last executing test programs: 19.423533179s ago: executing program 1 (id=95): socket$nl_generic(0x10, 0x3, 0x10) r0 = msgget$private(0x0, 0x0) msgsnd(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="03008000"], 0x8, 0x800) msgrcv(r0, 0x0, 0x0, 0x2, 0x3800) syz_pidfd_open(0x0, 0x0) pipe2(&(0x7f00000000c0), 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, 0x0, 0x0) syz_open_dev$usbmon(&(0x7f0000001580), 0x7, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x16, 0x5, &(0x7f0000000240)=ANY=[], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) syz_emit_ethernet(0x32, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x2, 0x9c, 0x0, @val=0x80}}}}}}}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip6_flowlabel\x00') ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000040)={0x4, 0xffff, 0xc, 0x0, 0x0}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x4000000) sendmsg$IPSET_CMD_DEL(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="e00000000a06010100000000000000000300000908000940800000010900020073797a310000000005000100070000000800094000000005880008800c000780080009"], 0x13a}, 0x1, 0x0, 0x0, 0x2000c880}, 0x48084) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r3, 0xc00464b4, &(0x7f0000000100)={r4}) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) io_uring_setup(0x6f6, &(0x7f0000005100)={0x0, 0x9dcc, 0x802}) r6 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r6, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x8b}, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) 15.131802691s ago: executing program 3 (id=104): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)=ANY=[], 0xfdef) 14.885482669s ago: executing program 3 (id=106): socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f0000000500)={0xf000000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x98f910, 0xffffc081, '\x00', @p_u8=&(0x7f00000003c0)=0xc2}}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, 0x0, 0x0) r2 = syz_open_dev$sndpcmp(0x0, 0xb, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r2, 0xc2604110, 0x0) openat$fb0(0xffffffffffffff9c, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000005580)=""/102392, 0x18ff8) setresuid(0xee00, 0x0, 0xee00) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, 0x0, 0xc000) bind$inet6(r1, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r1, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 13.626481641s ago: executing program 2 (id=107): r0 = socket$kcm(0x10, 0x3, 0x10) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x88800, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r3, 0x0, 0x0) sendmmsg$inet(r3, &(0x7f0000004980)=[{{0x0, 0x0, 0x0}}], 0x1, 0x20008000) setsockopt$inet_tcp_TLS_TX(r3, 0x6, 0x25, &(0x7f0000000a80)=@gcm_128={{0x303}, "9ff3d6661480294c", "5fa3c0bf46782bbee21b09b7446edc75", "5bee93e1", "f11bb8cba3046ce3"}, 0x28) socket$key(0xf, 0x3, 0x2) socketpair$unix(0x1, 0x1, 0x0, 0x0) sendmsg$unix(0xffffffffffffffff, 0x0, 0x240408c1) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40002001, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x98) r4 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x20101) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r4, 0xc2604110, &(0x7f00000005c0)={0x2, [[0x9ef8, 0xf1, 0x0, 0x1, 0xfffffffc, 0x0, 0x3, 0x10], [0x0, 0x8, 0x0, 0x10000007, 0x20000000, 0x4, 0xffffffff], [0x0, 0x1000000, 0xfffffffc, 0x0, 0x0, 0x0, 0x10000, 0xfffffffd]], '\x00', [{0xfffffffc, 0xf8}, {0x0, 0xfffffffd}, {0xe4}, {0x4, 0x5, 0x0, 0x1}, {0x3, 0xfffffffe}, {}, {0xffffffff, 0x400}, {}, {0x0, 0xffff}, {0x2, 0x10000000}, {0x9, 0xd78}, {0xfffffff8, 0x2}], '\x00', 0x0, 0x0, 0x0, 0xf8}) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000180)={0x48, 0x7, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0xfffffffd, 0x7eac0, 0x3d3b4e}) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="c018030029000b12d25a80648c2594f90224fc60100c02", 0x17}], 0x1}, 0x0) 13.561153908s ago: executing program 3 (id=108): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x4600, 0x0) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000880)={0x0, 0x2, 0x1, [0x1, 0xeb5b, 0x6, 0x3, 0x100000000], [0x1, 0x3, 0x4, 0x2ca, 0x4, 0x200, 0x5, 0x5631, 0x7, 0x5, 0xfffffffffffffff7, 0xaf, 0x100000001, 0x7, 0x6e0, 0x86e, 0x2, 0x4, 0x1, 0x2, 0xfffffffffffffff7, 0x7c, 0x8, 0x4, 0x8, 0x157b84ad, 0x0, 0xa, 0x80000001, 0x9, 0x10001, 0xfffffffffffffff9, 0x5, 0x3, 0x1, 0x1, 0x1001, 0x1, 0x4, 0x3, 0x8, 0x7, 0xb, 0x3, 0x0, 0x9, 0x10000, 0x1000, 0x2, 0x8, 0x64, 0x280000000000, 0x2, 0x4, 0x7, 0xa, 0x3, 0x8, 0x2, 0x0, 0xa0000000000, 0xfffffffffffffff5, 0x7, 0x3, 0x176, 0x15f, 0x0, 0x5, 0x5, 0xfc72, 0x9, 0x7, 0x7, 0x2, 0x6, 0x81, 0x2, 0x4, 0x10000000100, 0x0, 0x9, 0x2ce1, 0x7f, 0x8, 0xeab5, 0xffffffffffffffff, 0xeffffffffffffffe, 0x6, 0x10001, 0x2b6, 0x1, 0x2e06ffea, 0x10001, 0xf2d5, 0xffffffffffffffff, 0x2b6b, 0x1, 0x4, 0x5ac, 0x7f95, 0x20000d13, 0x2c, 0x1ff, 0x1000, 0xd05, 0x1, 0x9e, 0x8000000000000000, 0x3, 0x0, 0x3, 0x5, 0xc, 0x6, 0x6281, 0x10, 0x7f, 0x7, 0x3, 0x3, 0x7]}) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDSKBSENT(r3, 0x4b49, 0xfffffffffffffffd) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x8081) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) fchmodat(r4, &(0x7f0000000180)='./file0\x00', 0x22) r5 = syz_open_dev$loop(&(0x7f0000000240), 0x6, 0x0) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r5, 0x4c0a, &(0x7f0000000280)={r6, 0x0, {0x0, 0x0, 0x0, 0x32, 0x4000000000001001, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e00", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0x3, 0x6]}}) ioctl$SNDCTL_DSP_GETODELAY(r6, 0x80045017, &(0x7f0000000100)) pipe2$9p(0x0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff000000000200000009000100"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0xdc}}, 0x0) prctl$PR_GET_TSC(0x43, 0x0) sendmsg$NFT_MSG_GETRULE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000190a0102"], 0x14}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb7030000080000002d01000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newtaction={0x6c, 0x30, 0xb, 0x80000, 0x40, {}, [{0x58, 0x1, [@m_vlan={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x6b}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) 12.909882782s ago: executing program 0 (id=109): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000340)='GPL\x00', 0x6, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)={0x14, r4, 0x9c3fa077fa966179, 0x12, 0x0, {{0x7e}, {@void, @void}}}, 0x14}, 0x1, 0x0, 0x0, 0x8}, 0x4040800) r5 = socket$inet_icmp(0x2, 0x2, 0x1) sendmmsg$inet(r5, &(0x7f0000000c40)=[{{&(0x7f0000000200)={0x2, 0x4e22, @multicast1}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000080)="2a0000f128000000", 0x8}], 0x1}}], 0x1, 0x20000054) setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f0000000140)=@nat={'nat\x00', 0x1b, 0x5, 0x390, 0x1d0, 0x12c, 0xffffffff, 0x12c, 0x0, 0x350, 0x350, 0xffffffff, 0x350, 0x350, 0x5, &(0x7f0000000040), {[{{@uncond, 0x0, 0xa0, 0xc8, 0x0, {}, [@common=@ah={{0x30}, {[0x1, 0x1ff], 0x1}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x0, 0x4, 0x1}, {0x0, 0x1, 0x4}}}}, {{@uncond, 0x0, 0x70, 0xa8}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0x2, @remote, @multicast2, @gre_key=0xf, @port=0x4e22}}}}, {{@ip={@private=0xa010100, @private=0xa010100, 0xffffffff, 0xffffff00, 'ip6gretap0\x00', 'geneve1\x00', {}, {0xff}, 0x11, 0x3, 0x2}, 0x0, 0x98, 0xd0, 0x0, {}, [@common=@ttl={{0x28}, {0x3, 0x6}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x10, @rand_addr=0x64010102, @rand_addr=0x64010100, @gre_key=0x8, @icmp_id=0x66}}}}, {{@uncond, 0x0, 0x70, 0xb8}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x2, @ipv4=@multicast2, @ipv6=@mcast1, @port=0x4e24, @port=0x4e20}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r6 = fanotify_init(0x200, 0x0) fanotify_mark(r6, 0x1, 0x40000032, 0xffffffffffffffff, 0x0) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000e40), 0x40080, 0x0) ioctl$TIOCPKT(r7, 0x5420, &(0x7f00000000c0)=0x1) splice(r7, 0x0, 0xffffffffffffffff, 0x0, 0x7ffff000, 0x1) readv(r6, &(0x7f0000000180), 0x0) 12.885105506s ago: executing program 2 (id=110): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2d, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000580)='highspeed', 0x9) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r3, &(0x7f00000000c0), 0xffffffffffffffef, 0x0, 0x0, 0x0) recvfrom$inet(r3, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) socket$nl_netfilter(0x10, 