last executing test programs: 4.207494938s ago: executing program 1 (id=2): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) migrate_pages(r0, 0x5, 0x0, &(0x7f0000000080)=0x272) 3.995332791s ago: executing program 1 (id=5): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000000)=@gcm_128={{0x303}, "2d9421fe8a4c9563", "cf6ff9ff337ed301000100c747fbbfc1", "dbdc27ff", "16de86d67a8426bd"}, 0x28) recvmsg(r0, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000b40)=""/141, 0x8d}], 0x1}, 0x40000021) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r0) recvmmsg(r0, &(0x7f00000019c0)=[{{0x0, 0x0, 0x0}, 0x7fffffff}, {{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000180)=""/15, 0xf}], 0x1}, 0x9}], 0x2, 0x10100, 0x0) setsockopt$sock_int(r0, 0x1, 0x12, &(0x7f00000000c0)=0x8, 0x4) 3.722972485s ago: executing program 1 (id=6): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat(0xffffffffffffff9c, 0x0, 0x40, 0x1) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0x1c3902, 0x0) r1 = memfd_create(&(0x7f0000000000)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa', 0x2) ftruncate(r1, 0x800799c) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) read(r2, 0x0, 0x0) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0xb, 0x2012, r1, 0x0) lseek(r1, 0x0, 0x4) close_range(r1, 0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x40000, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x6, &(0x7f0000006680)) r5 = fsopen(&(0x7f0000000080)='mqueue\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x0, 0x0) fchdir(r6) r7 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x8880, 0x4d) lseek(r7, 0x1, 0x1) getdents64(r7, 0x0, 0x4f) 1.987533611s ago: executing program 1 (id=7): sendmsg$RDMA_NLDEV_CMD_STAT_GET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x20, 0x1411, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_STAT_MODE={0x8, 0x4a, 0x1}]}, 0x20}}, 0x0) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) r0 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$bt_hci(r0, 0x0, 0x0) openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bind$alg(0xffffffffffffffff, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) r2 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x80000803, 0x2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r3, &(0x7f0000000200)={0x10, 0x0, 0xffffffff, 0x80065c9}, 0xc) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0xa8}}, 0x0) sendmsg$NFT_BATCH(r4, 0x0, 0x20008000) ioctl$vim2m_VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000080)=0x2) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000000c0)="c4", 0x1}], 0x1) ioctl$VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000040)={0x201, 0xa, 0x2}) ioctl$VIDIOC_DECODER_CMD(r2, 0xc0485660, &(0x7f0000000380)={0x1, 0x2, @raw_data=[0x7ff, 0x0, 0x5, 0xf5088d3e, 0x3, 0x100, 0x4, 0x0, 0xffff, 0x4, 0x549, 0x8, 0x5, 0x9, 0x0, 0x6]}) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) 1.163869153s ago: executing program 2 (id=3): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x0) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r0, 0xc0605345, &(0x7f0000000040)={0x0, 0x0, {0x0, 0x0, 0x0, 0x3}}) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r1, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, r2, {0x7, 0x1f, 0xdfffffff, 0x5e490420, 0x4, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88}}, 0x50) syz_fuse_handle_req(r1, &(0x7f000000e3c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20, 0x0, 0x3731, {0x0, 0x7f69ff17f1e1ab77}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0xc5001, 0x104) ioctl$BTRFS_IOC_SNAP_DESTROY(r4, 0x40305828, 0x0) write$FUSE_WRITE(r4, 0x0, 0x0) write$FUSE_NOTIFY_RETRIEVE(r4, &(0x7f0000000000)={0x30, 0x5, 0x0, {0x0, 0x0, 0x2f8, 0x106}}, 0x30) r5 = socket$nl_generic(0x10, 0x3, 0x10) write$binfmt_aout(r4, &(0x7f0000000700)={{0xcc, 0x8, 0x3, 0xdd, 0x243, 0x5, 0xf7, 0xf76}, "af74f66d9efec92799f5202041db92039b6e622986257680ee56bbc6ab38c389e46b5f", ['\x00', '\x00', '\x00', '\x00']}, 0x443) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f00000000c0)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_MESH(r5, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x2c, r6, 0x1, 0x70bd2b, 0x25dfdbff, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x81}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x44000}, 0x0) sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000640)={0x2c, r6, 0x100, 0x70bd27, 0x25dfdbfc, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x5}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0xfffffff9}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x3}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000850}, 0x8001) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), r4) sendmsg$TIPC_NL_KEY_SET(r4, &(0x7f0000000600)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40001081}, 0xc, &(0x7f00000005c0)={&(0x7f0000000c80)={0x2a4, r8, 0x100, 