last executing test programs: 21m8.437189812s ago: executing program 1 (id=2512): timer_create(0x0, 0x0, &(0x7f0000000300)=0x0) r1 = syz_open_dev$sg(&(0x7f0000000140), 0xa, 0x28102) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f00000001c0)=0x2001) r2 = fcntl$dupfd(r1, 0x0, r1) readv(r2, &(0x7f0000000180)=[{&(0x7f0000000200)=""/132, 0x84}], 0x1) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) write$snddsp(r2, &(0x7f0000000340)="87ecc00c05dbb58b776f34f9b779d998d21e0e3353174bb169f81d1590532836dee366", 0x23) unshare(0x40200) semtimedop(0x0, &(0x7f0000000100)=[{0x4, 0x3, 0x1800}, {0x0, 0xffbf, 0x2000}], 0x2, 0x0) semop(0x0, &(0x7f0000000380)=[{0x2, 0xce92, 0x1000}], 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) 21m6.927366796s ago: executing program 1 (id=2518): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$can_j1939(r1, 0x0, 0x0) r3 = socket(0x1d, 0x2, 0x6) r4 = mmap$IORING_OFF_SQES(0x0, 0x1000, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, r4, &(0x7f0000000040)={0x2e, 0x3a, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x33f81df2, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f00000000c0)) setsockopt$ALG_SET_KEY(r3, 0x6a, 0x1, 0x0, 0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) bind$can_j1939(r3, &(0x7f0000000040)={0x1d, r5, 0x8000000000000003, {0x0, 0xf}, 0xff}, 0x18) sendmmsg(r1, &(0x7f000000a540), 0x0, 0x41) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newtfilter={0x24, 0x11, 0x1, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x74, r2, {0xb, 0xfff2}, {0xfff1, 0xffff}, {0x2, 0xd}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4012}, 0x20000050) 21m6.770089632s ago: executing program 1 (id=2520): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x77c, @empty, 0x1}, 0x1c) listen(r0, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r1, &(0x7f00000000c0)={0x2, 0x4e22, @empty}, 0x10) r2 = accept(r0, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xfffffdef}}, 0x44800) ioctl$KVM_SET_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee1, 0x0) recvfrom(r1, &(0x7f0000000200)=""/60, 0xfffffffffffffecb, 0x4100, 0x0, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x20) socket$nl_route(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f0000002d40)=[{{&(0x7f0000000240)=@isdn={0x22, 0x2, 0x6, 0x6, 0x1}, 0x80, &(0x7f0000000580)=[{0x0}, {&(0x7f0000000380)="43bee352abcf6c9174738d798ca4e5329a5e036ebbad9432c4a553a6bb", 0x1d}, {&(0x7f0000000400)}], 0x3, &(0x7f0000003000)=ANY=[], 0x3b0}}, {{&(0x7f0000000940)=@in={0x2, 0x4e22, @broadcast}, 0x80, &(0x7f0000001f80)=[{&(0x7f00000009c0)}, {0x0}, {&(0x7f0000000c80)}, {&(0x7f0000000d80)="99294cef3b1cc702e997afd2a0f510cf0ab079b75c4f7fbf0c777885b86f4da668b3843c721b87dba728b78de673504e57a7ae997a068b8340bf1d062f18d83bf19ed9681f6cfdeff3980bdcda89ed977f6f0cb4f93f1c7e09cb4c8fdc67c39beb500a5beee65d0e4d2315e957e206c1257b0846ad128370b4c1c5325a4c1864b1f9a0cc6b33c17db92e1035478374ac743a5f8fc761840b0131d906e342e061660dd9437843ad8016d120d519d7269ec753c8a4f5a5a86fff4cfa0e794e06abda84729a5d5a1852264e76024df242d52fc1fcba90709a1e7d82a284b4fafeeee656249caa5252746c872c024ad531fead7340846508f6c17c868192699226466ebae086b54dcb6a07c784c24d8cb3dd0afd4cebe3dcbe0923e3eb65b5b67a0043a62803adfb91c708007d820a8d3de4379774743d645e8469dae0ab1f213708e4e45a30a9e91288f078688e9cb7c8b3ea949eab4cff099cde5885ed6607d3ea8c0e75b84fa13f81ae437a39cc07c1e87b1d14c5e2ed82211591847317dfb4e747ae51ebb5982676b0e24d31ad3648151b8b0d13985dffc462ec3dcfc914cbacef349bb8d424e71175b18ccd54967ba0cc6794554539460925a91c32c906d14a88e95b918d3e7adb9ddb79e65de60af73b2b8fe29d856fc6a6c5ab881e66d97e8a1462ef728cf531ef0a7a1958f79cca7a7a0942fea608566f19e6f1bd3c8ccf0efcb1ba0cddf89af196dd85137d7fa8b599982077f117dc63ec1cf4641ed7f81c58e1b26325575c5c80829b26cb62df5f4c21fe55c53a836b4a7961236e791187336777923300e79c306a0a0a17119561387c5f2a3d54a84763631e39b73262dd3784d9c81402f3338d2a25e277d6de9a06c6d207ce604bf826c932a819ad2a9c005986e069c92949cc1f6ae7672e0c8ef548cbf2401b6636cee97d4985723ab3f4f42d7f954cf25c6dc81858b6ab4a1bfbe894f8f0a3f0dcc2406935183166f0d6c3833ca348932d3b927415d0c8f7c5912f09a310ae2f9c630ed432764abcf1dcf7fa165e0329f4b7faf20b93124db9e9a42951f698f662c8115d5c395903d854bd8285ab271f278feeffc9e3db5422d6a1a75fb54cf8e7eca556d31928592c2734f67a8f433e2bd9ef6ae6a7f407b919137123fe43d4dffe05379624b9493583e8cc51a739a70b984dc337556c2785c7b8cd8089f47d6e1dc2d39d315d805041bf31acf5a85b70cb25b0abec953c5f292367b5861e26d61ff2e0dc5c771a84c30973ce9896694c76a9d4bfe6fee5c2107497eb3fee32032a773f8c1e7013f0e926f1b504c80cde9e5c853512395cce51a0412c88312a4be25a2f1f2ba0385990b438353771513456fc0d70f601ac83059ba571bec55d25b1afa953c9b710a5167ce4a1c9865e12e995bb0b7b8b6648feef8f58152265163286c307d73f018254a2784e38070ea7ef9666f4d7d9256a6caa03bbcbb54dc844c2b7069b2e633d7d682fe5da90ead361d3033dde116484bc0ad17bea55e903d6620ed0bf257e1b1c0885fe182f32de59185d2e32ef34c33ec5e6735afea9c0f1890a00c3247a243682c4aa7824e6134ba2d5511cd9121ae9613622c4d20b488dc08ace82e5b29440dc868c0ce27aa659bb19ac3f3cd666a6c25e38081c02b3c6d8cd4239f885182a8807caec278a626d3482569eb4d14b6c48502f0aad106f42bc953d67741694522a68552f7b65b876073ca7f50a3b3f2063bb0796836a78fe89a5261d219dacdd8b7c0f3ae70e29451c961182d54505eee26f24bd30bc2cfb67df417db53f5b3c2c6f24a4087fd3df4ade7ab2225bfd6ae89a69f229e4d1e858cb7e263ecafc2eefe6a7035fe3885ab8d787cf92f3f46c870b3f93092d4de1360679889a02407bb720307f144aa1fdc96da1e30dde67bf465a7b960f92fbf0b774978735c78981c04a929b792539aef153eedb174651c5dee27af7700bd3b9a276ef7975063a4edfdcc56502fde538f7a631c3899fcba7b20085d0e1c279ab91513d6588715a4f72140672af279a00890f22af607d4dd0f70991bf6995a72541d2b3b31e05130a9ef546d7661ddb95f26782d3a3d440b7b9e0ee73555285ab57e4991e0f8eff489331549effd0e122d2488c2503e3ae217477bcfd6dea39a184a8b48295c62f2cdf9874edc90f5b89819cf27ada8391fb7e58f755cf53612d0f690a1beb7becb1a31ed2db435e3acdf5c9c280d3c2cf98d361a46c60859437040ba13edf3809715128d4c6f21b17e39d418105eee301300a0f3653e52a7c28c1d045e1e48f320a38959283a4b7819156ac4c70ac9f3433857c1648e84269fb65f8ee1c3f54c4b9f4c3bc0be2446da6bddf5400ddfac244205ac71b4f05d44746c7665741a5bbd42db019b403c01b9109c0842d9a4cb02035e66e041b6f19240b8ad2462a84b4d095a181b5a67de04afa92ee8dc538ee7541c0b918e3aeaa9b1fc1ea678538151c3e46ecd0edfcac40c40324d5f57635c1a7cc3970a0b296b9ef148284ab1b0d36293f63e387cf586e24da466953e033787c0fa221fd3951181fbf0367916ed5bc63d38873bb88ca696ab65f14562a9c4f6daab45646bb5cc3731ce7e41d809f5a14e39b8c7b8acab1ce168d7684e526ece176e604831f177ec2debf36454a202d9f2fb43ed2b80ac7063b83673ce2fa1ba4a187bc67759fda5dd5d38a3aa8ce241a2c80752b719d21d2edc7811033c14bc53457c6382f26a3ac3767ef021e75796551dadb66f1039eb5e8aa7436a965012ea9472846ffb0d306a047b9f423cd716bc881e82a541d0b78fa65ea8c7c4a92b21099f2c1793683c0ea0c64930087cd520726bb16c8e7a2425184730750e0c71cc317ce9366a73d920269ac474fc5a8d5ae3ee9973bb320c911c3e201f8ec0540bbffcc782ff59a40d88e646e67ebd16ec2e7083fd9ce4380a192a73bd2258f9c5246dec54033214d04d56fa355732f80c149b32627de2e0cff41eac8cba214d2d1e00876b52c4f598398233db41106845564b014dea8981ab45999b9d6459e869785839233e5193111566fe328949d39777cca1aa24394a31f55a64c0a41a285be99e1fac0a9a12d732ca7b91aa5127499fa49e24f12c3e52d3d56d2044f80889ba4bf06e319c46efaca8f0368b39d96c02cebdfc89107805211f459295652ed81106a2a945083036617a43e51353e566e1b7b362e1ff46214eaea5e5545a828192276c1eb102d69a9a9c519c2240d7835781b8eaff8b1fd162f03f9f770fb8e44b35a58b160bfaa9c57ee67b5c881a7c170a5495979ef2d2f65549c5cdd2c9228dbcab7ea75ee046a0918df50ee63d6892333da7280f72571d9cae6d9171afbba31e966bde1cd438e83ec06d602cc5436b468d8cf235129a0ecec03702c8e15277761e965f7c7571e1beb078f93a9710e0a400b5c9d50d09026ad997f780148eecdc2867666b6b08a037327ec655585204a156bc57177b7bbeab08cdf0686885b9e7e68f9ced5a1a46382a0f231efb03cda777811aa20fff2610772fd84583e1d7d94607fa3eedc53dd4c9d274d707f6df73cdbc7b62371cbe727d8009dfb73ae3554ab5cd2cc2bca03ed09d4ceaaf902f58867c489c516141ddf6e7ec453b6bf5ebe1a3e82fe5245d02426c668dbc30f2cddaf76bcd8b90f86e46ab1487b9140b4321f80dc39da3993f954242a2f33b8e3f1939e8cb83f88de1169bf180b27ed57b69a82b013f98e1e211aab81edc93aa3c9251addaadf077184e5f2db438753022c98cd696329b7045a53ef429a50fc2fb63bb8a87769eac556bd2d1e30fbb7ecd0803f7eea54a500c9030daef8c291a1f4ea64a473b5f275cb3fc90137266628c1ca9814cbfa50de28649ee58bdbec0bb25d1192e889fb3d1d59e690b78735c06cab5d2bdb3156614430069bbecfbbe89737a313460e32fa2956dec9d32f194ff1fd8569e3979d72a1417e1211956ef717a4be20b7f96820d6f1585557469ec2fb6b8088f8c0e0a42147221b5b14e2ab3d87ac450350633a2a4d7c19565cd4795772fffabf3ed0b4c536a0f09eeaadbceb613f753f4ec424f14e99cc5248562ea5dda3ccf661e84df7d38ecc90419f08e5659233ae2a289117188aa610317c94fc7b85d9874737f5d93aae748204f7f94c8611bd96928f0ca1b7301cd4c22cc7e7a0b1a6ace17303a4a6ac90f5b91eebc7430136a35c2e70e6a31b28a9b3f47b08b1cc32e70238df7ba14295556ddbce0191ede93d6be63ce299912cfbb2534ef51854d9ea06a4e645acec9002c69275ccc948adfb6c5704fbc4a807e3ac9c7e6e0d9e59c4d112a52116bb344ff37a2ebbb66ffc219f814dff8048059b6d34ec60107293c15c5debc0c82348059420153a0d15a088ea22e7161fcc7a5a7991770bbc2a9a22562eafd7519bed99c45411551f28236c8b26f88dc5d39b644c1f026747330ba00952b22dc61d44c5553edf96696669e20a7fc7bc7598e182509f5e2324e79085f3fa4db7de81666a1f5d5a4473375d9297cd1c5f8a822a06c3b92a19cd624b97d0268860c6e160508da61e5a852d69e635bf846c64bfb8b8e211d5854af31530317b4f8b922408f1e457bda1228e7611ee73bdc46e7d851ca9700866cefa5113f5704190d2db2b7df8e1098aadc0cb42d5ccfaa472cb1c8bb9b263f60b483301a16c21070872a0c9754e9168d3b1110eb646dee5eb17f25bb51c3cf853ca3af7717eaab29d66d3e08778e64972a35b1cbd997a44a759dacf3a558dc09838f1d2df4b66171cba8a49156228aeafd071a95451", 0xd4c}], 0x4, &(0x7f0000002040)=ANY=[@ANYBLOB="7800000000000000010000000500000003f3200500f4b73680c040a8d1837f7f73bea30f580beee49205ace2a8d8f88303f939a0bb602596558bdcc008fb643b7c18b47c09e6bb8f8969f9aece77cc08be48bdaa6d446332540a10f1db0452d411f8b78bbc97c5b4ad307f7b8879ff28297b000000000000e00000000000000015010000010000004a4e69ba635c14a1d9a14445168371e7a0297b79709dea9b64d3aa1951501d1577d3ad6fe2e784ac7c9c00668226e91bac230780597c2e5cf2e2002486681c10410eb395a87e8a8af46a6fe599a8e8a8e5bd50b1362733e39d155e4021fb63627f3dd23c0200e412ce05a54585106aedd0ec12657c7fea74"], 0x158}}, {{&(0x7f00000021c0)=@phonet={0x23, 0x0, 0x8, 0x9}, 0x80, &(0x7f0000002640)=[{&(0x7f0000002240)}, {0x0}, {0x0}, {&(0x7f0000000600)="d5248f86e433", 0x6}], 0x4, &(0x7f00000033c0)=ANY=[], 0x3f0}}], 0x3, 0x8000) 21m5.869456544s ago: executing program 1 (id=2527): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='ramfs\x00', 0x10, 0x0) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0/file0\x00', 0x3005840, 0x0, 0x5, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x104000, 0x0) mount$bind(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)='./file0/file0/../file0\x00', 0x0, 0xa1c08, 0x0) mount$bind(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)='./file0\x00', 0x0, 0x2125499, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000380)='\x00', 0x89901) 21m5.81485486s ago: executing program 1 (id=2528): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$can_j1939(r1, 0x0, 0x0) r3 = socket(0x1d, 0x2, 0x6) r4 = mmap$IORING_OFF_SQES(0x0, 0x1000, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, r4, &(0x7f0000000040)={0x2e, 0x3a, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x33f81df2, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f00000000c0)) setsockopt$ALG_SET_KEY(r3, 0x6a, 0x1, 0x0, 0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) bind$can_j1939(r3, &(0x7f0000000040)={0x1d, r5, 0x8000000000000003, {0x0, 0xf}, 0xff}, 0x18) sendmmsg(r1, &(0x7f000000a540), 0x0, 0x41) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newtfilter={0x24, 0x11, 0x1, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x74, r2, {0xb, 0xfff2}, {0xfff1, 0xffff}, {0x2, 0xd}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4012}, 0x20000050) 21m5.451411136s ago: executing program 1 (id=2533): socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="10000000040000000800000005"], 0x48) socket$inet(0x2, 0x3, 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) pipe(&(0x7f0000000040)={0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000640)={r0, &(0x7f0000000000), &(0x7f0000000600)=@udp=r1, 0x2}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000010000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000000850000003300000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r2, r4}, 0x14) syz_emit_ethernet(0x16, &(0x7f00000003c0)={@random="5b1a03de2511", @remote, @void, {@llc={0x4, {@snap={0x1, 0x0, "1a", "1a0bd5", 0x200}}}}}, 0x0) 21m5.238898688s ago: executing program 32 (id=2533): socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="10000000040000000800000005"], 0x48) socket$inet(0x2, 0x3, 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) pipe(&(0x7f0000000040)={0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000640)={r0, &(0x7f0000000000), &(0x7f0000000600)=@udp=r1, 0x2}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000010000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000000850000003300000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r2, r4}, 0x14) syz_emit_ethernet(0x16, &(0x7f00000003c0)={@random="5b1a03de2511", @remote, @void, {@llc={0x4, {@snap={0x1, 0x0, "1a", "1a0bd5", 0x200}}}}}, 0x0) 20m21.228836515s ago: executing program 0 (id=2704): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PAUSE_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x0) 20m21.172474821s ago: executing program 0 (id=2706): r0 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'ipvlan0\x00', 0x0}) r2 = socket$kcm(0x11, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000400)={&(0x7f0000000440)=@xdp={0x2c, 0x8, r1, 0x24}, 0x80, &(0x7f0000000100)=[{&(0x7f0000000500)="59ed0eaa6afb0999a69fe28a0fd6", 0xe}, {&(0x7f0000000000)="4f591b1494d8", 0x6}], 0x2}, 0x0) 20m21.115326127s ago: executing program 0 (id=2708): prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) ioctl$TIOCL_SCROLLCONSOLE(0xffffffffffffffff, 0x541c, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x104}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0xd, 0xb, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000fdffffff0000000000000001180100002020642500000000002020207b1af8ff000000"], &(0x7f0000000340)='GPL\x00', 0x1, 0x0, 0x0, 0x41000, 0xc}, 0x94) r3 = socket$nl_route(0x10, 0x3, 0x0) tkill(r0, 0x2f) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1d0000000400000008000000000000000100"/48, @ANYRES32=r4, @ANYBLOB="0100000002"], 0x40) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0xc, 0x7, &(0x7f0000000900)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x4}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r5}, {}, {0x85, 0x0, 0x0, 0x9d}}]}, &(0x7f0000000940)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x69, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r3, 0x8982, &(0x7f0000000000)={0x0, 'syz_tun\x00', {0x1}}) ioctl$TIOCGICOUNT(0xffffffffffffffff, 0x545d, 0x0) r6 = socket(0x1, 0x2, 0x0) r7 = socket$inet_tcp(0x2, 0x1, 0x0) r8 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r8, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000080)=""/74, 0x33e000, 0x1000}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r7, 0x4000000000000, 0x40, &(0x7f0000000500)=@raw={'raw\x00', 0x4001, 0x3, 0x390, 0x220, 0x700001b, 0x148, 0x220, 0x148, 0x2f8, 0x206, 0x240, 0x2f8, 0x240, 0x7fffffe, 0x0, {[{{@ip={@local, @rand_addr, 0x0, 0x0, 'veth1_macvtap\x00', 'bond_slave_1\x00', {0xff}, {}, 0x0, 0x1}, 0x1ea, 0x200, 0x220, 0x0, {0x390, 0x8f00}, [@common=@inet=@hashlimit2={{0x150}, {'ip6tnl0\x00', {0x5, 0x1ff, 0x1, 0x5, 0x1, 0x100, 0x1, 0x8, 0x20}, {0x8}}}, @common=@set={{0x40}, {{0x0, [0x5, 0x4, 0x7, 0x2, 0x1], 0x1, 0x6}}}]}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0xb0, 0xd8, 0x0, {}, [@common=@set={{0x40}, {{0x0, [0x1, 0x6275dd3c01ecbf44, 0x2, 0x5, 0x2], 0x4, 0x2}}}]}, @common=@unspec=@NFQUEUE3={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r9, r9) ptrace(0x4207, r0) syz_emit_ethernet(0x18, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x0) 20m20.134593357s ago: executing program 0 (id=2709): syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f00000002c0)='./file1\x00', 0x0, &(0x7f0000000300)={[{@dioread_nolock}, {@oldalloc}, {@barrier_val={'barrier', 0x3d, 0x9}}]}, 0xff, 0x4b2, &(0x7f0000000340)="$eJzs3c1vG2UaAPDHdpMmaXb7satV25W2lbpS90ON86FVk4ULJ+BQCVGJC0glJG4oceIodkoT9ZDCrQcOCAQS4sCdv4ALPVEhIc5wRxxQEZQgARKS0YztNF8OFqQxyvx+0sQz8zrzvK+t59XMOzOeADLrbPInFzEYEZ9GxNHG4uY3nG28rN2/OZVMuajXL3+TS9+XLLfe2vq/IxGxGhF9EfH04xEv5LbHrS6vzE6Wy6XF5nKxNrdQrC6vXLg2NzlTminNj4xfnJgYHx4bndiztt5+7aXblz54svf9H169d/f1jz5MqjXYLNvYjr3UaHpPHN+w7lBEPPowgnVBodme/m5XhN8k+f7+EhHn0vw/GoX02wSyoF6v13+uH25XvFoHDqx8ug+cyw9FRGM+nx8aauzD/zUG8uVKtfbfq5Wl+enGvvKx6MlfvVYuDTePFY5FTy5ZHknnHyyPblkei0j3gd8o9KfLQ1OV8vT+dnXAFkea+d/fzP/vC438BzJi50P+tgcFwAFiyA+yS/5Ddsl/yC75D9kl/yG75D9kl/yH7JL/kF3yH7JL/kMmPXXpUjLVW/e/T19fXpqtXL8wXarODs0tTQ1NVRYXhmYqlZn0np25X9teuVJZGPlfLN0o1krVWrG6vHJlrrI0X7uS3td/pdSzL60COnH8zJ3PcxGx+v/+dEr0NsvkKhxs9Xouun0PMtAdhW53QEDXGPqD7HKMD+zwE72b9LUrWNj7ugD7I9/tCgBdc/6U83+QVcb/IbuM/0N22ccHjP9D9hj/h+wabPP8rz9teHbXcET8OSI+K/Qcbj3rCzgI8l/lIvLJ/v/5o/8c3Fram/sxPUXQGxEvv3P5rRuTtdriSLL+2/X1tbeb60e7UX+gU608beUxAJBda/dvTrWm/Yz79WONixC2xz/UHJvsS89RDqzlNl2rkNujaxdWb0XEyZ3i55rPO2+c+RhYK2yLf6L5mmtsIq3vofS56fsT/9SG+P/YEP/07/5UIBvuJP3P8E75l09zOtbzb3P/M7hH10607//y6/1foU3/d6bDGC+++8qXbePfiji9Y/xWvL401tb4Sd3OdxY+d++5Z/7WrrD+XmM7O8Vf30BEFGtzC8Xq8sqF9HfkZkrzI+MXJybGh8dGJ4rpGHWxNVK93SMnP7m7W/sHHsTvj4iO2p+s+3dn7Y+f/v7xs2d3if+vczt//yd2iZ9U9D8dxv9u9Ivn25Ul8afbfP75XeIn68Y6jF998wnPEgeAP5Dq8srsZLlcWjRjxoyZ9Zlu90zAw/Yg6btdEwAAAAAAAAAAAKBT+3E5cbfbCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwEPwSAAD//2vj04Y=") r0 = openat(0xffffffffffffff9c, &(0x7f0000002240)='./file1\x00', 0x183042, 0x25) mkdirat(0xffffffffffffff9c, &(0x7f0000002280)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000022c0)='./proc\x00', &(0x7f0000002300)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000002340)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) write(r1, &(0x7f0000002380)='6', 0x1) pwrite64(r0, &(0x7f00000023c0)='6', 0x1, 0xe7e) 20m18.958000817s ago: executing program 0 (id=2714): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PAUSE_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x0) 20m18.479328445s ago: executing program 0 (id=2717): prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) ioctl$TIOCL_SCROLLCONSOLE(0xffffffffffffffff, 0x541c, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x104}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0xd, 0xb, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000fdffffff0000000000000001180100002020642500000000002020207b1af8ff000000"], &(0x7f0000000340)='GPL\x00', 0x1, 0x0, 0x0, 0x41000, 0xc}, 0x94) r3 = socket$nl_route(0x10, 0x3, 0x0) tkill(r0, 0x2f) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1d0000000400000008000000000000000100"/48, @ANYRES32=r4, @ANYBLOB="0100000002"], 0x40) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0xc, 0x7, &(0x7f0000000900)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x4}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r5}, {}, {0x85, 0x0, 0x0, 0x9d}}]}, &(0x7f0000000940)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x69, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r3, 0x8982, &(0x7f0000000000)={0x0, 'syz_tun\x00', {0x1}}) ioctl$TIOCGICOUNT(0xffffffffffffffff, 0x545d, 0x0) r6 = socket(0x1, 0x2, 0x0) r7 = socket$inet_tcp(0x2, 0x1, 0x0) r8 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r8, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000080)=""/74, 0x33e000, 0x1000}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r7, 0x4000000000000, 0x40, &(0x7f0000000500)=@raw={'raw\x00', 0x4001, 0x3, 0x390, 0x220, 0x700001b, 0x148, 0x220, 0x148, 0x2f8, 0x206, 0x240, 0x2f8, 0x240, 0x7fffffe, 0x0, {[{{@ip={@local, @rand_addr, 0x0, 0x0, 'veth1_macvtap\x00', 'bond_slave_1\x00', {0xff}, {}, 0x0, 0x1}, 0x1ea, 0x200, 0x220, 0x0, {0x390, 0x8f00}, [@common=@inet=@hashlimit2={{0x150}, {'ip6tnl0\x00', {0x5, 0x1ff, 0x1, 0x5, 0x1, 0x100, 0x1, 0x8, 0x20}, {0x8}}}, @common=@set={{0x40}, {{0x0, [0x5, 0x4, 0x7, 0x2, 0x1], 0x1, 0x6}}}]}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0xb0, 0xd8, 0x0, {}, [@common=@set={{0x40}, {{0x0, [0x1, 0x6275dd3c01ecbf44, 0x2, 0x5, 0x2], 0x4, 0x2}}}]}, @common=@unspec=@NFQUEUE3={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) ptrace(0x4207, r0) syz_emit_ethernet(0x18, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x0) 20m18.24216506s ago: executing program 33 (id=2717): prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) ioctl$TIOCL_SCROLLCONSOLE(0xffffffffffffffff, 0x541c, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x104}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0xd, 0xb, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000fdffffff0000000000000001180100002020642500000000002020207b1af8ff000000"], &(0x7f0000000340)='GPL\x00', 0x1, 0x0, 0x0, 0x41000, 0xc}, 0x94) r3 = socket$nl_route(0x10, 0x3, 0x0) tkill(r0, 0x2f) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1d0000000400000008000000000000000100"/48, @ANYRES32=r4, @ANYBLOB="0100000002"], 0x40) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0xc, 0x7, &(0x7f0000000900)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x4}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r5}, {}, {0x85, 0x0, 0x0, 0x9d}}]}, &(0x7f0000000940)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x69, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r3, 0x8982, &(0x7f0000000000)={0x0, 'syz_tun\x00', {0x1}}) ioctl$TIOCGICOUNT(0xffffffffffffffff, 0x545d, 0x0) r6 = socket(0x1, 0x2, 0x0) r7 = socket$inet_tcp(0x2, 0x1, 0x0) r8 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r8, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000080)=""/74, 0x33e000, 0x1000}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r7, 0x4000000000000, 0x40, &(0x7f0000000500)=@raw={'raw\x00', 0x4001, 0x3, 0x390, 0x220, 0x700001b, 0x148, 0x220, 0x148, 0x2f8, 0x206, 0x240, 0x2f8, 0x240, 0x7fffffe, 0x0, {[{{@ip={@local, @rand_addr, 0x0, 0x0, 'veth1_macvtap\x00', 'bond_slave_1\x00', {0xff}, {}, 0x0, 0x1}, 0x1ea, 0x200, 0x220, 0x0, {0x390, 0x8f00}, [@common=@inet=@hashlimit2={{0x150}, {'ip6tnl0\x00', {0x5, 0x1ff, 0x1, 0x5, 0x1, 0x100, 0x1, 0x8, 0x20}, {0x8}}}, @common=@set={{0x40}, {{0x0, [0x5, 0x4, 0x7, 0x2, 0x1], 0x1, 0x6}}}]}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0xb0, 0xd8, 0x0, {}, [@common=@set={{0x40}, {{0x0, [0x1, 0x6275dd3c01ecbf44, 0x2, 0x5, 0x2], 0x4, 0x2}}}]}, @common=@unspec=@NFQUEUE3={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) ptrace(0x4207, r0) syz_emit_ethernet(0x18, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x0) 15m36.369556586s ago: executing program 5 (id=3867): r0 = socket$inet(0x2, 0x1, 0x6) bind$inet(r0, &(0x7f0000000000)={0x2, 0x801, @loopback}, 0x10) r1 = mq_open(&(0x7f00000006c0)='&\x00w\xb4N6Bf\xa9\xc2\xd0\b\x06L\xbbQ\xd6T\xe3+SD\xa8\x0f\xefwHw\xdab\xc4\x1a\xe55@hA5\xd6\xec.)\x8f}\xc5#L\x99\"\x84;{\xfa\x04~\xf1\x17\x1d\x90\x83\xfc\x1e\xae\xb0/(\xbb\xd3\xb7\xca\x13j\xab\xfa\xc5Mq\xb7ks\xe0 \x9d\xf8\x7f\x84b\xa4h\xeekc\xffZ\x9fg\x84lm\xd7F\x97\xdcd\v\x00\x00\x90\x03\x12^\xf2{\xf1\xbe\x12[~\xe7\xca\xe4\x13\xd6k\xa6\xf3v5F\xc9.