0x3, 0xc) 10.42606686s ago: executing program 0 (id=111): setreuid(0xffffffffffffffff, 0xffffffffffffffff) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x18) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x5) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$KVM_CAP_SPLIT_IRQCHIP(0xffffffffffffffff, 0x4068aea3, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f0000000040)={0x1, 0x0, [{0x4, 0x2, 0x0, 0x0, @sint={0x7, 0x1ff}}]}) eventfd2(0x8, 0x1) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) 9.663470009s ago: executing program 2 (id=112): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r2, r1, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0xfdef, &(0x7f0000001bc0)=ANY=[], 0x0) 9.494356039s ago: executing program 1 (id=113): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) mount$9p_fd(0x0, 0x0, 0x0, 0x40, &(0x7f0000000180)) r2 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f0000000400)=[@in={0x2, 0x4e23, @empty}, @in6={0xa, 0x4e20, 0x8, @dev={0xfe, 0x80, '\x00', 0x2c}, 0x5}, @in={0x2, 0x4e23, @multicast1}, @in6={0xa, 0x4e21, 0x1, @local, 0xc46}], 0x58) shmget$private(0x0, 0x400000, 0x184, &(0x7f0000c00000/0x400000)=nil) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000002040)=""/102400, 0x19000) r4 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x200000001003, 0x2) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1) ioctl$VIDIOC_DECODER_CMD(r4, 0xc0485660, &(0x7f0000000000)={0x1, 0x1, @start={0x3ff, 0x1}}) capset(&(0x7f0000000000)={0x20080522}, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x5608, 0x3) socket$inet_udp(0x2, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'bridge0\x00'}) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000180)=@newlink={0x38, 0x10, 0x503, 0x2, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x14615, 0xef}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_FD0={0x8, 0x1, @udp6=r6}]}}}]}, 0x38}}, 0x0) 9.386273393s ago: executing program 3 (id=114): r0 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f0000000000)=0x9) connect$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @loopback}, 0x10) close(r0) 9.379388081s ago: executing program 2 (id=115): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2040, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0xff}, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000007a80)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0) write$cgroup_int(r1, 0x0, 0x0) ioctl$SNDCTL_TMR_STOP(0xffffffffffffffff, 0x5403) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r5 = syz_open_dev$cec(&(0x7f0000000380), 0x0, 0x80001) ioctl$CEC_S_MODE(r5, 0x40046109, &(0x7f00000003c0)=0x10) msgctl$MSG_INFO(0x0, 0xc, 0x0) r6 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r6, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000480)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_SETPLANE(r6, 0xc03064b7, 0x0) ioctl$DVB_DVR_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, 0x0) mmap$snddsp(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x8, 0x30, 0xffffffffffffffff, 0x6000) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/cgroup.procs\x00', 0x0, 0x0, 0x600) sendmsg$TIPC_NL_NODE_GET(r0, &(0x7f0000002900)={0x0, 0x0, &(0x7f00000028c0)={&(0x7f00000027c0)={0x14, 0x0, 0xf1f, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x4800}, 0x4080) syz_usb_connect(0x0, 0x24, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0x96, 0x47, 0x3f, 0x20, 0x10c4, 0x8244, 0x7275, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x8b, 0x4b, 0x28, 0x6, "", [{{0x9, 0x4, 0x31, 0xe, 0x0, 0x3, 0x0, 0x0, 0x1}}]}}]}}, 0x0) 8.014959295s ago: executing program 3 (id=116): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB], 0xfdef) 7.761909468s ago: executing program 1 (id=117): r0 = socket$kcm(0x10, 0x3, 0x10) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x88800, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r3, 0x0, 0x0) sendmmsg$inet(r3, &(0x7f0000004980)=[{{0x0, 0x0, 0x0}}], 0x1, 0x20008000) setsockopt$inet_tcp_TLS_TX(r3, 0x6, 0x25, &(0x7f0000000a80)=@gcm_128={{0x303}, "9ff3d6661480294c", "5fa3c0bf46782bbee21b09b7446edc75", "5bee93e1", "f11bb8cba3046ce3"}, 0x28) socket$key(0xf, 0x3, 0x2) socketpair$unix(0x1, 0x1, 0x0, 0x0) sendmsg$unix(0xffffffffffffffff, 0x0, 0x240408c1) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40002001, 0x0) sendmsg$can_bcm(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x98) syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x20101) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r1, 0x3b85, &(0x7f0000000040)={0x28, 0x7, 0x0, 0x0, &(0x7f000004c000/0x1000)=nil, 0x1000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000440)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000180)={0x48, 0x7, r4, 0x0, 0x10001, 0x0, 0xfffffffd, 0x7eac0, 0x3d3b4e}) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="c018030029000b12d25a80648c2594f90224fc60100c02", 0x17}], 0x1}, 0x0) 7.19524072s ago: executing program 0 (id=119): r0 = syz_open_dev$vbi(&(0x7f0000000040), 0x2, 0x2) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f00000007c0)={0x0, @bt={0xd80, 0x870, 0x1, 0x2, 0xd59f82, 0x19f5, 0xacc, 0xb, 0x0, 0xb, 0x27fd, 0x2800, 0x440, 0x3, 0xd, 0x22, {0x45, 0x80}, 0xcd, 0x3}}) 7.152875465s ago: executing program 1 (id=120): r0 = socket$kcm(0x10, 0x3, 0x10) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x88800, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r3, 0x0, 0x0) sendmmsg$inet(r3, &(0x7f0000004980)=[{{0x0, 0x0, 0x0}}], 0x1, 0x20008000) setsockopt$inet_tcp_TLS_TX(r3, 0x6, 0x25, &(0x7f0000000a80)=@gcm_128={{0x303}, "9ff3d6661480294c", "5fa3c0bf46782bbee21b09b7446edc75", "5bee93e1", "f11bb8cba3046ce3"}, 0x28) socket$key(0xf, 0x3, 0x2) socketpair$unix(0x1, 0x1, 0x0, 0x0) sendmsg$unix(0xffffffffffffffff, 0x0, 0x240408c1) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40002001, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x98) r4 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x20101) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r4, 0xc2604110, &(0x7f00000005c0)={0x2, [[0x9ef8, 0xf1, 0x0, 0x1, 0xfffffffc, 0x0, 0x3, 0x10], [0x0, 0x8, 0x0, 0x10000007, 0x20000000, 0x4, 0xffffffff], [0x0, 0x1000000, 0xfffffffc, 0x0, 0x0, 0x0, 0x10000, 0xfffffffd]], '\x00', [{0xfffffffc, 0xf8}, {0x0, 0xfffffffd}, {0xe4}, {0x4, 0x5, 0x0, 0x1}, {0x3, 0xfffffffe}, {}, {0xffffffff, 0x400}, {}, {0x0, 0xffff}, {0x2, 0x10000000}, {0x9, 0xd78}, {0xfffffff8, 0x2}], '\x00', 0x0, 0x0, 0x0, 0xf8}) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000180)={0x48, 0x7, 0xffffffffffffffff, 0x0, 0x10001, 0x0, 0xfffffffd, 0x7eac0, 0x3d3b4e}) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="c018030029000b12d25a80648c2594f90224fc60100c02", 0x17}], 0x1}, 0x0) 6.111958989s ago: executing program 3 (id=121): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0xa02, 0x0) r3 = dup(r2) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) read$FUSE(r3, &(0x7f0000000640)={0x2020}, 0x2020) 6.009149529s ago: executing program 0 (id=122): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c0058da2808010200000000000000000a0000070600024000080000"], 0x1c}}, 0x4) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000580)='highspeed', 0x9) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r3, &(0x7f00000000c0), 0xffffffffffffffef, 0x0, 0x0, 0x0) recvfrom$inet(r3, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) syz_emit_ethernet(0x4e, &(0x7f0000000000)={@local, @dev, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4dd708", 0x18, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@window={0x3, 0x3, 0x96}]}}}}}}}}, 0x0) 6.007100488s ago: executing program 4 (id=123): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000540), r0) sendmsg$IEEE802154_ADD_IFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000ecffffffffff2000000005002000000000000c001f0070687930"], 0x28}, 0x1, 0x0, 0x0, 0x810}, 0x0) 5.990095748s ago: executing program 1 (id=124): r0 = socket(0x2b, 0x1, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) r1 = socket(0x8, 0x0, 0x8000) ioctl$sock_netrom_SIOCADDRT(r1, 0x61d1, 0x0) unshare(0x40080) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, 0x0, 0x0) r3 = socket(0x22, 0xa, 0x2) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, 0x0, 0x0) close(0x4) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r4, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x11, 