last executing test programs: 6.711300565s ago: executing program 0 (id=1): r0 = syz_usb_connect(0x1, 0x2d, &(0x7f0000000300)=ANY=[@ANYBLOB="12012000f1048108cd060202d4920000000109021b1901000000d40904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) 4.034493776s ago: executing program 1 (id=20): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={0x28, r1, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xe, 0x1, @l2={'eth', 0x3a, 'caif0\x00'}}]}]}, 0x28}}, 0x0) 3.968521886s ago: executing program 1 (id=22): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x7) getrlimit(0x9, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000780)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) 3.10902848s ago: executing program 1 (id=25): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x20400008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) r3 = openat$ptp0(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$PTP_SYS_OFFSET(r3, 0xc0403d11, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x6c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2f}, @NFTA_SET_EXPRESSIONS={0x28, 0x12, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}, {0x10, 0x1, 0x0, 0x1, @dup_ipv4={{0x8}, @val={0x4}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x106}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xb4}}, 0x20050800) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, 0x0, 0x0) 3.105025046s ago: executing program 0 (id=26): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000207d1e512d00000000000109022400010000000009040000010300020009210000000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000002ac0)=ANY=[@ANYBLOB="00220500000057"], 0x0}, 0x0) 2.229146455s ago: executing program 1 (id=36): r0 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x42200) ioctl$USBDEVFS_SETCONFIGURATION(r0, 0x80045505, 0x0) 1.500295179s ago: executing program 4 (id=49): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90}, [@IFLA_IFNAME={0x14, 0x3, 'geneve1\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x4008030}, 0x2000000) 1.489425382s ago: executing program 1 (id=50): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) r2 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc) sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0xc000) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56fa8ef1d91a4574758ecefbe1d7a46df6d558ecf1820f", 0x18) r3 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) write$binfmt_misc(r0, &(0x7f0000000240), 0xfffffecc) 1.4442811s ago: executing program 4 (id=51): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_GET_VRING_BASE(r0, 0x4008af24, &(0x7f0000000080)) 1.332411326s ago: executing program 4 (id=52): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000004280)='.\x00', 0x0, 0x0) connect$pppl2tp(r1, &(0x7f0000001480)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x8, 0x0, 0x5, 0x0, {0xa, 0x0, 0x10f9a, @private2}}}, 0x32) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee3, 0x8031, 0xffffffffffffffff, 0x28f42000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x2000004}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x10, &(0x7f0000000580)=@framed={{0x18, 0x5}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r5}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x95}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='sched_switch\x00', r6}, 0x10) r7 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x40000, 0x0) r8 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) r9 = syz_open_dev$usbfs(&(0x7f0000000000), 0x20000007d, 0x48082) r10 = dup3(r8, r9, 0x0) ioctl$MON_IOCX_GETX(r10, 0x4018920a, &(0x7f0000000240)={&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @iso}, 0x0}) r11 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xc) ioctl$VHOST_SET_MEM_TABLE(r11, 0x4008af03, &(0x7f00000001c0)) ioctl$TIOCVHANGUP(r7, 0x5437, 0x0) 1.33214782s ago: executing program 3 (id=53): mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd']) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000004c0), &(0x7f00000004c0), 0x1000, r0}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000020850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='tlb_flush\x00', r1}, 0x10) 1.288454712s ago: executing program 3 (id=54): mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) 956.430081ms ago: executing program 3 (id=56): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f0000001680)=ANY=[], &(0x7f0000001700)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x9}, 0x94) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xa, 0x31, 0xffffffffffffffff, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x48c00, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$inet6(0xa, 