\xce\x87z\xd4<\xa8\xba\xd0\x9c\ff\xe1\xe2\xf9\x18\xc0\xd0\xa1\x02K\xdd0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000540)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000005c0), 0x58, 0x0) recvmmsg(r1, &(0x7f0000000600), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, 0xffffffffffffffff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./file1\x00', 0x2040, 0x0) fcntl$setlease(r3, 0x400, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./file1\x00', 0x2040, 0x0) fcntl$setlease(r4, 0x400, 0x0) fcntl$setlease(r3, 0x400, 0x0) r5 = socket(0xa, 0x3, 0xff) sendmsg$inet6(r5, &(0x7f0000000700)={&(0x7f0000000740)={0xa, 0xa, 0x4, @mcast2}, 0x1c, &(0x7f0000000780)=[{0x0}], 0x1}, 0x20008b88) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000840), 0x0, 0x40800) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x15, 0x3, &(0x7f0000000080)=ANY=[], &(0x7f0000000480)='syzkaller\x00', 0x5, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) 15m34.278220479s ago: executing program 5 (id=3878): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x103}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000380), 0x651, 0x0) recvmmsg(r2, &(0x7f00000003c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000400)=0x6) setsockopt$sock_timeval(r3, 0x1, 0x42, &(0x7f0000000440)={0x0, 0xea60}, 0x10) pidfd_getfd(0xffffffffffffffff, r2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'\x00', 0x1}) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000180)={0x1, 0x1, 0x0, 0x0, &(0x7f0000000200)}) ioctl$VHOST_SET_VRING_BUSYLOOP_TIMEOUT(r0, 0x4008af23, &(0x7f0000000240)={0x1, 0x4}) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, 0x0) write$tun(0xffffffffffffffff, 0x0, 0x10) 15m33.171602862s ago: executing program 5 (id=3880): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f00000000c0)={0x0, 0x0}) 15m33.015117898s ago: executing program 34 (id=3880): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f00000000c0)={0x0, 0x0}) 15m32.836486126s ago: executing program 2 (id=3884): bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x3, 0xe, &(0x7f0000000c00)=ANY=[@ANYBLOB="b700000081780000bfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff0000000071103b00000000001d400500000000004704000001ed00000f030000000000001d440000000000006b0afefe000000007203000000000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afc0513466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea01d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a07f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a126a1bdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0d5d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f10bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d00b07862c4fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52c094016406cdd32abf77fea373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e80dc18cde98d662eee077515dca8811922929e08538fab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f57cbc05cd897f40693ec427ea71578130cde48de3b4dda0c7b615b57ccd4f8ac729a80f891d91a89d967948b9d95b1f22480ab48969e86b854a8c17f3e264ce11f9f63552364e759eec94572f2f7b0e2f293573d0b80709815f4344f908c00"/2646], &(0x7f0000001680)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f00000016c0), 0x0, 0x10, &(0x7f0000001700), 0xfffffffffffffd00}, 0x48) 15m32.673862163s ago: executing program 2 (id=3886): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000040)='./file0/file0/file0\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x18d883, 0x0) mount$bind(&(0x7f0000000300)='.\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x185093, 0x0) umount2(&(0x7f00000002c0)='./file0\x00', 0xb) 15m32.540606366s ago: executing program 2 (id=3888): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x103}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000380), 0x651, 0x0) recvmmsg(r2, &(0x7f00000003c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000400)=0x6) setsockopt$sock_timeval(r3, 0x1, 0x42, &(0x7f0000000440)={0x0, 0xea60}, 0x10) pidfd_getfd(0xffffffffffffffff, r2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'\x00', 0x1}) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000180)={0x1, 0x1, 0x0, 0x0, &(0x7f0000000200)}) ioctl$VHOST_SET_VRING_BUSYLOOP_TIMEOUT(r0, 0x4008af23, &(0x7f0000000240)={0x1, 0x4}) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, 0x0) write$tun(r4, 0x0, 0x10) 15m32.043644197s ago: executing program 2 (id=3891): pipe2$watch_queue(&(0x7f0000000000), 0x80) sendmsg$MPTCP_PM_CMD_SET_FLAGS(0xffffffffffffffff, 0x0, 0x8010) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r0) r2 = getpid() sched_setscheduler(r2, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000400)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000480), 0x651, 0x0) recvmmsg(r3, &(0x7f00000004c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000500)=0x6) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="c4050000", @ANYRES16=r1, @ANYBLOB="a183ffffffff00000000050000000c0099"], 0x5c4}, 0x1, 0x0, 0x0, 0x40840}, 0x4c044) 15m31.71972579s ago: executing program 35 (id=3891): pipe2$watch_queue(&(0x7f0000000000), 0x80) sendmsg$MPTCP_PM_CMD_SET_FLAGS(0xffffffffffffffff, 0x0, 0x8010) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r0) r2 = getpid() sched_setscheduler(r2, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000400)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000480), 0x651, 0x0) recvmmsg(r3, &(0x7f00000004c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000500)=0x6) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="c4050000", @ANYRES16=r1, @ANYBLOB="a183ffffffff00000000050000000c0099"], 0x5c4}, 0x1, 0x0, 0x0, 0x40840}, 0x4c044) 14m37.039188915s ago: executing program 7 (id=4037): syz_mount_image$ext4(&(0x7f0000000340)='ext4\x00', &(0x7f0000000380)='./file0\x00', 0xc0ed4040, &(0x7f0000000480)={[{@noblock_validity}, {@lazytime}, {@journal_dev={'journal_dev', 0x3d, 0x3}}, {@min_batch_time={'min_batch_time', 0x3d, 0x4a}}, {@nobarrier}, {@journal_ioprio={'journal_ioprio', 0x3d, 0x3}}, {@nolazytime}, {@noload}]}, 0xf5, 0x48b, &(0x7f0000000540)="$eJzs3MtvVNUfAPDvvZ2WlscPfogPCGgVjMRHS8tDFiZGowkLjUZdYFzVaSFIAQM1EUIUXWCMC0Pi3rg08S9wpRujrkx0iXtDQgwb0NWYO/fePoaZtkMHpjCfT3KZc+6Dc75z7rk999zbBtCzhrN/koj1EXE5IjZGRKVxh+H848a189V/rp2vJlGrvfl3kh0W16+drxb/RX3JrMtX1GpFfk2Tci++EzExPT11usiPzpx4f/TM2XPPHDsxcXTq6NTJ8YMH9+3dMXBgfH9H4sziur7to1Pbtx56+9Kr1cOX3v3lu6y+64vtZRydNJx/u0093unCumzDvHRS6WJFaEvWbv3FcjlqfX0xNLttY7z8aVcrB9xulWY/nwsXasA9LBuoA72o/EGf3f+Wy1LjhQ6OPbru6gt5RFncN4ol31KJtNinv+H+tpMGI+LwhX+/zpa4TfMQAADz/ZCNf55uNv5L44F5+/2veIayKSL+HxGbI+K+iNgSEfdH1Pd9MCIearP8xickN49/0isLsrW+NktYXDb+e654trVw/FeO/mJTX5HbUI+/PzlybHpqT/Gd7I7+NVl+bMEhC/340u9fNq77ophmH543/suWrPyFEaZXGifoJidmJlYeee7qJxHbKs3iT2YH+klEbI2IbbdYxrEnv93ealuz+Mux8JI6cCdS+ybiibz9L0RD/KWk5fPJsWcPjO8fHYzpqT2j5Vlxs19/u/h6q/JXFH8HZO2/tun5n8ef3SMmgxFnzp47Xn9ee+YWCvnzs2rSYtOWIv7+lvHffP5Xd0UMJG/V0wPlXsXnQPJK9jFUrv9wYmbm9PjcsWW+/jmWx79751z8EzHX/zfnt2eR/PHG7PE7IuLhiHikaLtHI+KxiNi5SPg/v7jrvVbbWrf/IrPyHZTFP7lI+2eXvCw11/7tJ/qO//R9q/JrS57/Wfvvq6d2F2uWc/1bbgVX8t0BAADA3SKtvwOfpCOz6TQdGcnf4d8Sa9NKRDx15NQHJyfzd+U3RX9aznRtnDcfOlbMDZf58Yb83mLe+Ku+oXp+pHpqerLbwUOPW9ei/2f+6uyjFmA1uqfe6APaov9D79L/oXfp/9C7nu92BYDuGGi++uM7XQ+gK9of/w/elnoAd577f+hd+j/0Lv0felLL341PV/Qr/3drorI6qtE0MbQ6qlEmIl1yn3SVVHV5idc+z7vEaqlPmags+49Z3GJiTdNNTS8Xh9bf2csTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAiv0XAAD//1ub24E=") prlimit64(0x0, 0xe, &(0x7f0000000a00)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000a40)=0x8) getpid() syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000002340)={0x0, 0x0, &(0x7f0000002380)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x200000d0}, 0x40) sched_setaffinity(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000b00)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000b80), 0x651, 0x0) recvmmsg(r0, &(0x7f0000000bc0), 0x4000087, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='.\x00', 0x0, 0x0) ioctl$FS_IOC_GETFSMAP(r2, 0xc0c0583b, &(0x7f0000000c40)={0x0, 0x2904c, 0x0, 0x10003, '\x00', [{0x0, 0x5, 0x404, 0xffffffffffffffff}, {0xffffffff, 0x0, 0x9, 0xa}]}) mount$cgroup(0x0, &(0x7f0000002440)='./file0\x00', &(0x7f0000002480), 0x2010042, &(0x7f00000024c0)={[{@subsystem='cpuset'}]}) 14m28.931874221s ago: executing program 7 (id=4060): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000800), 0x0, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000840)={'syzkaller0\x00', @multicast}) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000880)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000940)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x2}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c8c1}, 0x20) sendmsg$nl_route_sched(r5, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000a40)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {0x0, 0xd}, {0xfff7, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_CE_THRESHOLD={0x8, 0xc, 0x6}, @TCA_FQ_FLOW_MAX_RATE={0x8, 0x7, 0x326d}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r7 = socket$kcm(0x11, 0x3, 0x0) r8 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000a80)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r7, &(0x7f0000000b00)={&(0x7f0000000b40)=@xdp={0x2c, 0x0, r9, 0x3b}, 0x80, &(0x7f0000000bc0)=[{&(0x7f0000000280)="270302005902140006000002b96dbcf706e105", 0x13}], 0x1}, 0x0) 14m27.925978974s ago: executing program 7 (id=4064): prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000440), 0x400000000000041, 0x0) socket$nl_route(0x10, 0x3, 0x0) sched_setaffinity(r0, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r2) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x3c, r3, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_FD={0x8, 0x17, @udp=r1}]}, 0x3c}}, 0x40000) 14m27.709049876s ago: executing program 7 (id=4066): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, 0x0, 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000040)='./file0/file0/file0\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x18d883, 0x0) mount$bind(&(0x7f0000000300)='.\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x185093, 0x0) umount2(&(0x7f00000002c0)='./file0\x00', 0xb) 14m27.548190912s ago: executing program 7 (id=4068): syz_mount_image$ext4(&(0x7f0000000340)='ext4\x00', &(0x7f0000000380)='./file0\x00', 0xc0ed4040, &(0x7f0000000480)={[{@noblock_validity}, {@lazytime}, {@journal_dev={'journal_dev', 0x3d, 0x3}}, {@min_batch_time={'min_batch_time', 0x3d, 0x4a}}, {@nobarrier}, {@journal_ioprio={'journal_ioprio', 0x3d, 0x3}}, {@nolazytime}, {@noload}]}, 0xf5, 0x48b, &(0x7f0000000540)="$eJzs3MtvVNUfAPDvvZ2WlscPfogPCGgVjMRHS8tDFiZGowkLjUZdYFzVaSFIAQM1EUIUXWCMC0Pi3rg08S9wpRujrkx0iXtDQgwb0NWYO/fePoaZtkMHpjCfT3KZc+6Dc75z7rk999zbBtCzhrN/koj1EXE5IjZGRKVxh+H848a189V/rp2vJlGrvfl3kh0W16+drxb/RX3JrMtX1GpFfk2Tci++EzExPT11usiPzpx4f/TM2XPPHDsxcXTq6NTJ8YMH9+3dMXBgfH9H4sziur7to1Pbtx56+9Kr1cOX3v3lu6y+64vtZRydNJx/u0093unCumzDvHRS6WJFaEvWbv3FcjlqfX0xNLttY7z8aVcrB9xulWY/nwsXasA9LBuoA72o/EGf3f+Wy1LjhQ6OPbru6gt5RFncN4ol31KJtNinv+H+tpMGI+LwhX+/zpa4TfMQAADz/ZCNf55uNv5L44F5+/2veIayKSL+HxGbI+K+iNgSEfdH1Pd9MCIearP8xickN49/0isLsrW+NktYXDb+e654trVw/FeO/mJTX5HbUI+/PzlybHpqT/Gd7I7+NVl+bMEhC/340u9fNq77ophmH543/suWrPyFEaZXGifoJidmJlYeee7qJxHbKs3iT2YH+klEbI2IbbdYxrEnv93ealuz+Mux8JI6cCdS+ybiibz9L0RD/KWk5fPJsWcPjO8fHYzpqT2j5Vlxs19/u/h6q/JXFH8HZO2/tun5n8ef3SMmgxFnzp47Xn9ee+YWCvnzs2rSYtOWIv7+lvHffP5Xd0UMJG/V0wPlXsXnQPJK9jFUrv9wYmbm9PjcsWW+/jmWx79751z8EzHX/zfnt2eR/PHG7PE7IuLhiHikaLtHI+KxiNi5SPg/v7jrvVbbWrf/IrPyHZTFP7lI+2eXvCw11/7tJ/qO//R9q/JrS57/Wfvvq6d2F2uWc/1bbgVX8t0BAADA3SKtvwOfpCOz6TQdGcnf4d8Sa9NKRDx15NQHJyfzd+U3RX9aznRtnDcfOlbMDZf58Yb83mLe+Ku+oXp+pHpqerLbwUOPW9ei/2f+6uyjFmA1uqfe6APaov9D79L/oXfp/9C7nu92BYDuGGi++uM7XQ+gK9of/w/elnoAd577f+hd+j/0Lv0felLL341PV/Qr/3drorI6qtE0MbQ6qlEmIl1yn3SVVHV5idc+z7vEaqlPmags+49Z3GJiTdNNTS8Xh9bf2csTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAiv0XAAD//1ub24E=") prlimit64(0x0, 0xe, &(0x7f0000000a00)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000a40)=0x8) getpid() syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(0xffffffffffffffff, &(0x7f0000002340)={0x0, 0x0, &(0x7f0000002380)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x200000d0}, 0x40) sched_setaffinity(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000b00)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000b80), 0x651, 0x0) recvmmsg(r0, &(0x7f0000000bc0), 0x4000087, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='.\x00', 0x0, 0x0) ioctl$FS_IOC_GETFSMAP(r2, 0xc0c0583b, &(0x7f0000000c40)={0x0, 0x2904c, 0x0, 0x10003, '\x00', [{0x0, 0x5, 0x404, 0xffffffffffffffff}, {0xffffffff, 0x0, 0x9, 0xa}]}) mount$cgroup(0x0, &(0x7f0000002440)='./file0\x00', &(0x7f0000002480), 0x2010042, &(0x7f00000024c0)={[{@subsystem='cpuset'}]}) 14m27.115618266s ago: executing program 7 (id=4070): bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000001280)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000012c0)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000001300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000001380)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000001400), 0x651, 0x0) recvmmsg(r1, &(0x7f0000001440), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000001480)=0x6) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000017c0)={0xa, 0x4e20, 0xbb6, @loopback, 0x5}, 0x28) connect$inet6(r3, &(0x7f0000001800)={0xa, 0x4e20, 0x9, @loopback, 0x106}, 0x1c) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x10, &(0x7f0000001840)=0x5, 0x2) r4 = fcntl$dupfd(r3, 0x406, r3) setsockopt$inet6_buf(r3, 0x29, 0x39, &(0x7f0000001880)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) write$binfmt_elf64(r4, &(0x7f00000018c0)=ANY=[], 0xfffffdcf) 14m26.716625777s ago: executing program 36 (id=4070): bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000001280)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000012c0)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000001300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000001380)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000001400), 0x651, 0x0) recvmmsg(r1, &(0x7f0000001440), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000001480)=0x6) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f00000017c0)={0xa, 0x4e20, 0xbb6, @loopback, 0x5}, 0x28) connect$inet6(r3, &(0x7f0000001800)={0xa, 0x4e20, 0x9, @loopback, 0x106}, 0x1c) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x10, &(0x7f0000001840)=0x5, 0x2) r4 = fcntl$dupfd(r3, 0x406, r3) setsockopt$inet6_buf(r3, 0x29, 0x39, &(0x7f0000001880)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) write$binfmt_elf64(r4, &(0x7f00000018c0)=ANY=[], 0xfffffdcf) 13m59.469356525s ago: executing program 8 (id=4163): socket$can_raw(0x1d, 0x3, 0x1) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000100)={0x1, "ff0f000000000000f5a72d866b0000000000f0ffdefe00"}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r2 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r2, 0xc0184800, &(0x7f0000000100)={0x4, r1}) ioctl$DMA_BUF_SET_NAME_A(r3, 0x40086203, &(0x7f00000001c0)='\x02\x00\x00\x00\x05\x00\x00\x00-control\x00') write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) close_range(r4, 0xffffffffffffffff, 0x0) 13m59.224420729s ago: executing program 8 (id=4165): prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) ioctl$TIOCL_SCROLLCONSOLE(0xffffffffffffffff, 0x541c, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x104}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0xd, 0xb, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000fdffffff0000000000000001180100002020642500000000002020207b1af8ff000000"], &(0x7f0000000340)='GPL\x00', 0x1, 0x0, 0x0, 0x41000, 0xc}, 0x94) r3 = socket$nl_route(0x10, 0x3, 0x0) tkill(r0, 0x2f) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1d0000000400000008000000000000000100"/48, @ANYRES32=r4, @ANYBLOB="0100000002"], 0x40) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0xc, 0x7, &(0x7f0000000900)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x4}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r5}, {}, {0x85, 0x0, 0x0, 0x9d}}]}, &(0x7f0000000940)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x69, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r3, 0x8982, &(0x7f0000000000)={0x0, 'syz_tun\x00', {0x1}}) ioctl$TIOCGICOUNT(0xffffffffffffffff, 0x545d, 0x0) r6 = socket(0x1, 0x2, 0x0) r7 = socket$inet_tcp(0x2, 0x1, 0x0) r8 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r8, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000080)=""/74, 0x33e000, 0x1000}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r7, 0x4000000000000, 0x40, &(0x7f0000000500)=@raw={'raw\x00', 0x4001, 0x3, 0x390, 0x220, 0x700001b, 0x148, 0x220, 0x148, 0x2f8, 0x206, 0x240, 0x2f8, 0x240, 0x7fffffe, 0x0, {[{{@ip={@local, @rand_addr, 0x0, 0x0, 'veth1_macvtap\x00', 'bond_slave_1\x00', {0xff}, {}, 0x0, 0x1}, 0x1ea, 0x200, 0x220, 0x0, {0x390, 0x8f00}, [@common=@inet=@hashlimit2={{0x150}, {'ip6tnl0\x00', {0x5, 0x1ff, 0x1, 0x5, 0x1, 0x100, 0x1, 0x8, 0x20}, {0x8}}}, @common=@set={{0x40}, {{0x0, [0x5, 0x4, 0x7, 0x2, 0x1], 0x1, 0x6}}}]}, @unspec=@NOTRACK={0x20}}, {{@uncond, 0x0, 0xb0, 0xd8, 0x0, {}, [@common=@set={{0x40}, {{0x0, [0x1, 0x6275dd3c01ecbf44, 0x2, 0x5, 0x2], 0x4, 0x2}}}]}, @common=@unspec=@NFQUEUE3={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r9, r9) ptrace(0x4207, r0) syz_emit_ethernet(0x18, &(0x7f0000000100)=ANY=[@ANYBLOB], 0x0) 13m58.243979849s ago: executing program 8 (id=4166): connect$inet(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/module/phram/parameters/phram\x00', 0x1, 0x0) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, 0x0, 0x0) write$binfmt_script(r0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_emit_vhci(&(0x7f0000000380)=ANY=[@ANYBLOB="02c82028002400010007d3040007c4faff02"], 0x2d) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000400)=0x7) r1 = getpid() bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, 0x0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f00000004c0)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000540)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000005c0), 0x58, 0x0) recvmmsg(r2, &(0x7f0000000600), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, 0xffffffffffffffff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./file1\x00', 0x2040, 0x0) fcntl$setlease(r4, 0x400, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./file1\x00', 0x2040, 0x0) fcntl$setlease(r5, 0x400, 0x0) fcntl$setlease(r4, 0x400, 0x0) r6 = socket(0xa, 0x3, 0xff) sendmsg$inet6(r6, &(0x7f0000000700)={&(0x7f0000000740)={0xa, 0xa, 0x4, @mcast2}, 0x1c, &(0x7f0000000780)=[{0x0}], 0x1}, 0x20008b88) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000840), 0x0, 0x40800) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x15, 0x3, &(0x7f0000000080)=ANY=[], &(0x7f0000000480)='syzkaller\x00', 0x5, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) 13m56.784477178s ago: executing program 8 (id=4170): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, 0x0, 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000040)='./file0/file0/file0\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x18d883, 0x0) mount$bind(&(0x7f0000000300)='.\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x185093, 0x0) umount2(&(0x7f00000002c0)='./file0\x00', 0xb) 13m56.629634144s ago: executing program 8 (id=4171): r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/ip_forward\x00', 0x1, 0x0) write$sysctl(r0, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000002c0)={'syzkaller1\x00', 0x1001}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'syzkaller1\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000480)={&(0x7f00000004c0), 0xc, &(0x7f0000000500)={&(0x7f0000000540)=@ipv4_newaddr={0x20, 0x14, 0x405, 0x70bc96, 0x0, {0x2, 0x18, 0x0, 0x0, r4}, [@IFA_LOCAL={0x8, 0x2, @private=0xa010101}]}, 0x20}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=@setlink={0x20, 0x13, 0x5, 0x70bc97, 0x0, {0x0, 0x0, 0x0, r4, 0x1, 0x1}}, 0x20}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000740)=@ipv4_newaddr={0x20, 0x14, 0x405, 0x70bc98, 0x0, {0x2, 0x18, 0x0, 0x0, r4}, [@IFA_LOCAL={0x8, 0x2, @rand_addr=0x64010101}]}, 0x20}}, 0x0) write$tun(r1, &(0x7f0000000a00)={@void, @void, @ipv4=@udp={{0x5, 0x4, 0x0, 0x0, 0x1f, 0x65, 0x0, 0x40, 0x11, 0x0, @rand_addr=0x64010102, @private=0xa010102}, {0x4e21, 0x4e20, 0xb, 0x0, @opaque='EFG'}}}, 0x1f) 13m56.319551716s ago: executing program 8 (id=4173): socket$can_raw(0x1d, 0x3, 0x1) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000100)={0x1, "ff0f000000000000f5a72d866b0000000000f0ffdefe00"}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r2 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r2, 0xc0184800, &(0x7f0000000100)={0x4, r1}) ioctl$DMA_BUF_SET_NAME_A(r3, 0x40086203, &(0x7f00000001c0)='\x02\x00\x00\x00\x05\x00\x00\x00-control\x00') write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) close_range(r4, 0xffffffffffffffff, 0x0) 13m55.721064697s ago: executing program 37 (id=4173): socket$can_raw(0x1d, 0x3, 0x1) r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000100)={0x1, "ff0f000000000000f5a72d866b0000000000f0ffdefe00"}) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r2 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r2, 0xc0184800, &(0x7f0000000100)={0x4, r1}) ioctl$DMA_BUF_SET_NAME_A(r3, 0x40086203, &(0x7f00000001c0)='\x02\x00\x00\x00\x05\x00\x00\x00-control\x00') write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) close_range(r4, 0xffffffffffffffff, 0x0) 31.453974757s ago: executing program 3 (id=7400): r0 = openat$dlm_plock(0xffffffffffffff9c, 0x0, 0x105000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f00000000c0)=0x5) setsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r2 = getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000140), 0x0, 0x0) read$msr(r4, &(0x7f00000006c0)=""/102392, 0x18ff8) kcmp$KCMP_EPOLL_TFD(r1, r2, 0x7, 0xffffffffffffffff, &(0x7f0000000280)={r0, r0, 0x4}) 24.471690798s ago: executing program 3 (id=7420): r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000340)={0xa, 0x4e20, 0x1, @ipv4={'\x00', '\xff\xff', @remote}, 0x202}, 0x1c) r1 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r1, 0x0, 0x0) listen(r1, 0x3cf) setsockopt$sock_int(r1, 0x1, 0x29, &(0x7f0000000000)=0xffffff7b, 0x4) listen(r1, 0x1) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000380)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000003c0), 0x0, 0x0) read$msr(r3, &(0x7f0000000540)=""/102392, 0x18ff8) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000019540), 0x84042, 0x0) r5 = syz_open_dev$loop(&(0x7f0000019580), 0x80000001, 0x162842) ioctl$LOOP_CONFIGURE(r5, 0x4c0a, &(0x7f00000195c0)={r4, 0x20a4, {0x0, 0x0, 0x0, 0x3, 0x14a1fd, 0x0, 0x0, 0x1e, 0x1c, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "a9103939c787a16c1ca43f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d2", "24431a1e77a68e00000010e200", [0x0, 0x400]}}) ioctl$AUTOFS_IOC_SETTIMEOUT(0xffffffffffffffff, 0x80049367, 0x0) sendmsg(r1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000100100000100000002000000003700001000000000000000110000000e00000044f3a0214f1f1c567132f2ffa370574c8e62855f31d4740771cf1bdf01c16b82dab013253478a26a4ca0312b37c8d216eb8c0d78496a915a263eb90eadb33102e5288732018b6ecde2b5fc7eea"], 0x28}, 0x0) r6 = socket$rxrpc(0x21, 0x2, 0x2) sendmsg(r6, &(0x7f0000000100)={&(0x7f0000000140)=@rxrpc=@in4={0x21, 0x1234, 0x2, 0x10, {0x2, 0x5678, @loopback}}, 0x80, &(0x7f00000001c0), 0x0, &(0x7f0000000240)=[{0x18, 0x110, 0x1, "01000000"}], 0x18}, 0x4010) 21.443907646s ago: executing program 3 (id=7426): syz_open_dev$dvb_frontend(&(0x7f0000000e40), 0x0, 0x0) 14.287633315s ago: executing program 6 (id=7435): openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000400)={0xe, 0x1, 0xfa00, @id_resuseaddr={&(0x7f0000000440)=0x1, 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) r0 = syz_io_uring_setup(0xf00, &(0x7f0000000580)={0x0, 0x5961, 0x10000, 0x0, 0x4e}, &(0x7f0000000600)=0x0, &(0x7f0000000640)=0x0, &(0x7f0000000680)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f00000006c0)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) 