last executing test programs: 21m41.859116833s ago: executing program 32 (id=625): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x103, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x0, &(0x7f0000000280)}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20000092, &(0x7f00000000c0)={0x2, 0x4e23, @loopback}, 0x10) sendto$inet(r0, &(0x7f0000000580)="17", 0x59a, 0x10008095, 0x0, 0x0) close(0x3) 21m36.983604618s ago: executing program 33 (id=635): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000200)={0x8000, 0x8, 0x40}) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000040)={0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0xfffffd52, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR(r0, 0xc01c64a3, &(0x7f0000000280)={0x3, r2, 0x1, 0x8, 0xa, 0x202, 0x1}) 21m31.496231835s ago: executing program 34 (id=645): r0 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000085c0)=@newtfilter={0x70, 0x2c, 0xd27, 0x70bd2b, 0x25dfdbff, {0x0, 0x0, 0x0, r4, {0x0, 0xe}, {}, {0x8, 0xc}}, [@filter_kind_options=@f_flow={{0x9}, {0x40, 0x2, [@TCA_FLOW_EMATCHES={0x3c, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x30, 0x2, 0x0, 0x1, [@TCF_EM_U32={0x1c, 0x1, 0x0, 0x0, {{0x7, 0x3, 0x67e6}, {0x9, 0x3, 0x5, 0x9}}}, @TCF_EM_NBYTE={0x10, 0x2, 0x0, 0x0, {{0x24}, {0x7d, 0x0, 0x2}}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}]}]}}]}, 0x70}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) prlimit64(0x0, 0x1, 0x0, 0x0) r6 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r6, 0xc4c85513, &(0x7f0000000c80)={{0x3, 0x1, 0x1, 0x3557, 'syz1\x00', 0x5}, 0x1, [0x2, 0x84, 0x1c00000000000000, 0x7fffffffffffffff, 0x3, 0x3896, 0x5, 0x1, 0x8, 0xfffffffc, 0xfffffffffffffff7, 0x9, 0x7ff, 0xc0, 0x2fc2f8ae, 0x2, 0x101, 0x8001, 0x7fffffffffffffff, 0xa1, 0xfffffffffffffff8, 0x40, 0x2, 0x2, 0x10, 0xd, 0x8, 0x2, 0x6, 0x6, 0x6, 0x5, 0x2, 0x8, 0xffff, 0x144be44d, 0xc3b, 0x400000000003, 0x0, 0x12, 0x2, 0x8, 0x100bb9, 0x2, 0x6, 0x9, 0xb1e, 0x5, 0xf, 0x651, 0x8, 0x8000, 0xc, 0xffffffffffffffff, 0x4, 0x0, 0x400, 0x1, 0x5, 0x80000000, 0x5, 0xb9b, 0x5, 0x1, 0x6, 0x80, 0x4, 0xc4, 0x8001, 0x5, 0xffff, 0x8, 0x1, 0x100000001, 0x81, 0x3, 0x1, 0x800, 0xf5, 0x7, 0x1, 0x401, 0xf, 0x4, 0x2c, 0x5, 0x8, 0x2, 0x3, 0x80000005, 0x80000000, 0xed, 0x9, 0x7, 0x3, 0x7, 0x500000000000000, 0x100, 0xfffffffffffffffb, 0xd05, 0xf, 0xab7c, 0x4, 0x4, 0x8, 0x61, 0x1, 0xe, 0x8, 0x1, 0x2, 0x0, 0x400000000, 0x13ff, 0x2, 0xd3, 0x80, 0x6, 0x1000, 0x401, 0xe51b, 0x9, 0x7, 0x3, 0x9, 0x5, 0x9, 0x1ff]}) r7 = userfaultfd(0x801) ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r7, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r7, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000199000/0x800000)=nil, 0x800000}) ioctl$VHOST_GET_VRING_ENDIAN(0xffffffffffffffff, 0x4008af14, &(0x7f0000000240)={0x3, 0x8}) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="4c0000001000090400400000000000000000ffff", @ANYRES32=0x0, @ANYBLOB="08910400000000001800128009000100766c616e00000000080002800400038014000300766c616e3000"/52], 0x4c}}, 0x0) prctl$PR_SET_MM(0x35, 0x9, &(0x7f0000f79000/0x1000)=nil) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x181040, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) 20m57.992848065s ago: executing program 35 (id=701): socket$inet(0x2, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$kcm(0x2, 0xa, 0x2) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000000)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000a5f000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0}, 0x68) ptrace(0x10, 0x1) r2 = creat(0x0, 0x14) syz_io_uring_setup(0xbdc, &(0x7f00000021c0)={0x0, 0x5011, 0x10000, 0x3, 0x40000330, 0x0, r2}, &(0x7f00000006c0)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, 0x0, 0x0, 0x4) sendmsg$SEG6_CMD_SET_TUNSRC(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40004801}, 0x24004880) 16m11.694141517s ago: executing program 4 (id=1200): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x200040c8, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$kcm(0x28, 0x1, 0x0) socket$kcm(0x28, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000200)={0x8000, 0x8, 0x40}) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f0000000040)={0x0, &(0x7f00000002c0)=[0x0], 0x0, 0x0, 0xfffffd52, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR(r1, 0xc01c64a3, &(0x7f0000000280)={0x3, r3, 0x1, 0x8, 0xa, 0x202, 0x1}) mount$cgroup(0x0, &(0x7f0000000340)='./cgroup\x00', &(0x7f00000001c0), 0x3000443, &(0x7f0000000000)={[{@subsystem='hugetlb'}, {}]}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_ep_read(0xffffffffffffffff, 0x5, 0x56, &(0x7f0000000040)=""/86) syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a0000000000010080030900010073797a30000000002c000000030a010101d974a0255cb1e3de6adf9b7c00000000000000ffff0000000900010073797a300000000009d6030073797a320000000060000000060a0104000000000000000001000000000b530000000038000480360001800b000100657874686472000024000280080001400000000c080003c4f133aab687"], 0xd4}}, 0x0) 16m8.805826393s ago: executing program 4 (id=1204): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000280)={0x1, 0x0, 0x27f}) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/vlan/vlan1\x00') syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = socket(0x1, 0x6, 0x1) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r2, 0x8983, &(0x7f0000000000)={0x1, 'vlan1\x00', {}, 0x5832}) socket$inet6(0xa, 0x3, 0x3c) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f000001b000)=""/102400, 0x19000) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000180)={r1, 0xe0, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffe29, 0x0, 0x0, 0x0, 0x3a, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000340), 0xffffffffffffffee, 0x2084, 0x8, 0x0, 0x0}}, 0x10) fallocate(0xffffffffffffffff, 0x3, 0x5, 0x8) getpid() r5 = syz_open_dev$sndctrl(0x0, 0x2, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000000)={0x0, @in={{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x19}}}, [0xfff, 0xff, 0x2400000000, 0x5, 0x9a, 0x3, 0x5, 0x8000, 0x7, 0xdec, 0xfffffffffffffff8, 0x1, 0x3, 0x30, 0x6]}, 0x0) r6 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x48002) write$binfmt_aout(r6, 0x0, 0xc8) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r5, 0xc0405519, &(0x7f0000000bc0)={0x5, 0x4, 0x5, 0xe2, 'syz1\x00', 0x1}) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) 16m7.592644376s ago: executing program 36 (id=1205): r0 = syz_open_dev$video4linux(&(0x7f0000000000), 0x3, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000000c0)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='contention_end\x00', r1}, 0x10) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_add_memb(r2, 0x107, 0x2, &(0x7f00000003c0)={0x0, 0x1, 0x6, @remote}, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000031401002cbd7000fcdbdf250900020073797a32000000000800410073697700140033006c6f"], 0x38}, 0x1, 0x0, 0x0, 0x44}, 0x810) sendmsg$RDMA_NLDEV_CMD_DELLINK(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=ANY=[@ANYBLOB="18000000041401002dbd7000fedbdf250800010000000000ba30b28e994c1a08d1ca4eb6b8b4889cdd4e786eb807e04eb88b935d785f3d3201c58033c88e160d2745a91b08363bcc34006d0009788455ec9ad10b"], 0x18}, 0x1, 0x0, 0x0, 0x671ec167a4b72164}, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/pm_async', 0x101801, 