0x80002, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r3, 0x0, 0x24000040) setsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) 643.955676ms ago: executing program 0 (id=62): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2006, 0x118, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x1000, 0x4, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x8}}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000100)={0x24, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x22, 0x3d}, 0x0}, 0x0) 564.044207ms ago: executing program 1 (id=64): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$PIO_UNIMAP(r3, 0x4b67, &(0x7f0000001ec0)={0x1, &(0x7f0000001e80)=[{0x0, 0x1000}]}) mount$9p_tcp(0x0, &(0x7f0000000540)='./file0\x00', &(0x7f0000000580), 0x8c1, 0x0) 225.763259ms ago: executing program 2 (id=65): r0 = socket(0x2b, 0x80801, 0x1) accept$phonet_pipe(r0, 0x0, 0x0) 199.560667ms ago: executing program 2 (id=66): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_pidfd_open(0x0, 0x0) openat$rfkill(0xffffffffffffff9c, 0x0, 0x801, 0x0) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$setsig(0x4203, r0, 0x80, &(0x7f00000000c0)={0x16, 0x7, 0x7}) 108.569975ms ago: executing program 4 (id=67): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc9ffb}]}) shmdt(0x0) 108.363136ms ago: executing program 3 (id=68): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mknodat(0xffffffffffffff9c, &(0x7f0000000140)='./file4\x00', 0x11c0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f00000008c0)='./file4\x00', r0, &(0x7f0000000900)='./file7\x00', 0x0) 108.27227ms ago: executing program 2 (id=69): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='loginuid\x00') preadv(r0, &(0x7f00000003c0)=[{&(0x7f0000000380)=""/44, 0x2c}], 0x1, 0x0, 0x0) write$sysctl(r0, &(0x7f0000000080)='4\x00', 0x2) writev(r0, 0x0, 0x0) 108.167816ms ago: executing program 4 (id=70): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/asound/timers\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000200)={0x2020}, 0x2020) 80.09143ms ago: executing program 2 (id=71): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r0, 0x3) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) syz_emit_ethernet(0x3e, &(0x7f0000000080)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1a}, @val={@void, {0x8100, 0x0, 0x0, 0x4}}, {@ipv4={0x800, @tcp={{0x6, 0x4, 0x0, 0x0, 0x2c, 0x65, 0x0, 0x2, 0x6, 0x0, @rand_addr=0x64010101, @local, {[@end]}}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2, 0xffff}}}}}}, 0x0) 79.348092ms ago: executing program 3 (id=72): r0 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000500)={'team0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x98, 0x24, 0xf0b, 0x0, 0xfffffffd, {0x0, 0x0, 0x12, r1, {0x0, 0xfff2}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x68, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x1, 0x0, 0x1], 0x0, [0x8, 0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}}, @TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME={0xc, 0x8, 0x8001}]}}]}, 0x98}}, 0x0) 69.730377ms ago: executing program 4 (id=73): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x7) getrlimit(0x9, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000780)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}], {0x14}}, 0x64}, 0x1, 0x0, 0x0, 0x40885}, 0x0) sendmsg$NFT_MSG_GETOBJ(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c000000130a010100000000000000"], 0x1c}}, 0x4044040) 388.53µs ago: executing program 2 (id=74): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) io_uring_setup(0x6f16, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xc, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x1) 196.597µs ago: executing program 2 (id=75): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)=@deltfilter={0x24, 0x2d, 0x200, 0x70bd26, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x0, 0xd}, {0x4, 0xe}, {0xfff1}}}, 0x24}}, 0x74000800) r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) syz_usb_disconnect(r0) syz_usb_connect(0x4, 0x24, &(0x7f0000000580)=ANY=[], 0x0) ioctl$EVIOCRMFF(r0, 0xc0085504, &(0x7f0000000140)=0x10) 0s ago: executing program 3 (id=76): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x4) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000180)=0x19ca, 0x4) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r1, &(0x7f00000000c0)="3f03fe7f0302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c153cfdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r2, 0x1, 0x0, 0x6, @multicast}, 0x14) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.211' (ED25519) to the list of known hosts. [ 24.210336][ T6537] cgroup: Unknown subsys