0xb, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000f40000000000000020000018010000202070250000000000202020db1af8ff00000000bfa100000000000017010000f0ffffffb702000008000000b70300000080000085000000ca00000095"], &(0x7f0000000400)='GPL\x00', 0x1, 0xdd, &(0x7f0000000440)=""/221, 0x0, 0x48, '\x00', 0x0, 0x0, r4}, 0x94) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd70000000000064010100000000000000000000000000fc01000000000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00080000000000000300000000000000"], 0xfc}}, 0x0) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000500)={0x1, {{0xa, 0x0, 0x0, @mcast1}}, 0x1}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x18, 0x6, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1000}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffb}, @map_idx_val={0x18, 0x4, 0x6, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2}]}, &(0x7f0000000080)='syzkaller\x00', 0x3, 0x27, &(0x7f0000000000)=""/114}, 0xa8) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$packet(0x11, 0x3, 0x300) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$packet_fanout(r6, 0x107, 0x12, 0x0, 0x0) setsockopt$packet_int(r6, 0x107, 0x16, &(0x7f0000000000)=0x4, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)={0x14, 0x23, 0x301, 0x270bd24, 0x25dfdbfa, {0x1}}, 0x14}}, 0xc004) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e1f, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x5}, 0x1c) 5.312418092s ago: executing program 4 (id=125): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x4600, 0x0) ioctl$BTRFS_IOC_GET_DEV_STATS(r2, 0xc4089434, &(0x7f0000000880)={0x0, 0x2, 0x1, [0x1, 0xeb5b, 0x6, 0x3, 0x100000000], [0x1, 0x3, 0x4, 0x2ca, 0x4, 0x200, 0x5, 0x5631, 0x7, 0x5, 0xfffffffffffffff7, 0xaf, 0x100000001, 0x7, 0x6e0, 0x86e, 0x2, 0x4, 0x1, 0x2, 0xfffffffffffffff7, 0x7c, 0x8, 0x4, 0x8, 0x157b84ad, 0x0, 0xa, 0x80000001, 0x9, 0x10001, 0xfffffffffffffff9, 0x5, 0x3, 0x1, 0x1, 0x1001, 0x1, 0x4, 0x3, 0x8, 0x7, 0xb, 0x3, 0x0, 0x9, 0x10000, 0x1000, 0x2, 0x8, 0x64, 0x280000000000, 0x2, 0x4, 0x7, 0xa, 0x3, 0x8, 0x2, 0x0, 0xa0000000000, 0xfffffffffffffff5, 0x7, 0x3, 0x176, 0x15f, 0x0, 0x5, 0x5, 0xfc72, 0x9, 0x7, 0x7, 0x2, 0x6, 0x81, 0x2, 0x4, 0x10000000100, 0x0, 0x9, 0x2ce1, 0x7f, 0x8, 0xeab5, 0xffffffffffffffff, 0xeffffffffffffffe, 0x6, 0x10001, 0x2b6, 0x1, 0x2e06ffea, 0x10001, 0xf2d5, 0xffffffffffffffff, 0x2b6b, 0x1, 0x4, 0x5ac, 0x7f95, 0x20000d13, 0x2c, 0x1ff, 0x1000, 0xd05, 0x1, 0x9e, 0x8000000000000000, 0x3, 0x0, 0x3, 0x5, 0xc, 0x6, 0x6281, 0x10, 0x7f, 0x7, 0x3, 0x3, 0x7]}) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDSKBSENT(r3, 0x4b49, 0xfffffffffffffffd) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x8081) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) fchmodat(r4, &(0x7f0000000180)='./file0\x00', 0x22) r5 = syz_open_dev$loop(&(0x7f0000000240), 0x6, 0x0) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r5, 0x4c0a, &(0x7f0000000280)={r6, 0x0, {0x0, 0x0, 0x0, 0x32, 0x4000000000001001, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e00", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0x3, 0x6]}}) ioctl$SNDCTL_DSP_GETODELAY(r6, 0x80045017, &(0x7f0000000100)) pipe2$9p(0x0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff000000000200000009000100"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0xdc}}, 0x0) prctl$PR_GET_TSC(0x43, 0x0) sendmsg$NFT_MSG_GETRULE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000190a0102"], 0x14}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb7030000080000002d01000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newtaction={0x6c, 0x30, 0xb, 0x80000, 0x40, {}, [{0x58, 0x1, [@m_vlan={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x6b}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) 4.923024605s ago: executing program 0 (id=126): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x80, 0x5, 0x7fff0003}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000100)) 4.670135s ago: executing program 2 (id=127): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() ptrace$pokeuser(0x6, r0, 0x8, 0x40) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) socket$can_raw(0x1d, 0x3, 0x1) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) mkdir(&(0x7f0000000640)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000080)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x3}, 0x5f) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') symlink(&(0x7f0000000540)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000800)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') sendmsg$kcm(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, 0x0}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10, 0x0, 0x0) stat(&(0x7f0000000f40)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) 2.941079401s ago: executing program 0 (id=128): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = socket$inet(0xa, 0x801, 0x84) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x13, 0x13, &(0x7f0000000080)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xde, &(0x7f00000001c0)=""/222, 0x41100, 0x8}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$NL80211_CMD_REQ_SET_REG(0xffffffffffffffff, 0x0, 0xc0) r4 = syz_init_net_socket$ax25(0x3, 0x5, 0x6) newfstatat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) setresuid(r5, r5, 0x0) ioctl$SIOCAX25CTLCON(r4, 0x89e8, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='devices.list\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000200)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r6, 0x0) connect$inet(r1, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r1, 0xfffffffd) r7 = accept4(r1, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r7, 0x84, 0x6, 0x0, &(0x7f0000000000)) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x2) io_setup(0x239f, &(0x7f0000000380)=0x0) io_submit(r8, 0x1, &(0x7f0000000b40)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x8, r0, 0x0, 0x0, 0x5, 0x0, 0x6}]) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4010}, 0x20050800) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 2.572695405s ago: executing program 2 (id=129): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$media(&(0x7f0000000040), 0x0, 0x0) ioctl$MEDIA_IOC_G_TOPOLOGY(r3, 0xc0487c04, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 2.406584421s ago: executing program 4 (id=130): accept4$llc(0xffffffffffffffff, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f0000000040)=0x10, 0x800) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_buf(r0, 0x29, 0x30, 0x0, 0x0) syz_open_dev$I2C(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) bind$alg(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = syz_open_procfs(0x0, &(0x7f0000000180)='io\x00') pread64(r2, 0x0, 0x0, 0x100000000004) 1.569014896s ago: executing program 4 (id=131): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r4, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r4, 0x84, 0x17, 0x0, 0x9) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r4, 0x84, 0x17, &(0x7f0000000340)=ANY=[@ANYRES32=0x0, @ANYBLOB="0800010018de991bf547b3035e10e623d4fe6643d184ef8c289072948707577fac968c138f8a22a17c7411a15133e9fe0b639d90160267997ea55de6843030742e4f4a31773d3f0a3765fc1d0903b6b8c8a0caeae1345c2f793a8e000141f91a2ef7aebb3fa1141867f577d055cc69f8eb62a6b6bb13b12af756d093c5cf52cf0f3aa9a36e5b94f1f3f7315305c9"], 0x9) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r5) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) openat(0xffffffffffffff9c, &(0x7f0000000240)='.