0x30) syz_usb_connect(0x2, 0x440, &(0x7f00000005c0)=ANY=[@ANYBLOB, @ANYBLOB="b2"], 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) pipe2(&(0x7f0000000080), 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) 16m7.582893946s ago: executing program 4 (id=1209): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000340)={0x400000100002f}) write$uinput_user_dev(r0, &(0x7f0000000800)={'syz1\x00', {0x0, 0x10, 0x2}, 0xffffffff, [0x0, 0x0, 0x0, 0x40000, 0x1, 0x2, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0xfffffffe, 0x0, 0xffffffff, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x296, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x6, 0x5f1], [0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x7, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000, 0xfffffffe, 0x400, 0x0, 0x200, 0x0, 0x2, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x80000, 0x0, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x7, 0x0, 0x4, 0x0, 0xffff], [0x8001, 0xfc, 0x0, 0xffffffff, 0x80, 0x0, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x0, 0x4, 0x9, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x0, 0x9fa, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x6, 0x0, 0x0, 0xbda6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x52c, 0x0, 0x5, 0x0, 0xfff, 0x3, 0x0, 0xfffffffe, 0x0, 0x1, 0x8], [0x40000000, 0x0, 0x74e2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000002, 0x40, 0x0, 0x0, 0xbd, 0x0, 0x0, 0x4, 0x0, 0x0, 0x2, 0x8, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x80000000, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x40, 0xcaa, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0xf, 0x4]}, 0x45c) syz_open_dev$tty1(0xc, 0x4, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r2 = userfaultfd(0x80801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x700}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1}) ioctl$UFFDIO_ZEROPAGE(r2, 0xc020aa08, &(0x7f0000000000)={{&(0x7f0000ffe000/0x2000)=nil, 0x2000}, 0x1}) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000580)='tracefs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000000)={0x2, 0x3, 0xffffe000, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) rt_sigprocmask(0x0, &(0x7f00000000c0)={[0xffffffffffffffff]}, 0x0, 0x8) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x4) ioctl$KVM_RUN(r4, 0xae80, 0x0) 16m6.583318646s ago: executing program 4 (id=1210): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1\x00', 0x94) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={0x0}, 0x18) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r0, 0x0) setpgid(0x0, r0) mount$cgroup(0x0, 0x0, 0x0, 0x10000, 0x0) r1 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) r2 = socket(0x11, 0x3, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bind$packet(r2, 0x0, 0x0) sendmsg$netlink(r2, &(0x7f0000002ac0)={0x0, 0x0, 0x0}, 0x0) chmod(&(0x7f00000001c0)='./file0\x00', 0x9) ioctl$AUTOFS_IOC_CATATONIC(r1, 0x9362, 0x0) 16m5.423359608s ago: executing program 4 (id=1212): timerfd_create(0x7, 0x80000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x242580, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r0, 0xa, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x2) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20000080) sendto(0xffffffffffffffff, &(0x7f0000000740), 0x0, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2040000, 0x0) timer_create(0x0, 0x0, 0x0) prctl$PR_SET_PTRACER(0x59616d61, 0x0) r2 = socket(0x2, 0x80805, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) sendmmsg$inet(r2, &(0x7f0000000900)=[{{&(0x7f0000000080)={0x2, 0x4, @rand_addr=0xac1414bb}, 0x10, &(0x7f0000000100)=[{&(0x7f00000000c0)='Q', 0x1}], 0x1}, 0x20000000}, {{&(0x7f0000000000)={0x2, 0x4e21, @local}, 0x10, &(0x7f0000000200)=[{&(0x7f0000001040)="6cb76d", 0x3}], 0x1}}], 0x2, 0x0) ioctl$UI_SET_SWBIT(0xffffffffffffffff, 0x4004556d, 0x0) r3 = dup(0xffffffffffffffff) ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x5) 16m4.535253826s ago: executing program 4 (id=1214): socket$inet_udp(0x2, 0x2, 0x0) ioctl$FIBMAP(0xffffffffffffffff, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000480)={0x9, 0x8b}, 0x0) setrlimit(0x6, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x1) sendmsg$IEEE802154_LLSEC_SETPARAMS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004081}, 0x84) sched_setaffinity(0x0, 0xfffffffffffffd37, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = fanotify_init(0x81, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@bloom_filter={0x1e, 0x10001, 0xc978, 0x800, 0x50200, 0xffffffffffffffff, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x4, 0x5, 0xa}, 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r2, 0x0, 0x0}, 0x10) fanotify_mark(r1, 0x105, 0x40001032, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='sched\x00') seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0) preadv(r3, &(0x7f0000000a80)=[{&(0x7f0000000580)=""/51, 0x33}], 0x1, 0x8, 0x0) read$FUSE(r1, &(0x7f00000057c0)={0x2020}, 0x2020) 16m3.977315686s ago: executing program 37 (id=1214): socket$inet_udp(0x2, 0x2, 0x0) ioctl$FIBMAP(0xffffffffffffffff, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000480)={0x9, 0x8b}, 0x0) setrlimit(0x6, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x1) sendmsg$IEEE802154_LLSEC_SETPARAMS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004081}, 0x84) sched_setaffinity(0x0, 0xfffffffffffffd37, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = fanotify_init(0x81, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@bloom_filter={0x1e, 0x10001, 0xc978, 0x800, 0x50200, 0xffffffffffffffff, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x4, 0x5, 0xa}, 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={r2, 0x0, 0x0}, 0x10) fanotify_mark(r1, 0x105, 0x40001032, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='sched\x00') seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0) preadv(r3, &(0x7f0000000a80)=[{&(0x7f0000000580)=""/51, 0x33}], 0x1, 0x8, 0x0) read$FUSE(r1, &(0x7f00000057c0)={0x2020}, 0x2020) 16m3.76762251s ago: executing program 6 (id=1217): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000340)={0x400000100002f}) write$uinput_user_dev(r0, &(0x7f0000000800)={'syz1\x00', {0x0, 0x10, 0x2}, 0xffffffff, [0x0, 0x0, 0x0, 0x40000, 0x1, 0x2, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0xfffffffe, 0x0, 0xffffffff, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x296, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x6, 0x5f1], [0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x7, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000, 0xfffffffe, 0x400, 0x0, 0x200, 0x0, 0x2, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x80000, 0x0, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x7, 0x0, 0x4, 0x0, 0xffff], [0x8001, 0xfc, 0x0, 0xffffffff, 0x80, 0x0, 0x0, 0x0, 0x0, 0x1, 0x4, 0x0, 0x0, 0x4, 0x9, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0xfffffffd, 0xffffffff, 0x0, 0x0, 0x9fa, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x6, 0x0, 0x0, 0xbda6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x52c, 0x0, 0x5, 0x0, 0xfff, 0x3, 0x0, 0xfffffffe, 0x0, 0x1, 0x8], [0x40000000, 0x0, 0x74e2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000002, 0x40, 0x0, 0x0, 0xbd, 0x0, 0x0, 0x4, 0x0, 0x0, 0x2, 