name 'net' [ 24.320352][ T6537] cgroup: Unknown subsys name 'cpuset' [ 24.322348][ T6537] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 24.478009][ T6537] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SS [ 25.640715][ T6555] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 25.653143][ T6561] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 25.654049][ T6561] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 25.654160][ T6561] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 25.654436][ T6561] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 25.654921][ T6565] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 25.655316][ T6561] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 25.655448][ T6561] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 25.655703][ T6561] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 25.655865][ T6561] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 25.656351][ T6561] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 25.656958][ T6561] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 25.657171][ T6561] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 25.658851][ T6561] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 25.661076][ T53] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 25.669319][ T53] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 25.669550][ T6561] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 25.674746][ T6555] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 25.674792][ T6561] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 25.677361][ T6555] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 25.678804][ T6555] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 25.681991][ T6555] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 25.683701][ T6555] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 25.686915][ T6555] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 25.688909][ T6555] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 25.842725][ T6550] chnl_net:caif_netlink_parms(): no params data found [ 25.864901][ T6551] chnl_net:caif_netlink_parms(): no params data found [ 25.872227][ T6563] chnl_net:caif_netlink_parms(): no params data found [ 25.892816][ T6554] chnl_net:caif_netlink_parms(): no params data found [ 25.916087][ T6550] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.917773][ T6550] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.919328][ T6550] bridge_slave_0: entered allmulticast mode [ 25.920934][ T6550] bridge_slave_0: entered promiscuous mode [ 25.934046][ T6550] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.935297][ T6550] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.936801][ T6550] bridge_slave_1: entered allmulticast mode [ 25.938255][ T6550] bridge_slave_1: entered promiscuous mode [ 25.957792][ T6551] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.957870][ T6551] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.958009][ T6551] bridge_slave_0: entered allmulticast mode [ 25.958440][ T6551] bridge_slave_0: entered promiscuous mode [ 25.960035][ T6551] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.960056][ T6551] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.960102][ T6551] bridge_slave_1: entered allmulticast mode [ 25.960513][ T6551] bridge_slave_1: entered promiscuous mode [ 25.971369][ T6563] bridge0: port 1(bridge_slave_0) entered blocking state [ 25.971407][ T6563] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.971477][ T6563] bridge_slave_0: entered allmulticast mode [ 25.971925][ T6563] bridge_slave_0: entered promiscuous mode [ 25.972523][ T6557] chnl_net:caif_netlink_parms(): no params data found [ 25.974467][ T6563] bridge0: port 2(bridge_slave_1) entered blocking state [ 25.974703][ T6563] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.974770][ T6563] bridge_slave_1: entered allmulticast mode [ 25.975185][ T6563] bridge_slave_1: entered promiscuous mode [ 25.977015][ T6550] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 25.978018][ T6550] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 26.002404][ T6551] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 26.003439][ T6551] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 26.017142][ T6550] team0: Port device team_slave_0 added [ 26.018045][ T6563] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 26.025348][ T6554] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.025417][ T6554] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.025481][ T6554] bridge_slave_0: entered allmulticast mode [ 26.025918][ T6554] bridge_slave_0: entered promiscuous mode [ 26.027111][ T6554] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.027135][ T6554] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.027203][ T6554] bridge_slave_1: entered allmulticast mode [ 26.027667][ T6554] bridge_slave_1: entered promiscuous mode [ 26.031758][ T6550] team0: Port device team_slave_1 added [ 26.035751][ T6563] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 26.040835][ T6551] team0: Port device team_slave_0 added [ 26.041698][ T6551] team0: Port device team_slave_1 added [ 26.051764][ T6550] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 26.051785][ T6550] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 26.051799][ T6550] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 26.052623][ T6550] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 26.052630][ T6550] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 26.052643][ T6550] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 26.090158][ T6563] team0: Port device team_slave_0 added [ 26.091618][ T6551] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 26.091641][ T6551] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 26.091655][ T6551] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 26.092177][ T6551] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 26.092183][ T6551] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 26.092195][ T6551] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 26.106577][ T6554] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 26.107853][ T6554] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 26.111539][ T6557] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.111613][ T6557] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.111663][ T6557] bridge_slave_0: entered allmulticast mode [ 26.112083][ T6557] bridge_slave_0: entered promiscuous mode [ 26.112782][ T6557] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.112800][ T6557] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.112845][ T6557] bridge_slave_1: entered allmulticast mode [ 26.113428][ T6557] bridge_slave_1: entered promiscuous mode [ 26.115294][ T6550] hsr_slave_0: entered promiscuous mode [ 26.115671][ T6550] hsr_slave_1: entered promiscuous mode [ 26.117674][ T6563] team0: Port device team_slave_1 added [ 26.142435][ T6551] hsr_slave_0: entered promiscuous mode [ 26.142739][ T6551] hsr_slave_1: entered promiscuous mode [ 26.142947][ T6551] debugfs: 'hsr0' already exists in 'hsr' [ 26.142995][ T6551] Cannot create hsr debugfs directory [ 26.147447][ T6554] team0: Port device team_slave_0 added [ 26.150271][ T6557] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 26.151348][ T6557] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 26.156909][ T6563] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 26.156933][ T6563] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 26.156951][ T6563] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 26.157558][ T6563] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 26.157566][ T6563] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 26.157578][ T6563] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 26.159998][ T6554] team0: Port device team_slave_1 added [ 26.185392][ T6557] team0: Port device team_slave_0 added [ 26.194038][ T6557] team0: Port device team_slave_1 added [ 26.207375][ T6554] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 26.207400][ T6554] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 26.207416][ T6554] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 26.208078][ T6554] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 26.208085][ T6554] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 26.208098][ T6554] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 26.222642][ T6563] hsr_slave_0: entered promiscuous mode [ 26.222936][ T6563] hsr_slave_1: entered promiscuous mode [ 26.223110][ T6563] debugfs: 'hsr0' already exists in 'hsr' [ 26.223121][ T6563] Cannot create hsr debugfs directory [ 26.224149][ T6557] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 26.224157][ T6557] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 26.224167][ T6557] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 26.233086][ T6557] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 26.233108][ T6557] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 26.233134][ T6557] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 26.277885][ T6557] hsr_slave_0: entered promiscuous mode [ 26.279388][ T6557] hsr_slave_1: entered promiscuous mode [ 26.280704][ T6557] debugfs: 'hsr0' already exists in 'hsr' [ 26.281816][ T6557] Cannot create hsr debugfs directory [ 26.284208][ T6554] hsr_slave_0: entered promiscuous mode [ 26.284513][ T6554] hsr_slave_1: entered