\x00', 0x0, 0x0) listen(r6, 0x0) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r7, 0x1, 0x8, 0x0, 0x0) connect$inet(r7, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r8 = accept(r5, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[], 0xfffffdef}}, 0x1) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000540)={{0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x8}, 0x0, 0x0, 0x1, 0x9b, 0x8, 0xc7c, 0x1000, 0x3, 0xa, 0xfff, r1, r1}) recvfrom(r7, 0x0, 0x0, 0x4100, 0x0, 0x0) socket(0xa, 0x3, 0x3a) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x20846, 0x2) 375.70884ms ago: executing program 4 (id=132): ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, 0x0) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x60240) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r0, 0xc0a85320, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x80d02, 0x0) socket(0x2, 0x80805, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_TIMEOUT(r1, 0x0, 0x48a, &(0x7f0000000300)={0x2be, 0x81, 0xffff8e34}, 0xc) utimensat(0xffffffffffffffff, 0x0, 0x0, 0x100) openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = socket$caif_seqpacket(0x25, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x80, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, 0x0, 0x0) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb) r4 = fcntl$getown(r2, 0x9) ioctl$sock_FIOGETOWN(r2, 0x8903, 0x0) tgkill(r4, 0x0, 0x1d) pipe2$watch_queue(0x0, 0x80) request_key(&(0x7f0000000240)='dns_resolver\x00', &(0x7f0000000140)={'syz', 0x1}, &(0x7f0000000180)='\x00', 0xfffffffffffffffc) semtimedop(0x0, &(0x7f0000000040), 0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_sco_SCO_CONNINFO(r5, 0x11, 0x2, 0x0, &(0x7f00000003c0)) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 291.520901ms ago: executing program 1 (id=133): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="280002001c00210000000000000000000700000005000000000000e20900020077a9e20000000000"], 0x28}}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000200)={0x1, @pix={0x8d8, 0x5, 0x58565559, 0x6, 0x8000002, 0xb, 0xb, 0xfffffffd, 0x0, 0x6, 0x0, 0x4}}) r5 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000640), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r5, 0xc0285700, &(0x7f0000000100)={0xfffffff8, "07bbfeb30c52d28881875bac175ccb0d6c446593aa7eaba9a256d98e03ab46af", 0xffffffffffffffff}) ioprio_set$pid(0x1, r1, 0x0) ioctl$SYNC_IOC_FILE_INFO(r6, 0xc0383e04, &(0x7f0000000140)={""/32, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000200)=[{}]}) 0s ago: executing program 4 (id=134): sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40081c4}, 0x44000) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0200000004000000020000000c000000001466bfdac3c37dd5273545b9193c412d42832b1bc897a82f6f0b95c99bcf82e5ef1a49736b94ceead334e440a96111d5"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0x2, 0x3, 0x0, 0xad7}, 0x14) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000780)=ANY=[@ANYBLOB="2000000040000701feffffff00000000017c000004004280040001800400028016a31fdf7ce10161d410ff422b8e2fbb5087050c7166e190fcfe13dbf82a57a82fefc92afd799452a689e3a5505df1e8cf0c701ad72839279467c82e3fe76ffc80600202809d4dcd4cc067db037194463cde68290cc1221d89661e517136f46f8a5ac4d4f3c149b0088309c4099b3eff05da02de135771"], 0x20}}, 0xc000) r1 = socket$alg(0x26, 0x5, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) sendmsg$IPVS_CMD_GET_DEST(r0, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10805}, 0x44049) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB, @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.64' (ED25519) to the list of known hosts. [ 81.739821][ T5829] cgroup: Unknown subsys name 'net' [ 81.867086][ T5829] cgroup: Unknown subsys name 'cpuset' [ 81.876574][ T5829] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 83.501534][ T5829] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 86.427158][ T5849] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 86.437531][ T5849] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 86.447267][ T5849] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 86.456077][ T5849] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 86.466254][ T5849] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 86.474293][ T5849] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 86.483014][ T5849] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 86.492005][ T5849] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 86.500297][ T5849] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 86.507942][ T5849] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 86.548601][ T5849] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 86.559586][ T5849] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 86.564408][ T5851] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 86.576477][ T5851] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 86.586267][ T5851] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 86.597131][ T5851] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 86.606223][ T5851] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 86.615737][ T5850] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 86.624736][ T5850] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 86.642348][ T5162] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 86.661276][ T51] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 86.670311][ T51] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 86.678615][ T51] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 86.689489][ T51] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 86.697361][ T51] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 87.423715][ T5845] chnl_net:caif_netlink_parms(): no params data found [ 87.470315][ T5844] chnl_net:caif_netlink_parms(): no params data found [ 87.651689][ T5852] chnl_net:caif_netlink_parms(): no params data found [ 87.714275][ T5846] chnl_net:caif_netlink_parms(): no params data found [ 87.788468][ T5845] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.796061][ T5845] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.804260][ T5845] bridge_slave_0: entered allmulticast mode [ 87.812609][ T5845] bridge_slave_0: entered promiscuous mode [ 87.862801][ T5845] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.870135][ T5845] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.877493][ T5845] bridge_slave_1: entered allmulticast mode [ 87.885362][ T5845] bridge_slave_1: entered promiscuous mode [ 87.893689][ T5856] chnl_net:caif_netlink_parms(): no params data found [ 87.913358][ T5844] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.920672][ T5844] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.928648][ T5844] bridge_slave_0: entered allmulticast mode [ 87.936573][ T5844] bridge_slave_0: entered promiscuous mode [ 87.992049][ T5844] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.999397][ T5844] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.006984][ T5844] bridge_slave_1: entered allmulticast mode [ 88.014696][ T5844] bridge_slave_1: entered promiscuous mode [ 88.098635][ T5845] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.139010][ T5844] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.164397][ T5845] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.197758][ T5844] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.240346][ T5852] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.247912][ T5852] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.255225][ T5852] bridge_slave_0: entered allmulticast mode [ 88.263116][ T5852] bridge_slave_0: entered promiscuous mode [ 88.283584][ T5846] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.290966][ T5846] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.298873][ T5846] bridge_slave_0: entered allmulticast mode [ 88.306746][ T5846] bridge_slave_0: entered promiscuous mode [ 88.336753][ T5852] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.344267][ T5852] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.351776][ T5852] bridge_slave_1: entered allmulticast mode [ 88.359979][ T5852] bridge_slave_1: entered promiscuous mode [ 88.380459][ T5846] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.387958][ T5846] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.395806][ T5846] bridge_slave_1: entered allmulticast mode [ 88.403757][ T5846] bridge_slave_1: entered promiscuous mode [ 88.413917][ T5845] team0: Port device team_slave_0 added [ 88.463925][ T5844] team0: Port device team_slave_0 added [ 88.485913][ T5845] team0: Port device team_slave_1 added [ 88.491881][ T5856] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.499408][ T5856] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.506763][ T5856] bridge_slave_0: entered allmulticast mode [ 88.514893][ T5856] bridge_slave_0: entered promiscuous mode [ 88.539433][ T5844] team0: Port device team_slave_1 added [ 88.570099][ T5856] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.579056][ T51] Bluetooth: hci1: command tx timeout [ 88.579238][ T5856] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.588662][ T5856] bridge_slave_1: entered allmulticast mode [ 88.592554][ T5849] Bluetooth: hci0: command tx timeout [ 88.604247][ T5856] bridge_slave_1: entered promiscuous mode [ 88.615701][ T5852] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.642575][ T5846] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.659922][ T5849] Bluetooth: hci2: command tx timeout [ 88.688117][ T5852] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.714271][ T5846] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.725236][ T5845] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.732191][ T5845] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.758368][ T5849] Bluetooth: hci4: command tx timeout [ 88.764428][ T51] Bluetooth: hci3: command tx timeout [ 88.770366][ T5845] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.809147][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.816260][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.842282][ T5844] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.867864][ T5845] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.874869][ T5845] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.900954][ T5845] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.925218][ T5856] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.949366][ T5844] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.956433][ T5844] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.982594][ T5844] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.010981][ T5846] team0: Port device team_slave_0 added [ 89.021715][ T5846] team0: Port device team_slave_1 added [ 89.031160][ T5856] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 89.044402][ T5852] team0: Port device team_slave_0 added [ 89.091444][ T5852] team0: Port device team_slave_1 added [ 89.194817][ T5846] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.201786][ T5846] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 89.228020][ T5846] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.242481][ T5856] team0: Port device team_slave_0 added [ 89.264262][ T5852] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.271227][ T5852] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 89.297275][ T5852] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.315337][ T5845] hsr_slave_0: entered promiscuous mode [ 89.322439][ T5845] hsr_slave_1: entered promiscuous mode [ 89.331915][ T5846] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.338953][ T5846] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 89.364930][ T5846] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.379088][ T5856] team0: Port device team_slave_1 added [ 89.406428][ T5844] hsr_slave_0: entered promiscuous mode [ 89.413607][ T5844] hsr_slave_1: entered promiscuous mode [ 89.420338][ T5844] debugfs: 'hsr0' already exists in 'hsr' [ 89.426260][ T5844] Cannot create hsr debugfs directory [ 89.433756][ T5852] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.440718][ T5852] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 89.466704][ T5852] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.510391][ T5856] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.517451][ T5856] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 89.543453][ T5856] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.604021][ T5856] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.611016][ T5856] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 89.637134][ T5856] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.818444][ T5852] hsr_slave_0: entered promiscuous mode [ 89.826978][ T5852] hsr_slave_1: entered promiscuous mode [ 89.834564][ T5852] debugfs: 'hsr0' already exists in 'hsr' [ 89.840330][ T5852] Cannot create hsr debugfs directory [ 89.852598][ T5846] hsr_slave_0: entered promiscuous mode [ 89.859789][ T5846] hsr_slave_1: entered promiscuous mode [ 89.866836][ T5846] debugfs: 'hsr0' already exists in 'hsr' [ 89.872590][ T5846] Cannot create hsr debugfs directory [ 89.928714][ T5856] hsr_slave_0: entered promiscuous mode [ 89.942007][ T5856] hsr_slave_1: entered promiscuous mode [ 89.949582][ T5856] debugfs: 'hsr0' already exists in 'hsr' [ 89.955688][ T5856] Cannot create hsr debugfs directory [ 90.550973][ T5845] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 90.570560][ T5845] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 90.587650][ T5845] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 90.601053][ T5845] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 90.652983][ T5849] Bluetooth: hci0: command tx timeout [ 90.658468][ T51] Bluetooth: hci1: command tx timeout [ 90.695700][ T5856] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 90.716021][ T5856] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 90.728473][ T5856] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 90.737331][ T5849] Bluetooth: hci2: command tx timeout [ 90.766406][ T5856] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 90.813121][ T5849] Bluetooth: hci4: command tx timeout [ 90.816490][ T51] Bluetooth: hci3: command tx timeout [ 90.868842][ T5846] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 90.891063][ T5846] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 90.906111][ T5846] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 90.917663][ T5846] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 91.067473][ T5852] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 91.095903][ T5852] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 91.107787][ T5852] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 91.120375][ T5852] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 91.144789][ T5845] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.260137][ T5844] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 91.271816][ T5844] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 91.289946][ T5845] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.306450][ T5844] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 91.319059][ T5844] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 91.339046][ T5856] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.390142][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.397631][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.461681][ T5856] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.470771][ T35] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.477933][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.526871][ T148] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.534145][ T148] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.579727][ T148] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.586942][ T148] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.671850][ T5846] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.790902][ T5846] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.808244][ T5852] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.858983][ T148] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.866273][ T148] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.881586][ T993] cfg80211: failed to load regulatory.db [ 91.918048][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.925293][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 92.018552][ T5852] 8021q: adding VLAN 0 to HW filter on device team0 [ 92.060152][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.067548][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 92.101228][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.108514][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 92.130832][ T5844] 8021q: adding VLAN 0 to HW filter on device bond0 [ 92.202104][ T5844] 8021q: adding VLAN 0 to HW filter on device team0 [ 92.247223][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 92.254445][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 92.271485][ T5845] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.300853][ T1012] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.308118][ T1012] bridge0: port 2(bridge_slave_1) entered forwarding state [ 92.405403][ T5856] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.734594][ T51] Bluetooth: hci0: command tx timeout [ 92.737603][ T5849] Bluetooth: hci1: command tx timeout [ 92.779521][ T5856] veth0_vlan: entered promiscuous mode [ 92.812909][ T5849] Bluetooth: hci2: command tx timeout [ 92.887737][ T5846] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.894948][ T5849] Bluetooth: hci3: command tx timeout [ 92.905018][ T5849] Bluetooth: hci4: command tx timeout [ 92.911317][ T5856] veth1_vlan: entered promiscuous mode [ 93.008889][ T5845] veth0_vlan: entered promiscuous mode [ 93.047505][ T5852] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 93.078903][ T5845] veth1_vlan: entered promiscuous mode [ 93.119631][ T5844] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 