0x8, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x80000000, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x40, 0xcaa, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0xf, 0x4]}, 0x45c) syz_open_dev$tty1(0xc, 0x4, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r2 = userfaultfd(0x80801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x700}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000580)='tracefs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000000)={0x2, 0x3, 0xffffe000, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) rt_sigprocmask(0x0, &(0x7f00000000c0)={[0xffffffffffffffff]}, 0x0, 0x8) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x4) ioctl$KVM_RUN(r5, 0xae80, 0x0) 16m2.566412803s ago: executing program 6 (id=1218): rseq(&(0x7f0000000300), 0x20, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)=0x0) timer_settime(r1, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r2 = mmap$KVM_VCPU(&(0x7f0000ffc000/0x4000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0) r3 = userfaultfd(0x80801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f00000002c0)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1}) syz_memcpy_off$KVM_EXIT_HYPERCALL(r2, 0x20, &(0x7f00000003c0)="1eb3bf65654102f4af4d221c8bd458d1e7cbdaf3657d0f34e790c85bdba7931791f6d15c3e681411f7a496c0dace6a3c242f5b016fef8a9cedaf6bec340dee49474360d34cb800", 0x0, 0x48) io_uring_enter(0xffffffffffffffff, 0x47f5, 0x0, 0x0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000002800)={0x0, 0x0, 0x0}, 0x8010) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r4, &(0x7f0000032680)=""/102392, 0x18ff8) 16m1.313442928s ago: executing program 6 (id=1219): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_int(r4, 0x0, 0x32, &(0x7f0000000000), 0x4) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r5 = socket(0x40000000015, 0x5, 0x0) r6 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r6, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af00000000", 0x17) connect$inet6(r6, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x3}, 0x31) sendmmsg$inet6(r6, &(0x7f0000009fc0)=[{{&(0x7f0000000200)={0xa, 0x4e22, 0x9, @empty, 0x2}, 0x1c, 0x0, 0x0, &(0x7f0000000840)=[@rthdrdstopts={{0x18, 0x29, 0x37, {0x49}}}, @pktinfo={{0x24, 0x29, 0x32, {@loopback}}}], 0x40}}], 0x1, 0x20000811) connect$inet(r5, 0x0, 0x0) bind$inet(r5, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x54}}, 0x0) r7 = syz_open_dev$vbi(&(0x7f0000000000), 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=@newlink={0x4c, 0x10, 0xffffffffffffffff, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x2017, 0x2021}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0xa}, @IFLA_MACVLAN_MODE={0x8, 0x1, 0x10}]}}}, @IFLA_LINK={0x8, 0x5, r8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4001}, 0x8000002) write(r7, &(0x7f00000000c0), 0x0) ioctl$VIDIOC_S_CTRL(r7, 0xc008561c, &(0x7f0000000080)={0xf0f046}) 15m59.407330494s ago: executing program 6 (id=1220): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1\x00', 0x94) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={0x0}, 0x18) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r0, 0x0) setpgid(0x0, r0) mount$cgroup(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x10000, 0x0) r1 = open(0x0, 0x0, 0x0) r2 = socket(0x11, 0x3, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bind$packet(r2, 0x0, 0x0) sendmsg$netlink(r2, &(0x7f0000002ac0)={0x0, 0x0, 0x0}, 0x0) chmod(&(0x7f00000001c0)='./file0\x00', 0x9) ioctl$AUTOFS_IOC_CATATONIC(r1, 0x9362, 0x0) 15m59.034850871s ago: executing program 6 (id=1223): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000000), 0x10) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x37, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x141080) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r4, 0x40045532, &(0x7f0000000200)=0x5) openat$audio(0xffffffffffffff9c, &(0x7f0000000100), 0x80002, 0x0) syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65) 15m58.499426172s ago: executing program 6 (id=1224): timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x3938700}, {0x0, 0x3938700}}, 0x0) timer_create(0x0, &(0x7f0000000180)={0x0, 0x13, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) clock_nanosleep(0x7, 0x0, &(0x7f00000004c0)={0x0, 0x3938700}, 0x0) 15m58.093585959s ago: executing program 38 (id=1224): timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x3938700}, {0x0, 0x3938700}}, 0x0) timer_create(0x0, &(0x7f0000000180)={0x0, 0x13, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000240)=0x0) timer_settime(r0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) clock_nanosleep(0x7, 0x0, &(0x7f00000004c0)={0x0, 0x3938700}, 0x0) 15m40.505967669s ago: executing program 9 (id=1215): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) mlock2(&(0x7f0000549000/0x1000)=nil, 0x1000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mremap(&(0x7f00009d1000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f00002a0000/0x4000)=nil) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=@bloom_filter={0x1e, 0x0, 0x7, 0x6, 0x0, 0xffffffffffffffff, 0xffffffff, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x9}, 0x50) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001740)={r4, 0x0, &(0x7f0000001700)=""/53}, 0x20) ioctl$sock_inet_SIOCSIFDSTADDR(r3, 0x8918, &(0x7f0000000040)={'ipvlan0\x00', {0x2, 0x4e20, @loopback}}) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 15m39.461270879s ago: executing program 9 (id=1240): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r1 = eventfd(0x6) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={r1, 0x6, 0x2, r1}) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, &(0x7f0000000600)={0x0, 0x0, @pic={0x2a, 0xc0, 0x15, 0x7, 0x3, 0x0, 0xf, 0x8, 0x3, 0x41, 0x3, 0x58, 0x8a, 0x5, 0x9, 0x7f}}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f000001b700)=""/102392, 0x18ff8) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xe, 0x4, 0x4, 0x2, 0x1000, 0xf1, 0x0, 0x7fffffffffffb, 0x5, 0x0, 0x1, 0x0, 0x5, 0x0, 0xbde], 0x1000, 0x3c4210}) ioctl$KVM_RUN(r2, 0xae80, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) 15m39.059265497s ago: executing program 9 (id=1241): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1\x00', 0x94) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={0x0}, 0x18) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r0, 0x0) setpgid(0x0, r0) mount$cgroup(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x10000, 0x0) r1 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) r2 = socket(0x11, 0x3, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bind$packet(r2, 0x0, 0x0) sendmsg$netlink(r2, 0x0, 0x0) chmod(&(0x7f00000001c0)='./file0\x00', 0x9) ioctl$AUTOFS_IOC_CATATONIC(r1, 0x9362, 0x0) 15m37.775482062s ago: executing program 9 (id=1243): r0 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x5000, 0x1, @remote, 0x5}, 0x1c) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000100)=',', 0xffdf}], 0x1) 15m37.130754644s ago: executing program 9 (id=1246): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) mlock2(&(0x7f0000549000/0x1000)=nil, 0x1000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mremap(&(0x7f00009d1000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f00002a0000/0x4000)=nil) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001740)={0xffffffffffffffff, 