promiscuous mode [ 26.284693][ T6554] debugfs: 'hsr0' already exists in 'hsr' [ 26.284702][ T6554] Cannot create hsr debugfs directory [ 26.376442][ T6550] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 26.379846][ T6550] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 26.386072][ T6550] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 26.388933][ T6550] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 26.403395][ T6550] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.403439][ T6550] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.403616][ T6550] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.403647][ T6550] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.409890][ T6551] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 26.413115][ T6551] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 26.415073][ T6551] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 26.421711][ T6551] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 26.445298][ T6551] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.445350][ T6551] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.445424][ T6551] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.445452][ T6551] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.452144][ T6563] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 26.455939][ T6550] 8021q: adding VLAN 0 to HW filter on device bond0 [ 26.457448][ T6563] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 26.470162][ T6563] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 26.471222][ T6563] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 26.474132][ T6557] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 26.482386][ T6557] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 26.484542][ T6557] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 26.489029][ T5187] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.490424][ T5187] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.491701][ T5187] bridge0: port 1(bridge_slave_0) entered disabled state [ 26.493294][ T5187] bridge0: port 2(bridge_slave_1) entered disabled state [ 26.505458][ T6557] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 26.513846][ T6550] 8021q: adding VLAN 0 to HW filter on device team0 [ 26.522411][ T42] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.522461][ T42] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.522803][ T42] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.522819][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.548368][ T6563] 8021q: adding VLAN 0 to HW filter on device bond0 [ 26.554402][ T6551] 8021q: adding VLAN 0 to HW filter on device bond0 [ 26.558429][ T6563] 8021q: adding VLAN 0 to HW filter on device team0 [ 26.564355][ T6554] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 26.566987][ T6554] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 26.570948][ T6554] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 26.575581][ T6551] 8021q: adding VLAN 0 to HW filter on device team0 [ 26.578212][ T6554] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 26.584297][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.584337][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.584714][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.584730][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.599917][ T6563] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 26.599948][ T6563] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 26.601522][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.601553][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.601840][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.601862][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.646852][ T6557] 8021q: adding VLAN 0 to HW filter on device bond0 [ 26.666664][ T6557] 8021q: adding VLAN 0 to HW filter on device team0 [ 26.674273][ T215] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.674310][ T215] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.687337][ T5187] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.687375][ T5187] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.697564][ T6563] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 26.719292][ T6551] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 26.743576][ T6563] veth0_vlan: entered promiscuous mode [ 26.747539][ T6563] veth1_vlan: entered promiscuous mode [ 26.753655][ T6550] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 26.763805][ T6551] veth0_vlan: entered promiscuous mode [ 26.776212][ T6557] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 26.780150][ T6550] veth0_vlan: entered promiscuous mode [ 26.782160][ T6551] veth1_vlan: entered promiscuous mode [ 26.786602][ T6554] 8021q: adding VLAN 0 to HW filter on device bond0 [ 26.805146][ T6563] veth0_macvtap: entered promiscuous mode [ 26.807418][ T6563] veth1_macvtap: entered promiscuous mode [ 26.809674][ T6550] veth1_vlan: entered promiscuous mode [ 26.816409][ T6550] veth0_macvtap: entered promiscuous mode [ 26.818569][ T6551] veth0_macvtap: entered promiscuous mode [ 26.821793][ T6551] veth1_macvtap: entered promiscuous mode [ 26.822910][ T6554] 8021q: adding VLAN 0 to HW filter on device team0 [ 26.826189][ T6550] veth1_macvtap: entered promiscuous mode [ 26.837902][ T6563] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 26.838908][ T6563] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 26.842635][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.842836][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.842949][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.843003][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.862546][ T5187] bridge0: port 1(bridge_slave_0) entered blocking state [ 26.862587][ T5187] bridge0: port 1(bridge_slave_0) entered forwarding state [ 26.872301][ T5187] bridge0: port 2(bridge_slave_1) entered blocking state [ 26.872342][ T5187] bridge0: port 2(bridge_slave_1) entered forwarding state [ 26.875853][ T6550] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 26.891987][ T6550] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 26.892661][ T6551] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 26.896629][ T6551] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 26.913102][ T5187] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.913281][ T5187] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.913297][ T5187] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.913310][ T5187] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.913323][ T5187] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.913335][ T5187] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.913347][ T5187] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.913359][ T5187] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 26.920290][ T5187] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 26.920300][ T5187] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 26.967472][ T6557] veth0_vlan: entered promiscuous mode [ 26.972826][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 26.972853][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 26.985851][ T6557] veth1_vlan: entered promiscuous mode [ 26.988034][ T5187] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 26.988060][ T5187] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 26.995178][ T6554] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 27.013002][ T15] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 27.013025][ T15] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 27.020001][ T6557] veth0_macvtap: entered promiscuous mode [ 27.023756][ T15] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 27.023782][ T15] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 27.035830][ T6557] veth1_macvtap: entered promiscuous mode [ 27.038765][ T6563] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 27.052679][ T6557] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 27.055365][ T6557] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 27.066340][ T6554] veth0_vlan: entered promiscuous mode [ 27.071666][ T5187] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.071763][ T5187] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.071782][ T5187] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.071794][ T5187] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.072431][ T4149] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 27.072442][ T4149] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 27.088042][ T6554] veth1_vlan: entered promiscuous mode [ 27.115535][ T6665] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 27.115720][ T6665] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 27.127438][ T6667] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 27.127615][ T6667] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 27.134777][ T6554] veth0_macvtap: entered promiscuous mode [ 27.140558][ T6554] veth1_macvtap: entered promiscuous mode [ 27.152618][ T6554] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 27.154512][ T5187] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 27.154536][ T5187] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 27.161588][ T6554] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 27.168097][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 27.168119][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 