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 74.034680][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 74.043301][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 74.052001][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 74.060527][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 74.069026][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 74.130756][ T8] usb 2-1: config 17 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 74.152676][ T8] usb 2-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 74.164643][ T8] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 74.336842][ T0] NOHZ tick-stop error: local softirq work is pending, handler #308!!! [ 74.456373][ T0] NOHZ tick-stop error: local softirq work is pending, handler #300!!! [ 74.492127][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 74.550520][ T5333] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.12'. [ 74.579714][ T5333] openvswitch: netlink: Tunnel attr 0 has unexpected len 2 expected 8 [ 74.696313][ T0] NOHZ tick-stop error: local softirq work is pending, handler #342!!! [ 74.796778][ T5330] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 74.866359][ T5236] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 74.936234][ T5330] usb 5-1: device descriptor read/64, error -71 [ 75.036132][ T5236] usb 4-1: Using ep0 maxpacket: 16 [ 75.066312][ T5236] usb 4-1: config 0 has no interfaces? [ 75.092987][ T5236] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 75.177549][ T5236] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 75.186438][ T5330] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 75.205775][ T5236] usb 4-1: Product: syz [ 75.226792][ T5236] usb 4-1: Manufacturer: syz [ 75.234958][ T5236] usb 4-1: SerialNumber: syz [ 75.286801][ T5236] usb 4-1: config 0 descriptor?? [ 75.336335][ T5330] usb 5-1: device descriptor read/64, error -71 [ 75.447344][ T5330] usb usb5-port1: attempt power cycle [ 75.559597][ T5362] netlink: 28 bytes leftover after parsing attributes in process `syz.0.19'. [ 75.623149][ T5295] usb 4-1: USB disconnect, device number 3 [ 75.824275][ T5330] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 75.867063][ T5330] usb 5-1: device descriptor read/8, error -71 [ 76.144619][ T148] usb 3-1: reset high-speed USB device number 2 using dummy_hcd [ 76.636239][ T5330] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 76.721305][ T5330] usb 5-1: device descriptor read/8, error -71 [ 76.831265][ T29] audit: type=1326 audit(1729285775.733:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5366 comm="syz.0.21" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f8f74f7dff9 code=0x0 [ 76.882007][ T5330] usb usb5-port1: unable to enumerate USB device [ 77.176282][ T5330] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 77.352776][ T5330] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 77.371503][ T5330] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 77.385193][ T5330] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 77.404975][ T5330] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 77.415821][ T5236] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 77.432456][ T5330] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 77.463553][ T5330] usb 1-1: config 0 descriptor?? [ 77.600721][ T5236] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 77.656503][ T5236] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 77.836094][ T5236] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 77.889352][ T5236] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 77.927303][ T5236] usb 4-1: config 0 descriptor?? [ 77.969314][ T5330] plantronics 0003:047F:FFFF.0002: ignoring exceeding usage max [ 77.998614][ T5330] plantronics 0003:047F:FFFF.0002: usage index exceeded [ 78.014788][ T5330] plantronics 0003:047F:FFFF.0002: item 0 1 2 0 parsing failed [ 78.024498][ T5330] plantronics 0003:047F:FFFF.0002: parse failed [ 78.040723][ T5330] plantronics 0003:047F:FFFF.0002: probe with driver plantronics failed with error -22 [ 78.216107][ T5295] usb 5-1: new full-speed USB device number 10 using dummy_hcd [ 78.790970][ T5236] plantronics 0003:047F:FFFF.0003: No inputs registered, leaving [ 79.166105][ T5295] usb 5-1: device descriptor read/64, error -71 [ 79.233156][ T5236] plantronics 0003:047F:FFFF.0003: hiddev1,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 80.469775][ T8] usb 2-1: string descriptor 0 read error: -71 [ 80.605649][ T8] aiptek 2-1:17.0: interface has no int in endpoints, but must have minimum 1 [ 80.754336][ T5236] usb 4-1: USB