0x0, &(0x7f0000001700)=""/53}, 0x20) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 15m36.462070607s ago: executing program 39 (id=1246): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) mlock2(&(0x7f0000549000/0x1000)=nil, 0x1000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mremap(&(0x7f00009d1000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f00002a0000/0x4000)=nil) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001740)={0xffffffffffffffff, 0x0, &(0x7f0000001700)=""/53}, 0x20) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 15m34.135311042s ago: executing program 2 (id=1255): r0 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x5000, 0x1, @remote, 0x5}, 0x1c) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000100)=',', 0xffdf}], 0x1) 15m33.283144978s ago: executing program 2 (id=1258): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) r1 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r1, &(0x7f0000000040)={0x1f, @none, 0x2}, 0xa) r2 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r2, &(0x7f00000001c0)={0x1f, @none, 0x1}, 0xa) shutdown(r1, 0x1) 15m32.567167742s ago: executing program 2 (id=1259): openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000100)) sendmsg$key(0xffffffffffffffff, 0x0, 0x8800) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000580)={'syz0\x00', {0x6ec9, 0x7, 0x5, 0x5}, 0x3e, [0x9, 0x2, 0x8, 0x2, 0x5334, 0x9, 0x80000000, 0x5, 0x8, 0x0, 0x2200006, 0xf5, 0x9, 0x39, 0x747d5a13, 0x8, 0xfffffb9a, 0xfffffffc, 0x4, 0xfffffffb, 0x4, 0x3, 0x4, 0xf252, 0x4, 0x800, 0x300000, 0x7, 0xe, 0x4623b, 0x0, 0x0, 0x1ff, 0x8000, 0x3ff, 0x3, 0xd, 0x4, 0xba55, 0x8da8, 0x2, 0x200, 0x3959, 0x8, 0xe, 0x3, 0x2, 0xde, 0x8, 0x9, 0x1, 0x1, 0x80000001, 0x2, 0xc, 0x1, 0x4, 0x0, 0x1000, 0x5, 0x40, 0x9, 0x7, 0x1], [0x6, 0x1e, 0x0, 0x8000, 0xfffffffe, 0x3, 0x0, 0x5, 0x7, 0xfffffffc, 0x6, 0x7fff, 0x72c, 0xc32, 0x3, 0x9, 0x10000, 0x400, 0x8001, 0x3, 0x1, 0x297, 0x5, 0x0, 0x981, 0x4, 0x100, 0x9, 0x2, 0x8, 0x0, 0x1000001, 0xdc3, 0xfffffffd, 0x0, 0x5, 0x1, 0xffffffff, 0x6, 0x5, 0x800, 0xffff, 0x6, 0x96, 0xfffffff9, 0x101, 0x0, 0x2, 0x401, 0xc, 0x3, 0x379, 0x9, 0xe, 0x5, 0x8, 0x6, 0x2, 0x1, 0x1, 0x8, 0x6, 0x200, 0x3], [0x401, 0xc584, 0xffff, 0xcd4, 0x7, 0x20, 0x7, 0x1004, 0x7, 0x20000010, 0x7, 0x9, 0xe8b, 0x5, 0x80000001, 0x5, 0xffffffff, 0x1000, 0x2, 0x10, 0x1, 0xfffffff9, 0xe55, 0x10, 0x80000001, 0x4, 0x4, 0x5, 0x6, 0x2, 0x5, 0x80, 0x9, 0x9, 0x47, 0x2, 0x2, 0x4, 0x7, 0x6d7e, 0x3, 0x8, 0x8001, 0xbf23, 0x6, 0x8, 0x95a, 0x0, 0x3ff, 0x3, 0x6, 0x100fffd, 0x2, 0x7, 0x4, 0xea, 0x7, 0x5, 0x6, 0xd9, 0x0, 0x8, 0x401, 0x5], [0x108e, 0x7fff, 0x3, 0x3, 0x88, 0x2, 0x6, 0x3, 0x40000050, 0x2, 0x763, 0xb, 0x402, 0x801, 0x4, 0x1000, 0x7f, 0x5, 0x3fa6, 0x4, 0x0, 0x5, 0x1e0, 0x4, 0xe48, 0x3, 0x3, 0x4, 0x103, 0x1000, 0x3b, 0x2, 0x5, 0x800, 0xa80a, 0x65f413f9, 0x4, 0x8, 0x8a8, 0x2, 0x40, 0x7, 0x2, 0x4, 0x4, 0x10, 0x800, 0xfffffffd, 0x7fff, 0x2, 0xfffffff8, 0x3, 0x9, 0x200, 0x7, 0x4ee1, 0xfffffffd, 0x7, 0xe, 0x2, 0xc, 0x2000b, 0x133, 0x6]}, 0x45c) r1 = socket(0x8000000010, 0x2, 0x0) write(r1, 0x0, 0x0) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) readv(0xffffffffffffffff, &(0x7f0000001900), 0x0) open(0x0, 0x0, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x0) r3 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$RFKILL_IOCTL_NOINPUT(0xffffffffffffffff, 0x5202) ioctl$TCXONC(r3, 0x540a, 0x2) r4 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi2\x00', 0xa400, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, &(0x7f0000000140)={'dt2801\x00', [0x9e1, 0x2566, 0xfffffffe, 0x4, 0x8, 0x0, 0x5, 0x10, 0x1002, 0xffffffff, 0x1, 0x5, 0x344, 0x1, 0x107, 0x0, 0x8, 0x3, 0x9, 0xe, 0x100, 0x1003, 0x7, 0xa, 0x5, 0x1, 0xb0c4, 0x7df, 0x8, 0x400007, 0x1]}) 15m31.588995501s ago: executing program 2 (id=1260): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1\x00', 0x94) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={0x0}, 0x18) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r0, 0x0) setpgid(0x0, r0) mount$cgroup(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x10000, 0x0) r1 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) r2 = socket(0x11, 0x3, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bind$packet(r2, 0x0, 0x0) sendmsg$netlink(r2, 0x0, 0x0) chmod(&(0x7f00000001c0)='./file0\x00', 0x9) ioctl$AUTOFS_IOC_CATATONIC(r1, 0x9362, 0x0) 15m30.55788277s ago: executing program 2 (id=1262): sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE(0x0, 0x0, 0x50) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) 15m30.0911406s ago: executing program 2 (id=1264): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = eventfd(0x6) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000100)={r2, 0x6, 0x2, r2}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000600)={0x0, 0x0, @pic={0x2a, 0xc0, 0x15, 0x7, 0x3, 0x0, 0xf, 0x8, 0x3, 0x41, 0x3, 0x58, 0x8a, 0x5, 0x9, 0x7f}}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f000001b700)=""/102392, 0x18ff8) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xe, 0x4, 0x4, 0x2, 0x1000, 0xf1, 0x0, 0x7fffffffffffb, 0x5, 0x0, 0x1, 0x0, 0x5, 0x0, 0xbde], 0x1000, 0x3c4210}) ioctl$KVM_RUN(r3, 0xae80, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) 15m29.699079747s ago: executing program 40 (id=1264): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = eventfd(0x6) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000100)={r2, 0x6, 0x2, r2}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000600)={0x0, 0x0, @pic={0x2a, 0xc0, 0x15, 0x7, 0x3, 0x0, 0xf, 0x8, 0x3, 0x41, 0x3, 0x58, 0x8a, 0x5, 0x9, 0x7f}}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f000001b700)=""/102392, 0x18ff8) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xe, 0x4, 0x4, 0x2, 0x1000, 0xf1, 0x0, 0x7fffffffffffb, 0x5, 0x0, 0x1, 0x0, 0x5, 0x0, 0xbde], 0x1000, 0x3c4210}) ioctl$KVM_RUN(r3, 0xae80, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) 2m45.563299297s ago: executing program 1 (id=2732): ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000000800), 0x0, 0x801, &(0x7f0000000040)={0x2, 0x4e23, @private=0xa010100}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x161281, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000300)='nfsd\x00', 0x2004041, 0x0) 2m42.095296883s ago: executing program 1 (id=2738): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) dup3(r1, r2, 0x80000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 2m41.543347334s ago: executing program 1 (id=2739): socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) syz_open_dev$sg(0x0, 0x0, 0x2000) read$msr(0xffffffffffffffff, &(0x7f0000002700)=""/102392, 0x18ff8) msgget(0x0, 0x40) mount(&(0x7f0000000040)=@nullb, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='ntfs3\x00', 0x1000080, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) 2m41.392338017s ago: executing program 1 (id=2741): r0 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB='ALTPCM \'Line Capture\' 00000000000000000000\nLINE2\nDIGITAL3\nSPEAKER \'Synth\' 0000000000C00000aster Playback\' '], 0xf7) 2m41.269879269s ago: executing program 1 (id=2744): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsopen(&(0x7f0000000500)='ramfs\x00', 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000001c0)=@generic={&(0x7f0000000180)='./file1/file0/file0\x00', 