27.172809][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.172957][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.173074][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.173133][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 27.200812][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 27.200836][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 27.213474][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 27.213501][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 27.384227][ T6608] usb 1-1: new low-speed USB device number 2 using dummy_hcd [ 27.534822][ T6678] ceph: No mds server is up or the cluster is laggy [ 27.562841][ T26] libceph: connect (1)[c::]:6789 error -101 [ 27.567299][ T26] libceph: mon0 (1)[c::]:6789 connect error [ 27.689670][ T6562] Bluetooth: hci3: command tx timeout [ 27.689997][ T6562] Bluetooth: hci0: command tx timeout [ 27.690071][ T6562] Bluetooth: hci2: command tx timeout [ 27.769153][ T6562] Bluetooth: hci4: command tx timeout [ 27.769740][ T6553] Bluetooth: hci1: command tx timeout [ 27.781459][ T6608] usb 1-1: config index 0 descriptor too short (expected 6427, got 27) [ 27.781484][ T6608] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 27.781511][ T6608] usb 1-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 27.781522][ T6608] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 27.791961][ T6608] usb 1-1: config 0 descriptor?? [ 27.815745][ T6688] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 27.819096][ T6688] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 27.916727][ T26] libceph: connect (1)[c::]:6789 error -101 [ 27.919551][ T26] libceph: mon0 (1)[c::]:6789 connect error [ 27.951330][ T6689] ceph: No mds server is up or the cluster is laggy [ 28.190275][ T26] libceph: connect (1)[c::]:6789 error -101 [ 28.191950][ T26] libceph: mon0 (1)[c::]:6789 connect error [ 29.146440][ T6702] binder: 6701:6702 tried to acquire reference to desc 0, got 1 instead [ 29.148598][ T6702] binder: 6701:6702 got transaction with invalid parent offset or type [ 29.152883][ T6702] binder: 6701:6702 transaction call to 6701:0 failed 5/29201/-22, code 0 size 104-24 line 3598 [ 29.156234][ T26] binder: undelivered TRANSACTION_ERROR: 29201 [ 29.191704][ T6704] loop9: detected capacity change from 0 to 7 [ 29.245287][ T6704] Dev loop9: unable to read RDB block 7 [ 29.248826][ T6704] loop9: unable to read partition table [ 29.249998][ T6704] loop9: partition table beyond EOD, truncated [ 29.250028][ T6704] loop_reread_partitions: partition scan of loop9 (þ被xü—ŸÑà– ) failed (rc=-5) [ 29.741274][ T6729] tipc: Started in network mode [ 29.741302][ T6729] tipc: Node identity , cluster identity 4711 [ 29.741326][ T6729] tipc: Failed to obtain node identity [ 29.741341][ T6729] tipc: Enabling of bearer rejected, failed to enable media [ 29.769559][ T6562] Bluetooth: hci0: command tx timeout [ 29.769598][ T6562] Bluetooth: hci3: command tx timeout [ 29.769805][ T6553] Bluetooth: hci2: command tx timeout [ 29.873475][ T6555] Bluetooth: hci1: command tx timeout [ 29.873518][ T6555] Bluetooth: hci4: command tx timeout [ 30.662079][ T26] usb 1-1: USB disconnect, device number 2 [ 30.994587][ T6744] netlink: 'syz.2.24': attribute type 15 has an invalid length. [ 31.269806][ T26] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 31.449390][ T26] usb 1-1: Using ep0 maxpacket: 32 [ 31.454950][ T26] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 31.457219][ T26] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 31.459368][ T26] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2d51, bcdDevice= 0.00 [ 31.461228][ T26] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 31.465862][ T26] usb 1-1: config 0 descriptor?? [ 31.850832][ T6553] Bluetooth: hci2: command tx timeout [ 31.850991][ T6553] Bluetooth: hci3: command tx timeout [ 31.851126][ T6553] Bluetooth: hci0: command tx timeout [ 31.939213][ T6553] Bluetooth: hci4: command tx timeout [ 31.939326][ T6553] Bluetooth: hci1: command tx timeout [ 32.069588][ T26] koneplus 0003:1E7D:2D51.0001: hidraw0: USB HID v0.00 Device [HID 1e7d:2d51] on usb-dummy_hcd.0-1/input0 [ 32.265113][ T26] koneplus 0003:1E7D:2D51.0001: couldn't init struct koneplus_device [ 32.265159][ T26] koneplus 0003:1E7D:2D51.0001: couldn't install mouse [ 32.267094][ T26] koneplus 0003:1E7D:2D51.0001: probe with driver koneplus failed with error -71 [ 32.283370][ T26] usb 1-1: USB disconnect, device number 3 [ 32.942011][ T6835] netlink: 'syz.2.58': attribute type 11 has an invalid length. [ 33.633521][ T31] audit: type=1326 audit(33.620:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6854 