0x70bd2b, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0xc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_MEDIA={0x14, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_LINK={0x104, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xc5af}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5b7f}]}, @TIPC_NLA_LINK_PROP={0x4c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x49}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1c00}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x90b0}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffff90c}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_MEDIA={0x20, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}]}]}, @TIPC_NLA_LINK={0xc8, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8001}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x103}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x54, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10001}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x30a}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x200}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x101}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x944}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}]}, @TIPC_NLA_LINK_PROP={0x4}]}, @TIPC_NLA_LINK={0x10, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}, @TIPC_NLA_BEARER={0x4}, @TIPC_NLA_PUBL={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x200}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x2a}]}, @TIPC_NLA_SOCK={0x5c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}, @TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2200}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x347d}]}]}, 0x2a4}, 0x1, 0x0, 0x0, 0x20004800}, 0x54) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x0, 0x0) 906.255797ms ago: executing program 1 (id=8): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000005c0)=@filter={'filter\x00', 0x4, 0x4, 0x544, 0xffffffff, 0x2f8, 0x2f8, 0x0, 0xfeffffff, 0xffffffff, 0x47c, 0x47c, 0x47c, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@private2={0xfc, 0x2, '\x00', 0x1}, @rand_addr=' \x01\x00', [0x0, 0xffffff00, 0xffffffff], [0xffffff00], 'ip6gre0\x00', 'veth0_to_bond\x00', {}, {}, 0x32, 0x7, 0x5, 0x4}, 0x2f2, 0x18c, 0x1cc, 0x0, {}, [@common=@unspec=@conntrack1={{0xb8}, {{@ipv6=@private0={0xfc, 0x0, '\x00', 0x1}, [0xffffff00, 0xff000000, 0x0, 0xffffffff], @ipv4=@multicast1, [0xff, 0xffffff00, 0xff, 0xffffffff], @ipv4=@local, [0x0, 0xff000000, 0x0, 0xffffff00], @ipv6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [0xff, 0xffffff00], 0x4, 0x1, 0x33, 0x4e23, 0x4e27, 0x4e22, 0x4e20, 0x702}, 0x1, 0xb}}, @common=@ah={{0x30}, {[0x4d5, 0x4d2], 0xc8, 0x4, 0x2}}]}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x1, 0x2, "7bb9e202c328195132db405277bbb7a6b21cf6ae22238cb8f38000"}}}, {{@uncond, 0x0, 0xec, 0x12c, 0x0, {}, [@common=@dst={{0x48}, {0x0, 0x1, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0xa, 0x7fff]}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x2, 0x57, {0x2000000}}}}, {{@ipv6={@empty, @mcast2, [0xffffffff], [0x0, 0x0, 0x0, 0xffffffff], 'veth1_macvtap\x00', 'vcan0\x00'}, 0x0, 0x160, 0x184, 0x0, {}, [@common=@frag={{0x30}, {[0x1, 0xa60], 0x0, 0x2, 0x2}}, @common=@srh1={{0x8c}, {0x4, 0x0, 0x0, 0x0, 0x0, @dev, @remote, @private1, [0x0, 0xff000000, 0xff000000, 0xffffff00], [0x0, 0xff000000], [0x0, 0xff, 0x0, 0xffffffff], 0x968, 0x2}}]}, @REJECT={0x24}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x5a0) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/comedi4\x00', 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) ioctl$FIONCLEX(0xffffffffffffffff, 0x5450) syz_emit_ethernet(0xbe, &(0x7f0000000c40)=ANY=[@ANYBLOB="aaaaaaaaaa0f0180c20000000800450000b0400000000011907800000000000000004e244e20009c907801000000000000007b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af584cbf2649a50f2dbc43efa845942824251d7d17b5191584bcd4fbe40a23424d000000000000000000cbad1784ff5b664840765393b93ae70b00000000000000bcfd56f1375461caaa2f19935e6996c7096ffeeb03000000000000649a3bfbc1f39cb307b3472eb9cdb042d2640f954c07a3178cfe7d49bc05bc71a708490eeeba458e2b7947817a1cf97e7e461dd8b99dac2236212c0046f5c69f0c"], 0x0) recvmmsg(r2, &(0x7f0000006000)=[{{0x0, 0x0, 0x0}}], 0x1, 0x40000102, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x80, &(0x7f0000000080)={0xa, 0x4e23, 0x10, @mcast1}, 0x1c) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b80)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x3}, 0x94) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000001100)='fdinfo/4\x00') pread64(r3, &(0x7f0000000340)=""/19, 0x13, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)) socket(0x10, 0x2, 0x0) r4 = mq_open(&(0x7f0000000100)='&\x00', 0x40, 0x118, 0x0) mq_notify(r4, &(0x7f0000000000)={0x110c230000, 0x3, 0x2, @thr={0x0, 0x0}}) close(0x3) mq_notify(r4, 0x0) getsockopt$inet_sctp_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000280)={0x0, 0x9454}, &(0x7f0000000300)=0x8) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000000c0)=0x0) syz_open_dev$sndctrl(&(0x7f0000000380), 