disconnect, device number 4 [ 80.776725][ T5295] usb 5-1: new full-speed USB device number 11 using dummy_hcd [ 80.971685][ T5295] usb 5-1: device descriptor read/64, error -71 [ 81.071068][ T5330] usb 1-1: USB disconnect, device number 3 [ 81.139340][ T5295] usb usb5-port1: attempt power cycle [ 81.426298][ T5236] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 81.596469][ T5236] usb 4-1: device descriptor read/64, error -71 [ 81.616187][ T5330] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 81.788209][ T5330] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 81.820634][ T5330] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF9, changing to 0x89 [ 81.842813][ T5236] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 81.881165][ T25] cfg80211: failed to load regulatory.db [ 81.915730][ T5330] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x89 has an invalid bInterval 0, changing to 10 [ 81.974927][ T5330] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid maxpacket 65535, setting to 64 [ 82.005256][ T5330] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 10 [ 82.026983][ T5236] usb 4-1: device descriptor read/64, error -71 [ 82.048597][ T5330] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 82.084978][ T5330] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 82.135235][ T5330] usb 1-1: New USB device found, idVendor=0bc7, idProduct=0008, bcdDevice=4f.c8 [ 82.148220][ T5236] usb usb4-port1: attempt power cycle [ 82.157593][ T5330] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 82.190786][ T5330] usb 1-1: Product: syz [ 82.203693][ T5330] usb 1-1: Manufacturer: syz [ 82.216151][ T5295] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 82.231626][ T5330] usb 1-1: SerialNumber: syz [ 82.257331][ T5295] usb 5-1: Using ep0 maxpacket: 16 [ 82.270096][ T5295] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 82.305389][ T5330] usb 1-1: config 0 descriptor?? [ 82.314495][ T5386] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 82.330549][ T5295] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 82.362601][ T5330] ati_remote 1-1:0.0: Initializing ati_remote hardware failed. [ 82.381927][ T5295] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 82.418334][ T5330] ati_remote 1-1:0.0: probe with driver ati_remote failed with error -5 [ 82.460646][ T5295] usb 5-1: New USB device found, idVendor=0458, idProduct=0087, bcdDevice= 0.00 [ 82.505904][ T5295] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 82.527995][ T5236] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 82.611505][ T5295] usb 5-1: config 0 descriptor?? [ 82.621018][ T5236] usb 4-1: device descriptor read/8, error -71 [ 82.676425][ T5284] usb 1-1: USB disconnect, device number 4 [ 83.122770][ T5236] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 83.591988][ T5236] usb 4-1: device descriptor read/8, error -71 [ 83.645207][ T5393] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 83.671286][ T5240] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 83.680946][ T5240] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 83.689804][ T5240] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 83.716351][ T5236] usb usb4-port1: unable to enumerate USB device [ 83.734354][ T5240] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 83.742321][ T5393] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 83.835602][ T5240] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 83.843293][ T5240] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 83.866112][ T5236] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 83.991277][ T5393] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 84.060747][ T5393] vlan2: entered promiscuous mode [ 84.069798][ T5393] dummy0: entered promiscuous mode [ 84.099620][ T5236] usb 1-1: Using ep0 maxpacket: 8 [ 84.134999][ T5236] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 84.178522][ T5236] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF9, changing to 0x89 [ 84.204891][ T5393] team0: Port device vlan2 added [ 84.234782][ T5236] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x89 has an invalid bInterval 0, changing to 7 [ 84.368681][ T5236] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid maxpacket 59391, setting to 1024 [ 84.422824][ T5236] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 84.481452][ T5236] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0 [ 84.510841][ T5236] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 84.572234][ T5295] usbhid 5-1:0.0: can't add hid device: -71 [ 84.593028][ T5295] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 84.627976][ T5236] usb 1-1: string descriptor 0 read error: -71 [ 84.634979][ T5236] usb 1-1: New USB device found, idVendor=0bc7, idProduct=0008, bcdDevice=4f.c8 [ 84.644734][ T5236] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 84.662190][ T5295] usb 5-1: USB disconnect, device number 12 [ 84.680510][ T5236] usb 1-1: config 0 descriptor?? [ 84.701666][ T5236] usb 1-1: can't set config #0, error -71 [ 84.931092][ T5236] usb 1-1: USB disconnect, device number 5 [ 85.356628][ T5413] netlink: 36 bytes leftover after parsing attributes in process `syz.3.34'. [ 85.374885][ T5413] netlink: 16 bytes leftover after parsing attributes in process `syz.3.34'. [ 85.401649][ T5413] netlink: 36 bytes leftover after parsing attributes in process `syz.3.34'. [ 85.422469][ T5413] netlink: 36 bytes leftover after parsing attributes in process `syz.3.34'. [ 85.456375][ T5236] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 85.596155][ T5236] usb 1-1: device descriptor read/64, error -71 [ 85.650065][ T5418] netlink: 12 bytes leftover after parsing attributes in process `syz.3.36'. [ 85.664297][ T5418] netlink: 20 bytes leftover after parsing attributes in process `syz.3.36'. [ 85.750251][ T5419] ptm ptm1: ldisc open failed (-12), clearing slot 1 [ 85.846165][ T5236] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 85.938839][ T5240] Bluetooth: hci5: command tx timeout [ 86.006235][ T5236] usb 1-1: device descriptor read/64, error -71 [ 86.142401][ T5236] usb usb1-port1: attempt power cycle [ 86.486407][ T5236] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 86.546092][ T5236] usb 1-1: device descriptor read/8, error -71 [ 86.796156][ T5236] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 86.833251][ T5236] usb 1-1: device descriptor read/8, error -71 [ 86.936162][ T5330] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 86.955564][ T5236] usb usb1-port1: unable to enumerate USB device [ 87.118546][ T5330] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 87.135802][ T5330] usb 5-1: config 0 has no interfaces? [ 87.154607][ T5330] usb 5-1: New USB device found, idVendor=0bfd, idProduct=0115, bcdDevice=cb.61 [ 87.173930][ T5330] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 87.182641][ T5330] usb 5-1: Product: syz [ 87.195042][ T5330] usb 5-1: Manufacturer: syz [ 87.200190][ T5330] usb 5-1: SerialNumber: syz [ 87.214371][ T5330] usb 5-1: config 0 descriptor?? [ 93.296276][ T5240] Bluetooth: hci5: command tx timeout [ 99.045968][ C0] sched: DL replenish lagged too much [ 99.080309][ T5240] Bluetooth: hci5: command tx timeout [ 100.203456][ T8] usb 2-1: USB disconnect, device number 2 [ 100.704677][ T5330] usb 5-1: USB disconnect, device number 13 [ 101.148597][ T5240] Bluetooth: hci5: command tx timeout [ 102.295238][ T5246] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 102.304162][ T5246] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 102.313166][ T5246] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 102.367668][ T5246] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 102.379585][ T5246] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 102.387726][ T5246] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 102.938017][ T5240] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 102.949793][ T5240] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 102.961761][ T5240] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 102.970441][ T5240] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 102.981386][ T5240] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 102.989230][ T5240] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 104.496466][ T5246] Bluetooth: hci0: command tx timeout [ 105.056415][ T5246] Bluetooth: hci4: command tx timeout [ 106.111461][ T5240] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 106.123109][ T5240] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 106.136517][ T5240] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 106.156287][ T5240] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 106.164105][ T5240] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 106.171892][ T5240] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 106.202661][ T5240] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 106.212749][ T5240] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 106.222484][ T5240] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 106.233455][ T5240] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 106.246791][ T5240] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 