93.141277][ T5856] veth0_macvtap: entered promiscuous mode [ 93.175469][ T5856] veth1_macvtap: entered promiscuous mode [ 93.195754][ T5846] veth0_vlan: entered promiscuous mode [ 93.238224][ T5846] veth1_vlan: entered promiscuous mode [ 93.288257][ T5856] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.303755][ T5856] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.326718][ T5845] veth0_macvtap: entered promiscuous mode [ 93.363642][ T35] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.389870][ T5845] veth1_macvtap: entered promiscuous mode [ 93.400590][ T35] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.412454][ T35] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.422229][ T5852] veth0_vlan: entered promiscuous mode [ 93.441175][ T35] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.469625][ T5844] veth0_vlan: entered promiscuous mode [ 93.507645][ T5852] veth1_vlan: entered promiscuous mode [ 93.529743][ T5846] veth0_macvtap: entered promiscuous mode [ 93.541503][ T5845] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.576406][ T5845] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.589725][ T5846] veth1_macvtap: entered promiscuous mode [ 93.609198][ T5844] veth1_vlan: entered promiscuous mode [ 93.660110][ T35] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.684193][ T35] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.693959][ T35] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.709516][ T1012] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.726234][ T1012] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.739435][ T35] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.815287][ T5846] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.828829][ T5852] veth0_macvtap: entered promiscuous mode [ 93.864869][ T5852] veth1_macvtap: entered promiscuous mode [ 93.884086][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.892173][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.905555][ T5846] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.943734][ T35] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.955211][ T35] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.970771][ T35] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.997922][ T5844] veth0_macvtap: entered promiscuous mode [ 94.010315][ T35] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.036896][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.053639][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.067178][ T5844] veth1_macvtap: entered promiscuous mode [ 94.078553][ T5856] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 94.092605][ T5852] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.135198][ T5852] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.187727][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.227701][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.246910][ T148] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.256730][ T148] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.267051][ T148] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.301056][ T148] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.315323][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.364120][ T5844] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.443387][ T75] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.467521][ T75] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.492185][ T75] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.492300][ T1012] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.511728][ T75] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.543745][ T1012] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.701595][ T5967] Zero length message leads to an empty skb [ 94.750970][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.777295][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.812914][ T5849] Bluetooth: hci1: command tx timeout [ 94.817942][ T51] Bluetooth: hci0: command tx timeout [ 94.865654][ T5964] ISOFS: Unable to identify CD-ROM format. [ 94.902873][ T51] Bluetooth: hci2: command tx timeout [ 94.923534][ T1012] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.953229][ T1012] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.983910][ T51] Bluetooth: hci4: command tx timeout [ 94.983934][ T5849] Bluetooth: hci3: command tx timeout [ 95.045486][ T75] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.072764][ T75] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.173122][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.197492][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.761588][ T148] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.786470][ T148] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.628353][ T993] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 98.802730][ T993] usb 1-1: Using ep0 maxpacket: 8 [ 98.850879][ T993] usb 1-1: config index 0 descriptor too short (expected 30, got 18) [ 98.928262][ T993] usb 1-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 98.957970][ T993] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.995538][ T993] usb 1-1: Product: syz [ 99.014759][ T993] usb 1-1: Manufacturer: syz [ 99.033970][ T993] usb 1-1: SerialNumber: syz [ 99.070847][ T993] usb 1-1: config 0 descriptor?? [ 99.122546][ T993] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 99.168891][ T993] usb 1-1: setting power ON [ 99.259422][ T993] dvb-usb: bulk message failed: -22 (2/0) [ 99.800171][ T993] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 99.835147][ T993] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 99.961805][ T993] usb 1-1: media controller created [ 100.036734][ T993] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 100.150111][ T993] usb 1-1: selecting invalid altsetting 6 [ 100.162788][ T993] usb 1-1: digital interface selection failed (-22) [ 100.175222][ T993] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 100.190154][ T993] usb 1-1: setting power OFF [ 100.202196][ T993] dvb-usb: bulk message failed: -22 (2/0) [ 100.213747][ T993] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 100.223683][ T993] (NULL device *): no alternate interface [ 101.157911][ T993] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 102.175527][ T993] usb 1-1: USB disconnect, device number 2 [ 103.370871][ T6034] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 103.904778][ T993] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 104.072761][ T993] usb 2-1: Using ep0 maxpacket: 32 [ 104.108586][ T993] usb 2-1: config 0 has an invalid interface number: 85 but max is 0 [ 104.143763][ T993] usb 2-1: config 0 has no interface number 0 [ 104.165277][ T993] usb 2-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 104.182166][ T993] usb 2-1: config 0 interface 85 has no altsetting 0 [ 104.205712][ T993] usb 2-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 104.219088][ T6048] syz.2.21 uses obsolete (PF_INET,SOCK_PACKET) [ 104.233366][ T993] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 104.250546][ T993] usb 2-1: Product: syz [ 104.256701][ T993] usb 2-1: Manufacturer: syz [ 104.270215][ T993] usb 2-1: SerialNumber: syz [ 104.288656][ T993] usb 2-1: config 0 descriptor?? [ 105.127501][ T6066] TCP: tcp_parse_options: Illegal window scaling value 150 > 14 received [ 105.212962][ T993] appletouch 2-1:0.85: Geyser mode initialized. [ 105.462554][ T993] input: appletouch as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.85/input/input5 [ 107.937711][ T29] audit: type=1800 audit(1773961539.180:2): pid=6087 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.29" name="file1" dev="overlay" ino=46 res=0 errno=0 [ 108.544802][ T10] usb 2-1: USB disconnect, device number 2 [ 108.668840][ T10] appletouch 2-1:0.85: input: appletouch disconnected [ 109.034339][ T6094] syzkaller0: entered promiscuous mode [ 109.044000][ T6094] syzkaller0: entered allmulticast mode [ 112.597974][ T6134] ======================================================= [ 112.597974][ T6134] WARNING: The mand mount option has been deprecated and [ 112.597974][ T6134] and is ignored by this kernel. Remove the mand [ 112.597974][ T6134] option from the mount to silence this warning. [ 112.597974][ T6134] ======================================================= [ 113.131017][ T6141] TCP: tcp_parse_options: Illegal window scaling value 150 > 14 received [ 113.532938][ T5941] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 