0x5, 0x40) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r6, 0x40047451, &(0x7f0000000080)=0x4) pwritev(r6, &(0x7f0000000180)=[{&(0x7f00000001c0)="00210bde", 0x4}], 0x1, 0xee, 0x1) sched_setaffinity(r5, 0x8, &(0x7f0000000100)=0x81) r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000200)=ANY=[@ANYRES64=r5], &(0x7f00000002c0)='GPL\x00', 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x300000f, 0x12, r1, 0x0) 770.149869ms ago: executing program 0 (id=1): openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x8) syz_io_uring_setup(0xf00, 0x0, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r0, r1, r2, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x15, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r4 = syz_open_dev$video4linux(&(0x7f00000001c0), 0x3, 0x40483) ioctl$VIDIOC_DQEVENT(r4, 0x80885659, 0x0) 716.81628ms ago: executing program 3 (id=4): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x20041040) socket$packet(0x11, 0x3, 0x300) socket$packet(0x11, 0x2, 0x300) r0 = socket$packet(0x11, 0xa, 0x300) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SEG6_CMD_SETHMAC(r1, 0x0, 0x4000) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00c00e}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x0) r3 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_RECV_OWN_MSGS(r3, 0x65, 0x4, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_genetlink_get_family_id$ieee802154(0x0, 0xffffffffffffffff) ioctl(r2, 0x8b2c, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c000000070601080000000000000000000000000500010006"], 0x1c}}, 0x0) recvmmsg(r4, &(0x7f0000003840)=[{{0x0, 0x0, &(0x7f0000002780)=[{&(0x7f00000002c0)=""/127, 0x7f}, {&(0x7f0000000340)=""/240, 0xf0}, {&(0x7f00000004c0)=""/77, 0x4d}, {&(0x7f00000016c0)=""/4096, 0x1000}], 0x4}, 0x1}], 0x1, 0x20, 0x0) setsockopt$bt_BT_VOICE(0xffffffffffffffff, 0x112, 0x13, 0x0, 0x13) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000100)=[{0x80000006}]}, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) 537.314472ms ago: executing program 3 (id=9): r0 = syz_usb_connect$uac3(0x0, 0x80, &(0x7f0000000100)=ANY=[@ANYBLOB="1201010200000040b421810040000102030109026e0003017f0006080b0002012230230904000000010130000a2401100a00090000000904014cbcda4430000904010101010230000905010960"], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000300)={0x40, 0x10}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac3(r0, 0x0, &(0x7f00000009c0)={0x44, &(0x7f0000000640)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = inotify_init() r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x4b8200, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'ip6gre0\x00', 0x10}) ioctl$TUNSETLINK(r2, 0x400454cd, 0x20) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x6, 0xfe, 0x7fff0006}]}) r5 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa8203, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r5, 0xc0184800, &(0x7f0000000080)={0x20004, r4, 0x2}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r3, 0xc00c642e, &(0x7f0000000440)={0x0, 0x0, r6}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f0000000040)={0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0x59, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR(r3, 0xc01c64a3, &(0x7f0000000280)={0x1, r7, 0xff, 0x100007, 0xa, 0x1ff, 0x1}) r8 = openat$panthor(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000200)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(r8, 0xc01864c1, &(0x7f0000000280)={r9}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(r6, 0xc01864c1, &(0x7f0000000180)={r9}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x3d, &(0x7f0000000040)={0x1, &(0x7f0000000080)=[{0x6, 0x9, 0x0, 0x7ffffdbd}]}) syslog(0x3, &(0x7f0000000200)=""/90, 0x5a) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r6, 0x84, 0x22, &(0x7f0000000340)={0x4, 0x9, 0x4adb, 0x58e}, &(0x7f0000000380)=0x10) close_range(r1, 0xffffffffffffffff, 0x0) syz_usb_control_io$uac3(r0, 0x0, &(0x7f0000000dc0)={0x44, &(0x7f0000000080)={0x40, 0x17, 0x4, "aa3579bc"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r10 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r10, 0x7a7, &(0x7f00000000c0)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r10, 0x7a0, &(0x7f0000000000)={@hyper}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r10, 0x7a8, &(0x7f0000000080)={{@local, 0x2}, @local, 0x0, 0x2, 0x5e, 0x200000000000, 0x100000000000006, 0x3}) 0s ago: executing program 1 (id=10): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder1\x00', 0x2, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000240)=0x0) move_pages(r0, 0x1, &(0x7f0000000280)=[&(0x7f0000ffc000/0x4000)=nil], 0x0, &(0x7f0000000480)=[0x0, 0x0, 0x0], 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x3b, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0xfffe) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYBLOB="010008020000001800006600000008000300", @ANYRES32, @ANYBLOB="08002600940900000800b700"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)=@allocspi={0xf8, 