13.512215264s ago: executing program 3 (id=7436): mount(0x0, 0x0, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x8, 0x40000088}, 0x0) gettid() sched_setscheduler(0x0, 0x1, &(0x7f0000000400)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000480)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000540)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000580), 0x0, 0x0) read$msr(r3, &(0x7f00000005c0)=""/102392, 0x18ff8) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) ioctl$COMEDI_INSNLIST(0xffffffffffffffff, 0x8010640b, &(0x7f00000004c0)={0x1, &(0x7f0000000500)=[{0x4000000, 0xff92, 0x0, 0x2, 0x6}]}) 13.369418328s ago: executing program 6 (id=7437): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x9a5eb000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, 0x0, 0x0) sendmmsg$inet(r3, &(0x7f0000000680)=[{{0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000700)}], 0x1}}], 0x1, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_cred(r1, 0x1, 0x11, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={0x0, &(0x7f0000000ac0)=""/257, 0x0, 0x101, 0x6}, 0x28) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) ptrace$ARCH_SET_CPUID(0x1e, r0, 0x0, 0x1012) socketpair(0x1d, 0x2, 0x2, &(0x7f0000000940)) sendmsg$nl_xfrm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@updpolicy={0x13c, 0x19, 0x1, 0x70bd29, 0x4, {{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0x0, 0x3}}, [@tmpl={0x84, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x0, @in6=@ipv4={'\x00', '\xff\xff', @local}, 0x0, 0x1, 0x0, 0x0, 0x1ff, 0x1ffd}, {{@in=@loopback, 0x0, 0x32}, 0xa, @in6=@dev={0xfe, 0x80, '\x00', 0x1b}, 0x0, 0x1, 0x0, 0x87, 0x29a, 0x0, 0x81}]}]}, 0x13c}}, 0x20004) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000980), 0x2241, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000009c0)={'pimreg\x00', 0x5005}) socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) 12.051811473s ago: executing program 3 (id=7438): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r0, &(0x7f0000000000), 0x8) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000340)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f00000003c0)='./my_configfs\x00', &(0x7f0000000600)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000640)='./my_configfs/usb_gadget/g1\x00', 0x1ff) mount(0x0, &(0x7f00000006c0)='./debug\x00', &(0x7f0000000700)='debugfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r1, &(0x7f0000000780)='+p', 0x2) mkdir(&(0x7f00000007c0)='./my_configfs/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdir(&(0x7f0000000800)='./my_configfs/target/usb_gadget\x00', 0x1ff) mkdir(&(0x7f0000000880)='./my_configfs/target/usb_gadget/naa.1234567890abcdef/tpgt_1\x00', 0x1ab) 9.155016108s ago: executing program 6 (id=7439): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x7, 0x80000001}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000480)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000500), 0x651, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000580)=0x6) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f00000005c0)={0x84, @remote, 0x0, 0x0, 'lblc\x00'}, 0x2c) setsockopt$IP_VS_SO_SET_DEL(r3, 0x0, 0x484, &(0x7f0000000600)={0x20000000000084, @remote, 0x0, 0x0, 'rr\x00'}, 0x2c) 8.704980964s ago: executing program 9 (id=7441): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./debug\x00', 0x1ff) mount(0x0, 0x0, 0x0, 0x0, 0x0) quotactl$Q_GETFMT(0xffffffff80000400, &(0x7f0000001680)=@filename='./proc/../file0\x00', 0x0, 0x0) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000016c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000001740)={0x7, 0xf, &(0x7f0000001800)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x6, 0x0, 0xb}, {0x65}}, [], {{0x7, 0x1, 0x5, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f00000018c0)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001900)='./debug/failslab/times\x00', 0x2, 0x0) write(r2, &(0x7f0000001940)='10000', 0x5) r3 = openat(0xffffffffffffff9c, &(0x7f0000001980)='./debug/failslab/probability\x00', 0x2, 0x132) write(r3, &(0x7f00000019c0)='5', 0x1) syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = openat$make_it_fail(0xffffffffffffff9c, &(0x7f0000001a00)='/proc/thread-self/make-it-fail\x00', 0x1, 0x0) write(r4, &(0x7f0000001a40)='1', 0x1) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(0xffffffffffffffff, 0x4048587b, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001a80)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000001ac0)='./sys\x00', &(0x7f0000001b00)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001b40)='./sys/class/vtconsole/vtcon0/bind\x00', 0x1, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) writev(r5, &(0x7f0000001b80)=[{&(0x7f0000001bc0)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) 8.701284994s ago: executing program 4 (id=7442): r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000340)={0xa, 0x4e20, 0x1, @ipv4={'\x00', '\xff\xff', @remote}, 0x202}, 0x1c) r1 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r1, 0x0, 0x0) listen(r1, 0x3cf) setsockopt$sock_int(r1, 0x1, 0x29, &(0x7f0000000000)=0xffffff7b, 0x4) listen(r1, 0x1) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000380)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000003c0), 0x0, 0x0) read$msr(r3, &(0x7f0000000540)=""/102392, 0x18ff8) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000019540), 0x84042, 0x0) r5 = syz_open_dev$loop(&(0x7f0000019580), 0x80000001, 0x162842) ioctl$LOOP_CONFIGURE(r5, 0x4c0a, &(0x7f00000195c0)={r4, 0x20a4, {0x0, 0x0, 0x0, 0x3, 0x14a1fd, 0x0, 0x0, 0x1e, 0x1c, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "a9103939c787a16c1ca43f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d2", "24431a1e77a68e00000010e200", [0x0, 0x400]}}) ioctl$AUTOFS_IOC_SETTIMEOUT(0xffffffffffffffff, 0x80049367, 0x0) sendmsg(r1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000100100000100000002000000003700001000000000000000110000000e00000044f3a0214f1f1c567132f2ffa370574c8e62855f31d4740771cf1bdf01c16b82dab013253478a26a4ca0312b37c8d216eb8c0d78496a915a263eb90eadb33102e5288732018b6ecde2b5fc7eea"], 0x28}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000140)=@rxrpc=@in4={0x21, 0x1234, 0x2, 0x10, {0x2, 0x5678, @loopback}}, 0x80, &(0x7f00000001c0), 0x0, &(0x7f0000000240)=[{0x18, 0x110, 0x1, "01000000"}], 0x18}, 0x4010) recvmsg(r1, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) 8.05170835s ago: executing program 4 (id=7443): r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000340)={0xa, 0x4e20, 0x1, @ipv4={'\x00', '\xff\xff', @remote}, 0x202}, 0x1c) r1 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r1, 0x0, 0x0) listen(r1, 0x3cf) setsockopt$sock_int(r1, 0x1, 0x29, &(0x7f0000000000)=0xffffff7b, 0x4) listen(r1, 0x1) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000380)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000003c0), 0x0, 0x0) read$msr(r3, &(0x7f0000000540)=""/102392, 0x18ff8) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000019540), 0x84042, 0x0) r5 = syz_open_dev$loop(&(0x7f0000019580), 0x80000001, 0x162842) ioctl$LOOP_CONFIGURE(r5, 0x4c0a, &(0x7f00000195c0)={r4, 0x20a4, {0x0, 0x0, 0x0, 0x3, 0x14a1fd, 0x0, 0x0, 0x1e, 0x1c, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "a9103939c787a16c1ca43f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d2", "24431a1e77a68e00000010e200", [0x0, 0x400]}}) ioctl$AUTOFS_IOC_SETTIMEOUT(0xffffffffffffffff, 0x80049367, 0x0) sendmsg(r1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000100100000100000002000000003700001000000000000000110000000e00000044f3a0214f1f1c567132f2ffa370574c8e62855f31d4740771cf1bdf01c16b82dab013253478a26a4ca0312b37c8d216eb8c0d78496a915a263eb90eadb33102e5288732018b6ecde2b5fc7eea"], 0x28}, 0x0) r6 = socket$rxrpc(0x21, 0x2, 0x2) sendmsg(r6, &(0x7f0000000100)={&(0x7f0000000140)=@rxrpc=@in4={0x21, 0x1234, 0x2, 0x10, {0x2, 0x5678, @loopback}}, 0x80, &(0x7f00000001c0), 0x0, &(0x7f0000000240)=[{0x18, 0x110, 0x1, "01000000"}], 0x18}, 0x4010) 7.572676629s ago: executing program 6 (id=7444): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sec\x00', &(0x7f0000000080)='securityfs\x00', 0x40, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sec/safesetid/gid_allowlist_policy\x00', 0x2, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240), 0x40000, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000280), 0x2, 0x141102) writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000300)="94", 0xf000}, {0x0}], 0x2) readlinkat(0xffffffffffffffff, 0x0, &(0x7f00000003c0)=""/188, 0xbc) mount$overlay(0x0, 0x0, 0x0, 0xa28000, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) fcntl$notify(0xffffffffffffffff, 0x402, 0x80000020) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000d00), 0xffffffffffffffff) creat(0x0, 0xa2) syz_open_dev$dvb_frontend(&(0x7f0000000e40), 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000f00)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 6.517518716s ago: executing program 9 (id=7445): openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000400)={0xe, 0x1, 0xfa00, @id_resuseaddr={&(0x7f0000000440)=0x1, 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) r0 = syz_io_uring_setup(0xf00, &(0x7f0000000580)={0x0, 0x5961, 0x10000, 0x0, 0x4e}, &(0x7f0000000600)=0x0, &(0x7f0000000640)=0x0, &(0x7f0000000680)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f00000006c0)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) 5.912666598s ago: executing program 4 (id=7446): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x2, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000b2e900007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000b00)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r0, 0x2000000, 0x1a, 0xffffffffffffffee, &(0x7f0000000080)="630b008646dc3f0adf398151d9000000000000000000ea1f0000", 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x2f) 5.448358405s ago: executing program 6 (id=7447): userfaultfd(0x1) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)=[@rights={{0x10}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x28}, 0x40000180) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, 0x0, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe700, 0x8000, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x2, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x89a0, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 5.321098518s ago: executing program 9 (id=7448): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x9a5eb000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, 0x0, 0x0) sendmmsg$inet(r3, &(0x7f0000000680)=[{{0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000700)}], 0x1}}], 0x1, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_cred(r1, 0x1, 0x11, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={0x0, &(0x7f0000000ac0)=""/257, 0x0, 0x101, 0x6}, 0x28) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) ptrace$ARCH_SET_CPUID(0x1e, r0, 0x0, 0x1012) socketpair(0x1d, 0x2, 0x2, &(0x7f0000000940)) sendmsg$nl_xfrm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@updpolicy={0x13c, 0x19, 0x1, 0x70bd29, 0x4, {{@in6=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0x0, 0x3}}, [@tmpl={0x84, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x0, @in6=@ipv4={'\x00', '\xff\xff', @local}, 0x0, 0x1, 0x0, 0x0, 0x1ff, 0x1ffd}, {{@in=@loopback, 0x0, 0x32}, 0xa, @in6=@dev={0xfe, 0x80, '\x00', 0x1b}, 0x0, 0x1, 0x0, 0x87, 0x29a, 0x0, 0x81}]}]}, 0x13c}}, 0x20004) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000980), 0x2241, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000009c0)={'pimreg\x00', 0x5005}) socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) 3.647449738s ago: executing program 4 (id=7449): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0x8, &(0x7f0000000540)=ANY=[@ANYBLOB="7a0af8ff75257078bfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000ff00000000b2595285faa6ead0169191d54f8196217fc560e2fc91f6da4dad4fdc2eb1b5986fc4a3f611a7c8edd3aa5d6ee7ab10b1a297cf52866651ddd73f30f2382f6cda4bfdd45be583823c0f09621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000000000000db453620ce72d75946c2b638d91dbef661962239c77edf2d34b12cd48a1b20fb7dd8432619f2c50d77bc0ea9b0af58e6fff4942eb613eff289026d5045ef76d7d864409eb2dc9518a09f4886afc26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc76be40d435aa8b5208ff0df2db761014b1b999a12df6bee431a668135b8214afa5827b56a8074bf1e6cf5d84b35a3a3a4c66824fe12dbe20fcf50a194185b9e2d8b815fedb0d982936156be3cdda66fb977aef7c9cb92428ef25d9bf665bd60024c09e9eed544126fabe4cb8d826e1ec03cc492f5cad6227c94fea467aea7fa8b58abc37056433edf43fba5566a3e022034ac81fd48f9b7314ffa730017fbd37fdb23bc26992529402a520ef67e246415a6a8ca9d4aa797a95ca3314ded0d8a24abd57e042888a9141ab4e6c6b939aaefc248791464970c43120211b9bc82a85cd2fc18f535c7986c2d52ba62f74f00000000008000000000000000000000000040000000000000"], &(0x7f0000000780)='GPL\x00'}, 0x48) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000007c0)=r3, 0x4) bind$netlink(r2, &(0x7f0000000840)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) syz_emit_ethernet(0x3e, &(0x7f0000000a80)={@local, @multicast, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "6410a6", 0x8, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, @local, {[@routing={0x84}]}}}}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000a40)=ANY=[@ANYBLOB="34000000100001080000e3015b08162335a00000", @ANYRES32=0x0, @ANYBLOB="80400100000001000c002b8008000100", @ANYBLOB="08001b"], 0x34}, 0x1, 0x0, 0x0, 0x20004040}, 0x0) 2.658220639s ago: executing program 4 (id=7450): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd\x00', 0x4a) mount(0x0, &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x1, 0x0) write(r0, 0x0, 0x0) 2.346913661s ago: executing program 9 (id=7451): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000140)={0xffffffffffffffff}, 0x2, 0x5}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000180)={0xe, 0x1, 0xfa00, @id_resuseaddr={&(0x7f0000000240)=0x1, r1, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {r1, 0x10, 0x0, @in={0x2, 0x4e23, @empty}}}, 0x90) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x16) socket(0x400000000010, 0x3, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000780)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000007c0)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f0000000800), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f0000000880)="94", 0xf000}, {0x0}], 0x2) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000008c0)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000940)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe}}}, &(0x7f0000000980)=0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup(r4) syz_ublk_setup_queues(r5, r3, &(0x7f00000009c0)={0x0, 0xc1, 0x10, 0xfffffffd, 0x230}, &(0x7f0000000a40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x403, 0x400, 0x3, 0xff}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc81d, 0x2, 0x1, 0x3ac}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x40, 0x4003bfff, 0x299}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) 2.285269547s ago: executing program 4 (id=7452): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x7, 0x80000001}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000480)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000500), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000540), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f00000005c0)={0x84, @remote, 0x0, 0x0, 'lblc\x00'}, 0x2c) setsockopt$IP_VS_SO_SET_DEL(r3, 0x0, 0x484, &(0x7f0000000600)={0x20000000000084, @remote, 0x0, 0x0, 'rr\x00'}, 0x2c) 2.041667982s ago: executing program 3 (id=7453): mount(0x0, 0x0, &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/devices/system/clockevents/clockevent0/current_device\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000380)={0x2020}, 0x2020) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000cc1ef420890b070064ef000000010902120001000000000904"], 0x0) r1 = syz_open_dev$dvb_demux(&(0x7f0000000040), 0xcd79, 0x141000) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r1, 0x40146f2c, &(0x7f0000000100)={0xd, 0x0, 0x6, 0x5, 0x4}) 1.848799312s ago: executing program 9 (id=7454): r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000340)={0xa, 0x4e20, 0x1, @ipv4={'\x00', '\xff\xff', @remote}, 0x202}, 0x1c) r1 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r1, 0x0, 0x0) listen(r1, 0x3cf) setsockopt$sock_int(r1, 0x1, 0x29, &(0x7f0000000000)=0xffffff7b, 0x4) listen(r1, 0x1) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000380)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000003c0), 0x0, 0x0) read$msr(r3, &(0x7f0000000540)=""/102392, 0x18ff8) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000019540), 0x84042, 0x0) r5 = syz_open_dev$loop(&(0x7f0000019580), 0x80000001, 0x162842) ioctl$LOOP_CONFIGURE(r5, 0x4c0a, &(0x7f00000195c0)={r4, 0x20a4, {0x0, 0x0, 0x0, 0x3, 0x14a1fd, 0x0, 0x0, 0x1e, 0x1c, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "a9103939c787a16c1ca43f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d2", "24431a1e77a68e00000010e200", [0x0, 0x400]}}) ioctl$AUTOFS_IOC_SETTIMEOUT(0xffffffffffffffff, 0x80049367, 0x0) sendmsg(r1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000100100000100000002000000003700001000000000000000110000000e00000044f3a0214f1f1c567132f2ffa370574c8e62855f31d4740771cf1bdf01c16b82dab013253478a26a4ca0312b37c8d216eb8c0d78496a915a263eb90eadb33102e5288732018b6ecde2b5fc7eea"], 0x28}, 0x0) socket$rxrpc(0x21, 0x2, 0x2) recvmsg(r1, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) 467.253562ms ago: executing program 9 (id=7455): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sec\x00', &(0x7f0000000080)='securityfs\x00', 0x40, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sec/safesetid/gid_allowlist_policy\x00', 0x2, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240), 0x40000, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000280), 0x2, 0x141102) writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000300)="94", 0xf000}, {0x0}], 0x2) readlinkat(0xffffffffffffffff, 0x0, &(0x7f00000003c0)=""/188, 0xbc) mount$overlay(0x0, 0x0, 0x0, 0xa28000, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) fcntl$notify(0xffffffffffffffff, 0x402, 0x80000020) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) syz_genetlink_get_family_id$l2tp(&(0x7f0000000d00), 0xffffffffffffffff) creat(0x0, 0xa2) syz_open_dev$dvb_frontend(&(0x7f0000000e40), 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000f00)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 0s ago: executing program 6 (id=7456): openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000400)={0xe, 0x1, 0xfa00, @id_resuseaddr={&(0x7f0000000440)=0x1, 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) r0 = syz_io_uring_setup(0xf00, &(0x7f0000000580)={0x0, 0x5961, 0x10000, 0x0, 0x4e}, &(0x7f0000000600)=0x0, &(0x7f0000000640)=0x0, &(0x7f0000000680)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f00000006c0)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r0, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) kernel console output (not intermixed with test programs): : 8 bytes leftover after parsing attributes in process `syz.6.5483'. [ 1321.700676][T25221] netlink: 4768 bytes leftover after parsing attributes in process `syz.4.5484'. [ 1321.718588][T25221] netlink: 4768 bytes leftover after parsing attributes in process `syz.4.5484'. [ 1322.308942][T25240] ip_tables: iptables: counters copy to user failed while replacing table [ 1322.494262][T25250] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1326.784477][T25294] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1326.927994][T25301] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5512'. [ 1327.568466][T25319] netlink: 'syz.6.5517': attribute type 1 has an invalid length. [ 1328.114241][T25344] netlink: 'syz.6.5527': attribute type 1 has an invalid length. [ 1328.672624][T25367] netlink: 'syz.6.5536': attribute type 1 has an invalid length. [ 1329.165500][T12910] Bluetooth: hci2: command tx timeout [ 1329.274438][T25392] netlink: 'syz.6.5546': attribute type 1 has an invalid length. [ 1329.822305][T25418] netlink: 'syz.3.5556': attribute type 1 has an invalid length. [ 1329.919975][T25421] ip_tables: iptables: counters copy to user failed while replacing table [ 1330.146172][T25426] overlayfs: failed to resolve './bus': -2 [ 1330.408587][T25433] syzkaller0: entered promiscuous mode [ 1330.414346][T25433] syzkaller0: entered allmulticast mode [ 1330.743761][T25450] netlink: 'syz.6.5567': attribute type 1 has an invalid length. [ 1330.753902][T25450] netlink: 84 bytes leftover after parsing attributes in process `syz.6.5567'. [ 1331.118596][T25457] overlayfs: failed to resolve './bus': -2 [ 1331.142373][T25461] ip_tables: iptables: counters copy to user failed while replacing table [ 1331.291529][T25466] syzkaller0: entered promiscuous mode [ 1331.299348][T25466] syzkaller0: entered allmulticast mode [ 1331.382405][T25472] netlink: 84 bytes leftover after parsing attributes in process `syz.6.5576'. [ 1331.651765][T25485] netlink: 4768 bytes leftover after parsing attributes in process `syz.9.5579'. [ 1332.468300][T25491] overlayfs: failed to resolve './bus': -2 [ 1332.623051][T25496] batman_adv: batadv0: Interface deactivated: syz_tun [ 1332.635917][T25496] batman_adv: batadv0: Removing interface: syz_tun [ 1332.784741][T25501] netlink: 132 bytes leftover after parsing attributes in process `syz.3.5585'. [ 1333.022429][T25508] batman_adv: batadv0: Adding interface: syz_tun [ 1333.030609][T25508] batman_adv: batadv0: The MTU of interface syz_tun is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1333.063049][T25508] batman_adv: batadv0: Interface activated: syz_tun [ 1333.071379][T25505] netlink: 84 bytes leftover after parsing attributes in process `syz.6.5587'. [ 1333.171031][T25513] netlink: 4768 bytes leftover after parsing attributes in process `syz.6.5591'. [ 1333.525203][T25518] overlayfs: failed to resolve './bus': -2 [ 1333.674071][T25521] batman_adv: batadv0: Interface deactivated: syz_tun [ 1333.684187][T25521] batman_adv: batadv0: Removing interface: syz_tun [ 1334.230080][T25536] batman_adv: batadv0: Adding interface: syz_tun [ 1334.237702][T25536] batman_adv: batadv0: The MTU of interface syz_tun is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1334.306188][T25536] batman_adv: batadv0: Interface activated: syz_tun [ 1334.372144][T25539] netlink: 84 bytes leftover after parsing attributes in process `syz.3.5600'. [ 1334.616955][T25543] overlayfs: failed to resolve './bus': -2 [ 1334.731479][T25548] batman_adv: batadv0: Interface deactivated: syz_tun [ 1334.767578][T25548] batman_adv: batadv0: Removing interface: syz_tun [ 1334.797420][T25550] syzkaller0: entered promiscuous mode [ 1334.802923][T25550] syzkaller0: entered allmulticast mode [ 1335.112159][T25564] batman_adv: batadv0: Adding interface: syz_tun [ 1335.124344][T25564] batman_adv: batadv0: The MTU of interface syz_tun is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1335.157403][T25564] batman_adv: batadv0: Interface activated: syz_tun [ 1335.590585][T25572] overlayfs: failed to resolve './bus': -2 [ 1335.702378][T25577] netlink: 28 bytes leftover after parsing attributes in process `syz.6.5614'. [ 1336.380480][T25593] overlayfs: failed to resolve './bus': -2 [ 1337.790526][T25632] overlayfs: failed to resolve './bus': -2 [ 1338.191554][T25648] netlink: 'syz.3.5638': attribute type 4 has an invalid length. [ 