106.255254][ T5240] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 106.576292][ T5240] Bluetooth: hci0: command tx timeout [ 107.142504][ T5240] Bluetooth: hci4: command tx timeout [ 108.256310][ T5240] Bluetooth: hci6: command tx timeout [ 108.336410][ T5240] Bluetooth: hci2: command tx timeout [ 108.657039][ T5240] Bluetooth: hci0: command tx timeout [ 109.216234][ T5240] Bluetooth: hci4: command tx timeout [ 110.337343][ T5240] Bluetooth: hci6: command tx timeout [ 110.416478][ T5240] Bluetooth: hci2: command tx timeout [ 110.736297][ T5240] Bluetooth: hci0: command tx timeout [ 111.302197][ T5240] Bluetooth: hci4: command tx timeout [ 112.422051][ T5240] Bluetooth: hci6: command tx timeout [ 112.496192][ T5240] Bluetooth: hci2: command tx timeout [ 113.993508][ T5249] syz-executor (5249) used greatest stack depth: 18800 bytes left [ 114.496187][ T5240] Bluetooth: hci6: command tx timeout [ 114.576184][ T5240] Bluetooth: hci2: command tx timeout [ 133.081244][ T1265] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.089545][ T1265] ieee802154 phy1 wpan1: encryption failed: -22 [ 144.615214][ T5246] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 144.624485][ T5246] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 144.636085][ T5246] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 144.645893][ T5246] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 144.664444][ T5246] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 144.676316][ T5246] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 146.736326][ T5246] Bluetooth: hci1: command tx timeout [ 148.816377][ T5246] Bluetooth: hci1: command tx timeout [ 150.896519][ T5246] Bluetooth: hci1: command tx timeout [ 152.982111][ T5246] Bluetooth: hci1: command tx timeout [ 163.644624][ T5243] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 163.657253][ T55] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 163.669050][ T5243] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 163.690733][ T5243] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 163.705172][ T5243] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 163.716615][ T5243] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 163.742520][ T5243] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 163.766733][ T5243] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 163.774546][ T5243] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 163.783510][ T5243] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 163.855837][ T5243] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 163.866916][ T5243] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 163.971377][ T5240] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 163.980989][ T5240] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 163.991291][ T5240] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 164.000054][ T5240] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 164.024083][ T5240] Bluetooth: hci8: unexpected cc 0x0c25 length: 249 > 3 [ 164.036464][ T5240] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 164.158935][ T5243] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 164.173479][ T5243] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 164.184838][ T5243] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 164.194410][ T5243] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 164.206908][ T5243] Bluetooth: hci9: unexpected cc 0x0c25 length: 249 > 3 [ 164.215591][ T5243] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 165.856387][ T5240] Bluetooth: hci3: command tx timeout [ 165.936267][ T5240] Bluetooth: hci7: command tx timeout [ 166.096599][ T5240] Bluetooth: hci8: command tx timeout [ 166.256386][ T5240] Bluetooth: hci9: command tx timeout [ 167.940988][ T5240] Bluetooth: hci3: command tx timeout [ 168.016287][ T5240] Bluetooth: hci7: command tx timeout [ 168.176295][ T5240] Bluetooth: hci8: command tx timeout [ 168.336312][ T5240] Bluetooth: hci9: command tx timeout [ 170.016251][ T5240] Bluetooth: hci3: command tx timeout [ 170.096268][ T5240] Bluetooth: hci7: command tx timeout [ 170.256111][ T5240] Bluetooth: hci8: command tx timeout [ 170.416175][ T5240] Bluetooth: hci9: command tx timeout [ 172.096661][ T5240] Bluetooth: hci3: command tx timeout [ 172.176201][ T5240] Bluetooth: hci7: command tx timeout [ 172.336122][ T5240] Bluetooth: hci8: command tx timeout [ 172.463927][ T2886] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 172.496372][ T5240] Bluetooth: hci9: command tx timeout [ 172.933587][ T2886] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 