0x16, 0x1, 0x0, 0x0, {{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in=@private=0xa010102, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@empty, 0x4d5, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x3e}}, {}, {}, {0x7, 0xfffffffd}, 0x0, 0x0, 0x2}, 0x0, 0x4}}, 0xf8}}, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f00000004c0)=@filter={'filter\x00', 0xe, 0x0, 0x90, [0x0, 0x80000300, 0x80000330, 0x80000360], 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000e4ffffff0000000000000000000000000000000800000000000000000000000000000000000000ffffffff0002000000000000000000000000000004000000eeff00000000000000000000000000000000000000000000feffffff00060000"]}, 0x108) r4 = syz_open_dev$sndmidi(&(0x7f00000001c0), 0x2, 0x8081) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mount(0x0, 0x0, 0x0, 0x204450, 0x0) syz_io_uring_setup(0x49d, &(0x7f0000000100)={0x0, 0x79af, 0x2, 0x8000, 0x400246}, 0x0, 0x0, 0x0) keyctl$instantiate(0xc, 0x0, 0x0, 0x0, 0xfffffffffffffff9) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) io_setup(0x1, &(0x7f0000000000)=0x0) io_getevents(r5, 0xffffffff, 0x0, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00') getdents64(r6, &(0x7f0000002f40)=""/4098, 0x1002) r7 = syz_open_procfs(0x0, &(0x7f0000000240)='net/vlan/vlan0\x00') preadv(r7, &(0x7f00000001c0)=[{&(0x7f0000000000)=""/196, 0xc4}, {&(0x7f0000000100)=""/28, 0x1c}, {&(0x7f0000000140)=""/93, 0x5d}], 0x3, 0xa3, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.75' (ED25519) to the list of known hosts. [ 72.997962][ T5762] cgroup: Unknown subsys name 'net' [ 73.130048][ T5762] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 74.551528][ T5762] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 75.908845][ T5775] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 75.917632][ T5775] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 75.943923][ T5775] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 75.954055][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 75.961793][ T51] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 75.969210][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 75.977604][ T51] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 75.986930][ T5778] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 75.995526][ T5778] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 76.004692][ T5778] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 76.011788][ T5778] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 76.020415][ T5778] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 76.045018][ T5786] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 76.053055][ T5786] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 76.061082][ T5786] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 76.067590][ T5785] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 76.068742][ T5786] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 76.082948][ T5786] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 76.092565][ T5778] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 76.101555][ T5778] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 76.109177][ T5782] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 76.119780][ T5782] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 76.131811][ T5778] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 76.140067][ T5778] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 76.535444][ T5773] chnl_net:caif_netlink_parms(): no params data found [ 76.583311][ T5779] chnl_net:caif_netlink_parms(): no params data found [ 76.650529][ T5776] chnl_net:caif_netlink_parms(): no params data found [ 76.722118][ T5780] chnl_net:caif_netlink_parms(): no params data found [ 76.775866][ T5773] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.783648][ T5773] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.791112][ T5773] bridge_slave_0: entered allmulticast mode [ 76.798058][ T5773] bridge_slave_0: entered promiscuous mode [ 76.829669][ T5773] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.836986][ T5773] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.844711][ T5773] bridge_slave_1: entered allmulticast mode [ 76.851548][ T5773] bridge_slave_1: entered promiscuous mode [ 76.869364][ T5779] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.876700][ T5779] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.884099][ T5779] bridge_slave_0: entered allmulticast mode [ 76.890744][ T5779] bridge_slave_0: entered promiscuous mode [ 76.899511][ T5779] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.906990][ T5779] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.914660][ T5779] bridge_slave_1: entered allmulticast mode [ 76.921376][ T5779] bridge_slave_1: entered promiscuous mode [ 77.002351][ T5773] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.016284][ T5779] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.026595][ T5776] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.033866][ T5776] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.041126][ T5776] bridge_slave_0: entered allmulticast mode [ 77.047912][ T5776] bridge_slave_0: entered promiscuous mode [ 77.056869][ T5776] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.064822][ T5776] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.071996][ T5776] bridge_slave_1: entered allmulticast mode [ 77.079015][ T5776] bridge_slave_1: entered promiscuous mode [ 77.095584][ T5780] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.102705][ T5780] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.110156][ T5780] bridge_slave_0: entered allmulticast mode [ 77.117047][ T5780] bridge_slave_0: entered promiscuous mode [ 77.126274][ T5773] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.152300][ T5779] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.188111][ T5780] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.195908][ T5780] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.203058][ T5780] bridge_slave_1: entered allmulticast mode [ 77.210078][ T5780] bridge_slave_1: entered promiscuous mode [ 77.219811][ T5773] team0: Port device team_slave_0 added [ 77.229045][ T5773] team0: Port device team_slave_1 added [ 77.252250][ T5779] team0: Port device team_slave_0 added [ 77.277160][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.284275][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.310437][ T5773] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.325220][ T5779] team0: Port device team_slave_1 added [ 77.334748][ T5776] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.346993][ T5776] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.374846][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.381826][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.408408][ T5773] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.437673][ T5780] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.459677][ T5776] team0: Port device team_slave_0 added [ 77.477335][ T5780] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.509127][ T5776] team0: Port device team_slave_1 added [ 77.517385][ T5779] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.524433][ T5779] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.550659][ T5779] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.567165][ T5780] team0: Port device team_slave_0 added [ 77.598695][ T5779] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.605799][ T5779] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.631746][ T5779] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.644763][ T5780] team0: Port device team_slave_1 added [ 77.705458][ T5773] hsr_slave_0: entered promiscuous mode [ 77.711850][ T5773] hsr_slave_1: entered promiscuous mode [ 77.719597][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.728926][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.755456][ T5776] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.768136][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.775256][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.801270][ T5776] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.814267][ T5780] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.821316][ T5780] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.847555][ T5780] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.891347][ T5780] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.898424][ T5780] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.926971][ T5780] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.951411][ T5776] hsr_slave_0: entered promiscuous mode [ 77.959975][ T5776] hsr_slave_1: entered promiscuous mode [ 77.966938][ T5776] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 77.974926][ T5776] Cannot create hsr debugfs directory [ 77.998559][ T5779] hsr_slave_0: entered promiscuous mode [ 78.005404][ T5779] hsr_slave_1: entered promiscuous mode [ 78.011438][ T5779] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 78.019302][ T5779] Cannot create hsr debugfs directory [ 78.080989][ T5780] hsr_slave_0: entered promiscuous mode [ 78.087320][ T5780] hsr_slave_1: entered promiscuous mode [ 78.093343][ T5780] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 78.101695][ T5780] Cannot create hsr debugfs directory [ 78.154527][ T5775] Bluetooth: hci2: command tx timeout [ 78.154538][ T5778] Bluetooth: hci0: command tx timeout [ 78.154746][ T5775] Bluetooth: hci3: command tx timeout [ 78.234155][ T5775] Bluetooth: hci1: command tx timeout [ 78.484141][ T5773] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 78.496964][ T5773] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 78.507823][ T5773] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 78.518526][ T5773] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 78.565887][ T5779] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 78.581236][ T5779] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 78.592975][ T5779] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 78.602635][ T5779] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 78.699627][ T5780] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 78.726573][ T5780] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 78.743291][ T5780] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 78.754866][ T5780] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 78.835231][ T5776] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 78.848901][ T5776] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 78.858958][ T5776] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 78.870851][ T5776] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 78.923319][ T5773] 8021q: adding VLAN 0 to HW filter on device bond0 [ 78.999364][ T5773] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.018074][ T5779] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.041542][ T1124] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.048896][ T1124] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.081935][ T1124] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.089101][ T1124] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.126486][ T5779] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.173294][ T1124] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.180547][ T1124] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.192893][ T1124] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.200046][ T1124] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.219536][ T5776] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.237281][ T5780] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.286068][ T5780] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.336703][ T5776] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.361398][ T4535] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.368592][ T4535] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.383385][ T4535] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.390631][ T4535] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.417954][ T4535] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.425161][ T4535] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.442901][ T3539] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.450042][ T3539] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.558411][ T5773] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 79.702077][ T5773] veth0_vlan: entered promiscuous mode [ 79.747353][ T5773] veth1_vlan: entered promiscuous mode [ 79.854097][ T5773] veth0_macvtap: entered promiscuous mode [ 79.878761][ T5773] veth1_macvtap: entered promiscuous mode [ 79.929643][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 79.959921][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 79.989876][ T5773] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.014065][ T5773] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.022815][ T5773] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.036673][ T5773] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.089561][ T5776] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.140749][ T5779] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.151136][ T5780] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.228166][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.242842][ T5775] Bluetooth: hci0: command tx timeout [ 80.242865][ T51] Bluetooth: hci2: command tx timeout [ 80.249700][ T5775] Bluetooth: hci3: command tx timeout [ 80.272002][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.312359][ T5779] veth0_vlan: entered promiscuous mode [ 80.318431][ T5775] Bluetooth: hci1: command tx timeout [ 80.351490][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.363762][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.373070][ T5779] veth1_vlan: entered promiscuous mode [ 80.393567][ T5780] veth0_vlan: entered promiscuous mode [ 80.417653][ T5776] veth0_vlan: entered promiscuous mode [ 80.449448][ T5780] veth1_vlan: entered promiscuous mode [ 80.477010][ T5776] veth1_vlan: entered promiscuous mode [ 80.517510][ T5779] veth0_macvtap: entered promiscuous mode [ 80.561519][ T5779] veth1_macvtap: entered promiscuous mode [ 80.571665][ T5780] veth0_macvtap: entered promiscuous mode [ 80.597216][ T5780] veth1_macvtap: entered promiscuous mode [ 80.617079][ T5779] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 80.628659][ T5779] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.641534][ T5779] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.667936][ T5779] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 80.679563][ T5779] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.692367][ T5779] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.715137][ T5776] veth0_macvtap: entered promiscuous mode [ 80.723351][ T5779] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.738837][ T5779] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.748220][ T5779] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.758168][ T5779] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.772360][ T5776] veth1_macvtap: entered promiscuous mode [ 80.797414][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 80.809265][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.822956][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 80.843923][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.868159][ T5780] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.886151][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 80.899901][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.912373][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 80.925384][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.938671][ T5780] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.961620][ T5780] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.975506][ T5780] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.991587][ T5780] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.000851][ T5780] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.061961][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.079746][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.089737][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.100359][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.110284][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.120986][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.137496][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.214470][ T5847] syz.1.6[5847]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 81.251462][ T5847] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 81.308672][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.324658][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.347693][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.397050][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.451660][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.498346][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.552806][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 82.049890][ T5776] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.104356][ T5776] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.143654][ T5776] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.190772][ T5776] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.319844][ T5775] Bluetooth: hci3: command tx timeout [ 82.342723][ T5775] Bluetooth: hci2: command tx timeout [ 82.383638][ T51] Bluetooth: hci0: command tx timeout [ 82.394086][ T51] Bluetooth: hci1: command tx timeout [ 82.540500][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.556976][ T4535] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.587046][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.635296][ T4535] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.683033][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.703886][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.758038][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.791926][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.898280][ T1124] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.915802][ T1124] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.962263][ T1124] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.987780][ T1124] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.397300][ T5775] Bluetooth: hci0: command tx timeout [ 84.397319][ T5778] Bluetooth: hci3: command tx timeout [ 84.480381][ T5775] Bluetooth: hci2: command tx timeout [ 84.485948][ T5778] Bluetooth: hci1: command tx timeout [ 84.555695][ T5815] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 84.770775][ T5815] usb 4-1: unable to get BOS descriptor or descriptor too short [ 84.806186][ T5815] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 84.830519][ T5815] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 84.937479][ T5815] usb 4-1: too many endpoints for config 1 interface 1 altsetting 76: 188, using maximum allowed: 30 [ 93.433782][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 95.174432][ T0] NOHZ tick-stop error: local softirq work is pending, handler #142!!! [ 95.583962][ T0] NOHZ tick-stop error: local softirq work is pending, handler #1c2!!! [ 95.993575][ T0] NOHZ tick-stop error: local softirq work is pending, handler #1c2!!! [ 97.734394][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 98.143963][ T0] NOHZ tick-stop error: local softirq work is pending, handler #142!!! [ 98.553579][ T0] NOHZ tick-stop error: local softirq work is pending, handler #142!!! [ 100.294495][ T0] NOHZ tick-stop error: local softirq work is pending, handler #1c2!!! [ 100.704049][ T0] NOHZ tick-stop error: local softirq work is pending, handler #1c2!!! [ 101.113593][ T0] NOHZ tick-stop error: local softirq work is pending, handler #1c2!!! [ 189.953602][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 189.960734][ C0] rcu: (detected by 0, t=10502 jiffies, g=9461, q=853 ncpus=2) [ 