1338.485357][T25658] netlink: 28 bytes leftover after parsing attributes in process `syz.6.5641'. [ 1338.597445][T25659] overlayfs: failed to resolve './bus': -2 [ 1338.916674][T25676] netlink: 'syz.3.5650': attribute type 4 has an invalid length. [ 1339.244047][T25692] syzkaller0: entered promiscuous mode [ 1339.258969][T25692] syzkaller0: entered allmulticast mode [ 1339.331525][T25694] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5654'. [ 1339.941716][T25703] overlayfs: failed to resolve './bus': -2 [ 1340.062866][T25707] netlink: 'syz.3.5660': attribute type 4 has an invalid length. [ 1340.355846][T25717] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5663'. [ 1340.460364][T25720] ip_tables: iptables: counters copy to user failed while replacing table [ 1340.531851][T25721] syzkaller0: entered promiscuous mode [ 1340.551004][T25721] syzkaller0: entered allmulticast mode [ 1340.757850][T25731] netlink: 'syz.9.5670': attribute type 4 has an invalid length. [ 1340.884128][T25734] overlayfs: failed to resolve './bus': -2 [ 1341.114567][T25748] netlink: 8 bytes leftover after parsing attributes in process `syz.9.5673'. [ 1341.283056][T25754] ip_tables: iptables: counters copy to user failed while replacing table [ 1341.700808][T25767] overlayfs: failed to resolve './bus': -2 [ 1341.833911][T25772] netlink: 'syz.4.5681': attribute type 4 has an invalid length. [ 1341.860373][T25776] netlink: 52 bytes leftover after parsing attributes in process `syz.6.5684'. [ 1341.876467][T25776] bridge0: port 4(team0) entered disabled state [ 1341.883383][T25776] bridge0: port 2(bridge_slave_1) entered disabled state [ 1341.890937][T25776] bridge0: port 1(bridge_slave_0) entered disabled state [ 1342.037414][T25785] ip_tables: iptables: counters copy to user failed while replacing table [ 1342.120709][T25786] netlink: 4768 bytes leftover after parsing attributes in process `syz.6.5686'. [ 1342.147645][T25786] netlink: 4768 bytes leftover after parsing attributes in process `syz.6.5686'. [ 1342.425752][T25795] overlayfs: failed to resolve './bus': -2 [ 1342.524537][T25804] netlink: 'syz.9.5693': attribute type 4 has an invalid length. [ 1342.891912][T25815] ip_tables: iptables: counters copy to user failed while replacing table [ 1342.996735][T25821] netlink: 84 bytes leftover after parsing attributes in process `syz.3.5699'. [ 1343.312122][T25830] overlayfs: failed to resolve './bus': -2 [ 1343.443433][T25835] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5707'. [ 1343.873446][T25855] overlayfs: failed to resolve './bus': -2 [ 1344.209935][T25866] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5717'. [ 1344.235411][T25868] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1344.678030][T25878] overlayfs: failed to resolve './bus': -2 [ 1344.971297][T25886] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5724'. [ 1345.585109][T25916] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1345.606462][T25908] overlayfs: failed to resolve './bus': -2 [ 1345.770124][T25927] netlink: 4 bytes leftover after parsing attributes in process `syz.9.5736'. [ 1346.306575][T25947] overlayfs: failed to resolve './bus': -2 [ 1346.410692][T25951] vxlan1: entered promiscuous mode [ 1346.843954][T25969] netlink: 4 bytes leftover after parsing attributes in process `syz.9.5750'. [ 1347.049618][T25977] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1347.171696][T25979] overlayfs: failed to resolve './bus': -2 [ 1347.667875][T25997] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5764'. [ 1348.037743][T26022] ip_tables: iptables: counters copy to user failed while replacing table [ 1348.140507][T26026] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1348.241040][T26033] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5777'. [ 1348.377266][T26041] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5776'. [ 1348.609427][T26051] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5783'. [ 1348.614292][T26052] netlink: 60 bytes leftover after parsing attributes in process `syz.3.5782'. [ 1348.761923][T26058] netlink: 8 bytes leftover after parsing attributes in process `syz.9.5786'. [ 1350.095599][T26078] __nla_validate_parse: 1 callbacks suppressed [ 1350.095613][T26078] netlink: 60 bytes leftover after parsing attributes in process `syz.6.5792'. [ 1350.203548][T26082] netlink: 40 bytes leftover after parsing attributes in process `syz.9.5793'. [ 1352.669353][T26102] netlink: 4 bytes leftover after parsing attributes in process `syz.6.5802'. [ 1352.692749][T26122] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5805'. [ 1354.738247][T26182] loop3: detected capacity change from 0 to 33280 [ 1354.776820][T26183] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5817'. [ 1354.801662][T26182] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 1354.872571][T26182] EXT4-fs error (device loop3): ext4_orphan_get:1434: comm syz.3.5821: bad orphan inode 131083 [ 1354.914096][T26182] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1356.408809][T26216] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5831'. [ 1356.461411][T26178] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1357.275535][T12910] Bluetooth: hci1: command 0x0406 tx timeout [ 1357.975275][T26255] netlink: 'syz.6.5842': attribute type 2 has an invalid length. [ 1360.506906][T26306] netlink: 12 bytes leftover after parsing attributes in process `syz.6.5862'. [ 1360.526222][T26308] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5864'. [ 1360.809766][T26322] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5870'. [ 1360.836285][T26322] x_tables: ip6_tables: policy.0 match: invalid size 312 (kernel) != (user) 0 [ 1361.765373][ T1287] ieee802154 phy0 wpan0: encryption failed: -22 [ 1361.771733][ T1287] ieee802154 phy1 wpan1: encryption failed: -22 [ 1362.196596][T26357] netlink: 'syz.3.5881': attribute type 72 has an invalid length. [ 1362.204614][T26357] netlink: 52 bytes leftover after parsing attributes in process `syz.3.5881'. [ 1363.242807][T26373] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1363.392206][T26382] netlink: 'syz.6.5892': attribute type 72 has an invalid length. [ 1363.403407][T26382] netlink: 52 bytes leftover after parsing attributes in process `syz.6.5892'. [ 1363.508618][T26390] netlink: 40 bytes leftover after parsing attributes in process `syz.9.5895'. [ 1364.074234][T26391] Cannot find set identified by id 0 to match [ 1364.577670][T26416] netlink: 'syz.6.5904': attribute type 72 has an invalid length. [ 1364.604119][T26416] netlink: 52 bytes leftover after parsing attributes in process `syz.6.5904'. [ 1364.612776][T26418] netlink: 40 bytes leftover after parsing attributes in process `syz.9.5906'. [ 1364.733219][T26424] ip_tables: iptables: counters copy to user failed while replacing table [ 1365.430349][T26439] xt_NFQUEUE: number of total queues is 0 [ 1365.570874][T26441] netlink: 40 bytes leftover after parsing attributes in process `syz.6.5917'. [ 1365.601203][T26448] netlink: 60 bytes leftover after parsing attributes in process `syz.4.5918'. [ 1365.690219][T26452] ip_tables: iptables: counters copy to user failed while replacing table [ 1365.803699][T26454] netlink: 16 bytes leftover after parsing attributes in process `syz.9.5922'. [ 1366.011320][T26465] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5927'. [ 1366.096385][T26470] netlink: 60 bytes leftover after parsing attributes in process `syz.4.5928'. [ 1366.748631][T26483] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:aa) already exists on: syz_tun [ 1366.759178][T26483] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1366.769180][T26483] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:aa) already exists on: syz_tun [ 1366.784206][T26483] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1366.794810][T26483] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:aa) already exists on: syz_tun [ 1366.805035][T26483] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1366.819622][T26482] Cannot find set identified by id 0 to match [ 1368.199502][T26514] netlink: 60 bytes leftover after parsing attributes in process `syz.9.5941'. [ 1368.530238][T26516] netlink: 44 bytes leftover after parsing attributes in process `syz.4.5942'. [ 1369.598783][T26535] Cannot find set identified by id 0 to match [ 1374.111666][T26576] xt_NFQUEUE: number of total queues is 0 [ 1375.627548][T26601] netlink: 12 bytes leftover after parsing attributes in process `syz.9.5967'. [ 1376.100161][T26612] Cannot find set identified by id 0 to match [ 1377.350139][T26639] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5981'. [ 1377.710581][T26643] Cannot find set identified by id 0 to match [ 1378.864831][T26668] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 1378.971465][T26672] netlink: 'syz.3.5993': attribute type 2 has an invalid length. [ 1379.447541][T26678] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:aa) already exists on: syz_tun [ 1379.457553][T26678] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1379.467498][T26678] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:aa) already exists on: syz_tun [ 1379.487202][T26679] xt_NFQUEUE: number of total queues is 0 [ 1379.495195][T26678] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1379.505171][T26678] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:aa) already exists on: syz_tun [ 1379.515269][T26678] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1380.318669][T26697] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 1380.485115][T26708] netlink: 'syz.3.6003': attribute type 2 has an invalid length. [ 1381.294884][T26719] xt_NFQUEUE: number of total queues is 0 [ 1383.323444][T26747] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 1383.873393][T26762] Cannot find set identified by id 0 to match [ 1384.808050][T26776] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6024'. [ 1385.311298][T26791] xt_NFQUEUE: number of total queues is 0 [ 1385.694831][T26792] loop4: detected capacity change from 0 to 256 [ 1386.004032][T26796] netlink: 44 bytes leftover after parsing attributes in process `syz.4.6030'. [ 1386.788281][T26809] ip_tables: iptables: counters copy to user failed while replacing table [ 1387.386550][T26822] xt_NFQUEUE: number of total queues is 0 [ 1388.041094][T26826] netlink: 44 bytes leftover after parsing attributes in process `syz.9.6041'. [ 1388.775422][T26835] ip_tables: iptables: counters copy to user failed while replacing table [ 1389.116943][T26846] netlink: 'syz.6.6049': attribute type 39 has an invalid length. [ 1389.304674][T26856] loop4: detected capacity change from 0 to 256 [ 1389.445696][T26859] netlink: 44 bytes leftover after parsing attributes in process `syz.4.6053'. [ 1389.849826][T26861] ip_tables: iptables: counters copy to user failed while replacing table [ 1390.581723][T26891] netlink: 12 bytes leftover after parsing attributes in process `syz.9.6065'. [ 1390.647636][T26891] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1390.951322][T26901] loop4: detected capacity change from 0 to 256 [ 1391.089984][T26903] netlink: 44 bytes leftover after parsing attributes in process `syz.4.6068'. [ 1392.541851][T12910] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1392.551610][T12910] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1392.568164][T12910] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1392.577039][T18673] batman_adv: batadv0: Interface deactivated: syz_tun [ 1392.596989][T12910] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1392.633416][T12910] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 1392.641442][T12910] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1393.061391][T18673] batman_adv: batadv0: Removing interface: syz_tun [ 1393.274036][T26926] netlink: 44 bytes leftover after parsing attributes in process `syz.9.6077'. [ 1393.369505][T26920] rxe_eth0 speed is unknown, defaulting to 1000 [ 1393.645500][T26932] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6080'. [ 1393.689694][T26934] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1393.720141][T26920] wlan1 speed is unknown, defaulting to 1000 [ 1394.060301][T26920] chnl_net:caif_netlink_parms(): no params data found [ 1394.189095][T26920] bridge0: port 1(bridge_slave_0) entered blocking state [ 1394.196422][T26920] bridge0: port 1(bridge_slave_0) entered disabled state [ 1394.203581][T26920] bridge_slave_0: entered allmulticast mode [ 1394.211213][T26920] bridge_slave_0: entered promiscuous mode [ 1394.220469][T26920] bridge0: port 2(bridge_slave_1) entered blocking state [ 1394.227888][T26920] bridge0: port 2(bridge_slave_1) entered disabled state [ 1394.245164][T26920] bridge_slave_1: entered allmulticast mode [ 1394.252689][T26920] bridge_slave_1: entered promiscuous mode [ 1394.284300][T26920] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1394.296610][T26920] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1394.355109][T26920] team0: Port device team_slave_0 added [ 1394.363601][T26920] team0: Port device team_slave_1 added [ 1394.417043][T26920] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1394.432802][T26920] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1394.801903][T26920] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1394.929110][T12910] Bluetooth: hci0: command tx timeout [ 1394.946774][T26953] netlink: 44 bytes leftover after parsing attributes in process `syz.9.6086'. [ 1395.013863][T26920] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1395.104372][T26920] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1395.155315][T26920] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1395.210848][T26920] hsr_slave_0: entered promiscuous mode [ 1395.279455][T26920] hsr_slave_1: entered promiscuous mode [ 1395.588855][T26920] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1395.643426][T26966] netlink: 12 bytes leftover after parsing attributes in process `syz.9.6092'. [ 1395.753940][T26920] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1395.762426][T26970] netlink: 'syz.9.6094': attribute type 2 has an invalid length. [ 1395.915955][T26920] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1396.021051][T26920] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1396.374330][T26972] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1396.560261][T26972] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1396.731458][T26972] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1396.843144][T26972] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1396.871015][T26993] netlink: 12 bytes leftover after parsing attributes in process `syz.9.6099'. [ 1396.911768][T26920] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1396.931932][T26920] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1396.957794][T26920] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1396.981913][T26920] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1397.005360][T12910] Bluetooth: hci0: command tx timeout [ 1397.058391][T26972] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1397.091584][T26997] netlink: 12 bytes leftover after parsing attributes in process `syz.9.6101'. [ 1397.099027][T26972] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1397.138683][T26972] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1397.164213][T26972] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1397.242279][T26920] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1397.284459][T26920] 8021q: adding VLAN 0 to HW filter on device team0 [ 1397.309270][ T1098] bridge0: port 1(bridge_slave_0) entered blocking state [ 1397.316479][ T1098] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1397.327594][T27001] netlink: 'syz.4.6103': attribute type 2 has an invalid length. [ 1397.343727][ T1098] bridge0: port 2(bridge_slave_1) entered blocking state [ 1397.350852][ T1098] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1397.706097][T26920] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1399.085444][T12910] Bluetooth: hci0: command tx timeout [ 1399.428170][T12910] Bluetooth: unknown link type 132 [ 1399.433452][T12910] Bluetooth: hci2: connection err: -111 [ 1399.442346][T27028] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6109'. [ 1399.648341][T27037] netlink: 'syz.3.6113': attribute type 2 has an invalid length. [ 1399.731283][T26920] veth0_vlan: entered promiscuous mode [ 1399.780733][T26920] veth1_vlan: entered promiscuous mode [ 1399.872600][T26920] veth0_macvtap: entered promiscuous mode [ 1399.988447][T26920] veth1_macvtap: entered promiscuous mode [ 1400.041616][T26920] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1400.071916][T26920] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1400.089556][T26920] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1400.101436][T26920] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1400.117727][T26920] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1400.132712][T26920] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1400.153439][T26920] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1400.169768][T26920] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1400.204790][T26920] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1400.230413][T26920] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1400.246983][T26920] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1400.269020][T26920] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1400.299065][T26920] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1400.308412][T27066] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6120'. [ 1400.319207][T26920] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1400.341983][T26920] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1400.360804][T26920] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1400.385074][T26920] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1400.398818][T26920] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1400.410421][T26920] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1400.427907][T26920] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1400.442861][T26920] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1400.451802][T26920] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1400.466028][T26920] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1400.480834][T26920] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1400.641428][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1400.656697][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1400.709286][ T1086] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1400.722767][ T1086] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1401.165606][T12910] Bluetooth: hci0: command tx timeout [ 1401.782070][T27086] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6127'. [ 1401.907685][T27090] netlink: 'syz.6.6129': attribute type 2 has an invalid length. [ 1401.919191][T27091] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 1401.953754][T27091] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6128'. [ 1402.123894][T27096] bridge0: port 3(syz_tun) entered blocking state [ 1402.131779][T27096] bridge0: port 3(syz_tun) entered disabled state [ 1402.138952][T27096] syz_tun: entered allmulticast mode [ 1402.145503][T27096] syz_tun: entered promiscuous mode [ 1402.151561][T27096] bridge0: port 3(syz_tun) entered blocking state [ 1402.158153][T27096] bridge0: port 3(syz_tun) entered forwarding state [ 1402.481570][T27100] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:aa) already exists on: syz_tun [ 1402.491533][T27100] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1402.501513][T27100] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:aa) already exists on: syz_tun [ 1402.521255][T27100] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1403.256750][T27110] netlink: 12 bytes leftover after parsing attributes in process `syz.9.6136'. [ 1403.433795][T27121] netlink: 'syz.9.6139': attribute type 2 has an invalid length. [ 1404.776047][T27146] netlink: 12 bytes leftover after parsing attributes in process `syz.9.6147'. [ 1404.892138][T27150] netlink: 'syz.3.6149': attribute type 2 has an invalid length. [ 1406.257075][T27179] netlink: 12 bytes leftover after parsing attributes in process `syz.9.6158'. [ 1406.553014][T27192] netlink: 1172 bytes leftover after parsing attributes in process `syz.9.6163'. [ 1407.394805][T27197] ip_tables: iptables: counters copy to user failed while replacing table [ 1407.584186][T27206] netlink: 12 bytes leftover after parsing attributes in process `syz.9.6169'. [ 1408.462775][T27223] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 1408.546373][T27230] netlink: 4 bytes leftover after parsing attributes in process `syz.9.6173'. [ 1409.359355][T27237] ip_tables: iptables: counters copy to user failed while replacing table [ 1409.379080][T27237] netlink: 72 bytes leftover after parsing attributes in process `syz.3.6177'. [ 1409.564029][T27244] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6181'. [ 1412.229154][T27278] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6193'. [ 1412.571111][T27296] netlink: 4 bytes leftover after parsing attributes in process `syz.9.6199'. [ 1412.600351][T27296] team_slave_0: entered promiscuous mode [ 1412.606634][T27296] team_slave_1: entered promiscuous mode [ 1412.634024][T27296] macsec1: entered promiscuous mode [ 1412.639384][T27296] team0: entered promiscuous mode [ 1412.646016][T27296] macsec1: entered allmulticast mode [ 1412.651704][T27296] team0: entered allmulticast mode [ 1412.657704][T27296] team_slave_0: entered allmulticast mode [ 1412.663566][T27296] team_slave_1: entered allmulticast mode [ 1412.696760][T27296] team0: Device macsec1 is already an upper device of the team interface [ 1412.713416][T27296] team0: left allmulticast mode [ 1412.718629][T27296] team_slave_0: left allmulticast mode [ 1412.730777][T27296] team_slave_1: left allmulticast mode [ 1412.737338][T27296] team0: left promiscuous mode [ 1412.749683][T27296] team_slave_0: left promiscuous mode [ 1412.755146][T27296] team_slave_1: left promiscuous mode [ 1413.876113][T27318] Cannot find set identified by id 0 to match [ 1414.098112][T27322] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6206'. [ 1415.582921][T27344] netlink: 24 bytes leftover after parsing attributes in process `syz.9.6216'. [ 1415.950521][T27354] xt_NFQUEUE: number of total queues is 0 [ 1418.154242][T27403] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1421.230426][T27482] netlink: 'syz.9.6265': attribute type 2 has an invalid length. [ 1423.172826][ T1287] ieee802154 phy0 wpan0: encryption failed: -22 [ 1423.179376][ T1287] ieee802154 phy1 wpan1: encryption failed: -22 [ 1423.279528][T27502] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 1423.310225][T27502] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 1423.342910][T27502] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 1423.927885][T27506] ip_tables: iptables: counters copy to user failed while replacing table [ 1423.946765][T27506] netlink: 72 bytes leftover after parsing attributes in process `syz.9.6271'. [ 1424.463091][T27524] netlink: 52 bytes leftover after parsing attributes in process `syz.3.6277'. [ 1425.265204][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 1425.678390][T27535] device-mapper: table: 248:12: multipath: error getting device (-ENOENT) [ 1425.695080][T27535] device-mapper: ioctl: error adding target to table [ 1426.359600][T27547] netlink: 52 bytes leftover after parsing attributes in process `syz.4.6287'. [ 1426.472219][ T28] kauditd_printk_skb: 