comm="syz.4.67" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff86f5b9e8 code=0x7ffc0000 [ 33.637404][ T31] audit: type=1326 audit(33.620:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6854 comm="syz.4.67" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=197 compat=0 ip=0xffff86f5b9e8 code=0x7ffc0000 [ 33.641160][ T31] audit: type=1326 audit(33.630:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6854 comm="syz.4.67" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff86f5b9e8 code=0x7ffc0000 [ 33.644614][ T31] audit: type=1326 audit(33.630:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6854 comm="syz.4.67" exe="/root/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff86f5b9e8 code=0x7ffc0000 [ 33.652383][ T26] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 33.838384][ T26] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 33.838422][ T26] usb 1-1: New USB device found, idVendor=2006, idProduct=0118, bcdDevice= 0.00 [ 33.838443][ T26] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 33.929061][ T6562] Bluetooth: hci2: command tx timeout [ 33.930215][ T6553] Bluetooth: hci3: command tx timeout [ 33.932401][ T6555] Bluetooth: hci0: command tx timeout [ 33.995226][ T26] usb 1-1: config 0 descriptor?? [ 34.001880][ T6872] ------------[ cut here ]------------ [ 34.001889][ T6872] WARNING: CPU: 0 PID: 6872 at mm/page_alloc.c:5154 __alloc_frozen_pages_noprof+0xd0/0x318 [ 34.004279][ T6872] Modules linked in: [ 34.004878][ T6872] CPU: 0 UID: 0 PID: 6872 Comm: syz.2.75 Not tainted syzkaller #0 PREEMPT [ 34.006161][ T6872] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 [ 34.007655][ T6872] pstate: 23400005 (nzCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) [ 34.008838][ T6872] pc : __alloc_frozen_pages_noprof+0xd0/0x318 [ 34.009746][ T6872] lr : __alloc_frozen_pages_noprof+0xac/0x318 [ 34.010663][ T6872] sp : ffff8000a5c37760 [ 34.011315][ T6872] x29: ffff8000a5c37820 x28: dfff800000000000 x27: 0000000000000003 [ 34.012597][ T6872] x26: 1ffff00012e7a250 x25: dfff800000000000 x24: ffff8000a5c37780 [ 34.013825][ T6872] x23: ffff700014b86ef0 x22: 0000000000000000 x21: 0000000000040cc0 [ 34.015053][ T6872] x20: 0000000000000000 x19: 000000000000000e x18: 0000000000000000 [ 34.016168][ T6872] x17: 0000000000000000 x16: ffff80008ad6b188 x15: 0000000000000005 [ 34.017310][ T6872] x14: 1ffff00014b86ef4 x13: 0000000000000000 x12: 0000000000000000 [ 34.018439][ T6872] x11: ffff700014b86ef9 x10: dfff800000000000 x9 : 0000000000000001 [ 34.019699][ T6872] x8 : ffff800092c29000 x7 : 0000000000000000 x6 : ffff8000a5c37ae8 [ 34.020923][ T6872] x5 : ffff8000a5c37ae8 x4 : 0000000000000000 x3 : 0000000000000020 [ 34.022123][ T6872] x2 : 0000000000000008 x1 : 0000000000000000 x0 : 0000000000000000 [ 34.023354][ T6872] Call trace: [ 34.023836][ T6872] __alloc_frozen_pages_noprof+0xd0/0x318 (P) [ 34.024787][ T6872] alloc_pages_mpol+0x1e4/0x460 [ 34.025562][ T6872] alloc_frozen_pages_noprof+0xe0/0x210 [ 34.026391][ T6872] ___kmalloc_large_node+0xac/0x154 [ 34.027206][ T6872] __kmalloc_large_node_noprof+0x2c/0x8c [ 34.028076][ T6872] __kmalloc_noprof+0x4bc/0x728 [ 34.028767][ T6872] raw_ioctl+0x1320/0x3368 [ 34.029405][ T6872] __arm64_sys_ioctl+0x14c/0x1c4 [ 34.030092][ T6872] invoke_syscall+0x98/0x254 [ 34.030776][ T6872] el0_svc_common+0xe8/0x23c [ 34.031423][ T6872] do_el0_svc+0x48/0x58 [ 34.032047][ T6872] el0_svc+0x5c/0x254 [ 34.032638][ T6872] el0t_64_sync_handler+0x84/0x12c [ 34.033387][ T6872] el0t_64_sync+0x198/0x19c [ 34.034063][ T6872] irq event stamp: 512 [ 34.034679][ T6872] hardirqs last enabled at (511): [] kasan_quarantine_put+0x1a0/0x1c8 [ 34.036115][ T6872] hardirqs last disabled at (512): [] el1_brk64+0x20/0x54 [ 34.037407][ T6872] softirqs last enabled at (494): [] local_bh_enable+0x10/0x34 [ 34.038741][ T6872] softirqs last disabled at (492): [] local_bh_disable+0x10/0x34 [ 34.040100][ T6872] ---[ end trace 0000000000000000 ]--- [ 34.041891][ T6553] Bluetooth: hci4: command tx timeout [ 34.042773][ T6555] Bluetooth: hci1: command tx timeout [ 34.402397][ T26] hkems 0003:2006:0118.0002: unknown main item tag 0x0 [ 34.402431][ T26] hkems 0003:2006:0118.0002: unknown main item tag 0x0 [ 34.402442][ T26] hkems 0003:2006:0118.0002: unknown main item tag 0x0 [ 34.402451][ T26] hkems 0003:2006:0118.0002: unknown main item tag 0x0 [ 34.402459][ T26] hkems 0003:2006:0118.0002: unknown main item tag 0x0 [ 34.404347][ T26] hkems 0003:2006:0118.0002: hidraw0: USB HID v10.00 Device [HID 2006:0118] on usb-dummy_hcd.0-1/input0 [ 34.404364][ T26] hkems 0003:2006:0118.0002: no inputs found [ 34.404371][ T26] hkems 0003:2006:0118.0002: force feedback init failed [ 34.605076][ T26] usb 1-1: USB disconnect, device number 4