0x0, 0x18}, 0x18) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x220) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x40000, 0x120) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) r4 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x888000, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r4, 0xc018937c, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r3, {0x1}}, './file0\x00'}) 2m39.69192324s ago: executing program 1 (id=2747): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) dup3(r1, r2, 0x80000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 2m23.623801s ago: executing program 41 (id=2747): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) dup3(r1, r2, 0x80000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 58.414926387s ago: executing program 5 (id=3012): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x42032, 0xffffffffffffffff, 0x0) move_pages(0x0, 0x3, &(0x7f0000000140)=[&(0x7f0000a0d000/0x3000)=nil, &(0x7f0000a3a000/0x1000)=nil, &(0x7f0000fc7000/0x13000)=nil], &(0x7f0000000240)=[0x1], &(0x7f0000000000), 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x11, 0x4, 0x4, 0xc}, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r3 = syz_open_dev$MSR(&(0x7f0000000200), 0xa, 0x0) lsetxattr$system_posix_acl(0x0, 0x0, 0x0, 0x5c, 0x0) ioctl$VIDIOC_S_DV_TIMINGS(0xffffffffffffffff, 0xc0845657, 0x0) read$msr(r3, &(0x7f0000002240)=""/102400, 0x19000) r4 = openat$rfkill(0xffffffffffffff9c, 0x0, 0x602, 0x0) writev(r4, &(0x7f0000000440)=[{&(0x7f0000000040)="93d90400000300", 0x7}], 0x1) r5 = add_key$keyring(&(0x7f00000001c0), &(0x7f0000000240)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) add_key$user(&(0x7f0000000080), 0x0, &(0x7f0000000140)="27bb8a6af547da4cad0fbd9a8e46fa06226f81d37635a6370b94c473d2c66a0324b50da8e60cbdc7109c4f7fa0", 0x2d, r5) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000a00)=@newtaction={0xeb0, 0x30, 0xb, 0x0, 0x0, {}, [{0xe9c, 0x1, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80006}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_pedit={0xe50, 0x2, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{0x5, 0xa, 0x4, 0x1, 0x2000000}, 0x5, 0x1}, [{0x9, 0x80000001, 0x1, 0x630, 0x8, 0x1}, {0xdf, 0x4, 0x5, 0x5, 0x10, 0xe}, {0x1, 0x85a, 0x5, 0xe6db, 0x3, 0xfffffffc}, {0x6, 0x400, 0x9321, 0xa6, 0x6, 0x7}, {0x5, 0x5, 0xffffffc0, 0x0, 0x3}, {0xe, 0xf5, 0x3, 0x9, 0xffffbff8, 0x3}, {0x0, 0x7, 0xfff, 0x2, 0x9163ef6c, 0x40080003}, {0x3, 0x5, 0x80, 0x0, 0xacc8, 0x2}, {0x8001, 0xffb, 0x9, 0xffff, 0xfffffffe, 0x81}, {0x8, 0xfff, 0x6, 0xeb84, 0x8, 0x30c4}, {0x7, 0x9, 0xfffffffc, 0x100, 0x4}, {0x8004, 0x80000001, 0xfffffeff, 0x80000df, 0x4, 0x5}, {0x0, 0x80000001, 0x9, 0x7, 0x1000, 0x7}, {0x5, 0x2, 0xfffffffd, 0x9, 0x474, 0x594}, {0x7fffffff, 0x1, 0x8, 0xfffffff9, 0x6, 0xffffffff}, {0x24, 0x5, 0xf, 0x6, 0x6, 0x8000003}, {0xbb, 0x5, 0x2, 0x310, 0xf}, {0x9b7d, 0x52fc, 0x3, 0x3, 0x48, 0x9}, {0xbd, 0x8, 0x10, 0xe4d, 0x7f, 0x3}, {0x8, 0x8, 0x9, 0x27, 0x2, 0x5}, {0x4, 0x1000, 0x5, 0x6, 0x93e, 0x6}, {0x1, 0x7, 0x0, 0x1, 0xff, 0x3}, {0xb, 0x7f, 0xfffff417, 0x1, 0x3ff, 0x9}, {0x4, 0x8, 0x7, 0xb, 0x8, 0x80004d}, {0x34db, 0xffff, 0x0, 0x3ff, 0x1, 0x400}, {0x1, 0xcb1d, 0x8, 0x1, 0x0, 0x4}, {0x5, 0x3, 0x7, 0x8, 0x3, 0x984}, {0x2, 0xffffffff, 0x3, 0x2, 0x9, 0x40}, {0x7, 0x281, 0x7fffffff, 0x3, 0x3, 0x8}, {0x5, 0x4, 0x1, 0x8, 0x4, 0x2f}, {0x6, 0x3, 0x4, 0xd1a1, 0x9, 0x7}, {0x5, 0x3, 0x8, 0x4, 0x16, 0x2}, {0x8001, 0x87, 0x6, 0x1, 0x3, 0x4}, {0x6, 0x9e4, 0x8b7f, 0x11, 0x3, 0x7}, {0x7, 0x1, 0x800, 0x70f, 0x8001, 0x3}, {0x4, 0x10, 0x6, 0x1, 0x4, 0x22ff}, {0x5, 0x10001, 0x9, 0x0, 0x10001, 0x7}, {0xf85, 0x2e, 0x100, 0x3, 0x100, 0xe60c}, {0x2, 0x5, 0x1, 0xe000000}, {0x4e2, 0x6ae, 0x2, 0x100, 0x5, 0xd}, {0x1, 0xcad, 0xa5, 0x2, 0x4d800, 0x6}, {0x20, 0x7f, 0x33, 0x2, 0x400, 0x4}, {0x4, 0x62e, 0xb, 0x219c, 0x0, 0x5}, {0x0, 0x4, 0x0, 0x1, 0x1, 0x1}, {0x7f, 0x945a, 0x0, 0x0, 0x8, 0x3}, {0xda1, 0x893, 0x2, 0x9, 0xfffffa2e, 0x6}, {0x1, 0xfffffff3, 0x7fffffff, 0x8, 0x0, 0x1}, {0x2, 0x8, 0x2, 0xe, 0x2, 0x2}, {0x6, 0x100, 0xe, 0x10000, 0x5, 0x7}, {0x0, 0x6, 0x7, 0x4, 0xc, 0x800}, {0x8, 0x10000, 0x1, 0x1, 0x7}, {0x7d5, 0x2, 0x4, 0x800, 0xf}, {0x1, 0x5, 0x6, 0x2, 0x8, 0xc}, {0x2, 0x1, 0x3, 0xc, 0x1, 0x2c3}, {0x1000, 0x3, 0xbc, 0x8001, 0xfa, 0x8}, {0x2, 0x3, 0x9, 0x50e, 0x55ac, 0xa5e2}, {0x0, 0x196680, 0xffffff91, 0xfd, 0x3, 0x7}, {0x4, 0x4, 0x2, 0x1, 0x0, 0xe}, {0xfffffff5, 0x8, 0x7023, 0x8, 0x5, 0x851}, {0x3, 0x78, 0x7, 0xa, 0x5dec4cac, 0x6}, {0x4, 0x9, 0x3a, 0x2, 0x8, 0x602}, {0x4, 0x7fffffff, 0x8, 0x8, 0x8, 0xff}, {0x7, 0xfffffff1, 0x2f2c, 0x400, 0x6, 0x6}, {0x10001, 0x81, 0x40, 0x2, 0x85, 0x2}, {0x2, 0x8550, 0x4c, 0x3, 0xfffffffa, 0x736d}, {0x7f, 0x199, 0x5, 0x9, 0x7, 0x2}, {0x7, 0x1, 0x8, 0x7, 0x2, 0x7}, {0x9, 0x3f1, 0x4, 0x5, 0x5, 0x8}, {0x100, 0x3ff, 0x0, 0x7f53, 0x7, 0x1}, {0x3ff, 0xc, 0x4, 0x1, 0x4, 0x4}, {0x9, 0x381, 0xfff, 0x5d7c, 0x0, 0x8001}, {0x8, 0x0, 0x7, 0xfffffffb, 0x3ee, 0x4}, {0xbfffffe, 0x6, 0x101, 0x5, 0x400, 0x8000400}, {0x7fff, 0xb3, 0x2, 0x10000, 0x6, 0x14}, {0x0, 0x1, 0x4c90, 0x4, 0x2000007f, 0x8}, {0x5, 0x25b, 0x0, 0x3, 0x2, 0x2}, {0x29dbdf0, 0xd, 0xfffffffd, 0x7, 0x6, 0x3}, {0x7, 0x1, 0xa, 0x8, 0x5, 0x5}, {0x473, 0x8, 0x2, 0x400, 0x4000000, 0x69b3d6e6}, {0x1, 0xb7bb, 0x22800000, 0x3, 0x10, 0x5}, {0x7f, 0x7, 0x6, 0xffffffff, 0x3, 0x8}, {0xfffffff7, 0x5, 0xa, 0x40, 0x863, 0x2}, {0xb, 0x9, 0xc, 0x3c1, 0x6e, 0x40}, {0x6, 0xd, 0x6, 0xfb0000, 0x1, 0x7}, {0xe0, 0x100, 0x1, 0xb, 0x8, 0x7}, {0xffc, 0x1, 0x0, 0x38, 0x0, 0x9}, {0x82, 0x10, 0x401, 0x0, 0x4, 0xef}, {0x7, 0x2, 0x200, 0x8, 0x9, 0x2}, {0x54, 0x5, 0xa33f, 0x101, 0x2, 0x10001}, {0x1, 0x4, 0x800004, 0x10001, 0x2, 0xce}, {0x4, 0x8, 0x8, 0x3, 0xf, 0x9}, {0x6, 0x5, 0x8, 0xffffffff, 0x405b9, 0x6}, {0x9, 0x0, 0x9, 0x2, 0x9}, {0x0, 0x2, 0xb, 0x7fffffff, 0xfc0, 0x7f1b4893}, {0x4, 0xd, 0x3, 0x4, 0x7, 0x7}, {0x4, 0x5, 0xe, 0x3, 0x3dcb, 0x9}, {0x200, 0x0, 0xe8, 0x1, 0x800000d4, 0x1}, {0xc651, 0x5f83, 0x2, 0x1, 0xd, 0x8}, {0xfff, 0x5, 0x1, 0x0, 0x49, 0x5}, {0x5, 0x3, 0x7, 0x97fd, 0xef, 0x202}, {0x2, 0xa, 0x1000, 0x1, 0x6, 0xe0}, {0x800, 0x4c, 0x7, 0x0, 0xfffffff7, 0x9}, {0x6, 0xffff, 0xffff8001, 0xa, 0xae36, 0x36b6800}, {0xcfb7, 0x0, 0x101, 0x2, 0x1, 0xaa82}, {0x6, 0x800, 0xec3d, 0xffffffff, 0xea5, 0x3}, {0x9, 0x5, 0x2, 0x0, 0x0, 0xdd}, {0x6, 0x6, 0x0, 0x1e9, 0x6, 0x1}, {0x3, 0x7, 0x5, 0x3, 0x400, 0x81}, {0x970, 0x100, 0xb2eb, 0x2, 0x3, 0x9}, {0x3, 0x6, 0x8, 0x7, 0xd, 0x474c}, {0xf, 0x101, 0x9a, 0x1000, 0x2, 0xfffffffc}, {0x3, 0x98e, 0x1a5e666b, 0x10, 0x7, 0x9}, {0xfffffffb, 0x3, 0x3, 0x2ee8000, 0x8}, {0x3, 0x2, 0x2, 0x3, 0x3, 0x2}, {0x7, 0x4, 0x1, 0x7, 0x101, 0xef}, {0x70a0, 0x9, 0x425b597f, 0x1, 0x2, 0x7}, {0x6, 0xc000000, 0x402, 0x4, 0x8, 0x5}, {0x3, 0x6, 0x7, 0xfffffff9, 0x0, 0xffffffff}, {0x7, 0x9, 0x8, 0x0, 0x9, 0xd6}, {0x24, 0x10001, 0x6, 0x1, 0x39d6}, {0x401, 0x7d4, 0x9, 0x8000, 0xffff, 0x7}, {0x6, 0x92e4, 0x130, 0x0, 0x4, 0x9}, {0x0, 0x7fff, 0x7, 0x8001, 0x8, 0x5}, {0x7e, 0x800, 0xfffffff9, 0x6, 0x4b64, 0x80000001}, {0x2ad78a25, 0x2, 0x6, 0x6, 0x4, 0x8}, {0x2, 0x9, 0x0, 0x8a7, 0x129, 0xc}, {0x7, 0x2, 0x8, 0x3, 0xe01, 0xf933271}, {0x4a3, 0x4, 0x3, 0x514c, 0xf8a, 0x19}], [{0x1}, {0x4, 0x1}, {}, {0x1}, {0x3}, {0x0, 0x1}, {0x3, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {}, {0x5}, {0x1}, {0x2}, {0x0, 0x1}, {0x1, 0x1}, {}, {0x4}, {}, {0x1, 0x1}, {0x5, 