13 callbacks suppressed [ 1426.472233][ T28] audit: type=1800 audit(1794470455.979:184): pid=27549 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.6289" name="features" dev="configfs" ino=109618 res=0 errno=0 [ 1426.588184][T27553] ip_tables: iptables: counters copy to user failed while replacing table [ 1426.610175][T27553] netlink: 72 bytes leftover after parsing attributes in process `syz.3.6281'. [ 1427.715241][T27568] netlink: 'syz.4.6295': attribute type 4 has an invalid length. [ 1427.962206][T27579] netlink: 52 bytes leftover after parsing attributes in process `syz.4.6298'. [ 1428.017688][T27581] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6299'. [ 1428.042801][T27581] tipc: Invalid UDP bearer configuration [ 1428.042852][T27581] tipc: Enabling of bearer rejected, failed to enable media [ 1428.091583][T27583] ip_tables: iptables: counters copy to user failed while replacing table [ 1428.121262][T27583] netlink: 72 bytes leftover after parsing attributes in process `syz.4.6300'. [ 1429.352673][T27597] gadgetfs: bound to dummy_udc driver [ 1429.791571][T27609] netlink: 52 bytes leftover after parsing attributes in process `syz.4.6308'. [ 1429.989033][T27615] ip_tables: iptables: counters copy to user failed while replacing table [ 1430.041149][T27616] netlink: 72 bytes leftover after parsing attributes in process `syz.4.6310'. [ 1432.577117][T27637] netlink: 52 bytes leftover after parsing attributes in process `syz.9.6318'. [ 1433.304881][T27649] netlink: 84 bytes leftover after parsing attributes in process `syz.6.6322'. [ 1433.724737][T27664] netlink: 52 bytes leftover after parsing attributes in process `syz.4.6327'. [ 1434.863348][T27678] netlink: 'syz.3.6332': attribute type 1 has an invalid length. [ 1435.505167][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 1443.294165][T27776] ip_tables: iptables: counters copy to user failed while replacing table [ 1443.393197][T27778] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6354'. [ 1447.157512][T27797] netlink: 84 bytes leftover after parsing attributes in process `syz.4.6363'. [ 1447.597299][T27808] ip_tables: iptables: counters copy to user failed while replacing table [ 1449.576737][T27825] syzkaller1: entered promiscuous mode [ 1449.595324][T27825] syzkaller1: entered allmulticast mode [ 1450.012931][T27846] ip_tables: iptables: counters copy to user failed while replacing table [ 1450.193229][T27855] tipc: Cannot configure node identity twice [ 1450.430736][T13529] tipc: Subscription rejected, illegal request [ 1451.167992][T12910] Bluetooth: hci2: command 0x0406 tx timeout [ 1451.309998][T27869] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6386'. [ 1453.003769][T27896] tipc: Started in network mode [ 1453.043919][T27896] tipc: Node identity 4, cluster identity 4711 [ 1453.081460][T27896] tipc: Node number set to 4 [ 1453.146418][T13529] tipc: Subscription rejected, illegal request [ 1453.513219][T27895] overlayfs: failed to clone upperpath [ 1455.575605][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 1460.247914][ T28] audit: type=1326 audit(1794470489.759:185): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27938 comm="syz.9.6408" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff300ba8fd9 code=0x7fc00000 [ 1460.383639][ T28] audit: type=1326 audit(1794470489.879:186): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27938 comm="syz.9.6408" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7ff300ba8fd9 code=0x7fc00000 [ 1460.441116][ T28] audit: type=1326 audit(1794470489.889:187): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27938 comm="syz.9.6408" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff300ba8fd9 code=0x7fc00000 [ 1460.503299][ T28] audit: type=1326 audit(1794470489.889:188): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27938 comm="syz.9.6408" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff300ba8fd9 code=0x7fc00000 [ 1460.545089][ T28] audit: type=1326 audit(1794470489.889:189): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27938 comm="syz.9.6408" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff300ba8fd9 code=0x7fc00000 [ 1460.601323][ T28] audit: type=1326 audit(1794470489.889:190): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27938 comm="syz.9.6408" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff300ba8fd9 code=0x7fc00000 [ 1460.683536][ T28] audit: type=1326 audit(1794470489.889:191): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27938 comm="syz.9.6408" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff300ba8fd9 code=0x7fc00000 [ 1460.761323][ T28] audit: type=1326 audit(1794470489.889:192): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27938 comm="syz.9.6408" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff300ba8fd9 code=0x7fc00000 [ 1460.832964][ T28] audit: type=1326 audit(1794470489.889:193): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27938 comm="syz.9.6408" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff300ba8fd9 code=0x7fc00000 [ 1460.899188][ T28] audit: type=1326 audit(1794470489.889:194): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27938 comm="syz.9.6408" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff300ba8fd9 code=0x7fc00000 [ 1461.345242][ T8] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 1461.537094][ T8] usb 7-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 1461.555019][ T8] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1461.574014][ T8] usb 7-1: config 0 descriptor?? [ 1462.001843][ T8] [drm] Initialized udl 0.0.1 20120220 for 7-1:0.0 on minor 2 [ 1462.027400][T27969] fuse: Bad value for 'rootmode' [ 1462.042590][ T8] [drm] Initialized udl on minor 2 [ 1462.216042][ T8] udl 7-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1462.253227][ T8] udl 7-1:0.0: [drm] Cannot find any crtc or sizes [ 1462.269947][T20788] udl 7-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1462.281093][T20788] udl 7-1:0.0: [drm] Cannot find any crtc or sizes [ 1462.290651][ T8] usb 7-1: USB disconnect, device number 2 [ 1464.045017][T27985] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wireguard%d": -EINTR [ 1464.175316][ T52] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 1464.176019][T12910] Bluetooth: hci1: command 0x1003 tx timeout [ 1464.402444][T27990] netlink: 'syz.3.6423': attribute type 2 has an invalid length. [ 1465.075106][T20788] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 1466.866357][T20788] usb 5-1: Using ep0 maxpacket: 16 [ 1466.874166][T20788] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 8 [ 1466.914643][T20788] usb 5-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 6.00 [ 1466.937144][T20788] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1466.965816][T20788] usb 5-1: Product: syz [ 1466.970003][T20788] usb 5-1: Manufacturer: syz [ 1466.974608][T20788] usb 5-1: SerialNumber: syz [ 1466.996156][T20788] usb 5-1: config 0 descriptor?? [ 1467.004809][T20788] ftdi_sio 5-1:0.0: FTDI USB Serial Device converter detected [ 1467.031657][T20788] usb 5-1: Detected FT232R [ 1467.236628][T28022] netlink: 'syz.6.6434': attribute type 2 has an invalid length. [ 1467.428071][T20788] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 1467.454051][T20788] ftdi_sio 5-1:0.0: GPIO initialisation failed: -71 [ 1467.468416][T20788] usb 5-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 1467.492046][T20788] usb 5-1: USB disconnect, device number 13 [ 1467.509164][T20788] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 1467.532108][T20788] ftdi_sio 5-1:0.0: device disconnected [ 1467.702388][T28032] ip_tables: iptables: counters copy to user failed while replacing table [ 1467.714463][T28032] netlink: 72 bytes leftover after parsing attributes in process `syz.3.6438'. [ 1467.746013][T19612] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 1468.375580][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 1468.754193][T19612] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1468.766089][T19612] usb 7-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 64, changing to 7 [ 1468.777093][T19612] usb 7-1: Duplicate descriptor for config 1 interface 2 altsetting 0, skipping [ 1468.789028][T19612] usb 7-1: New USB device found, idVendor=041e, idProduct=3020, bcdDevice= 0.40 [ 1468.798236][T19612] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1468.811090][T19612] usb 7-1: Product: syz [ 1468.815656][T19612] usb 7-1: Manufacturer: syz [ 1468.820379][T19612] usb 7-1: SerialNumber: syz [ 1469.743887][T19612] usb 7-1: unit 4 not found! [ 1469.841454][T19612] usb 7-1: USB disconnect, device number 3 [ 1469.887319][T28048] netlink: 'syz.9.6444': attribute type 2 has an invalid length. [ 1469.950001][T27975] udevd[27975]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1470.147567][T28055] ip_tables: iptables: counters copy to user failed while replacing table [ 1470.171049][T28055] netlink: 72 bytes leftover after parsing attributes in process `syz.6.6447'. [ 1471.065533][ T8] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 1471.379761][ T28] kauditd_printk_skb: 58 callbacks suppressed [ 1471.379796][ T28] audit: type=1326 audit(1794470500.879:253): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28079 comm="syz.9.6455" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff300ba8fd9 code=0x7ffc0000 [ 1471.434624][ T28] audit: type=1326 audit(1794470500.879:254): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28079 comm="syz.9.6455" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff300ba8fd9 code=0x7ffc0000 [ 1471.867283][ T28] audit: type=1326 audit(1794470500.879:255): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28079 comm="syz.9.6455" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7ff300b6980e code=0x7ffc0000 [ 1471.976457][ T8] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1471.995477][ T8] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1472.005709][ T8] usb 7-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 1472.014838][ T8] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1472.018029][ T28] audit: type=1326 audit(1794470500.879:256): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28079 comm="syz.9.6455" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7ff300b6980e code=0x7ffc0000 [ 1472.050500][ T8] usb 7-1: config 0 descriptor?? [ 1472.132885][ T28] audit: type=1326 audit(1794470500.879:257): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28079 comm="syz.9.6455" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff300ba8fd9 code=0x7ffc0000 [ 1472.172167][ T28] audit: type=1326 audit(1794470500.879:258): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28079 comm="syz.9.6455" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff300ba8fd9 code=0x7ffc0000 [ 1472.212795][ T28] audit: type=1326 audit(1794470500.879:259): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28079 comm="syz.9.6455" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7ff300ba8fd9 code=0x7ffc0000 [ 1472.255332][ T28] audit: type=1326 audit(1794470500.879:260): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28079 comm="syz.9.6455" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff300ba8fd9 code=0x7ffc0000 [ 1472.301573][ T28] audit: type=1326 audit(1794470500.879:261): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28079 comm="syz.9.6455" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff300ba8fd9 code=0x7ffc0000 [ 1472.344354][ T28] audit: type=1326 audit(1794470500.879:262): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=28079 comm="syz.9.6455" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7ff300ba8fd9 code=0x7ffc0000 [ 1472.507301][ T8] playstation 0003:054C:0DF2.000A: unknown main item tag 0x0 [ 1472.523804][ T8] playstation 0003:054C:0DF2.000A: unknown main item tag 0x0 [ 1472.540323][ T8] playstation 0003:054C:0DF2.000A: unknown main item tag 0x0 [ 1472.556807][ T8] playstation 0003:054C:0DF2.000A: unknown main item tag 0x0 [ 1472.564372][ T8] playstation 0003:054C:0DF2.000A: unknown main item tag 0x0 [ 1472.585761][ T8] playstation 0003:054C:0DF2.000A: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.6-1/input0 [ 1472.899707][T28107] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1472.909428][ T8] playstation 0003:054C:0DF2.000A: Failed to retrieve feature with reportID 32: -71 [ 1472.933816][ T8] playstation 0003:054C:0DF2.000A: Failed to retrieve DualSense firmware info: -71 [ 1472.953522][ T8] playstation 0003:054C:0DF2.000A: Failed to get firmware info from DualSense [ 1472.962740][ T8] playstation 0003:054C:0DF2.000A: Failed to create dualsense. [ 1472.991763][ T8] playstation: probe of 0003:054C:0DF2.000A failed with error -71 [ 1473.011459][ T8] usb 7-1: USB disconnect, device number 4 [ 1474.166550][T13488] IPVS: starting estimator thread 0... [ 1474.255257][T28123] IPVS: using max 20 ests per chain, 48000 per kthread [ 1474.591227][T28143] ip_tables: iptables: counters copy to user failed while replacing table [ 1474.765250][ T8] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 1474.978212][ T8] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1474.988520][ T8] usb 7-1: New USB device found, idVendor=0bda, idProduct=0129, bcdDevice= 1.00 [ 1474.997643][ T8] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1475.117002][ T8] rtsx_usb: probe of 7-1:1.0 failed with error -22 [ 1477.080432][T28163] FAULT_INJECTION: forcing a failure. [ 1477.080432][T28163] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1477.115235][T28163] CPU: 1 PID: 28163 Comm: syz.4.6485 Not tainted syzkaller #0 [ 1477.122728][T28163] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 1477.125581][T19612] usb 7-1: USB disconnect, device number 5 [ 1477.132784][T28163] Call Trace: [ 1477.132796][T28163] [ 1477.144794][T28163] dump_stack_lvl+0x18c/0x250 [ 1477.149487][T28163] ? show_regs_print_info+0x20/0x20 [ 1477.154704][T28163] ? load_image+0x420/0x420 [ 1477.159216][T28163] ? __lock_acquire+0x1431/0x7eb0 [ 1477.164269][T28163] should_fail_ex+0x394/0x4c0 [ 1477.168968][T28163] get_futex_key+0x134/0xf40 [ 1477.173572][T28163] ? futex_setup_timer+0xc0/0xc0 [ 1477.178534][T28163] futex_wake+0x127/0x4f0 [ 1477.182884][T28163] ? futex_wake_mark+0x150/0x150 [ 1477.187848][T28163] do_futex+0x35d/0x3e0 [ 1477.192013][T28163] ? __might_fault+0xaa/0x120 [ 1477.196707][T28163] ? __ia32_sys_get_robust_list+0x110/0x110 [ 1477.202621][T28163] ? __might_fault+0xc6/0x120 [ 1477.207310][T28163] mm_release+0x184/0x3a0 [ 1477.211658][T28163] ? exit_mm_release+0x30/0x30 [ 1477.216435][T28163] ? lockdep_hardirqs_on+0x98/0x150 [ 1477.221653][T28163] exit_mm+0xa4/0x340 [ 1477.225651][T28163] ? sysctl_delayacct+0x220/0x220 [ 1477.230689][T28163] ? do_exit+0x2530/0x2530 [ 1477.235126][T28163] ? tty_audit_exit+0x14d/0x1f0 [ 1477.240027][T28163] do_exit+0x909/0x2530 [ 1477.244209][T28163] ? put_task_struct+0xc0/0xc0 [ 1477.248994][T28163] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1477.254984][T28163] ? get_signal+0x100e/0x1390 [ 1477.259671][T28163] ? lock_chain_count+0x20/0x20 [ 1477.264537][T28163] ? _raw_spin_lock_irq+0xbb/0xf0 [ 1477.269579][T28163] do_group_exit+0x22d/0x2f0 [ 1477.274176][T28163] ? lockdep_hardirqs_on+0x98/0x150 [ 1477.279388][T28163] get_signal+0x12a6/0x1390 [ 1477.283928][T28163] arch_do_signal_or_restart+0xc2/0x7b0 [ 1477.289520][T28163] ? __ia32_sys_get_robust_list+0x110/0x110 [ 1477.295427][T28163] ? get_sigframe_size+0x20/0x20 [ 1477.300398][T28163] ? exit_to_user_mode_loop+0x3b/0x110 [ 1477.305878][T28163] exit_to_user_mode_loop+0x70/0x110 [ 1477.311178][T28163] exit_to_user_mode_prepare+0xee/0x180 [ 1477.316741][T28163] syscall_exit_to_user_mode+0x1a/0x50 [ 1477.322222][T28163] do_syscall_64+0x61/0xb0 [ 1477.326652][T28163] ? clear_bhb_loop+0x40/0x90 [ 1477.331344][T28163] ? clear_bhb_loop+0x40/0x90 [ 1477.336044][T28163] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1477.341956][T28163] RIP: 0033:0x7f49297a8fd9 [ 1477.346383][T28163] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1477.366000][T28163] RSP: 002b:00007f492a6940e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1477.374426][T28163] RAX: fffffffffffffe00 RBX: 00007f4929a25fa8 RCX: 00007f49297a8fd9 [ 1477.382408][T28163] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f4929a25fa8 [ 1477.390387][T28163] RBP: 00007f4929a25fa0 R08: 0000000000000000 R09: 0000000000000000 [ 1477.398367][T28163] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1477.406345][T28163] R13: 00007f4929a26038 R14: 00007ffcebff2850 R15: 00007ffcebff2938 [ 1477.414338][T28163] [ 1477.711088][T28171] netdevsim netdevsim9 netdevsim0: IPsec offload requires 128 bit authentication [ 1483.795104][T13488] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 1484.015842][T13488] usb 5-1: Using ep0 maxpacket: 8 [ 1484.043070][T13488] usb 5-1: config 0 has an invalid interface number: 55 but max is 0 [ 1484.065088][T13488] usb 5-1: config 0 has no interface number 0 [ 1484.085670][T13488] usb 5-1: config 0 interface 55 altsetting 0 has an invalid endpoint with address 0x80, skipping [ 1484.111782][T13488] usb 5-1: config 0 interface 55 altsetting 0 has an invalid endpoint with address 0xAB, skipping [ 1484.145409][T28236] netlink: 4768 bytes leftover after parsing attributes in process `syz.9.6506'. [ 1484.166115][T28236] netlink: 4768 bytes leftover after parsing attributes in process `syz.9.6506'. [ 1484.195174][T13488] usb 5-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1484.230416][T13488] usb 5-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1484.254992][T13488] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1484.326228][T13488] usb 5-1: config 0 descriptor?? [ 1484.381164][T13488] ldusb 5-1:0.55: Interrupt in endpoint not found [ 1484.615602][ T1287] ieee802154 phy0 wpan0: encryption failed: -22 [ 1484.621933][ T1287] ieee802154 phy1 wpan1: encryption failed: -22 [ 1484.639861][ T973] usb 5-1: USB disconnect, device number 14 [ 1488.812032][T28273] netlink: 4768 bytes leftover after parsing attributes in process `syz.4.6516'. [ 1489.716452][T28284] netlink: 4768 bytes leftover after parsing attributes in process `syz.4.6516'. [ 1494.115530][T19612] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 1494.406112][T19612] usb 7-1: Using ep0 maxpacket: 32 [ 1495.209053][T19612] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 1495.237458][T19612] usb 7-1: config 0 has no interface number 0 [ 1495.265166][T19612] usb 7-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 1495.295335][T19612] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1495.313581][T19612] usb 7-1: Product: syz [ 1495.320447][T19612] usb 7-1: Manufacturer: syz [ 1495.332850][T19612] usb 7-1: SerialNumber: syz [ 1495.347885][T19612] usb 7-1: config 0 descriptor?? [ 1495.360858][T19612] usb 7-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 1495.380041][T19612] usb 7-1: selecting invalid altsetting 1 [ 1495.390103][T19612] usb 7-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 1495.418459][T19612] usb 7-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1495.448214][T19612] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 1495.463767][T19612] usb 7-1: media controller created [ 1495.500943][T19612] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1495.792930][T19612] usb 7-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 1495.959010][T19612] usb 7-1: USB disconnect, device number 6 [ 1496.715049][T13488] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 1496.795323][T20788] usb 7-1: new high-speed USB device number 7 using dummy_hcd [ 1496.925317][T13488] usb 5-1: Using ep0 maxpacket: 32 [ 1496.940501][T13488] usb 5-1: config 0 has an invalid interface number: 173 but max is 0 [ 1496.957582][T13488] usb 5-1: config 0 has no interface number 0 [ 1496.974511][T13488] usb 5-1: New USB device found, idVendor=2304, idProduct=023b, bcdDevice=5b.f3 [ 1496.987807][T13488] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1497.006460][T13488] usb 5-1: Product: syz [ 1497.016809][T13488] usb 5-1: Manufacturer: syz [ 1497.027480][T20788] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1497.028301][T13488] usb 5-1: SerialNumber: syz [ 1497.054096][T13488] usb 5-1: config 0 descriptor?? [ 1497.058342][T20788] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1497.089986][T20788] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1497.119385][T20788] usb 7-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1497.154087][T20788] usb 7-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 1497.180343][T20788] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1497.298449][T13488] dvb-usb: found a 'Pinnacle PCTV HD USB Stick' in cold state, will try to load a firmware [ 1497.375267][T13488] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 1497.383382][T13488] dib0700: firmware download failed at 7 with -22 [ 1497.421079][T13488] usb 5-1: USB disconnect, device number 15 [ 1498.251360][T20788] [drm] Initialized gud 1.0.0 20200422 for 7-1:1.0 on minor 2 [ 1498.646338][T20788] gud 7-1:1.0: [drm] Cannot find any crtc or sizes [ 1498.936135][T19369] usb 7-1: USB disconnect, device number 7 [ 1499.018651][ T973] gud 7-1:1.0: [drm] fb1: guddrmfb frame buffer device [ 1500.668458][T28387] netlink: 'syz.3.6548': attribute type 4 has an invalid length. [ 1500.726147][ T973] usb 7-1: new full-speed USB device number 8 using dummy_hcd [ 1500.916971][ T973] usb 7-1: not running at top speed; connect to a high speed hub [ 1500.926417][ T973] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1500.944367][ T973] usb 7-1: New USB device found, idVendor=046d, idProduct=0825, bcdDevice= 1.00 [ 1500.959137][ T973] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1501.003548][ T973] usb 7-1: Found UVC 1.00 device (046d:0825) [ 1501.014386][ T973] usb 7-1: No streaming interface found for terminal 2. [ 1501.263590][ T973] usb 7-1: USB disconnect, device number 8 [ 1503.424647][T28426] netlink: 'syz.6.6563': attribute type 4 has an invalid length. [ 1505.064131][T28431] netlink: 'syz.6.6565': attribute type 10 has an invalid length. [ 1505.715677][T28431] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1505.723558][T28431] team0: Port device batadv0 added [ 1509.508652][T28455] dvmrp5: entered allmulticast mode [ 1509.550944][T28455] dvmrp5: left allmulticast mode [ 1509.615077][T13488] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 1509.826735][T13488] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1509.845440][T13488] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1509.866375][T13488] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1509.886586][T13488] usb 7-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1509.905359][T19369] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 1509.926196][T13488] usb 7-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 1509.945501][T13488] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1510.125255][T19369] usb 5-1: Using ep0 maxpacket: 32 [ 1510.144080][T19369] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x8C has invalid maxpacket 1536, setting to 1024 [ 1510.156344][T19369] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 1024 [ 1510.182601][T19369] usb 5-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 1510.199342][T19369] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1510.200462][T28462] netlink: 'syz.9.6573': attribute type 4 has an invalid length. [ 1510.209637][T19369] usb 5-1: Product: syz [ 1510.231151][T19369] usb 5-1: Manufacturer: syz [ 1510.235986][T19369] usb 5-1: SerialNumber: syz [ 1510.250451][T28456] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1510.510343][T19369] usb 5-1: Quirk or no altest; falling back to MIDI 1.0 [ 1510.517758][T19369] usb 5-1: MIDIStreaming interface descriptor not found [ 1510.553678][T19369] usb 5-1: USB disconnect, device number 16 [ 1510.661665][T28468] udevd[28468]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1510.989236][T13488] [drm] Initialized gud 1.0.0 20200422 for 7-1:1.0 on minor 2 [ 1512.762298][T13488] gud 7-1:1.0: [drm] fb1: guddrmfb frame buffer device [ 1512.790352][T13488] usb 7-1: USB disconnect, device number 9 [ 1513.641692][T28483] netlink: 'syz.6.6581': attribute type 1 has an invalid length. [ 1515.427343][T28498] netlink: 'syz.3.6587': attribute type 4 has an invalid length. [ 1515.927731][T28512] syz_tun: left allmulticast mode [ 1515.932966][T28512] syz_tun: left promiscuous mode [ 1515.938731][T28512] bridge0: port 3(syz_tun) entered disabled state [ 1515.948714][T28512] batman_adv: batadv0: Adding interface: syz_tun [ 1515.961804][T28512] batman_adv: batadv0: The MTU of interface syz_tun is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1515.999805][T28512] batman_adv: batadv0: Interface activated: syz_tun [ 1516.127237][T28517] netlink: 'syz.6.6593': attribute type 1 has an invalid length. [ 1517.409185][T25113] Bluetooth: hci0: command 0x0406 tx timeout [ 1517.674137][T28546] netlink: 'syz.6.6605': attribute type 1 has an invalid length. [ 1518.670265][T28574] ip_tables: iptables: counters copy to user failed while replacing table [ 1518.683940][T28574] netlink: 72 bytes leftover after parsing attributes in process `syz.6.6617'. [ 1520.218184][T28597] ip_tables: iptables: counters copy to user failed while replacing table [ 1520.247197][T28597] netlink: 72 bytes leftover after parsing attributes in process `syz.3.6626'. [ 1521.295561][ T8] IPVS: starting estimator thread 0... [ 1521.405338][T28605] IPVS: using max 20 ests per chain, 48000 per kthread [ 1522.965759][T28627] ip_tables: iptables: counters copy to user failed while replacing table [ 1523.895210][T13488] IPVS: starting estimator thread 0... [ 1524.005847][T28632] IPVS: using max 36 ests per chain, 86400 per kthread [ 1524.225274][T13488] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 1524.343779][T28648] netlink: 72 bytes leftover after parsing attributes in process `syz.9.6643'. [ 1524.412450][T13488] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1524.423438][T13488] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1524.433908][T13488] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1524.443940][T13488] usb 7-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1524.457229][T13488] usb 7-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 1524.468346][T13488] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1524.842920][T28657] netlink: 12 bytes leftover after parsing attributes in process `syz.9.6646'. [ 1526.254860][T28663] ip_tables: iptables: counters copy to user failed while replacing table [ 1526.540812][T28673] netlink: 56 bytes leftover after parsing attributes in process `syz.9.6652'. [ 1527.011209][T13488] [drm] Initialized gud 1.0.0 20200422 for 7-1:1.0 on minor 2 [ 1527.125513][T28691] ip_tables: iptables: counters copy to user failed while replacing table [ 1528.469593][T13488] gud 7-1:1.0: [drm] fb1: guddrmfb frame buffer device [ 1528.495773][T13488] usb 7-1: USB disconnect, device number 10 [ 1528.740024][T28703] netlink: 56 bytes leftover after parsing attributes in process `syz.3.6661'. [ 1530.491650][T28730] netlink: 56 bytes leftover after parsing attributes in process `syz.9.6671'. [ 1530.955075][ T973] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 1531.175104][ T973] usb 5-1: device descriptor read/64, error -71 [ 1531.445471][ T973] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 1531.615048][ T973] usb 5-1: device descriptor read/64, error -71 [ 1531.735243][ T973] usb usb5-port1: attempt power cycle [ 1531.874116][T28763] netlink: 48 bytes leftover after parsing attributes in process `syz.6.6685'. [ 1532.235244][ T973] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 1532.295948][ T973] usb 5-1: device descriptor read/8, error -71 [ 1533.055243][ T973] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 1533.087548][ T973] usb 5-1: device descriptor read/8, error -71 [ 1533.194777][T28784] netlink: 48 bytes leftover after parsing attributes in process `syz.9.6694'. [ 1533.215628][ T973] usb usb5-port1: unable to enumerate USB device [ 1534.845056][T28812] netlink: 48 bytes leftover after parsing attributes in process `syz.9.6703'. [ 1538.151115][T28844] netlink: 48 bytes leftover after parsing attributes in process `syz.6.6713'. [ 1538.936302][T28865] netlink: 'syz.4.6719': attribute type 4 has an invalid length. [ 1539.571504][T28871] netlink: 4768 bytes leftover after parsing attributes in process `syz.9.6722'. [ 1539.612425][T28871] netlink: 4768 bytes leftover after parsing attributes in process `syz.9.6722'. [ 1539.775763][T28874] netlink: 48 bytes leftover after parsing attributes in process `syz.4.6723'. [ 1540.586174][T19612] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 1541.406293][T19612] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1541.440679][T19612] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1541.467619][T19612] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1541.477596][T19612] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1541.491841][T19612] usb 5-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 1541.515236][T19612] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1541.991230][T28897] netlink: 48 bytes leftover after parsing attributes in process `syz.3.6732'. [ 1542.481009][T19612] gud 5-1:1.0: Failed to get connectors (error=-5) [ 1542.495176][T19612] gud: probe of 5-1:1.0 failed with error -5 [ 1542.622290][T25113] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1542.639326][T25113] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1542.658693][T28902] overlayfs: failed to resolve './cgroup': -2 [ 1542.666319][T25113] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1542.694001][T25113] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1542.701519][T25113] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 1542.714000][T25113] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1542.812570][T28907] rxe_eth0 speed is unknown, defaulting to 1000 [ 1543.055685][T28913] netlink: 4768 bytes leftover after parsing attributes in process `syz.6.6736'. [ 1543.096672][T28913] netlink: 4768 bytes leftover after parsing attributes in process `syz.6.6736'. [ 1543.233834][T28907] wlan1 speed is unknown, defaulting to 1000 [ 1543.598536][T28907] chnl_net:caif_netlink_parms(): no params data found [ 1543.712535][ T8] usb 5-1: USB disconnect, device number 21 [ 1543.794047][T28907] bridge0: port 1(bridge_slave_0) entered blocking state [ 1543.801988][T28907] bridge0: port 1(bridge_slave_0) entered disabled state [ 1543.812156][T28907] bridge_slave_0: entered allmulticast mode [ 1543.819686][T28907] bridge_slave_0: entered promiscuous mode [ 1543.830001][T28907] bridge0: port 2(bridge_slave_1) entered blocking state [ 1543.837525][T28907] bridge0: port 2(bridge_slave_1) entered disabled state [ 1543.847976][T28907] bridge_slave_1: entered allmulticast mode [ 1543.873038][T28907] bridge_slave_1: entered promiscuous mode [ 1543.960842][T28907] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1544.016300][T28907] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1544.087884][T28907] team0: Port device team_slave_0 added [ 1544.114056][T28907] team0: Port device team_slave_1 added [ 1544.176070][T28939] netlink: 40 bytes leftover after parsing attributes in process `syz.4.6742'. [ 1544.198278][T28907] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1544.206629][T28907] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1544.235305][T28907] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1544.291982][T28907] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1544.308655][T28907] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1544.360031][T28907] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1545.552091][T25113] Bluetooth: hci1: command tx timeout [ 1545.648015][T28907] hsr_slave_0: entered promiscuous mode [ 1545.670855][T28907] hsr_slave_1: entered promiscuous mode [ 1545.715244][T28907] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1545.727620][T28907] Cannot create hsr debugfs directory [ 1546.052279][ T1287] ieee802154 phy0 wpan0: encryption failed: -22 [ 1546.058741][ T1287] ieee802154 phy1 wpan1: encryption failed: -22 [ 1546.248145][T28907] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1546.448281][T28907] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1546.650526][T28907] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1546.872941][T28961] netlink: 4768 bytes leftover after parsing attributes in process `syz.3.6748'. [ 1546.925457][T28957] netlink: 4768 bytes leftover after parsing attributes in process `syz.3.6748'. [ 1546.932894][T28907] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1546.965174][ T8] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 1547.155323][ T8] usb 5-1: Using ep0 maxpacket: 8 [ 1547.361564][ T8] usb 5-1: config 2 has an invalid interface number: 31 but max is 0 [ 1547.531472][ T8] usb 5-1: config 2 has no interface number 0 [ 1547.565914][T25113] Bluetooth: hci1: command tx timeout [ 1547.589501][ T8] usb 5-1: config 2 interface 31 has no altsetting 0 [ 1547.671584][ T8] usb 5-1: New USB device found, idVendor=1a86, idProduct=e092, bcdDevice=53.3f [ 1547.696685][T28907] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 1547.712275][ T8] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1547.728026][T28907] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 1547.740068][ T8] usb 5-1: Product: syz [ 1547.765249][ T8] usb 5-1: Manufacturer: syz [ 1547.769967][ T8] usb 5-1: SerialNumber: syz [ 1547.788196][T28907] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 1547.841817][T28907] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 1548.168629][T28907] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1548.226233][ T8] ch9200: probe of 5-1:2.31 failed with error -22 [ 1548.246329][T28907] 8021q: adding VLAN 0 to HW filter on device team0 [ 1548.251265][ T8] usb 5-1: USB disconnect, device number 22 [ 1548.271572][T13529] bridge0: port 1(bridge_slave_0) entered blocking state [ 1548.278747][T13529] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1548.347810][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 1548.355017][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1548.869198][T28979] netlink: 40 bytes leftover after parsing attributes in process `syz.6.6752'. [ 1548.897042][T28907] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1548.909581][T28981] overlayfs: failed to resolve './cgroup': -2 [ 1550.323823][ T52] Bluetooth: hci1: command tx timeout [ 1550.604294][T28907] veth0_vlan: entered promiscuous mode [ 1550.633731][T28907] veth1_vlan: entered promiscuous mode [ 1550.735547][T28907] veth0_macvtap: entered promiscuous mode [ 1550.757969][T28907] veth1_macvtap: entered promiscuous mode [ 1550.797254][T28907] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1550.832028][T28907] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1550.858909][T28907] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1550.883105][T28907] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1550.923850][T28907] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1550.946356][T28907] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1550.966598][T28907] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1550.989003][T28907] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1551.009519][T28907] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1551.033635][T28907] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1551.053823][T28907] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1551.075055][T28907] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1551.099835][T28907] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1551.133347][T28907] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1551.143922][T28907] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1551.154697][T28907] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1551.168743][T28907] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1551.186428][T28907] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1551.201728][T28907] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1551.220429][T28907] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1551.244608][T28907] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1551.267349][T28907] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1551.288492][T28907] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1551.302844][T28907] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1551.324354][T28907] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1551.334151][T28907] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1551.368236][T28907] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1551.387009][T29008] netlink: 4768 bytes leftover after parsing attributes in process `syz.6.6757'. [ 1551.397038][T28907] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1551.409054][T29008] netlink: 4768 bytes leftover after parsing attributes in process `syz.6.6757'. [ 1551.610365][ T3438] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1551.640232][ T3438] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1551.667204][T29013] netlink: 40 bytes leftover after parsing attributes in process `syz.4.6761'. [ 1551.678775][T13529] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1551.695639][T13529] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1551.922480][T29019] netlink: 'syz.9.6731': attribute type 4 has an invalid length. [ 1552.505339][ T52] Bluetooth: hci1: command tx timeout [ 1555.222240][T29037] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6769'. [ 1556.075216][T13488] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 1557.645368][ T52] Bluetooth: hci3: Entering manufacturer mode failed (-110) [ 1557.655335][T25113] Bluetooth: hci3: command 0xfc11 tx timeout [ 1557.965881][T13488] usb 10-1: no configurations [ 1557.970604][T13488] usb 10-1: can't read configurations, error -22 [ 1558.992971][T29070] fuse: Bad value for 'rootmode' [ 1560.254207][T29085] netlink: 40 bytes leftover after parsing attributes in process `syz.6.6785'. [ 1560.535568][ T973] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 1563.962173][ T52] Bluetooth: hci3: Opcode 0x1003 failed: -110 [ 1563.962586][T25113] Bluetooth: hci3: command 0x1003 tx timeout [ 1564.365091][ T973] usb 5-1: device not accepting address 23, error -71 [ 1564.487805][T29117] netlink: 'syz.9.6795': attribute type 4 has an invalid length. [ 1564.575043][T29120] netlink: 40 bytes leftover after parsing attributes in process `syz.4.6796'. [ 1565.086945][ T973] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 1565.148961][ T3453] Bluetooth: hci3: Frame reassembly failed (-84) [ 1565.297104][ T973] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1565.309034][ T973] usb 5-1: config 0 has no interfaces? [ 1565.314795][ T973] usb 5-1: New USB device found, idVendor=0bda, idProduct=0129, bcdDevice= 1.00 [ 1565.333486][ T973] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1565.359313][ T973] usb 5-1: config 0 descriptor?? [ 1565.769207][ T23] usb 5-1: USB disconnect, device number 24 [ 1567.166277][T12910] Bluetooth: hci3: Opcode 0x1003 failed: -110 [ 1567.436487][T29142] netlink: 40 bytes leftover after parsing attributes in process `syz.6.6805'. [ 1567.485278][T29094] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 1567.491917][ T52] Bluetooth: hci5: command 0x1003 tx timeout [ 1567.689555][T29149] netlink: 'syz.9.6808': attribute type 4 has an invalid length. [ 1568.729034][ T973] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 1568.747835][T29158] netlink: 8 bytes leftover after parsing attributes in process `syz.9.6812'. [ 1569.114682][ T973] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1569.135742][ T973] usb 7-1: config 0 has no interfaces? [ 1569.141571][ T973] usb 7-1: New USB device found, idVendor=0bda, idProduct=0129, bcdDevice= 1.00 [ 1569.194180][ T973] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1569.232375][ T973] usb 7-1: config 0 descriptor?? [ 1571.303352][ T23] usb 7-1: USB disconnect, device number 11 [ 1572.792745][T29177] netlink: 40 bytes leftover after parsing attributes in process `syz.4.6816'. [ 1573.501521][T29185] loop6: detected capacity change from 0 to 16384 [ 1574.155284][T29187] loop6: detected capacity change from 16384 to 0 [ 1577.196414][T29211] netlink: 40 bytes leftover after parsing attributes in process `syz.4.6826'. [ 1577.836721][T29232] FAULT_INJECTION: forcing a failure. [ 1577.836721][T29232] name failslab, interval 1, probability 0, space 0, times 0 [ 1577.856174][T29232] CPU: 0 PID: 29232 Comm: syz.9.6835 Not tainted syzkaller #0 [ 1577.863666][T29232] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 1577.873730][T29232] Call Trace: [ 1577.877024][T29232] [ 1577.879965][T29232] dump_stack_lvl+0x18c/0x250 [ 1577.884668][T29232] ? sctp_sendmsg+0x1519/0x27b0 [ 1577.889658][T29232] ? ___sys_sendmsg+0x2a6/0x360 [ 1577.894529][T29232] ? show_regs_print_info+0x20/0x20 [ 1577.899749][T29232] ? load_image+0x420/0x420 [ 1577.904280][T29232] should_fail_ex+0x394/0x4c0 [ 1577.908981][T29232] should_failslab+0x9/0x20 [ 1577.913494][T29232] slab_pre_alloc_hook+0x59/0x300 [ 1577.918539][T29232] ? sctp_add_bind_addr+0x8c/0x360 [ 1577.923666][T29232] __kmem_cache_alloc_node+0x53/0x260 [ 1577.929054][T29232] ? sctp_add_bind_addr+0x8c/0x360 [ 1577.934180][T29232] kmalloc_trace+0x2a/0xe0 [ 1577.938620][T29232] sctp_add_bind_addr+0x8c/0x360 [ 1577.943580][T29232] sctp_copy_local_addr_list+0x31b/0x4e0 [ 1577.949235][T29232] ? sctp_copy_local_addr_list+0xa4/0x4e0 [ 1577.954972][T29232] ? sctp_do_8_2_transport_strike+0x910/0x910 [ 1577.961063][T29232] ? sctp_v4_is_any+0x35/0x60 [ 1577.965755][T29232] ? sctp_copy_one_addr+0x8c/0x350 [ 1577.970888][T29232] sctp_bind_addr_copy+0x189/0x3c0 [ 1577.976027][T29232] sctp_connect_new_asoc+0x2f9/0x6a0 [ 1577.981333][T29232] ? __sctp_connect+0xd80/0xd80 [ 1577.986197][T29232] ? __local_bh_enable_ip+0x13a/0x1c0 [ 1577.991584][T29232] ? _local_bh_enable+0xa0/0xa0 [ 1577.996445][T29232] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 1578.002270][T29232] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 1578.008094][T29232] ? bpf_lsm_sctp_bind_connect+0x9/0x10 [ 1578.013656][T29232] ? security_sctp_bind_connect+0x89/0xb0 [ 1578.019400][T29232] sctp_sendmsg+0x1519/0x27b0 [ 1578.024108][T29232] ? sctp_getsockopt+0xb60/0xb60 [ 1578.029064][T29232] ? aa_sk_perm+0x7bb/0x8e0 [ 1578.033587][T29232] ? aa_af_perm+0x330/0x330 [ 1578.038109][T29232] ? tomoyo_socket_sendmsg_permission+0x1e1/0x2f0 [ 1578.044546][T29232] ? sock_rps_record_flow+0x19/0x3f0 [ 1578.049892][T29232] ? inet_sendmsg+0x7e/0x2a0 [ 1578.054506][T29232] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1578.059808][T29232] ? inet_send_prepare+0x250/0x250 [ 1578.064946][T29232] ____sys_sendmsg+0x61b/0x980 [ 1578.069732][T29232] ? __asan_memset+0x22/0x40 [ 1578.074343][T29232] ? __sys_sendmsg_sock+0x30/0x30 [ 1578.079377][T29232] ? __import_iovec+0x5f2/0x850 [ 1578.084256][T29232] ? import_iovec+0x73/0xa0 [ 1578.088785][T29232] ___sys_sendmsg+0x2a6/0x360 [ 1578.093474][T29232] ? preempt_schedule+0xc0/0xd0 [ 1578.098357][T29232] ? __sys_sendmsg+0x2b0/0x2b0 [ 1578.103183][T29232] ? __might_fault+0xc6/0x120 [ 1578.107871][T29232] ? __might_fault+0xaa/0x120 [ 1578.112563][T29232] __sys_sendmmsg+0x2ca/0x510 [ 1578.117260][T29232] ? __ia32_sys_sendmsg+0x90/0x90 [ 1578.122308][T29232] ? __ia32_sys_get_robust_list+0x110/0x110 [ 1578.128230][T29232] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1578.134228][T29232] ? lock_chain_count+0x20/0x20 [ 1578.139101][T29232] __x64_sys_sendmmsg+0xa0/0xb0 [ 1578.143980][T29232] do_syscall_64+0x55/0xb0 [ 1578.148413][T29232] ? clear_bhb_loop+0x40/0x90 [ 1578.153112][T29232] ? clear_bhb_loop+0x40/0x90 [ 1578.157812][T29232] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1578.163720][T29232] RIP: 0033:0x7f7738ba8fd9 [ 1578.168147][T29232] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1578.187766][T29232] RSP: 002b:00007f77399ac028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1578.196195][T29232] RAX: ffffffffffffffda RBX: 00007f7738e25fa0 RCX: 00007f7738ba8fd9 [ 1578.204177][T29232] RDX: 0000000000000002 RSI: 0000200000000700 RDI: 0000000000000004 [ 1578.212161][T29232] RBP: 00007f7738c37fed R08: 0000000000000000 R09: 0000000000000000 [ 1578.220136][T29232] R10: 0000000000048000 R11: 0000000000000246 R12: 0000000000000000 [ 1578.228092][T29232] R13: 00007f7738e26038 R14: 00007f7738e25fa0 R15: 00007fff953c6f08 [ 1578.236059][T29232] [ 1578.366790][T29235] netlink: 40 bytes leftover after parsing attributes in process `syz.6.6837'. [ 1579.911188][T29260] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6848'. [ 1582.092474][T29297] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6858'. [ 1582.696327][T29314] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1582.886533][T29324] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6868'. [ 1583.441475][T29344] netlink: 'syz.4.6875': attribute type 4 has an invalid length. [ 1583.803657][T29350] netlink: 40 bytes leftover after parsing attributes in process `syz.6.6877'. [ 1583.965466][T29352] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1588.994611][T29397] netlink: 'syz.6.6889': attribute type 4 has an invalid length. [ 1589.983296][T29413] Bluetooth: MGMT ver 1.22 [ 1593.422393][T29437] netlink: 'syz.4.6900': attribute type 4 has an invalid length. [ 1594.070360][T13488] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 1595.535108][T13488] usb 5-1: Using ep0 maxpacket: 16 [ 1595.635245][T13488] usb 5-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xF3, skipping [ 1595.664983][T13488] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1595.674389][T13488] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1595.682479][T13488] usb 5-1: Product: syz [ 1595.687044][T13488] usb 5-1: Manufacturer: syz [ 1595.691661][T13488] usb 5-1: SerialNumber: syz [ 1595.706301][T13488] usb 5-1: config 0 descriptor?? [ 1595.911795][T29470] netlink: 'syz.6.6913': attribute type 4 has an invalid length. [ 1596.964745][T13488] usb 5-1: USB disconnect, device number 25 [ 1597.453193][T29496] netlink: 40 bytes leftover after parsing attributes in process `syz.6.6921'. [ 1599.312907][T29526] netlink: 40 bytes leftover after parsing attributes in process `syz.4.6931'. [ 1606.878018][T29576] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6941'. [ 1607.492336][ T1287] ieee802154 phy0 wpan0: encryption failed: -22 [ 1607.498839][ T1287] ieee802154 phy1 wpan1: encryption failed: -22 [ 1607.854862][T13488] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 1608.217280][T13488] usb 7-1: device descriptor read/64, error -71 [ 1609.285196][T13488] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 1609.668015][T13488] usb 7-1: device descriptor read/64, error -71 [ 1610.140928][T13488] usb usb7-port1: attempt power cycle [ 1610.216877][T29617] netlink: 40 bytes leftover after parsing attributes in process `syz.9.6959'. [ 1611.465962][T13488] usb