173.632859][ T2886] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 194.505473][ T1265] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.512115][ T1265] ieee802154 phy1 wpan1: encryption failed: -22 [ 205.727006][ T5243] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 205.741153][ T5243] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 205.749881][ T5243] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 205.760937][ T5243] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 205.769722][ T5243] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 205.777500][ T5243] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 207.859639][ T5243] Bluetooth: hci0: command tx timeout [ 209.936148][ T5243] Bluetooth: hci0: command tx timeout [ 212.026224][ T5243] Bluetooth: hci0: command tx timeout [ 214.096248][ T5243] Bluetooth: hci0: command tx timeout [ 221.934553][ T2886] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 223.956103][ T30] INFO: task kworker/0:6:5287 blocked for more than 143 seconds. [ 223.964143][ T30] Not tainted 6.12.0-rc3-syzkaller-00217-g4d939780b705 #0 [ 223.972967][ T5240] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 223.982424][ T5240] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 223.990900][ T5240] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 224.000538][ T5240] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 224.012403][ T5240] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 224.020091][ T5240] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 224.236091][ T30] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 224.244853][ T30] task:kworker/0:6 state:D stack:19544 pid:5287 tgid:5287 ppid:2 flags:0x00004000 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 224.536191][ T30] Workqueue: usb_hub_wq hub_event [ 224.541373][ T30] Call Trace: [ 224.544732][ T30] [ 224.555995][ T30] __schedule+0x1895/0x4b30 [ 224.560612][ T30] ? mark_lock+0x9a/0x360 [ 224.565032][ T30] ? __pfx___schedule+0x10/0x10 [ 224.604343][ T30] ? __pfx_lock_release+0x10/0x10 [ 224.641844][ T30] ? schedule+0x90/0x320 [ 224.664131][ T30] schedule+0x14b/0x320 [ 224.681853][ T30] schedule_preempt_disabled+0x13/0x30 [ 224.706065][ T30] __mutex_lock+0x6a7/0xd70 [ 224.710675][ T30] ? __mutex_lock+0x52a/0xd70 [ 224.761752][ T30] ? hub_event+0x7d5/0x5150 [ 224.776143][ T30] ? __pfx___mutex_lock+0x10/0x10 [ 224.781277][ T30] ? _raw_spin_unlock_irq+0x23/0x50 [ 224.815759][ T30] ? lockdep_hardirqs_on+0x99/0x150 [ 224.855174][ T30] ? pm_runtime_barrier+0x152/0x1d0 [ 224.881691][ T30] hub_event+0x7d5/0x5150 [ 224.911697][ T30] ? __pfx_register_lock_class+0x10/0x10 [ 224.931862][ T30] ? debug_object_deactivate+0x2d5/0x390 [ 224.981975][ T30] ? __pfx_hub_event+0x10/0x10 [ 224.992350][ T30] ? __pfx_lock_acquire+0x10/0x10 [ 225.006131][ T30] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 225.012413][ T30] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 225.054056][ T30] ? process_scheduled_works+0x976/0x1850 [ 225.062771][ T30] process_scheduled_works+0xa63/0x1850 [ 225.091841][ T30] ? __pfx_process_scheduled_works+0x10/0x10 [ 225.112310][ T30] ? assign_work+0x364/0x3d0 [ 225.119079][ T30] worker_thread+0x870/0xd30 [ 225.145323][ T30] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 225.157729][ T30] ? __kthread_parkme+0x169/0x1d0 [ 225.162880][ T30] ? __pfx_worker_thread+0x10/0x10 [ 225.196206][ T30] kthread+0x2f0/0x390 [ 225.200375][ T30] ? __pfx_worker_thread+0x10/0x10 [ 225.205548][ T30] ? __pfx_kthread+0x10/0x10 [ 225.249969][ T55] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 225.259577][ T55] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 225.268343][ T55] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 225.285670][ T30] ret_from_fork+0x4b/0x80 [ 225.290379][ T30] ? __pfx_kthread+0x10/0x10 [ 225.295034][ T30] ret_from_fork_asm+0x1a/0x30 [ 225.309186][ T30] [ 225.351038][ T55] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 225.359030][ T55] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 225.366565][ T55] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 225.459071][ T30] [ 225.459071][ T30] Showing all locks held in the system: [ 225.467025][ T30] 3 locks held by kworker/0:0/8: [ 225.472010][ T30] 2 locks held by kworker/u8:1/12: [ 225.477351][ T30] 4 locks held by ksoftirqd/0/16: [ 225.482428][ T30] 1 lock held by khungtaskd/30: [ 225.487387][ T30] #0: ffffffff8e937de0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x2a0 [ 225.497395][ T30] 3 locks held by kworker/1:1/47: [ 225.502545][ T30] #0: ffff88801ac80948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 [ 225.513801][ T30] #1: ffffc90000b77d00 ((fqdir_free_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 [ 225.525295][ T30] #2: ffffffff8e93d240 (rcu_state.barrier_mutex){+.