0x1}, {0x5}, {0x3}, {0x5, 0x1}, {}, {0x0, 0x1}, {0x3}, {0x2, 0x1}, {0x4}, {0x5}, {0x5, 0x1}, {0x3, 0x1}, {0x4}, {0x1}, {0x0, 0x1}, {0x3, 0x1}, {0x4}, {0x1}, {0x1, 0x1}, {0x4}, {0x1}, {0x3, 0x1}, {0x1}, {0x3}, {0x2, 0x1}, {0x5, 0x1}, {0x3}, {0x3}, {0x0, 0x1}, {0x3, 0x1}, {0x4}, {0x5, 0x1}, {0x2}, {0x3, 0x1}, {0x5, 0x1}, {0x1}, {0x1}, {0x3}, {0x5, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x4}, {0x5}, {0x1, 0x1}, {}, {0x3, 0x1}, {0x2, 0x1}, {0x5, 0x1}, {0x4}, {0x4, 0x1}, {0x0, 0x1}, {0x2}, {0x5}, {0x9, 0x1}, {0x2, 0x1}, {0x3, 0x1}, {}, {0x3, 0x1}, {}, {0x1, 0x1}, {0x2}, {0x5}, {0x2, 0x1}, {0x6, 0x1}, {0x2, 0x1}, {0x5, 0x1}, {0x3}, {0x3, 0x1}, {0x1}, {0x2}, {0x2}, {0x5}, {0x3, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x2}, {0x1}, {0x1, 0x1}, {0x4, 0x1}, {0x5}, {0x4}, {0x2, 0x1}, {0x3, 0x1}, {0x4}, {0x1}, {0x5, 0x1}, {0x4, 0x1}, {0x3}, {0x3, 0x1}, {0x0, 0x1}, {0x5}, {0x3, 0x1}, {0x4}, {0x5, 0x1}, {0x3}, {0x5, 0x1}, {0x3}, {0x4}, {0x5, 0x1}, {0x3, 0x1}, {0x4}, {0x1, 0x1}, {0x4}, {0x6, 0x1}, {0x5, 0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xeb0}}, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x40}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=@newtfilter={0x8c, 0x2c, 0xd27, 0x30bd25, 0x25df9bfb, {0x0, 0x0, 0x0, 0x0, {0xd, 0xe}, {}, {0x7}}, [@filter_kind_options=@f_route={{0xa}, {0x54, 0x2, [@TCA_ROUTE4_ACT={0x50, 0x6, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0xa, 0x5, 0x4, 0x7, 0x8}, 0x39}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x3}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0x0, 0x3}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) r7 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040), 0x101000, 0x0) io_uring_setup(0x46e4, &(0x7f0000000340)={0x0, 0xc60e, 0x400, 0x1, 0x25c, 0x0, r7}) 57.624880142s ago: executing program 5 (id=3014): r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(0x0, r1) sendmsg$IEEE802154_START_REQ(r1, &(0x7f0000000340)={0x0, 0x25, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYRES16=r2, @ANYBLOB="010000000000000000000d0000d2b300070012000000050017000000000006000a00ffff00000500190004000000060008000000000005001800f8000000", @ANYBLOB='D\x00\x00\x00'], 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x20000040) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) getsockopt$inet_int(r0, 0x0, 0x16, &(0x7f0000000300), &(0x7f0000000400)=0x4) r4 = socket(0x10, 0x80002, 0x0) r5 = openat$tun(0xffffffffffffff9c, 0x0, 0x220800, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x88}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0xfffffffffffffffe) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) open(0x0, 0x6c633e, 0xa7f7a8c46d031303) ioctl$TUNSETIFF(r5, 0x400454ca, 0x0) r7 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r7}, &(0x7f0000bbdffc)=0x0) timer_settime(r8, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) bind$can_j1939(0xffffffffffffffff, &(0x7f0000000380)={0x1d, 0x0, 0x1, {0x0, 0x1, 0x3}, 0xfe}, 0x18) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0xffa1, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r3, @ANYBLOB="00000000100000001c001a80080002802d00ff0008000200", @ANYBLOB="35874207"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000100)={'sit0\x00', &(0x7f0000000440)={'sit0\x00', 0x0, 0x8, 0x700, 0x4, 0xff, {{0x6, 0x4, 0x1, 0x3c, 0x18, 0x67, 0x0, 0x8, 0x29, 0x0, @empty, @rand_addr=0x64010101, {[@noop]}}}}}) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x3, 0x0) 53.322599064s ago: executing program 5 (id=3022): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400010bce) r0 = syz_open_dev$MSR(&(0x7f0000000380), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x101301) ioctl$USBDEVFS_CONTROL(r1, 0xc0105500, &(0x7f0000000040)={0x0, 0x3, 0x1, 0x3, 0x0, 0x7, 0x0}) 52.533320549s ago: executing program 5 (id=3023): sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x5) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8041, 0x0) write$dsp(r0, &(0x7f00000001c0)="5cba", 0x2) ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000440)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0xf2ffffff) 51.801909013s ago: executing program 5 (id=3028): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsopen(&(0x7f0000000500)='ramfs\x00', 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000001c0)=@generic={&(0x7f0000000180)='./file1/file0/file0\x00', 0x0, 0x18}, 0x18) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x220) r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x40000, 0x120) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r3, {0x1}}, './file0\x00'}) 50.655043595s ago: executing program 5 (id=3029): ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000005c0)={'\x00', 0x400, 0x3, 0x6, 0x101, 0x803, 0xffffffffffffffff}) ioctl$COMEDI_DEVCONFIG(0xffffffffffffffff, 0x40946400, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010004b0400000000000000007a000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000200012800b0001006272696467650000100002800c0021"], 0x40}, 0x1, 0x0, 0x0, 0x34041043}, 0x0) syz_emit_vhci(&(0x7f0000000240)=ANY=[@ANYBLOB="040e0705022012"], 0xa) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0) getrusage(0x0, &(0x7f0000000640)) 35.489622034s ago: executing program 3 (id=3063): r0 = gettid() timer_create(0xb, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000000080)) r1 = syz_open_dev$cec(&(0x7f0000000240), 0x0, 0x2182) ioctl$CEC_RECEIVE(r1, 0xc0386106, &(0x7f0000000000)={0x0, 0x7, 0x1, 0xfffffffd, 0x0, 0x9, '&\x00', 0x0, 0x0, 0x4a, 0x0, 0x0, 0x7, 0xe}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x1) r2 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r2, &(0x7f0000002700)=""/102392, 0x18ff8) memfd_secret(0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x240448c5}, 0x8000002) 35.382604746s ago: executing program 42 (id=3029): ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000005c0)={'\x00', 0x400, 0x3, 0x6, 0x101, 0x803, 0xffffffffffffffff}) ioctl$COMEDI_DEVCONFIG(0xffffffffffffffff, 0x40946400, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="4000000010004b0400000000000000007a000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000200012800b0001006272696467650000100002800c0021"], 0x40}, 0x1, 0x0, 0x0, 0x34041043}, 0x0) syz_emit_vhci(&(0x7f0000000240)=ANY=[@ANYBLOB="040e0705022012"], 0xa) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0) getrusage(0x0, &(0x7f0000000640)) 32.694770847s ago: executing program 3 (id=3071): sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x5) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8041, 0x0) write$dsp(r0, &(0x7f00000001c0)="5cba91", 0x3) ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000440)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0xf2ffffff) 31.353696683s ago: executing program 3 (id=3074): syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x80a02, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{0x0}], 0x1) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x2, 0x0, 0x20000000004, 0xfffffffffffffffd, 0x2, 0x0, 0x1000001000, 0x49}, 0x0, &(0x7f00000002c0)={0x3f7, 0x8000000000000000, 0x80000000, 0x9, 0x1000000000003, 0xf, 0x6}, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 30.155212405s ago: executing program 3 (id=3078): gettid() timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r0 = syz_open_dev$cec(&(0x7f0000000240), 0x0, 0x2182) ioctl$CEC_RECEIVE(r0, 0xc0386106, &(0x7f0000000000)={0x0, 0x7, 0x1, 0xfffffffd, 0x0, 0x9, '&\x00', 0x0, 0x0, 0x4a, 0x0, 0x0, 0x7, 0xe}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x1) r1 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) memfd_secret(0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x240448c5}, 0x8000002) 28.227221452s ago: executing program 3 (id=3081): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsopen(&(0x7f0000000500)='ramfs\x00', 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000001c0)=@generic={&(0x7f0000000180)='./file1/file0/file0\x00', 0x0, 0x18}, 0x18) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x220) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x888000, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r3, 0xc018937c, &(0x7f00000000c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x1}}, './file0\x00'}) 26.989731096s ago: executing program 3 (id=3083): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102400, 0x19000) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) umount2(&(0x7f00000002c0)='./file0\x00', 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f00000001c0)=0x3) ioctl$PPPIOCGIDLE(0xffffffffffffffff, 0x8010743f, &(0x7f0000000100)) r1 = socket$nl_generic(0x10, 0x3, 0x10) lsetxattr$security_ima(0x0, 0x0, 0x0, 0x9, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r5 = fcntl$dupfd(r4, 0x406, r3) write$sndseq(r5, &(0x7f0000000200)=[{0x0, 0x2a, 0x0, 0x0, @time={0x7f, 0x4}, {}, {}, @raw32}, {0x0, 0x0, 0x0, 0x7, @tick, {}, {0x0, 0x4}, @addr={0xd1, 0x9}}], 0x38) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r1, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 20.277998194s ago: executing program 8 (id=3091): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="130100002add1e20ef050a023691010203010902240001000000000904000002ea1998000905a6a70000000000090507", @ANYRES32], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000300)={0x0, 0x5, 0x1, 'O'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000500)={0x44, &(0x7f00000002c0)={0x20, 0x14, 0xa, "4d6fbf86d0b01d60b19e"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 17.051294655s ago: executing program 8 (id=3098): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeeb, 0x8031, 0xffffffffffffffff, 0xbf5ce000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000018c0)=ANY=[@ANYBLOB="0a000000d2cf00003d36000002"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180), 0x3, r3}, 0x38) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000380)={r3, &(0x7f0000001940), &(0x7f00000002c0)=""/187}, 0x20) 15.22053355s ago: executing program 8 (id=3101): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x11, 0x3, 0x0, &(0x7f0000000300)='GPL\x00'}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x4, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) sched_setaffinity(0x0, 0xfffffffffffffd58, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) r1 = socket(0x10, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f0000000280)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x53, 0x3, 0x6a, @private1, @mcast2={0xff, 0x5}, 0x8, 0x40, 0x7d, 0x3ff}}) 14.425184225s ago: executing program 8 (id=3103): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe3}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, 0x0, 0x0) sendmmsg$inet(r0, &(0x7f0000007d80)=[{{0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f0000006940)="14863a73a208656c3f3701a6522b234c639f7f00e99c207cc2ee3078b389b9ae8aeab2465a46006f64b36bea891fd4e2e7dcd5c3ac95207f073cc1c209b91f6d7127f9515320e71bd997fb376f3647ae645716db6cebc54b0a87e3333c026913c7cb605266d390388892f3c87cdd03a2ee0e9ba8a1e7d18a565b3c01ec67d2471c842a5c55cdb2db516381419b962962f513f048cb7997249d6f2e66b7bbd71af86b5bee9c0799b905cfa0b8894acf65e0fbde697393245fb8abd62329c2596acb0044bedf87c8319a659975fa2b3096cd3df68675c2bfa2e51b7607ca202fafecfabeb591fc0385bdc50b9d5ef2d37857872e00f6281e12b2ccb53ca78a63c8c02f0fe6019daeb0e0dc82af626fcaf0289baa8f17402694698dd76d5487a1c9deac0328674f335c2231852933284f5e0ee20dc338199740d4dc24d8d29ab5aa8fa0e842739359a375943b3951966bda4fc5d6ecf6c65f7371e9cfcd83fd4b94a19ae79dcc9052b157bbc0a9f5138a6312652ed63e1f7b234e7c150a2dbd3592cddf5b0d2c6ceceae00a9f6787d3e3edc6b7dbb0884b51dc54088d0ddef300e6d81273b27b87c85dc49a71217e54f5c01b64a7555226e8b1d97b973d1a521e5c5a1f925a18d4bd0d8196c00f1f13a6e4fec83f45e3f67a8934c70439ce1b86121e896bd13a2dd7d697741ac9590138aa12c86e47d24dba8308bf20a07ceaa4f88efd0b7fb7cab08132515f3fbe7c6d7f3f15fe28daa1dfdfb0b4b1a70857e1f8f6e3", 0x222}], 0x1}}], 0x1, 0x40) 14.347528347s ago: executing program 8 (id=3104): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsopen(&(0x7f0000000500)='ramfs\x00', 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000001c0)=@generic={&(0x7f0000000180)='./file1/file0/file0\x00', 0x0, 0x18}, 0x18) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x220) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x888000, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r3, 0xc018937c, &(0x7f00000000c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x1}}, './file0\x00'}) 12.714234178s ago: executing program 8 (id=3106): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x42032, 0xffffffffffffffff, 0x0) move_pages(0x0, 0x3, &(0x7f0000000140)=[&(0x7f0000a0d000/0x3000)=nil, &(0x7f0000a3a000/0x1000)=nil, &(0x7f0000fc7000/0x13000)=nil], &(0x7f0000000240)=[0x1], &(0x7f0000000000), 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x11, 0x4, 0x4, 0xc}, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r3 = syz_open_dev$MSR(&(0x7f0000000200), 0xa, 0x0) read$msr(r3, &(0x7f0000002240)=""/102400, 0x19000) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = openat$rfkill(0xffffffffffffff9c, 0x0, 0x602, 0x0) writev(r4, &(0x7f0000000440)=[{&(0x7f0000000040)="93d90400000300", 0x7}], 0x1) r5 = add_key$keyring(&(0x7f00000001c0), &(0x7f0000000240)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) add_key$user(&(0x7f0000000080), 0x0, &(0x7f0000000140)="27bb8a6af547da4cad0fbd9a8e46fa06226f81d37635a6370b94c473d2c66a0324b50da8e60cbdc7109c4f7fa0", 0x2d, r5) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000a00)=@newtaction={0xeb0, 0x30, 0xb, 0x0, 0x0, {}, [{0xe9c, 0x1, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80006}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_pedit={0xe50, 0x2, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{0x5, 0xa, 0x4, 0x1, 0x2000000}, 0x5, 0x1}, [{0x9, 0x80000001, 0x1, 0x630, 0x8, 0x1}, {0xdf, 0x4, 0x5, 0x5, 0x10, 0xe}, {0x1, 0x85a, 0x5, 0xe6db, 0x3, 0xfffffffc}, {0x6, 0x400, 0x9321, 0xa6, 0x6, 0x7}, {0x5, 0x5, 0xffffffc0, 0x0, 0x3}, {0xe, 0xf5, 0x3, 0x9, 0xffffbff8, 0x3}, {0x0, 0x7, 0xfff, 0x2, 0x9163ef6c, 0x40080003}, {0x3, 0x5, 0x80, 0x0, 0xacc8, 0x2}, {0x8001, 0xffb, 0x9, 0xffff, 0xfffffffe, 0x81}, {0x8, 0xfff, 0x6, 0xeb84, 0x8, 0x30c4}, {0x7, 0x9, 0xfffffffc, 0x100, 0x4}, {0x8004, 0x80000001, 0xfffffeff, 0x80000df, 0x4, 0x5}, {0x0, 0x80000001, 0x9, 0x7, 0x1000, 0x7}, {0x5, 0x2, 0xfffffffd, 0x9, 0x474, 0x594}, {0x7fffffff, 0x1, 0x8, 0xfffffff9, 0x6, 0xffffffff}, {0x24, 0x5, 0xf, 0x6, 0x6, 0x8000003}, {0xbb, 0x5, 0x2, 0x310, 0xf}, {0x9b7d, 0x52fc, 0x3, 0x3, 0x48, 0x9}, {0xbd, 0x8, 0x10, 0xe4d, 0x7f, 0x3}, {0x8, 0x8, 0x9, 0x27, 0x2, 0x5}, {0x4, 0x1000, 0x5, 0x6, 