189.968395][ C0] rcu: All QSes seen, last rcu_preempt kthread activity 10502 (4294956084-4294945582), jiffies_till_next_fqs=1, root ->qsmask 0x0 [ 189.981793][ C0] rcu: rcu_preempt kthread starved for 10502 jiffies! g9461 f0x2 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0 [ 189.992921][ C0] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 190.002911][ C0] rcu: RCU grace-period kthread stack dump: [ 190.008815][ C0] task:rcu_preempt state:R running task stack:25960 pid:17 ppid:2 flags:0x00004000 [ 190.019642][ C0] Call Trace: [ 190.022947][ C0] [ 190.025897][ C0] __schedule+0x15ae/0x4660 [ 190.030459][ C0] ? asan.module_dtor+0x20/0x20 [ 190.035338][ C0] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 190.041363][ C0] ? preempt_schedule_irq+0xb4/0x150 [ 190.046680][ C0] preempt_schedule_irq+0xbf/0x150 [ 190.051831][ C0] ? preempt_schedule_notrace+0x110/0x110 [ 190.057583][ C0] ? rcu_irq_exit_check_preempt+0xdf/0x210 [ 190.063420][ C0] irqentry_exit+0x67/0x70 [ 190.067861][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 190.073879][ C0] RIP: 0010:__timer_delete_sync+0x1ac/0x2e0 [ 190.079798][ C0] Code: 00 4d 85 f6 75 16 e8 83 90 10 00 eb 15 e8 7c 90 10 00 e8 67 83 0d 09 4d 85 f6 74 ea e8 6d 90 10 00 fb 65 44 8b 35 5c 63 8d 7e <44> 89 f6 81 e6 00 00 0f 00 31 ff e8 04 94 10 00 41 81 e6 00 00 0f [ 190.099426][ C0] RSP: 0018:ffffc90000167aa0 EFLAGS: 00000293 [ 190.105519][ C0] RAX: ffffffff817654e3 RBX: ffffc90000167ba0 RCX: ffff88801a270000 [ 190.113513][ C0] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 190.121498][ C0] RBP: ffffc90000167b70 R08: ffffffff8e8ae5ef R09: 1ffffffff1d15cbd [ 190.129485][ C0] R10: dffffc0000000000 R11: fffffbfff1d15cbe R12: ffffffff8176544e [ 190.137487][ C0] R13: 1ffff9200002cf58 R14: 0000000080000000 R15: 0000000000000000 [ 190.145482][ C0] ? __timer_delete_sync+0x10e/0x2e0 [ 190.150798][ C0] ? __timer_delete_sync+0x1a3/0x2e0 [ 190.156109][ C0] ? timer_delete_sync+0x20/0x20 [ 190.161075][ C0] schedule_timeout+0x192/0x2d0 [ 190.165948][ C0] ? console_conditional_schedule+0x40/0x40 [ 190.171869][ C0] ? update_process_times+0x1b0/0x1b0 [ 190.177265][ C0] ? prepare_to_swait_event+0x344/0x360 [ 190.182836][ C0] rcu_gp_fqs_loop+0x30d/0x1590 [ 190.187710][ C0] ? rcu_gp_kthread+0x3b0/0x3b0 [ 190.192582][ C0] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 190.198498][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 190.203720][ C0] ? rcu_gp_init+0x1530/0x1530 [ 190.208504][ C0] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 190.214426][ C0] ? finish_swait+0xca/0x1d0 [ 190.219044][ C0] rcu_gp_kthread+0x9d/0x3b0 [ 190.223649][ C0] ? rcu_report_qs_rsp+0x1a0/0x1a0 [ 190.228786][ C0] ? __kthread_parkme+0x71/0x1c0 [ 190.233739][ C0] ? __kthread_parkme+0x15b/0x1c0 [ 190.238791][ C0] kthread+0x2fa/0x390 [ 190.242870][ C0] ? rcu_report_qs_rsp+0x1a0/0x1a0 [ 190.247996][ C0] ? kthread_blkcg+0xd0/0xd0 [ 190.252612][ C0] ret_from_fork+0x48/0x80 [ 190.257065][ C0] ? kthread_blkcg+0xd0/0xd0 [ 190.261675][ C0] ret_from_fork_asm+0x11/0x20 [ 190.266471][ C0] [ 190.269511][ C0] rcu: Stack dump where RCU GP kthread last ran: [ 190.275854][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 [ 190.282888][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 190.292957][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x10 [ 190.298622][ C0] Code: dc 23 02 c3 cc cc cc cc cc cc cc f3 0f 1e fa 0f 0b 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 66 90 0f 00 2d 43 67 44 00 fb f4 66 0f 1f 00 55 41 57 41 56 41 54 53 50 8b 2f eb 2c 89 cb 80 f9 [ 190.318256][ C0] RSP: 0018:ffffffff8ce07d80 EFLAGS: 000002c6 [ 190.324343][ C0] RAX: f05e041cb3869d00 RBX: ffffffff81628b01 RCX: f05e041cb3869d00 [ 190.332337][ C0] RDX: 0000000000000001 RSI: ffffffff8acacb60 RDI: ffffffff8b1c7be0 [ 190.340321][ C0] RBP: ffffffff8ce07eb8 R08: ffff8880b8e36bab R09: 1ffff110171c6d75 [ 190.348310][ C0] R10: dffffc0000000000 R11: ffffed10171c6d76 R12: 1ffffffff19c0fbc [ 190.356301][ C0] R13: dffffc0000000000 R14: 1ffffffff19d2688 R15: 0000000000000000 [ 190.364289][ C0] FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 190.373246][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 190.379856][ C0] CR2: 0000001b2dc1eff8 CR3: 00000000301d3000 CR4: 00000000003506f0 [ 190.387853][ C0] Call Trace: [ 190.391144][ C0] [ 190.394085][ C0] default_idle+0x13/0x20 [ 190.398434][ C0] default_idle_call+0x6c/0xa0 [ 190.403224][ C0] do_idle+0x221/0x5c0 [ 190.407331][ C0] ? idle_inject_timer_fn+0x60/0x60 [ 190.412546][ C0] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 190.418466][ C0] ? _raw_spin_unlock+0x40/0x40 [ 190.423348][ C0] cpu_startup_entry+0x43/0x60 [ 190.428131][ C0] rest_init+0x2e2/0x300 [ 190.432393][ C0] ? time_init+0x40/0x40 [ 190.436652][ C0] arch_call_rest_init+0xe/0x10 [ 190.441529][ C0] start_kernel+0x459/0x4e0 [ 190.446051][ C0] x86_64_start_reservations+0x2a/0x30 [ 190.451542][ C0] x86_64_start_kernel+0x60/0x60 [ 190.456491][ C0] secondary_startup_64_no_verify+0x179/0x17b [ 190.462589][ C0]