113.702752][ T5941] usb 1-1: Using ep0 maxpacket: 32 [ 113.717534][ T5941] usb 1-1: config 0 has an invalid interface number: 85 but max is 0 [ 113.738687][ T5941] usb 1-1: config 0 has no interface number 0 [ 113.750669][ T5941] usb 1-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 113.767330][ T5941] usb 1-1: config 0 interface 85 has no altsetting 0 [ 113.815294][ T5941] usb 1-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 113.868749][ T5941] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 113.910524][ T5941] usb 1-1: Product: syz [ 113.939214][ T5941] usb 1-1: Manufacturer: syz [ 113.956387][ T5941] usb 1-1: SerialNumber: syz [ 113.971312][ T5941] usb 1-1: config 0 descriptor?? [ 115.526998][ T5941] appletouch 1-1:0.85: Failed to request geyser raw mode [ 115.620937][ T5941] appletouch 1-1:0.85: probe with driver appletouch failed with error -5 [ 115.949762][ T5941] usb 1-1: USB disconnect, device number 3 [ 115.984051][ T6164] team0: No ports can be present during mode change [ 117.098711][ T6183] bond0: (slave bond_slave_1): Releasing backup interface [ 117.461990][ T6190] TCP: tcp_parse_options: Illegal window scaling value 150 > 14 received [ 120.096244][ T6212] hfs: can't find a HFS filesystem on dev nullb0 [ 121.353146][ T5941] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 121.537228][ T5941] usb 4-1: Using ep0 maxpacket: 32 [ 121.552964][ T5941] usb 4-1: config 0 has an invalid interface number: 85 but max is 0 [ 121.572796][ T5941] usb 4-1: config 0 has no interface number 0 [ 121.588645][ T5941] usb 4-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 121.608737][ T5941] usb 4-1: config 0 interface 85 has no altsetting 0 [ 121.622344][ T5941] usb 4-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 121.641149][ T5941] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 121.650069][ T5941] usb 4-1: Product: syz [ 121.654596][ T5941] usb 4-1: Manufacturer: syz [ 121.725539][ T5941] usb 4-1: SerialNumber: syz [ 121.748222][ T5941] usb 4-1: config 0 descriptor?? [ 121.796107][ T6235] usb usb6: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 122.864026][ T5941] appletouch 4-1:0.85: Failed to request geyser raw mode [ 122.955896][ T5941] appletouch 4-1:0.85: probe with driver appletouch failed with error -5 [ 122.977915][ T5941] usb 4-1: USB disconnect, device number 2 [ 123.050575][ T6231] netlink: 4 bytes leftover after parsing attributes in process `syz.1.71'. [ 124.190112][ T6231] team0: Port device team_slave_0 removed [ 125.372007][ T6236] netlink: 'syz.1.71': attribute type 1 has an invalid length. [ 126.423317][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c2!!! [ 128.314259][ T5941] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 128.678588][ T5941] usb 1-1: Using ep0 maxpacket: 32 [ 128.930171][ T5941] usb 1-1: config 0 has an invalid interface number: 85 but max is 0 [ 128.944791][ T5941] usb 1-1: config 0 has no interface number 0 [ 128.953831][ T5941] usb 1-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 129.013836][ T5941] usb 1-1: config 0 interface 85 has no altsetting 0 [ 129.045907][ T5941] usb 1-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 129.070990][ T5941] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 129.103077][ T5941] usb 1-1: Product: syz [ 129.117595][ T5941] usb 1-1: Manufacturer: syz [ 129.141000][ T5941] usb 1-1: SerialNumber: syz [ 129.192817][ T5941] usb 1-1: config 0 descriptor?? [ 130.694793][ T5941] appletouch 1-1:0.85: Geyser mode initialized. [ 130.731653][ T5941] input: appletouch as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.85/input/input8 [ 132.422495][ T6315] TCP: tcp_parse_options: Illegal window scaling value 150 > 14 received [ 132.490407][ T6323] netlink: 20 bytes leftover after parsing attributes in process `syz.1.95'. [ 132.870801][ T1317] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.884601][ T1317] ieee802154 phy1 wpan1: encryption failed: -22 [ 134.133338][ T1225] usb 1-1: USB disconnect, device number 4 [ 134.268243][ T1225] appletouch 1-1:0.85: input: appletouch disconnected [ 135.857796][ T1225] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 136.063310][ T1225] usb 1-1: Using ep0 maxpacket: 16 [ 136.183193][ T6357] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 136.216608][ T6357] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 136.288962][ T1225] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 136.516775][ T1225] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 136.551181][ T1225] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 136.621957][ T1225] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 136.700916][ T1225] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 136.851591][ T1225] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 136.873627][ T1225] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 136.885648][ T1225] usb 1-1: Manufacturer: syz [ 137.099510][ T1225] usb 1-1: config 0 descriptor?? [ 138.087697][ T6370] loop6: detected capacity change from 0 to 7 [ 138.130477][ T6371] netlink: 12 bytes leftover after parsing attributes in process `syz.3.108'. [ 138.222053][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 138.231497][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 138.410044][ T1225] rc_core: IR keymap rc-hauppauge not found [ 138.416542][ T1225] Registered IR keymap rc-empty [ 138.421884][ T1225] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 138.455305][ T1225] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 138.471296][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 138.480533][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 138.492029][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 138.501380][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 139.473809][ T6376] syz.0.109 (6376) used greatest stack depth: 16392 bytes left [ 139.492474][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 139.501883][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 139.512685][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 139.521882][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 139.632958][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 140.180488][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 140.189733][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 140.203859][ T6371] netlink: 68 bytes leftover after parsing attributes in process `syz.3.108'. [ 140.213141][ T6371] netlink: 68 bytes leftover after parsing attributes in process `syz.3.108'. [ 140.359964][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 140.369192][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 140.386067][ T6370] ldm_validate_partition_table(): Disk read failed. [ 140.396819][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 140.406105][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 140.423469][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 140.432766][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 140.444009][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 140.453294][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 140.956468][ T1225] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 140.972297][ T1225] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input9 [ 141.130588][ T6370] Dev loop6: unable to read RDB block 0 [ 141.157809][ T1225] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 141.189815][ T6370] loop6: unable to read partition table [ 141.220740][ T6370] loop6: partition table beyond EOD, truncated [ 141.230783][ T1225] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 141.259863][ T6370] loop_reread_partitions: partition scan of loop6 (Sj̖P=ý?