+.}-{3:3}, at: rcu_barrier+0x4c/0x530 [ 225.726177][ T30] 4 locks held by kworker/0:2/148: [ 225.731400][ T30] 3 locks held by kworker/u8:5/947: [ 225.745560][ T30] #0: ffff88801ac89148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 [ 225.776261][ T30] #1: ffffc90003be7d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 [ 225.821924][ T30] #2: ffffffff8fcd2d08 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xe/0x60 [ 225.833899][ T30] 6 locks held by kworker/u8:7/2886: [ 225.854925][ T30] #0: ffff88801baed948 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 [ 225.875623][ T30] #1: ffffc900099f7d00 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 [ 225.896333][ T30] #2: ffffffff8fcc6210 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x16a/0xcc0 [ 225.911187][ T30] #3: ffff8880279700e8 (&dev->mutex){....}-{3:3}, at: devlink_pernet_pre_exit+0x13b/0x440 [ 225.923542][ T30] #4: ffff888027971250 (&devlink->lock_key#4){+.+.}-{3:3}, at: devlink_pernet_pre_exit+0x14d/0x440 [ 225.942721][ T30] #5: ffffffff8fcd2d08 (rtnl_mutex){+.+.}-{3:3}, at: unregister_nexthop_notifier+0x17/0x40 [ 225.953447][ T30] 2 locks held by getty/4990: [ 225.965079][ T30] #0: ffff88802eaec0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 225.977195][ T30] #1: ffffc90002f062f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6a6/0x1e00 [ 225.994279][ T30] 2 locks held by kworker/1:3/5236: [ 226.004563][ T30] #0: ffff88801ac80948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 [ 226.024179][ T30] #1: ffffc90002dcfd00 (free_ipc_work){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 [ 226.035094][ T30] 3 locks held by kworker/u9:4/5240: [ 226.048372][ T30] #0: ffff888034acb948 ((wq_completion)hci5){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 [ 226.063966][ T30] #1: ffffc90003cc7d00 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 [ 226.083382][ T30] #2: ffff888034ee8d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_power_on+0x1bf/0x6b0 [ 226.093657][ T30] 3 locks held by kworker/u9:5/5243: [ 226.105630][ T55] Bluetooth: hci3: command tx timeout [ 226.115168][ T30] #0: ffff88804b727948 ((wq_completion)hci4){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 [ 226.128742][ T30] #1: ffffc90003ce7d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 [ 226.141770][ T30] #2: ffff888023c3cd80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1ec/0x400 [ 226.153145][ T30] 4 locks held by kworker/0:6/5287: [ 226.158755][ T30] #0: ffff8880216f5948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 [ 226.170619][ T30] #1: ffffc90003f77d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 [ 226.186047][ T30] #2: ffff888028771190 (&dev->mutex){....}-{3:3}, at: hub_event+0x1fe/0x5150 [ 226.195062][ T30] #3: ffff888028774510 (&port_dev->status_lock){+.+.}-{3:3}, at: hub_event+0x7d5/0x5150 [ 226.205667][ T30] 2 locks held by syz-executor/5440: [ 226.211470][ T30] #0: ffffffff8fcc6210 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x328/0x570 [ 226.221572][ T30] #1: ffffffff8fcd2d08 (rtnl_mutex){+.+.}-{3:3}, at: caif_exit_net+0x6f/0x4a0 [ 226.244739][ T30] 2 locks held by syz-executor/5448: [ 226.253216][ T30] #0: ffffffff8fcc6210 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x328/0x570 [ 226.269872][ T30] #1: ffffffff8fcd2d08 (rtnl_mutex){+.+.}-{3:3}, at: cangw_pernet_exit_batch+0x20/0x90 [ 226.283351][ T30] 2 locks held by syz-executor/5457: [ 226.293717][ T30] #0: ffff88806095cd80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x203/0x510 [ 226.305552][ T30] #1: ffff88806095c078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x572/0x11a0 [ 226.320602][ T30] 2 locks held by syz-executor/5466: [ 226.327670][ T30] #0: ffffffff8fcd2d08 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3b/0x1b0 [ 226.337100][ T5240] Bluetooth: hci5: Opcode 0x0c03 failed: -110 [ 226.384859][ T30] #1: ffffffff8e93d378 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x451/0x830 [ 226.398493][ T30] 1 lock held by syz-executor/5467: [ 226.403846][ T30] #0: ffffffff8e93d378 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x451/0x830 [ 226.422204][ T30] 3 locks held by syz-executor/5469: [ 226.433963][ T30] #0: ffff88801c774d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x203/0x510 [ 226.452129][ T30] #1: ffff88801c774078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x572/0x11a0 [ 226.474366][ T30] #2: ffffffff8fe3f628 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xa6/0x240 [ 226.487739][ T30] 1 lock held by syz-executor/5471: [ 226.493194][ T30] #0: ffffffff8fcd2d08 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e6/0xcf0 [ 226.511402][ T30] 1 lock held by syz-executor/5483: [ 226.517152][ T30] #0: ffffffff8fcd2d08 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e6/0xcf0 [ 226.533091][ T30] 2 locks held by syz-executor/5494: [ 226.538929][ T30] #0: ffffffff8fcc6210 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x328/0x570 [ 226.558661][ T30] #1: ffffffff8fcd2d08 (rtnl_mutex){+.