usb7-port1: Cannot enable. Maybe the USB cable is bad? [ 1611.476824][T29643] netlink: 40 bytes leftover after parsing attributes in process `syz.4.6969'. [ 1611.745088][T13488] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 1611.986054][T13488] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1612.209352][T13488] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1612.283871][T13488] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1612.293370][T13488] usb 7-1: Product: syz [ 1612.305389][T13488] usb 7-1: Manufacturer: syz [ 1612.310118][T13488] usb 7-1: SerialNumber: syz [ 1614.071172][T29670] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6979'. [ 1614.136666][T13488] cdc_ncm 7-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 1614.149816][T13488] cdc_ncm 7-1:1.0: dwNtbInMaxSize=6 is too small. Using 2048 [ 1614.160344][T13488] cdc_ncm 7-1:1.0: setting rx_max = 2048 [ 1614.337220][T13488] cdc_ncm 7-1:1.0: setting tx_max = 48 [ 1614.359200][T13488] cdc_ncm 7-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.6-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 1614.467089][T13488] usb 7-1: USB disconnect, device number 15 [ 1614.510854][T13488] cdc_ncm 7-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.6-1, CDC NCM (NO ZLP) [ 1615.065025][ T973] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 1615.245265][ T973] usb 10-1: device descriptor read/64, error -71 [ 1615.344132][T29686] netlink: 'syz.4.6985': attribute type 4 has an invalid length. [ 1615.525083][ T973] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 1615.621635][T29694] netlink: 40 bytes leftover after parsing attributes in process `syz.6.6989'. [ 1615.686494][ T973] usb 10-1: device descriptor read/64, error -71 [ 1615.816025][ T973] usb usb10-port1: attempt power cycle [ 1616.245292][ T973] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 1616.263143][T29715] netlink: 40 bytes leftover after parsing attributes in process `syz.4.6998'. [ 1616.276578][ T973] usb 10-1: device descriptor read/8, error -71 [ 1617.747540][ T973] usb 10-1: new high-speed USB device number 7 using dummy_hcd [ 1617.795308][ T973] usb 10-1: device descriptor read/8, error -71 [ 1617.913281][T29735] netlink: 40 bytes leftover after parsing attributes in process `syz.9.7007'. [ 1617.925457][ T973] usb usb10-port1: unable to enumerate USB device [ 1617.945476][T29736] netlink: 'syz.3.7005': attribute type 4 has an invalid length. [ 1618.895087][ T28] kauditd_printk_skb: 11 callbacks suppressed [ 1618.895103][ T28] audit: type=1807 audit(1794470648.399:274): UNKNOWN=app res=0 [ 1618.920316][T29754] ima: policy update failed [ 1618.935291][ T28] audit: type=1802 audit(1794470648.419:275): pid=29754 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=update_policy cause=invalid-policy comm="syz.6.7014" res=0 errno=0 [ 1618.976127][ T28] audit: type=1802 audit(1794470648.439:276): pid=29754 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.6.7014" res=0 errno=0 [ 1619.075217][T29761] netlink: 40 bytes leftover after parsing attributes in process `syz.9.7016'. [ 1619.331874][T29775] netlink: 'syz.3.7021': attribute type 4 has an invalid length. [ 1619.355202][T13488] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 1619.525135][T13488] usb 7-1: device descriptor read/64, error -71 [ 1619.675201][T29789] netlink: 40 bytes leftover after parsing attributes in process `syz.4.7028'. [ 1619.805642][T13488] usb 7-1: new high-speed USB device number 17 using dummy_hcd [ 1620.750144][T13488] usb 7-1: device descriptor read/64, error -71 [ 1620.885776][T13488] usb usb7-port1: attempt power cycle [ 1620.995989][T29810] netlink: 40 bytes leftover after parsing attributes in process `syz.4.7037'. [ 1621.222672][T29819] netlink: 'syz.3.7039': attribute type 4 has an invalid length. [ 1621.319518][T13488] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 1622.006947][T13488] usb 7-1: device descriptor read/8, error -71 [ 1622.414469][T29840] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7048'. [ 1622.794459][T29850] netlink: 'syz.3.7051': attribute type 4 has an invalid length. [ 1623.735265][ T973] usb 10-1: new high-speed USB device number 8 using dummy_hcd [ 1623.885257][ T973] usb 10-1: device descriptor read/64, error -71 [ 1623.925123][ T23] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 1624.118075][ T23] usb 5-1: New USB device found, idVendor=0552, idProduct=5510, bcdDevice= 0.00 [ 1624.128550][ T23] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 1624.137064][ T23] usb 5-1: Product: syz [ 1624.141406][ T23] usb 5-1: Manufacturer: syz [ 1624.155568][ T973] usb 10-1: new high-speed USB device number 9 using dummy_hcd [ 1624.315221][ T973] usb 10-1: device descriptor read/64, error -71 [ 1624.435232][ T973] usb usb10-port1: attempt power cycle [ 1624.445169][T12910] Bluetooth: hci3: Opcode 0x1003 failed: -110 [ 1624.445263][T29094] Bluetooth: hci3: command 0x1003 tx timeout [ 1624.533506][T29868] netlink: 40 bytes leftover after parsing attributes in process `syz.6.7059'. [ 1624.721462][ T23] scsi host1: uas [ 1624.733950][ C1] usb 5-1: stat urb: no pending cmd for uas-tag 0 [ 1624.845485][ T973] usb 10-1: new high-speed USB device number 10 using dummy_hcd [ 1624.887746][ T973] usb 10-1: device descriptor read/8, error -71 [ 1624.942506][ C1] usb 5-1: cmd cmplt err -71 [ 1624.943550][T20788] usb 5-1: USB disconnect, device number 26 [ 1624.959063][T20788] scsi 1:0:0:0: tag#8 uas_zap_pending 0 uas-tag 1 inflight: CMD [ 1624.967304][T20788] scsi 1:0:0:0: tag#8 CDB: Inquiry 12 00 00 00 24 00 [ 1625.175038][ T973] usb 10-1: new high-speed USB device number 11 using dummy_hcd [ 1625.208790][ T973] usb 10-1: device descriptor read/8, error -71 [ 1625.335821][ T973] usb usb10-port1: unable to enumerate USB device [ 1625.663754][T29876] netlink: 40 bytes leftover after parsing attributes in process `syz.6.7068'. [ 1626.638545][T29885] netlink: 'syz.9.7063': attribute type 4 has an invalid length. [ 1627.797958][T29902] netlink: 40 bytes leftover after parsing attributes in process `syz.6.7070'. [ 1629.333152][ T23] usb 10-1: new high-speed USB device number 12 using dummy_hcd [ 1629.485226][ T23] usb 10-1: device descriptor read/64, error -71 [ 1629.785234][ T23] usb 10-1: new high-speed USB device number 13 using dummy_hcd [ 1629.885328][T29094] Bluetooth: hci3: command 0x1003 tx timeout [ 1629.893704][T29926] netlink: 'syz.6.7077': attribute type 4 has an invalid length. [ 1629.894847][T12910] Bluetooth: hci3: Opcode 0x1003 failed: -110 [ 1629.948802][ T23] usb 10-1: device descriptor read/64, error -71 [ 1630.088036][ T23] usb usb10-port1: attempt power cycle [ 1630.875331][ T23] usb 10-1: new high-speed USB device number 14 using dummy_hcd [ 1630.950011][ T23] usb 10-1: device descriptor read/8, error -71 [ 1631.059373][T29937] netlink: 40 bytes leftover after parsing attributes in process `syz.9.7081'. [ 1631.433858][T29953] netlink: 'syz.6.7087': attribute type 4 has an invalid length. [ 1631.600926][T29959] netlink: 40 bytes leftover after parsing attributes in process `syz.9.7091'. [ 1631.975703][ T23] usb 10-1: new high-speed USB device number 15 using dummy_hcd [ 1632.018687][ T23] usb 10-1: config 0 has no interfaces? [ 1632.024337][ T23] usb 10-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 1632.033727][ T23] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1632.043797][ T23] usb 10-1: config 0 descriptor?? [ 1632.681072][T29979] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7100'. [ 1632.798503][T29982] netlink: 'syz.3.7101': attribute type 4 has an invalid length. [ 1633.257542][T29967] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1633.264240][T29967] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 1633.282572][T29967] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1633.288802][T29967] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 1633.300267][T29967] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1633.307378][T29967] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 1633.316850][T29967] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1633.322878][T29967] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 1633.329262][T12910] Bluetooth: hci3: Opcode 0x1003 failed: -110 [ 1633.344031][T29967] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 1633.891483][T30005] netlink: 40 bytes leftover after parsing attributes in process `syz.4.7109'. [ 1634.052824][T30011] overlayfs: failed to resolve './bus': -2 [ 1634.063665][T30011] libceph: resolve '0.' (ret=-3): failed [ 1635.228463][T12910] Bluetooth: hci4: command 0x0406 tx timeout [ 1635.325131][T12910] Bluetooth: hci1: command 0x0c1a tx timeout [ 1635.331206][T29094] Bluetooth: hci0: command 0x0406 tx timeout [ 1635.337280][ T52] Bluetooth: hci2: command 0x0406 tx timeout [ 1635.424243][ T23] usb 10-1: USB disconnect, device number 15 [ 1635.811362][T30026] netlink: 'syz.3.7115': attribute type 4 has an invalid length. [ 1636.123726][T30033] netlink: 40 bytes leftover after parsing attributes in process `syz.9.7118'. [ 1636.465037][T19612] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 1636.625342][ T973] usb 10-1: new high-speed USB device number 16 using dummy_hcd [ 1636.657779][T19612] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1636.679541][T19612] usb 5-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1636.698697][T19612] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1636.729162][T19612] usb 5-1: config 0 descriptor?? [ 1636.753655][T19612] pwc: Askey VC010 type 2 USB webcam detected. [ 1636.837612][ T973] usb 10-1: config 0 has no interfaces? [ 1637.245152][T12910] Bluetooth: hci4: command 0x0406 tx timeout [ 1637.405470][T29094] Bluetooth: hci0: command 0x0406 tx timeout [ 1637.411634][T12910] Bluetooth: hci1: command 0x0c1a tx timeout [ 1637.417918][ T52] Bluetooth: hci2: command 0x0406 tx timeout [ 1637.467606][ T973] usb 10-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 1637.570548][T19612] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1637.578604][ T973] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1637.587923][T19612] pwc: recv_control_msg error -32 req 02 val 2700 [ 1637.603912][ T973] usb 10-1: config 0 descriptor?? [ 1637.610468][T19612] pwc: recv_control_msg error -32 req 02 val 2c00 [ 1637.625329][T19612] pwc: recv_control_msg error -32 req 04 val 1000 [ 1637.642607][T19612] pwc: recv_control_msg error -32 req 04 val 1300 [ 1637.650423][T19612] pwc: recv_control_msg error -32 req 04 val 1400 [ 1637.658527][T19612] pwc: recv_control_msg error -32 req 02 val 2000 [ 1637.674630][T19612] pwc: recv_control_msg error -32 req 02 val 2100 [ 1637.682220][T19612] pwc: recv_control_msg error -32 req 04 val 1500 [ 1637.697846][T19612] pwc: recv_control_msg error -32 req 02 val 2500 [ 1637.705679][T30035] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1637.737088][T30035] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1637.757499][T19612] pwc: recv_control_msg error -32 req 02 val 2400 [ 1637.993052][T19612] pwc: recv_control_msg error -71 req 02 val 2900 [ 1638.084006][T19612] pwc: recv_control_msg error -71 req 02 val 2800 [ 1638.162732][T19612] pwc: recv_control_msg error -71 req 04 val 1100 [ 1638.260319][T19612] pwc: recv_control_msg error -71 req 04 val 1200 [ 1638.424498][T19612] pwc: Registered as video103. [ 1638.473539][T19612] input: PWC snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/input/input75 [ 1638.547567][T19612] usb 5-1: USB disconnect, device number 27 [ 1638.722184][T30067] netlink: 40 bytes leftover after parsing attributes in process `syz.6.7128'. [ 1638.722984][T30069] netlink: 'syz.4.7130': attribute type 9 has an invalid length. [ 1638.912406][T30077] netlink: 'syz.3.7132': attribute type 4 has an invalid length. [ 1639.400269][ T23] usb 10-1: USB disconnect, device number 16 [ 1639.485205][ T52] Bluetooth: hci1: command 0x0c1a tx timeout [ 1640.313101][T30099] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7141'. [ 1642.197064][T30116] netlink: 'syz.9.7148': attribute type 4 has an invalid length. [ 1644.975954][T30135] netlink: 40 bytes leftover after parsing attributes in process `syz.9.7153'. [ 1649.597305][T30161] netlink: 40 bytes leftover after parsing attributes in process `syz.9.7162'. [ 1656.435300][T30207] Invalid ELF header type: 3 != 1 [ 1657.074696][T30205] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1657.295539][T30205] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1661.393924][ T23] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 1668.934426][ T1287] ieee802154 phy0 wpan0: encryption failed: -22 [ 1668.942993][ T1287] ieee802154 phy1 wpan1: encryption failed: -22 [ 1671.482290][T30276] overlayfs: missing 'workdir' [ 1675.219354][ T973] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 1675.436903][ T973] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1675.465013][ T973] usb 7-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1675.504637][ T973] usb 7-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 1675.545364][ T973] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1675.979931][T22986] batman_adv: batadv0: Interface deactivated: syz_tun [ 1677.410488][T12910] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1677.422619][T12910] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1677.430994][T19612] usb 7-1: USB disconnect, device number 21 [ 1677.440001][T12910] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1677.449942][T12910] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1677.459304][T12910] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 1677.466859][T12910] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1677.553286][T22986] batman_adv: batadv0: Removing interface: syz_tun [ 1677.678118][T30302] rxe_eth0 speed is unknown, defaulting to 1000 [ 1678.700753][T30302] wlan1 speed is unknown, defaulting to 1000 [ 1679.755092][ T52] Bluetooth: hci3: command tx timeout [ 1680.155708][T30302] chnl_net:caif_netlink_parms(): no params data found [ 1680.403226][T30302] bridge0: port 1(bridge_slave_0) entered blocking state [ 1680.453367][T30302] bridge0: port 1(bridge_slave_0) entered disabled state [ 1680.483763][T30302] bridge_slave_0: entered allmulticast mode [ 1680.495104][ T973] usb 5-1: new high-speed USB device number 28 using dummy_hcd [ 1680.505340][T30302] bridge_slave_0: entered promiscuous mode [ 1680.534427][T30302] bridge0: port 2(bridge_slave_1) entered blocking state [ 1680.543233][T30302] bridge0: port 2(bridge_slave_1) entered disabled state [ 1680.552973][T30302] bridge_slave_1: entered allmulticast mode [ 1680.560579][T30302] bridge_slave_1: entered promiscuous mode [ 1680.662676][T30302] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1680.684192][T30302] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1680.695232][ T973] usb 5-1: Using ep0 maxpacket: 16 [ 1680.702118][ T973] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1680.723490][ T973] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1680.727439][T30340] FAULT_INJECTION: forcing a failure. [ 1680.727439][T30340] name failslab, interval 1, probability 0, space 0, times 0 [ 1680.744840][ T973] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1680.776565][T30302] team0: Port device team_slave_0 added [ 1680.784637][ T973] usb 5-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1680.784856][T30340] CPU: 1 PID: 30340 Comm: syz.9.7205 Not tainted syzkaller #0 [ 1680.795248][ T973] usb 5-1: New USB device strings: Mfr=191, Product=249, SerialNumber=0 [ 1680.801103][T30340] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 1680.801117][T30340] Call Trace: [ 1680.801126][T30340] [ 1680.801136][T30340] dump_stack_lvl+0x18c/0x250 [ 1680.812698][T30302] team0: Port device team_slave_1 added [ 1680.819474][T30340] ? show_regs_print_info+0x20/0x20 [ 1680.819505][T30340] ? load_image+0x420/0x420 [ 1680.823942][ T973] usb 5-1: Product: syz [ 1680.825685][T30340] ? __might_sleep+0xe0/0xe0 [ 1680.825716][T30340] ? __lock_acquire+0x7eb0/0x7eb0 [ 1680.825738][T30340] ? mark_lock+0x94/0x320 [ 1680.825763][T30340] should_fail_ex+0x394/0x4c0 [ 1680.825794][T30340] should_failslab+0x9/0x20 [ 1680.825813][T30340] slab_pre_alloc_hook+0x59/0x300 [ 1680.825835][T30340] ? snd_seq_port_connect+0x6b/0x420 [ 1680.825885][T30340] __kmem_cache_alloc_node+0x53/0x260 [ 1680.825908][T30340] ? snd_seq_port_connect+0x6b/0x420 [ 1680.825930][T30340] kmalloc_trace+0x2a/0xe0 [ 1680.825959][T30340] snd_seq_port_connect+0x6b/0x420 [ 1680.825981][T30340] ? do_raw_read_unlock+0x3d/0x80 [ 1680.839683][ T973] usb 5-1: Manufacturer: syz [ 1680.841349][T30340] ? _raw_read_unlock+0x28/0x40 [ 1680.841384][T30340] snd_seq_ioctl_subscribe_port+0x318/0x6e0 [ 1680.857743][ T973] usb 5-1: config 0 descriptor?? [ 1680.859574][T30340] ? snd_seq_oss_midi_open+0x19a/0x800 [ 1680.859611][T30340] ? snd_seq_ioctl_set_port_info+0x1a0/0x1a0 [ 1680.879077][T30302] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1680.883343][T30340] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1680.883373][T30340] ? _raw_spin_unlock+0x40/0x40 [ 1680.889030][T30302] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1680.893984][T30340] snd_seq_oss_midi_open+0x4f7/0x800 [ 1680.899013][T30302] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1680.903489][T30340] ? snd_seq_oss_midi_open_all+0xc0/0xc0 [ 1680.910906][T30302] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1680.913089][T30340] snd_seq_oss_midi_open_all+0x59/0xc0 [ 1680.918224][T30302] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1680.923787][T30340] snd_seq_oss_open+0x9b3/0xf10 [ 1680.923820][T30340] ? snd_seq_oss_delete_client+0x50/0x50 [ 1680.929443][T30302] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1680.934203][T30340] ? trace_raw_output_contention_end+0xd0/0xd0 [ 1681.070432][T30340] ? soundcore_open+0x274/0x4c0 [ 1681.075383][T30340] ? odev_open+0x5c/0xa0 [ 1681.079648][T30340] ? __lock_acquire+0x7eb0/0x7eb0 [ 1681.084697][T30340] ? snd_seq_oss_process_event+0x29b0/0x29b0 [ 1681.090693][T30340] ? async_call_lookup_ports+0x20/0x20 [ 1681.096173][T30340] ? do_raw_spin_unlock+0x121/0x230 [ 1681.101399][T30340] ? soundcore_open+0x310/0x4c0 [ 1681.106276][T30340] odev_open+0x67/0xa0 [ 1681.110368][T30340] chrdev_open+0x58c/0x600 [ 1681.114811][T30340] ? cd_forget+0x160/0x160 [ 1681.119258][T30340] ? fsnotify_perm+0x3ed/0x5e0 [ 1681.124049][T30340] do_dentry_open+0x880/0x14b0 [ 1681.128841][T30340] ? cd_forget+0x160/0x160 [ 1681.133275][T30340] path_openat+0x284f/0x3270 [ 1681.137864][T30340] ? do_sys_openat2+0xda/0x1d0 [ 1681.142616][T30340] ? __x64_sys_openat+0x139/0x160 [ 1681.147634][T30340] ? verify_lock_unused+0x140/0x140 [ 1681.152817][T30340] ? do_filp_open+0x430/0x430 [ 1681.157488][T30340] do_filp_open+0x1f2/0x430 [ 1681.162009][T30340] ? vfs_tmpfile+0x620/0x620 [ 1681.166613][T30340] ? _raw_spin_unlock+0x28/0x40 [ 1681.171449][T30340] ? alloc_fd+0x590/0x640 [ 1681.175788][T30340] do_sys_openat2+0x134/0x1d0 [ 1681.180478][T30340] ? do_sys_open+0xe0/0xe0 [ 1681.184890][T30340] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1681.190871][T30340] ? lock_chain_count+0x20/0x20 [ 1681.195724][T30340] __x64_sys_openat+0x139/0x160 [ 1681.200566][T30340] do_syscall_64+0x55/0xb0 [ 1681.204973][T30340] ? clear_bhb_loop+0x40/0x90 [ 1681.209640][T30340] ? clear_bhb_loop+0x40/0x90 [ 1681.214303][T30340] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1681.220181][T30340] RIP: 0033:0x7f7738ba8fd9 [ 1681.224581][T30340] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1681.244173][T30340] RSP: 002b:00007f77399ac028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1681.252590][T30340] RAX: ffffffffffffffda RBX: 00007f7738e25fa0 RCX: 00007f7738ba8fd9 [ 1681.260547][T30340] RDX: 0000000000080200 RSI: 0000200000000380 RDI: ffffffffffffff9c [ 1681.268507][T30340] RBP: 00007f7738c37fed R08: 0000000000000000 R09: 0000000000000000 [ 1681.276498][T30340] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1681.284489][T30340] R13: 00007f7738e26038 R14: 00007f7738e25fa0 R15: 00007fff953c6f08 [ 1681.288012][T19612] usb 5-1: USB disconnect, device number 28 [ 1681.292472][T30340] [ 1681.311167][T30302] hsr_slave_0: entered promiscuous mode [ 1681.400124][T30302] hsr_slave_1: entered promiscuous mode [ 1681.419776][T30302] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1681.427802][T30302] Cannot create hsr debugfs directory [ 1681.805146][ T52] Bluetooth: hci3: command tx timeout [ 1681.811179][ T973] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 1682.103857][T30302] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1682.498403][T30302] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1682.618962][T30302] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1682.687669][ T973] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1682.727157][ T973] usb 7-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1682.740296][ T973] usb 7-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00 [ 1682.742418][T30302] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1682.749755][ T973] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1683.067553][T30302] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1683.082733][T30302] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1683.109617][T30302] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1683.133232][T30302] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1683.341520][T30302] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1683.378600][T30302] 8021q: adding VLAN 0 to HW filter on device team0 [ 1683.403821][T13530] bridge0: port 1(bridge_slave_0) entered blocking state [ 1683.410980][T13530] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1683.459953][T13530] bridge0: port 2(bridge_slave_1) entered blocking state [ 1683.467128][T13530] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1683.581011][T30358] tmpfs: Bad value for 'mpol' [ 1683.895264][ T52] Bluetooth: hci3: command tx timeout [ 1685.082793][T30302] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1685.121963][T19612] usb 7-1: USB disconnect, device number 22 [ 1685.965096][T12910] Bluetooth: hci3: command tx timeout [ 1686.152387][T30302] veth0_vlan: entered promiscuous mode [ 1686.859986][T30302] veth1_vlan: entered promiscuous mode [ 1687.264135][T30302] veth0_macvtap: entered promiscuous mode [ 1687.316602][T30302] veth1_macvtap: entered promiscuous mode [ 1687.340702][T30302] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1687.372050][T30302] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1687.405815][T30302] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1687.439930][T30302] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1687.466822][T30302] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1687.485638][T30302] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1687.505776][T30374] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1687.524099][T30302] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1687.563854][T30302] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1688.895101][T30302] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1688.906093][T30302] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1688.926644][T30302] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1688.937755][T30302] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1688.962948][T30302] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1688.996939][T30302] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1689.009947][T30302] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1689.023266][T30302] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1689.035359][T30302] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1689.050135][T30302] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1689.061246][T30302] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1689.084446][T30302] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1689.095336][T30302] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1689.107178][T30302] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1689.119899][T30302] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1689.133290][T30302] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1689.150419][T30302] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1689.184032][T30302] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1689.235712][T30302] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1689.245571][ T8] usb 5-1: new high-speed USB device number 29 using dummy_hcd [ 1689.265097][T30302] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1689.275972][T30302] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1689.285221][T30302] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1689.425378][ T8] usb 5-1: Using ep0 maxpacket: 16 [ 1689.447163][ T8] usb 5-1: config 0 has no interfaces? [ 1689.470823][ T8] usb 5-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 1689.495001][ T8] usb 5-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 1689.503101][ T8] usb 5-1: Product: syz [ 1689.524240][ T3506] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1689.549882][ T8] usb 5-1: Manufacturer: syz [ 1689.554548][ T3506] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1689.554556][ T8] usb 5-1: SerialNumber: syz [ 1689.558163][ T8] usb 5-1: config 0 descriptor?? [ 1689.650477][ T3506] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1689.686353][ T3506] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1689.862355][ T8] usb 5-1: USB disconnect, device number 29 [ 1691.624273][T30406] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 1691.633199][T30406] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1695.777392][T30430] tmpfs: Bad value for 'mpol' [ 1698.626611][T19368] usb 5-1: new high-speed USB device number 30 using dummy_hcd [ 1698.988897][T19368] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1699.087578][T19368] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1699.220874][T19368] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1699.370085][T19368] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1699.455242][T19368] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1699.548991][T19368] usb 5-1: config 0 descriptor?? [ 1701.419680][T19368] plantronics 0003:047F:FFFF.000B: No inputs registered, leaving [ 1701.466338][T19368] plantronics 0003:047F:FFFF.000B: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 1704.353616][ T8] usb 5-1: reset high-speed USB device number 30 using dummy_hcd [ 1706.985516][ T973] usb 5-1: USB disconnect, device number 30 [ 1709.447033][ T973] usb 4-1: new high-speed USB device number 85 using dummy_hcd [ 1710.711221][ T973] usb 4-1: Using ep0 maxpacket: 8 [ 1710.726231][ T973] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1710.746311][ T973] usb 4-1: config 4 interface 0 has no altsetting 0 [ 1710.758452][ T973] usb 4-1: string descriptor 0 read error: -22 [ 1710.764701][ T973] usb 4-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 1710.795006][ T973] usb 4-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 1710.816476][ T973] usb 4-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 1710.842548][ T973] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1710.877628][ T973] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 1710.907062][ T973] usb 4-1: media controller created [ 1710.973616][T30526] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1711.004700][T30526] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1711.016115][T30510] usb 4-1: dvb_usb_au6610: wlen=0, aborting [ 1711.037394][ T973] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1711.121005][T30526] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1711.127179][T30526] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1711.133173][T30526] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 1711.181189][T30526] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 1711.237237][T30510] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1711.245962][T30510] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1711.255914][ T973] zl10353_read_register: readreg error (reg=127, ret==0) [ 1711.411771][ T973] usb 4-1: USB disconnect, device number 85 [ 1712.925159][ T52] Bluetooth: hci2: command 0x0406 tx timeout [ 1713.012070][T30567] printk: console [ttyS0] disabled [ 1713.172249][T30567] printk: console [ttyS0] enabled [ 1713.193437][ T52] Bluetooth: hci3: command 0x0c1a tx timeout [ 1713.193452][T12910] Bluetooth: hci1: command 0x0c1a tx timeout [ 1715.257091][ T52] Bluetooth: hci3: command 0x0c1a tx timeout [ 1718.264890][ T52] Bluetooth: hci3: command 0x0c1a tx timeout [ 1730.915067][ T1287] ieee802154 phy0 wpan0: encryption failed: -22 [ 1730.921401][ T1287] ieee802154 phy1 wpan1: encryption failed: -22 [ 1738.445662][T19368] usb 4-1: new high-speed USB device number 86 using dummy_hcd [ 1739.540986][T19368] usb 4-1: config 255 has an invalid interface number: 235 but max is 2 [ 1739.554993][T19368] usb 4-1: config 255 has an invalid interface number: 97 but max is 2 [ 1739.563270][T19368] usb 4-1: config 255 has an invalid interface descriptor of length 2, skipping [ 1739.595120][T19368] usb 4-1: config 255 has an invalid descriptor of length 0, skipping remainder of the config [ 1739.614989][T19368] usb 4-1: config 255 has 2 interfaces, different from the descriptor's value: 3 [ 1739.624131][T19368] usb 4-1: config 255 has no interface number 0 [ 1739.645059][T19368] usb 4-1: config 255 has no interface number 1 [ 1739.651359][T19368] usb 4-1: config 255 interface 235 altsetting 4 bulk endpoint 0xA has invalid maxpacket 16 [ 1739.685008][T19368] usb 4-1: config 255 interface 97 altsetting 9 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 1739.705239][T19368] usb 4-1: config 255 interface 97 altsetting 9 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 1739.736471][T19368] usb 4-1: config 255 interface 235 has no altsetting 0 [ 1739.743439][T19368] usb 4-1: config 255 interface 97 has no altsetting 0 [ 1739.774621][T19368] usb 4-1: New USB device found, idVendor=0424, idProduct=cf19, bcdDevice=71.90 [ 1739.805108][T19368] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1739.813121][T19368] usb 4-1: Product: syz [ 1739.835279][T19368] usb 4-1: Manufacturer: syz [ 1739.852400][T19368] usb 4-1: SerialNumber: syz [ 1739.871231][T30724] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1740.067729][T23344] batman_adv: batadv0: Interface deactivated: syz_tun [ 1742.114700][T23344] batman_adv: batadv0: Removing interface: syz_tun [ 1742.138114][T19368] usb 4-1: bad CDC descriptors [ 1742.143914][T12910] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1742.163634][T12910] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1742.176533][T12910] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1742.197251][T12910] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1742.207537][T12910] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 1742.215605][T12910] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1742.263903][T19368] usb 4-1: bad CDC descriptors [ 1742.392313][T19368] usb 4-1: USB disconnect, device number 86 [ 1742.655364][T30757] rxe_eth0 speed is unknown, defaulting to 1000 [ 1743.011505][T30757] wlan1 speed is unknown, defaulting to 1000 [ 1743.975738][T12910] block nbd3: Receive control failed (result -32) [ 1744.323031][T12910] Bluetooth: hci2: command tx timeout [ 1744.349167][T30768] block nbd3: shutting down sockets [ 1744.532325][T30757] chnl_net:caif_netlink_parms(): no params data found [ 1745.214293][T30757] bridge0: port 1(bridge_slave_0) entered blocking state [ 1745.222737][T30757] bridge0: port 1(bridge_slave_0) entered disabled state [ 1745.237476][T30757] bridge_slave_0: entered allmulticast mode [ 1745.244194][T30757] bridge_slave_0: entered promiscuous mode [ 1745.255009][T30757] bridge0: port 2(bridge_slave_1) entered blocking state [ 1745.263266][T30757] bridge0: port 2(bridge_slave_1) entered disabled state [ 1745.272134][T30757] bridge_slave_1: entered allmulticast mode [ 1745.283591][T30757] bridge_slave_1: entered promiscuous mode [ 1745.325848][T30757] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1745.337613][T30757] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1745.384168][T30757] team0: Port device team_slave_0 added [ 1745.393389][T30757] team0: Port device team_slave_1 added [ 1745.521155][T30757] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1745.546017][T30757] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1745.624862][T30757] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1745.708165][T30757] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1746.740064][T12910] Bluetooth: hci2: command tx timeout [ 1747.753692][T30757] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1748.212426][T30757] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1748.985061][ T52] Bluetooth: hci2: command tx timeout [ 1750.280003][T30757] hsr_slave_0: entered promiscuous mode [ 1750.324078][T30757] hsr_slave_1: entered promiscuous mode [ 1750.335877][T30757] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1750.343453][T30757] Cannot create hsr debugfs directory [ 1750.705388][T30757] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1750.927925][T30757] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1751.006041][ T52] Bluetooth: hci2: command tx timeout [ 1751.683007][T30757] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1751.835520][T30757] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1753.057237][T30757] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1753.176196][T30757] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1753.260011][T30835] Invalid ELF header type: 3 != 1 [ 1753.407540][T30757] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1753.826983][T30757] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1754.080393][T30757] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1754.157733][T30757] 8021q: adding VLAN 0 to HW filter on device team0 [ 1754.186094][ T1086] bridge0: port 1(bridge_slave_0) entered blocking state [ 1754.193222][ T1086] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1755.450840][T30779] bridge0: port 2(bridge_slave_1) entered blocking state [ 1755.458013][T30779] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1757.992359][T30757] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1758.160989][T30873] netlink: 40 bytes leftover after parsing attributes in process `syz.9.7331'. [ 1759.663813][T30757] veth0_vlan: entered promiscuous mode [ 1759.704112][T30757] veth1_vlan: entered promiscuous mode [ 1759.857571][T30757] veth0_macvtap: entered promiscuous mode [ 1760.030176][T30757] veth1_macvtap: entered promiscuous mode [ 1760.618734][T30757] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1760.695089][T30757] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1760.704989][T30757] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1760.715433][T30757] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1760.725336][T30757] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1760.737487][T30757] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1760.747697][T30757] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1760.758564][T30757] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1760.768830][T30757] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1760.779363][T30757] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1760.789255][T30757] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1760.800077][T30757] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1760.809944][T30757] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1760.820547][T30757] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1760.833676][T30757] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1760.844109][T30757] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1760.854681][T30757] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1760.864630][T30757] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1760.875137][T30757] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1760.905267][T30757] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1760.927489][T30757] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1760.955032][T30757] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1760.970596][T30757] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1760.983742][T30757] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1760.994529][T30757] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1761.180121][T30757] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1761.234469][T30757] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1761.303591][T30757] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1761.385776][T30757] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1761.579975][T30757] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1761.705871][T30757] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1761.745174][T30757] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1761.785040][T30757] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1761.793757][T30757] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1761.842733][T30903] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7339'. [ 1762.041798][ T1086] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1762.064779][ T1086] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1762.095742][ T1086] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1762.103576][ T1086] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1770.374720][T30954] netlink: 'syz.4.7352': attribute type 10 has an invalid length. [ 1770.413236][T30954] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1770.421726][T30954] team0: Port device batadv0 added [ 1772.980502][T30993] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7367'. [ 1780.078259][T31021] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1780.162894][T31029] netlink: 8 bytes leftover after parsing attributes in process `syz.9.7377'. [ 1790.515873][T31098] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7387'. [ 1791.845787][ T1287] ieee802154 phy0 wpan0: encryption failed: -22 [ 1791.852109][ T1287] ieee802154 phy1 wpan1: encryption failed: -22 [ 1796.145445][T31130] netlink: 'syz.6.7408': attribute type 4 has an invalid length. [ 1805.231249][T31209] overlayfs: failed to resolve './bus': -2 [ 1805.257510][T31209] libceph: resolve '0.' (ret=-3): failed [ 1806.690877][T31216] netlink: 'syz.6.7424': attribute type 4 has an invalid length. [ 1815.675400][T31257] netlink: 'syz.9.7441': attribute type 4 has an invalid length. [ 1820.360872][T31289] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7449'. [ 1821.499417][T30537] IPVS: starting estimator thread 0... [ 1821.607664][ T5853] usb 4-1: new high-speed USB device number 87 using dummy_hcd [ 1821.645554][T31308] IPVS: using max 19 ests per chain, 45600 per kthread [ 1822.915863][ T5853] usb 4-1: Using ep0 maxpacket: 32 [ 1822.971758][ T5853] usb 4-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 1823.025447][ T5853] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1823.093015][ T5853] usb 4-1: config 0 descriptor?? [ 1823.115653][ T5853] as10x_usb: device has been detected [ 1823.133383][ T5853] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 1823.243922][ T5853] usb 4-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 1823.343981][T31304] ------------[ cut here ]------------ [ 1823.349525][T31304] DEBUG_LOCKS_WARN_ON(lock->magic != lock) [ 1823.370938][T31304] WARNING: CPU: 1 PID: 31304 at kernel/locking/mutex.c:582 __mutex_lock+0xb9d/0xce0 [ 1823.386343][T31304] Modules linked in: [ 1823.390245][T31304] CPU: 1 PID: 31304 Comm: syz.3.7453 Not tainted syzkaller #0 [ 1823.398395][T31304] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 1823.408530][T31304] RIP: 0010:__mutex_lock+0xb9d/0xce0 [ 1823.413802][T31304] Code: 04 08 84 c0 0f 85 2f 01 00 00 83 3d dc 7c ed 04 00 0f 85 7c f5 ff ff 48 c7 c7 e0 bb ea 8a 48 c7 c6 80 bc ea 8a e8 d3 f0 b0 f6 <0f> 0b e9 62 f5 ff ff 0f 0b e9 20 f9 ff ff 0f 0b e9 fa f5 ff ff 48 [ 1823.433632][T31304] RSP: 0018:ffffc900055a7ac0 EFLAGS: 00010246 [ 1823.439741][T31304] RAX: 435e957dd9097100 RBX: ffff888066100ce0 RCX: 0000000000080000 [ 1823.447784][T31304] RDX: ffffc900111c3000 RSI: 0000000000003500 RDI: 0000000000003501 [ 1823.455789][T31304] RBP: ffffc900055a7c20 R08: ffff8880b8d28c53 R09: 1ffff110171a518a [ 1823.463752][T31304] R10: dffffc0000000000 R11: ffffed10171a518b R12: 1ffff92000ab4f68 [ 1823.471761][T31304] R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000 [ 1823.479748][T31304] FS: 00007f58a33bf6c0(0000) GS:ffff8880b8d00000(0000) knlGS:0000000000000000 [ 1823.488690][T31304] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1823.495291][T31304] CR2: 0000001b32a1eff8 CR3: 000000007e31a000 CR4: 00000000003506e0 [ 1823.503944][T31304] Call Trace: [ 1823.507287][T31304] [ 1823.510208][T31304] ? trace_contention_end+0x39/0xe0 [ 1823.515416][T31304] ? __mutex_lock+0x30d/0xce0 [ 1823.520081][T31304] ? as102_dvb_dmx_start_feed+0x70/0x280 [ 1823.525817][T31304] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 1823.531445][T31304] ? mutex_lock_nested+0x20/0x20 [ 1823.536407][T31304] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1823.542375][T31304] ? dmx_ts_feed_start_filtering+0x52/0x220 [ 1823.548301][T31304] ? mutex_unlock+0x10/0x10 [ 1823.552808][T31304] ? mutex_lock_nested+0x20/0x20 [ 1823.557814][T31304] ? _raw_spin_lock_irq+0xbb/0xf0 [ 1823.562832][T31304] ? _raw_spin_unlock_irq+0x23/0x50 [ 1823.568046][T31304] as102_dvb_dmx_start_feed+0x70/0x280 [ 1823.573492][T31304] dmx_ts_feed_start_filtering+0x120/0x220 [ 1823.579309][T31304] ? dmx_ts_feed_stop_filtering+0x190/0x190 [ 1823.585218][T31304] dvb_dmxdev_filter_start+0x422/0x10a0 [ 1823.590755][T31304] dvb_demux_do_ioctl+0x482/0x530 [ 1823.595791][T31304] dvb_usercopy+0x195/0x2b0 [ 1823.600282][T31304] ? dvb_dmxdev_buffer_read+0x4a0/0x4a0 [ 1823.606499][T31304] ? dvb_generic_ioctl+0xb0/0xb0 [ 1823.611430][T31304] ? dvb_demux_poll+0x210/0x210 [ 1823.616348][T31304] dvb_demux_ioctl+0x29/0x30 [ 1823.620924][T31304] __se_sys_ioctl+0xfd/0x170 [ 1823.625525][T31304] do_syscall_64+0x55/0xb0 [ 1823.629932][T31304] ? clear_bhb_loop+0x40/0x90 [ 1823.634592][T31304] ? clear_bhb_loop+0x40/0x90 [ 1823.639275][T31304] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1823.645345][T31304] RIP: 0033:0x7f58a25a8fd9 [ 1823.649745][T31304] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1823.669409][T31304] RSP: 002b:00007f58a33bf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1823.677834][T31304] RAX: ffffffffffffffda RBX: 00007f58a2825fa0 RCX: 00007f58a25a8fd9 [ 1823.685811][T31304] RDX: 0000200000000100 RSI: 0000000040146f2c RDI: 0000000000000004 [ 1823.693767][T31304] RBP: 00007f58a2637fed R08: 0000000000000000 R09: 0000000000000000 [ 1823.701739][T31304] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1823.710398][T31304] R13: 00007f58a2826038 R14: 00007f58a2825fa0 R15: 00007fffe2443df8 [ 1823.718419][T31304] [ 1823.721423][T31304] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1823.728681][T31304] CPU: 1 PID: 31304 Comm: syz.3.7453 Not tainted syzkaller #0 [ 1823.736117][T31304] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 1823.746151][T31304] Call Trace: [ 1823.749409][T31304] [ 1823.752320][T31304] dump_stack_lvl+0x18c/0x250 [ 1823.756982][T31304] ? show_regs_print_info+0x20/0x20 [ 1823.762163][T31304] ? load_image+0x420/0x420 [ 1823.766649][T31304] panic+0x2ca/0x720 [ 1823.770521][T31304] ? bpf_jit_dump+0xd0/0xd0 [ 1823.775014][T31304] __warn+0x2e0/0x470 [ 1823.778990][T31304] ? __mutex_lock+0xb9d/0xce0 [ 1823.783646][T31304] ? __mutex_lock+0xb9d/0xce0 [ 1823.788303][T31304] report_bug+0x2be/0x4f0 [ 1823.792614][T31304] ? __mutex_lock+0xb9d/0xce0 [ 1823.797270][T31304] ? __mutex_lock+0xb9d/0xce0 [ 1823.801923][T31304] ? __mutex_lock+0xb9f/0xce0 [ 1823.806581][T31304] handle_bug+0xcf/0x120 [ 1823.810808][T31304] exc_invalid_op+0x1a/0x50 [ 1823.815294][T31304] asm_exc_invalid_op+0x1a/0x20 [ 1823.820127][T31304] RIP: 0010:__mutex_lock+0xb9d/0xce0 [ 1823.825406][T31304] Code: 04 08 84 c0 0f 85 2f 01 00 00 83 3d dc 7c ed 04 00 0f 85 7c f5 ff ff 48 c7 c7 e0 bb ea 8a 48 c7 c6 80 bc ea 8a e8 d3 f0 b0 f6 <0f> 0b e9 62 f5 ff ff 0f 0b e9 20 f9 ff ff 0f 0b e9 fa f5 ff ff 48 [ 1823.845009][T31304] RSP: 0018:ffffc900055a7ac0 EFLAGS: 00010246 [ 1823.851055][T31304] RAX: 435e957dd9097100 RBX: ffff888066100ce0 RCX: 0000000000080000 [ 1823.859007][T31304] RDX: ffffc900111c3000 RSI: 0000000000003500 RDI: 0000000000003501 [ 1823.866962][T31304] RBP: ffffc900055a7c20 R08: ffff8880b8d28c53 R09: 1ffff110171a518a [ 1823.874913][T31304] R10: dffffc0000000000 R11: ffffed10171a518b R12: 1ffff92000ab4f68 [ 1823.882883][T31304] R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000 [ 1823.890842][T31304] ? trace_contention_end+0x39/0xe0 [ 1823.896028][T31304] ? __mutex_lock+0x30d/0xce0 [ 1823.900684][T31304] ? as102_dvb_dmx_start_feed+0x70/0x280 [ 1823.906305][T31304] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 1823.911920][T31304] ? mutex_lock_nested+0x20/0x20 [ 1823.916837][T31304] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1823.922797][T31304] ? dmx_ts_feed_start_filtering+0x52/0x220 [ 1823.928673][T31304] ? mutex_unlock+0x10/0x10 [ 1823.933155][T31304] ? mutex_lock_nested+0x20/0x20 [ 1823.938074][T31304] ? _raw_spin_lock_irq+0xbb/0xf0 [ 1823.943080][T31304] ? _raw_spin_unlock_irq+0x23/0x50 [ 1823.948260][T31304] as102_dvb_dmx_start_feed+0x70/0x280 [ 1823.953705][T31304] dmx_ts_feed_start_filtering+0x120/0x220 [ 1823.959494][T31304] ? dmx_ts_feed_stop_filtering+0x190/0x190 [ 1823.965374][T31304] dvb_dmxdev_filter_start+0x422/0x10a0 [ 1823.970904][T31304] dvb_demux_do_ioctl+0x482/0x530 [ 1823.975913][T31304] dvb_usercopy+0x195/0x2b0 [ 1823.980397][T31304] ? dvb_dmxdev_buffer_read+0x4a0/0x4a0 [ 1823.985926][T31304] ? dvb_generic_ioctl+0xb0/0xb0 [ 1823.990846][T31304] ? dvb_demux_poll+0x210/0x210 [ 1823.995677][T31304] dvb_demux_ioctl+0x29/0x30 [ 1824.000257][T31304] __se_sys_ioctl+0xfd/0x170 [ 1824.004832][T31304] do_syscall_64+0x55/0xb0 [ 1824.009232][T31304] ? clear_bhb_loop+0x40/0x90 [ 1824.013893][T31304] ? clear_bhb_loop+0x40/0x90 [ 1824.018555][T31304] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1824.024428][T31304] RIP: 0033:0x7f58a25a8fd9 [ 1824.028823][T31304] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1824.048410][T31304] RSP: 002b:00007f58a33bf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1824.056800][T31304] RAX: ffffffffffffffda RBX: 00007f58a2825fa0 RCX: 00007f58a25a8fd9 [ 1824.064751][T31304] RDX: 0000200000000100 RSI: 0000000040146f2c RDI: 0000000000000004 [ 1824.072702][T31304] RBP: 00007f58a2637fed R08: 0000000000000000 R09: 0000000000000000 [ 1824.080652][T31304] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1824.088603][T31304] R13: 00007f58a2826038 R14: 00007f58a2825fa0 R15: 00007fffe2443df8 [ 1824.096559][T31304] [ 1824.099814][T31304] Kernel Offset: disabled [ 1824.104121][T31304] Rebooting in 86400 seconds..