}X %`ր5) failed (rc=-5) [ 141.303254][ T1225] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 141.361681][ T1225] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 141.412786][ T1225] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 141.463513][ T1225] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 141.512846][ T1225] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 141.564540][ T1225] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 141.746675][ T1225] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 141.825016][ T1225] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 142.798136][ T1225] mceusb 1-1:0.0: Registered with mce emulator interface version 1 [ 142.834712][ T1225] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 142.874338][ T1225] usb 1-1: USB disconnect, device number 5 [ 143.022981][ T5941] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 143.552859][ T5941] usb 3-1: Using ep0 maxpacket: 32 [ 143.565573][ T5941] usb 3-1: config 139 has an invalid interface number: 49 but max is 0 [ 143.604699][ T5941] usb 3-1: config 139 has no interface number 0 [ 143.642915][ T5941] usb 3-1: config 139 interface 49 has no altsetting 0 [ 143.886731][ T5941] usb 3-1: New USB device found, idVendor=10c4, idProduct=8244, bcdDevice=72.75 [ 144.142722][ T5941] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 144.159513][ T5941] usb 3-1: Product: syz [ 144.170840][ T5941] usb 3-1: Manufacturer: syz [ 144.177554][ T5941] usb 3-1: SerialNumber: syz [ 145.320587][ T6430] TCP: tcp_parse_options: Illegal window scaling value 150 > 14 received [ 145.691180][ T6434] loop6: detected capacity change from 0 to 7 [ 145.762859][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 145.873816][ T6435] netlink: 12 bytes leftover after parsing attributes in process `syz.4.125'. [ 146.042526][ C0] blk_print_req_error: 10 callbacks suppressed [ 146.042547][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 146.058007][ C0] buffer_io_error: 10 callbacks suppressed [ 146.058023][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 146.087826][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 146.097069][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 146.116753][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 146.126001][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 146.150456][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 146.159708][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 146.179996][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 146.189255][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 146.204172][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 146.213371][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 146.224405][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 146.233626][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 146.241916][ T6434] ldm_validate_partition_table(): Disk read failed. [ 146.252026][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 146.261254][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 146.277299][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 146.286528][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 146.301301][ C0] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 146.310518][ C0] Buffer I/O error on dev loop6, logical block 0, async page read [ 146.325693][ T6434] Dev loop6: unable to read RDB block 0 [ 146.351110][ T6434] loop6: unable to read partition table [ 146.358271][ T6434] loop6: partition table beyond EOD, truncated [ 146.364736][ T6434] loop_reread_partitions: partition scan of loop6 (Sj̖P=ý?}X %`ր5) failed (rc=-5) [ 146.687024][ T5941] radio-usb-si4713 3-1:139.49: Si4713 development board discovered: (10C4:8244) [ 146.734495][ T6436] netlink: 68 bytes leftover after parsing attributes in process `syz.4.125'. [ 146.753443][ T6436] netlink: 68 bytes leftover after parsing attributes in process `syz.4.125'. [ 146.766623][ T5941] radio-usb-si4713 3-1:139.49: probe with driver radio-usb-si4713 failed with error -71 [ 147.756850][ T5941] usbhid 3-1:139.49: couldn't find an input interrupt endpoint [ 147.767189][ T5941] usb 3-1: USB disconnect, device number 2 [ 151.482129][ T6447] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] SMP KASAN PTI [ 151.494073][ T6447] KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] [ 151.502496][ T6447] CPU: 0 UID: 0 PID: 6447 Comm: syz.2.129 Tainted: G L syzkaller #0 PREEMPT(full) [ 151.513249][ T6447] Tainted: [L]=SOFTLOCKUP [ 151.517616][ T6447] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 151.527676][ T6447] RIP: 0010:rwsem_mark_wake+0xfa/0x7c0 [ 151.533130][ T6447] Code: 01 00 74 08 4c 89 f7 e8 94 d9 8d 00 4c 89 74 24 10 4d 8b 26 4d 8d 74 24 18 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 75 06 00 00 41 83 3e 00 74 64 4c 89 ef be [ 151.552719][ T6447] RSP: 0018:ffffc900066f79a0 EFLAGS: 00010006 [ 151.558774][ T6447] RAX: 0000000000000003 RBX: 0000000000000000 RCX: dffffc0000000000 [ 151.566748][ T6447] RDX: 1ffff92000cdef40 RSI: ffffffff8e1b1f01 RDI: ffffffff8c287200 [ 151.574716][ T6447] RBP: ffffc900066f7aa0 R08: 0000000000000003 R09: 0000000000000004 [ 151.582695][ T6447] R10: dffffc0000000000 R11: fffff52000cdef50 R12: 0000000000000000 [ 151.590662][ T6447] R13: ffff88802eaa8f50 R14: 0000000000000018 R15: ffffc900066f7c20 [ 151.598637][ T6447] FS: 0000555594f2a500(0000) GS:ffff888125436000(0000) knlGS:0000000000000000 [ 151.607560][ T6447] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 151.614134][ T6447] CR2: 00002000003bd030 CR3: 000000007d386000 CR4: 00000000003526f0 [ 151.622110][ T6447] Call Trace: [ 151.625396][ T6447] [ 151.628326][ T6447] ? __lock_acquire+0x6b5/0x2cf0 [ 151.633272][ T6447] ? __pfx_rwsem_mark_wake+0x10/0x10 [ 151.638563][ T6447] ? do_raw_spin_lock+0x12b/0x2f0 [ 151.643586][ T6447] rwsem_del_wake_waiter+0x25d/0x2e0 [ 151.648872][ T6447] rwsem_down_write_slowpath+0xa6f/0x1080 [ 151.654613][ T6447] ? rwsem_down_write_slowpath+0x4a3/0x1080 [ 151.660516][ T6447] ? __pfx_rwsem_down_write_slowpath+0x10/0x10 [ 151.666674][ T6447] ? futex_wake+0x4ac/0x580 [ 151.671175][ T6447] ? __pfx_futex_wait+0x10/0x10 [ 151.676039][ T6447] ? vm_mmap_pgoff+0x234/0x4f0 [ 151.680797][ T6447] down_write_killable+0x1eb/0x240 [ 151.685916][ T6447] ? __pfx_down_write_killable+0x10/0x10 [ 151.691564][ T6447] ? apparmor_mmap_file+0x197/0x3e0 [ 151.696757][ T6447] ? security_mmap_file+0x4df/0xa20 [ 151.701956][ T6447] vm_mmap_pgoff+0x234/0x4f0 [ 151.706545][ T6447] ? __se_sys_futex+0x3a8/0x450 [ 151.711389][ T6447] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 151.716515][ T6447] ? __pfx___se_sys_futex+0x10/0x10 [ 151.721711][ T6447] ? rcu_is_watching+0x15/0xb0 [ 151.726471][ T6447] ? ksys_mmap_pgoff+0xf3/0x760 [ 151.731338][ T6447] ? __x64_sys_mmap+0x7f/0x140 [ 151.736139][ T6447] do_syscall_64+0x14d/0xf80 [ 151.740779][ T6447] ? trace_irq_disable+0x3b/0x150 [ 151.745810][ T6447] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 151.751872][ T6447] ? clear_bhb_loop+0x40/0x90 [ 151.756550][ T6447] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 151.762442][ T6447] RIP: 0033:0x7fbe10f9c502 [ 151.766889][ T6447] Code: 4f 01 00 0f 1f 44 00 00 41 f7 c1 ff 0f 00 00 75 27 55 89 cd 53 48 89 fb 48 85 ff 74 3b 41 89 ea 48 89 df b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 6e 5b 5d c3 0f 1f 00 48 c7 c0 e8 ff ff ff 64 [ 151.786497][ T6447] RSP: 002b:00007ffdeac6e358 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 151.794904][ T6447] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fbe10f9c502 [ 151.802864][ T6447] RDX: 0000000000000000 RSI: 0000000000021000 RDI: 0000000000000000 [ 151.810825][ T6447] RBP: 0000000000020022 R08: 00000000ffffffff R09: 0000000000000000 [ 151.818786][ T6447] R10: 0000000000020022 R11: 0000000000000246 R12: 00007ffdeac6e4c0 [ 151.826772][ T6447] R13: ffffffffffffffc0 R14: 0000000000001000 R15: 0000000000000000 [ 151.834769][ T6447] [ 151.837798][ T6447] Modules linked in: [ 151.841692][ T6447] ---[ end trace 0000000000000000 ]--- [ 151.847169][ T6447] RIP: 0010:rwsem_mark_wake+0xfa/0x7c0 [ 151.852646][ T6447] Code: 01 00 74 08 4c 89 f7 e8 94 d9 8d 00 4c 89 74 24 10 4d 8b 26 4d 8d 74 24 18 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 75 06 00 00 41 83 3e 00 74 64 4c 89 ef be [ 151.872263][ T6447] RSP: 0018:ffffc900066f79a0 EFLAGS: 00010006 [ 151.878327][ T6447] RAX: 0000000000000003 RBX: 0000000000000000 RCX: dffffc0000000000 [ 151.886297][ T6447] RDX: 1ffff92000cdef40 RSI: ffffffff8e1b1f01 RDI: ffffffff8c287200 [ 151.894269][ T6447] RBP: ffffc900066f7aa0 R08: 0000000000000003 R09: 0000000000000004 [ 151.902234][ T6447] R10: dffffc0000000000 R11: fffff52000cdef50 R12: 0000000000000000 [ 151.910204][ T6447] R13: ffff88802eaa8f50 R14: 0000000000000018 R15: ffffc900066f7c20 [ 151.918177][ T6447] FS: 0000555594f2a500(0000) GS:ffff888125436000(0000) knlGS:0000000000000000 [ 151.927123][ T6447] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 151.933716][ T6447] CR2: 00002000003bd030 CR3: 000000007d386000 CR4: 00000000003526f0 [ 151.941687][ T6447] Kernel panic - not syncing: Fatal exception [ 153.101671][ T6447] Shutting down cpus with NMI [ 153.107018][ T6447] Kernel Offset: disabled [ 153.111374][ T6447] Rebooting in 86400 seconds..