+.}-{3:3}, at: register_nexthop_notifier+0x84/0x290 [ 226.575106][ T30] 2 locks held by syz-executor/5497: [ 226.593853][ T30] #0: ffffffff8fcc6210 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x328/0x570 [ 226.605171][ T30] #1: ffffffff8fcd2d08 (rtnl_mutex){+.+.}-{3:3}, at: register_nexthop_notifier+0x84/0x290 [ 226.625525][ T30] [ 226.653311][ T30] ============================================= [ 226.653311][ T30] [ 226.689364][ T30] NMI backtrace for cpu 1 [ 226.693794][ T30] CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.12.0-rc3-syzkaller-00217-g4d939780b705 #0 [ 226.704359][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 226.714461][ T30] Call Trace: [ 226.717807][ T30] [ 226.720797][ T30] dump_stack_lvl+0x241/0x360 [ 226.725537][ T30] ? __pfx_dump_stack_lvl+0x10/0x10 [ 226.730785][ T30] ? __pfx__printk+0x10/0x10 [ 226.735438][ T30] nmi_cpu_backtrace+0x49c/0x4d0 [ 226.740435][ T30] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 226.745939][ T30] ? _printk+0xd5/0x120 [ 226.750144][ T30] ? __pfx__printk+0x10/0x10 [ 226.754818][ T30] ? __wake_up_klogd+0xcc/0x110 [ 226.759730][ T30] ? __pfx__printk+0x10/0x10 [ 226.764370][ T30] ? __rcu_read_unlock+0xa1/0x110 [ 226.769447][ T30] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 226.775481][ T30] nmi_trigger_cpumask_backtrace+0x198/0x320 [ 226.781525][ T30] watchdog+0xff4/0x1040 [ 226.785828][ T30] ? watchdog+0x1ea/0x1040 [ 226.790307][ T30] ? __pfx_watchdog+0x10/0x10 [ 226.795035][ T30] kthread+0x2f0/0x390 [ 226.799153][ T30] ? __pfx_watchdog+0x10/0x10 [ 226.803880][ T30] ? __pfx_kthread+0x10/0x10 [ 226.808520][ T30] ret_from_fork+0x4b/0x80 [ 226.812993][ T30] ? __pfx_kthread+0x10/0x10 [ 226.817630][ T30] ret_from_fork_asm+0x1a/0x30 [ 226.822462][ T30] [ 226.826557][ T30] Sending NMI from CPU 1 to CPUs 0: [ 226.831850][ C0] NMI backtrace for cpu 0 [ 226.831866][ C0] CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.12.0-rc3-syzkaller-00217-g4d939780b705 #0 [ 226.831887][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 226.831900][ C0] RIP: 0010:preempt_count_sub+0x6/0x170 [ 226.831931][ C0] Code: c7 c7 00 32 1d 90 e8 b9 5f 9b 00 e9 66 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 56 <53> 89 fb 48 c7 c0 40 09 3d 9a 48 c1 e8 03 49 be 00 00 00 00 00 fc [ 226.831949][ C0] RSP: 0018:ffffc90000157310 EFLAGS: 00000006 [ 226.831967][ C0] RAX: 0000000080000101 RBX: 1ffff9200002ae68 RCX: ffffffff819caf9c [ 226.831980][ C0] RDX: 0000000000000000 RSI: ffffffff8c610180 RDI: 0000000000000001 [ 226.831992][ C0] RBP: ffffc900001573d0 R08: ffffffff901cffaf R09: 1ffffffff2039ff5 [ 226.832006][ C0] R10: dffffc0000000000 R11: fffffbfff2039ff6 R12: dffffc0000000000 [ 226.832020][ C0] R13: 1ffff9200002ae6c R14: ffffc90000157360 R15: 0000000000000200 [ 226.832033][ C0] FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 [ 226.832048][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 226.832060][ C0] CR2: 0000001b32c0dff8 CR3: 000000000e734000 CR4: 00000000003526f0 [ 226.832076][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 226.832086][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 226.832097][ C0] Call Trace: [ 226.832103][ C0] [ 226.832111][ C0] ? nmi_cpu_backtrace+0x3c2/0x4d0 [ 226.832135][ C0] ? __pfx_lock_acquire+0x10/0x10 [ 226.832164][ C0] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 226.832186][ C0] ? nmi_handle+0x2a/0x5a0 [ 226.832212][ C0] ? nmi_cpu_backtrace_handler+0xc/0x20 [ 226.832237][ C0] ? nmi_handle+0x14f/0x5a0 [ 226.832255][ C0] ? nmi_handle+0x2a/0x5a0 [ 226.832274][ C0] ? preempt_count_sub+0x6/0x170 [ 226.832296][ C0] ? default_do_nmi+0x63/0x160 [ 226.832319][ C0] ? exc_nmi+0x123/0x1f0 [ 226.832349][ C0] ? end_repeat_nmi+0xf/0x53 [ 226.832371][ C0] ? trace_irq_disable+0x2c/0x120 [ 226.832395][ C0] ? preempt_count_sub+0x6/0x170 [ 226.832417][ C0] ? preempt_count_sub+0x6/0x170 [ 226.832441][ C0] ? preempt_count_sub+0x6/0x170 [ 226.832463][ C0] [ 226.832469][ C0] [ 226.832475][ C0] __local_bh_enable_ip+0x163/0x200 [ 226.832500][ C0] ? __pfx___local_bh_disable_ip+0x10/0x10 [ 226.832522][ C0] ? ipt_do_table+0x312/0x1860 [ 226.832539][ C0] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 226.832574][ C0] ipt_do_table+0x1552/0x1860 [ 226.832603][ C0] ? ipt_do_table+0x312/0x1860 [ 226.832620][ C0] ? __pfx_ipt_do_table+0x10/0x10 [ 226.832639][ C0] ? ipv4_conntrack_defrag+0x2a2/0x5a0 [ 226.832662][ C0] ? ip_sabotage_in+0x55/0x290 [ 226.832684][ C0] ? __pfx_ipt_do_table+0x10/0x10 [ 226.832699][ C0] nf_hook_slow+0xc3/0x220 [ 226.832724][ C0] ? __pfx_ip_rcv_finish+0x10/0x10 [ 226.832745][ C0] ? __pfx_ip_rcv_finish+0x10/0x10 [ 226.832766][ C0] NF_HOOK+0x29e/0x450 [ 226.832785][ C0] ? __lock_acquire+0x1384/0x2050 [ 226.832813][ C0] ? NF_HOOK+0x9a/0x450 [ 226.832834][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 226.832853][ C0] ? ip_rcv_core+0x801/0xd10 [ 226.832875][ C0] ? __pfx_ip_rcv_finish+0x10/0x10 [ 226.832899][ C0] ? __pfx_ip_rcv+0x10/0x10 [ 226.832920][ C0] __netif_receive_skb+0x2bf/0x650 [ 226.832945][ C0] ? __pfx_lock_acquire+0x10/0x10 [ 226.832971][ C0] ? __pfx___netif_receive_skb+0x10/0x10 [ 226.832993][ C0] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 226.833020][ C0] ? __pfx_lock_release+0x10/0x10 [ 226.833046][ C0] ? _raw_spin_lock_irq+0xdf/0x120 [ 226.833079][ C0] process_backlog+0x662/0x15b0 [ 226.833105][ C0] ? process_backlog+0x33b/0x15b0 [ 226.833133][ C0] ? __pfx_process_backlog+0x10/0x10 [ 226.833157][ C0] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 226.833185][ C0] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 226.833213][ C0] __napi_poll+0xcb/0x490 [ 226.833237][ C0] net_rx_action+0x89b/0x1240 [ 226.833271][ C0] ? __pfx_net_rx_action+0x10/0x10 [ 226.833296][ C0] ? __pfx_tmigr_handle_remote+0x10/0x10 [ 226.833339][ C0] handle_softirqs+0x2c5/0x980 [ 226.833365][ C0] ? run_ksoftirqd+0xca/0x130 [ 226.833392][ C0] ? __pfx_handle_softirqs+0x10/0x10 [ 226.833415][ C0] ? preempt_schedule+0xe1/0xf0 [ 226.833435][ C0] run_ksoftirqd+0xca/0x130 [ 226.833460][ C0] ? __pfx_run_ksoftirqd+0x10/0x10 [ 226.833485][ C0] ? __pfx_ksoftirqd_should_run+0x10/0x10 [ 226.833512][ C0] ? __pfx_ksoftirqd_should_run+0x10/0x10 [ 226.833538][ C0] ? smpboot_thread_fn+0x2d3/0xa30 [ 226.833563][ C0] ? smpboot_thread_fn+0x4fb/0xa30 [ 226.833592][ C0] ? smpboot_thread_fn+0x656/0xa30 [ 226.833617][ C0] ? __pfx_run_ksoftirqd+0x10/0x10 [ 226.833641][ C0] smpboot_thread_fn+0x544/0xa30 [ 226.833666][ C0] ? smpboot_thread_fn+0x4e/0xa30 [ 226.833693][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 226.833717][ C0] kthread+0x2f0/0x390 [ 226.833734][ C0] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 226.833758][ C0] ? __pfx_kthread+0x10/0x10 [ 226.833775][ C0] ret_from_fork+0x4b/0x80 [ 226.833800][ C0] ? __pfx_kthread+0x10/0x10 [ 226.833817][ C0] ret_from_fork_asm+0x1a/0x30 [ 226.833850][ C0] [ 227.552941][ T55] Bluetooth: hci6: command tx timeout [ 227.568372][ T30] Kernel panic - not syncing: hung_task: blocked tasks [ 227.575328][ T30] CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.12.0-rc3-syzkaller-00217-g4d939780b705 #0 [ 227.585872][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 227.595975][ T30] Call Trace: [ 227.599295][ T30] [ 227.602264][ T30] dump_stack_lvl+0x241/0x360 [ 227.606991][ T30] ? __pfx_dump_stack_lvl+0x10/0x10 [ 227.612238][ T30] ? __pfx__printk+0x10/0x10 [ 227.616887][ T30] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 227.622936][ T30] ? vscnprintf+0x5d/0x90 [ 227.627321][ T30] panic+0x349/0x880 [ 227.631356][ T30] ? nmi_trigger_cpumask_backtrace+0x244/0x320 [ 227.637568][ T30] ? __pfx_panic+0x10/0x10 [ 227.642022][ T30] ? tick_nohz_tick_stopped+0x82/0xb0 [ 227.647443][ T30] ? __irq_work_queue_local+0x137/0x410 [ 227.653068][ T30] ? preempt_schedule_thunk+0x1a/0x30 [ 227.658582][ T30] ? nmi_trigger_cpumask_backtrace+0x244/0x320 [ 227.664803][ T30] ? nmi_trigger_cpumask_backtrace+0x2d4/0x320 [ 227.671015][ T30] ? nmi_trigger_cpumask_backtrace+0x2d9/0x320 [ 227.677225][ T30] watchdog+0x1033/0x1040 [ 227.681605][ T30] ? watchdog+0x1ea/0x1040 [ 227.686099][ T30] ? __pfx_watchdog+0x10/0x10 [ 227.690825][ T30] kthread+0x2f0/0x390 [ 227.694939][ T30] ? __pfx_watchdog+0x10/0x10 [ 227.699666][ T30] ? __pfx_kthread+0x10/0x10 [ 227.704300][ T30] ret_from_fork+0x4b/0x80 [ 227.708765][ T30] ? __pfx_kthread+0x10/0x10 [ 227.713431][ T30] ret_from_fork_asm+0x1a/0x30 [ 227.718263][ T30] [ 227.721459][ T30] Kernel Offset: disabled [ 227.725796][ T30] Rebooting in 86400 seconds..