0x93e, 0x6}, {0x1, 0x7, 0x0, 0x1, 0xff, 0x3}, {0xb, 0x7f, 0xfffff417, 0x1, 0x3ff, 0x9}, {0x4, 0x8, 0x7, 0xb, 0x8, 0x80004d}, {0x34db, 0xffff, 0x0, 0x3ff, 0x1, 0x400}, {0x1, 0xcb1d, 0x8, 0x1, 0x0, 0x4}, {0x5, 0x3, 0x7, 0x8, 0x3, 0x984}, {0x2, 0xffffffff, 0x3, 0x2, 0x9, 0x40}, {0x7, 0x281, 0x7fffffff, 0x3, 0x3, 0x8}, {0x5, 0x4, 0x1, 0x8, 0x4, 0x2f}, {0x6, 0x3, 0x4, 0xd1a1, 0x9, 0x7}, {0x5, 0x3, 0x8, 0x4, 0x16, 0x2}, {0x8001, 0x87, 0x6, 0x1, 0x3, 0x4}, {0x6, 0x9e4, 0x8b7f, 0x11, 0x3, 0x7}, {0x7, 0x1, 0x800, 0x70f, 0x8001, 0x3}, {0x4, 0x10, 0x6, 0x1, 0x4, 0x22ff}, {0x5, 0x10001, 0x9, 0x0, 0x10001, 0x7}, {0xf85, 0x2e, 0x100, 0x3, 0x100, 0xe60c}, {0x2, 0x5, 0x1, 0xe000000}, {0x4e2, 0x6ae, 0x2, 0x100, 0x5, 0xd}, {0x1, 0xcad, 0xa5, 0x2, 0x4d800, 0x6}, {0x20, 0x7f, 0x33, 0x2, 0x400, 0x4}, {0x4, 0x62e, 0xb, 0x219c, 0x0, 0x5}, {0x0, 0x4, 0x0, 0x1, 0x1, 0x1}, {0x7f, 0x945a, 0x0, 0x0, 0x8, 0x3}, {0xda1, 0x893, 0x2, 0x9, 0xfffffa2e, 0x6}, {0x1, 0xfffffff3, 0x7fffffff, 0x8, 0x0, 0x1}, {0x2, 0x8, 0x2, 0xe, 0x2, 0x2}, {0x6, 0x100, 0xe, 0x10000, 0x5, 0x7}, {0x0, 0x6, 0x7, 0x4, 0xc, 0x800}, {0x8, 0x10000, 0x1, 0x1, 0x7}, {0x7d5, 0x2, 0x4, 0x800, 0xf}, {0x1, 0x5, 0x6, 0x2, 0x8, 0xc}, {0x2, 0x1, 0x3, 0xc, 0x1, 0x2c3}, {0x1000, 0x3, 0xbc, 0x8001, 0xfa, 0x8}, {0x2, 0x3, 0x9, 0x50e, 0x55ac, 0xa5e2}, {0x0, 0x196680, 0xffffff91, 0xfd, 0x3, 0x7}, {0x4, 0x4, 0x2, 0x1, 0x0, 0xe}, {0xfffffff5, 0x8, 0x7023, 0x8, 0x5, 0x851}, {0x3, 0x78, 0x7, 0xa, 0x5dec4cac, 0x6}, {0x4, 0x9, 0x3a, 0x2, 0x8, 0x602}, {0x4, 0x7fffffff, 0x8, 0x8, 0x8, 0xff}, {0x7, 0xfffffff1, 0x2f2c, 0x400, 0x6, 0x6}, {0x10001, 0x81, 0x40, 0x2, 0x85, 0x2}, {0x2, 0x8550, 0x4c, 0x3, 0xfffffffa, 0x736d}, {0x7f, 0x199, 0x5, 0x9, 0x7, 0x2}, {0x7, 0x1, 0x8, 0x7, 0x2, 0x7}, {0x9, 0x3f1, 0x4, 0x5, 0x5, 0x8}, {0x100, 0x3ff, 0x0, 0x7f53, 0x7, 0x1}, {0x3ff, 0xc, 0x4, 0x1, 0x4, 0x4}, {0x9, 0x381, 0xfff, 0x5d7c, 0x0, 0x8001}, {0x8, 0x0, 0x7, 0xfffffffb, 0x3ee, 0x4}, {0xbfffffe, 0x6, 0x101, 0x5, 0x400, 0x8000400}, {0x7fff, 0xb3, 0x2, 0x10000, 0x6, 0x14}, {0x0, 0x1, 0x4c90, 0x4, 0x2000007f, 0x8}, {0x5, 0x25b, 0x0, 0x3, 0x2, 0x2}, {0x29dbdf0, 0xd, 0xfffffffd, 0x7, 0x6, 0x3}, {0x7, 0x1, 0xa, 0x8, 0x5, 0x5}, {0x473, 0x8, 0x2, 0x400, 0x4000000, 0x69b3d6e6}, {0x1, 0xb7bb, 0x22800000, 0x3, 0x10, 0x5}, {0x7f, 0x7, 0x6, 0xffffffff, 0x3, 0x8}, {0xfffffff7, 0x5, 0xa, 0x40, 0x863, 0x2}, {0xb, 0x9, 0xc, 0x3c1, 0x6e, 0x40}, {0x6, 0xd, 0x6, 0xfb0000, 0x1, 0x7}, {0xe0, 0x100, 0x1, 0xb, 0x8, 0x7}, {0xffc, 0x1, 0x0, 0x38, 0x0, 0x9}, {0x82, 0x10, 0x401, 0x0, 0x4, 0xef}, {0x7, 0x2, 0x200, 0x8, 0x9, 0x2}, {0x54, 0x5, 0xa33f, 0x101, 0x2, 0x10001}, {0x1, 0x4, 0x800004, 0x10001, 0x2, 0xce}, {0x4, 0x8, 0x8, 0x3, 0xf, 0x9}, {0x6, 0x5, 0x8, 0xffffffff, 0x405b9, 0x6}, {0x9, 0x0, 0x9, 0x2, 0x9}, {0x0, 0x2, 0xb, 0x7fffffff, 0xfc0, 0x7f1b4893}, {0x4, 0xd, 0x3, 0x4, 0x7, 0x7}, {0x4, 0x5, 0xe, 0x3, 0x3dcb, 0x9}, {0x200, 0x0, 0xe8, 0x1, 0x800000d4, 0x1}, {0xc651, 0x5f83, 0x2, 0x1, 0xd, 0x8}, {0xfff, 0x5, 0x1, 0x0, 0x49, 0x5}, {0x5, 0x3, 0x7, 0x97fd, 0xef, 0x202}, {0x2, 0xa, 0x1000, 0x1, 0x6, 0xe0}, {0x800, 0x4c, 0x7, 0x0, 0xfffffff7, 0x9}, {0x6, 0xffff, 0xffff8001, 0xa, 0xae36, 0x36b6800}, {0xcfb7, 0x0, 0x101, 0x2, 0x1, 0xaa82}, {0x6, 0x800, 0xec3d, 0xffffffff, 0xea5, 0x3}, {0x9, 0x5, 0x2, 0x0, 0x0, 0xdd}, {0x6, 0x6, 0x0, 0x1e9, 0x6, 0x1}, {0x3, 0x7, 0x5, 0x3, 0x400, 0x81}, {0x970, 0x100, 0xb2eb, 0x2, 0x3, 0x9}, {0x3, 0x6, 0x8, 0x7, 0xd, 0x474c}, {0xf, 0x101, 0x9a, 0x1000, 0x2, 0xfffffffc}, {0x3, 0x98e, 0x1a5e666b, 0x10, 0x7, 0x9}, {0xfffffffb, 0x3, 0x3, 0x2ee8000, 0x8}, {0x3, 0x2, 0x2, 0x3, 0x3, 0x2}, {0x7, 0x4, 0x1, 0x7, 0x101, 0xef}, {0x70a0, 0x9, 0x425b597f, 0x1, 0x2, 0x7}, {0x6, 0xc000000, 0x402, 0x4, 0x8, 0x5}, {0x3, 0x6, 0x7, 0xfffffff9, 0x0, 0xffffffff}, {0x7, 0x9, 0x8, 0x0, 0x9, 0xd6}, {0x24, 0x10001, 0x6, 0x1, 0x39d6}, {0x401, 0x7d4, 0x9, 0x8000, 0xffff, 0x7}, {0x6, 0x92e4, 0x130, 0x0, 0x4, 0x9}, {0x0, 0x7fff, 0x7, 0x8001, 0x8, 0x5}, {0x7e, 0x800, 0xfffffff9, 0x6, 0x4b64, 0x80000001}, {0x2ad78a25, 0x2, 0x6, 0x6, 0x4, 0x8}, {0x2, 0x9, 0x0, 0x8a7, 0x129, 0xc}, {0x7, 0x2, 0x8, 0x3, 0xe01, 0xf933271}, {0x4a3, 0x4, 0x3, 0x514c, 0xf8a, 0x19}], [{0x1}, {0x4, 0x1}, {}, {0x1}, {0x3}, {0x0, 0x1}, {0x3, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {}, {0x5}, {0x1}, {0x2}, {0x0, 0x1}, {0x1, 0x1}, {}, {0x4}, {}, {0x1, 0x1}, {0x5, 0x1}, {0x5}, {0x3}, {0x5, 0x1}, {}, {0x0, 0x1}, {0x3}, {0x2, 0x1}, {0x4}, {0x5}, {0x5, 0x1}, {0x3, 0x1}, {0x4}, {0x1}, {0x0, 0x1}, {0x3, 0x1}, {0x4}, {0x1}, {0x1, 0x1}, {0x4}, {0x1}, {0x3, 0x1}, {0x1}, {0x3}, {0x2, 0x1}, {0x5, 0x1}, {0x3}, {0x3}, {0x0, 0x1}, {0x3, 0x1}, {0x4}, {0x5, 0x1}, {0x2}, {0x3, 0x1}, {0x5, 0x1}, {0x1}, {0x1}, {0x3}, {0x5, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x4}, {0x5}, {0x1, 0x1}, {}, {0x3, 0x1}, {0x2, 0x1}, {0x5, 0x1}, {0x4}, {0x4, 0x1}, {0x0, 0x1}, {0x2}, {0x5}, {0x9, 0x1}, {0x2, 0x1}, {0x3, 0x1}, {}, {0x3, 0x1}, {}, {0x1, 0x1}, {0x2}, {0x5}, {0x2, 0x1}, {0x6, 0x1}, {0x2, 0x1}, {0x5, 0x1}, {0x3}, {0x3, 0x1}, {0x1}, {0x2}, {0x2}, {0x5}, {0x3, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x2}, {0x1}, {0x1, 0x1}, {0x4, 0x1}, {0x5}, {0x4}, {0x2, 0x1}, {0x3, 0x1}, {0x4}, {0x1}, {0x5, 0x1}, {0x4, 0x1}, {0x3}, {0x3, 0x1}, {0x0, 0x1}, {0x5}, {0x3, 0x1}, {0x4}, {0x5, 0x1}, {0x3}, {0x5, 0x1}, {0x3}, {0x4}, {0x5, 0x1}, {0x3, 0x1}, {0x4}, {0x1, 0x1}, {0x4}, {0x6, 0x1}, {0x5, 0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xeb0}}, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x40}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=@newtfilter={0x8c, 0x2c, 0xd27, 0x30bd25, 0x25df9bfb, {0x0, 0x0, 0x0, 0x0, {0xd, 0xe}, {}, {0x7}}, [@filter_kind_options=@f_route={{0xa}, {0x54, 0x2, [@TCA_ROUTE4_ACT={0x50, 0x6, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0xa, 0x5, 0x4, 0x7, 0x8}, 0x39}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x3}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0x0, 0x3}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x8010}, 0x0) r7 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040), 0x101000, 0x0) io_uring_setup(0x46e4, &(0x7f0000000340)={0x0, 0xc60e, 0x400, 0x1, 0x25c, 0x0, r7}) 10.803236854s ago: executing program 43 (id=3083): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102400, 0x19000) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) umount2(&(0x7f00000002c0)='./file0\x00', 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f00000001c0)=0x3) ioctl$PPPIOCGIDLE(0xffffffffffffffff, 0x8010743f, &(0x7f0000000100)) r1 = socket$nl_generic(0x10, 0x3, 0x10) lsetxattr$security_ima(0x0, 0x0, 0x0, 0x9, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r5 = fcntl$dupfd(r4, 0x406, r3) write$sndseq(r5, &(0x7f0000000200)=[{0x0, 0x2a, 0x0, 0x0, @time={0x7f, 0x4}, {}, {}, @raw32}, {0x0, 0x0, 0x0, 0x7, @tick, {}, {0x0, 0x4}, @addr={0xd1, 0x9}}], 0x38) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r1, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 7.532960796s ago: executing program 7 (id=3115): syz_usb_connect(0x1, 0xfffffffffffffd22, 0x0, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @void}, 0x10) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = eventfd(0xc) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000700)={0x2, 0x0, [{0x2, 0x7f, &(0x7f00000001c0)=""/127}, {0x11000, 0x89, &(0x7f0000000580)=""/137}]}) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f00000002c0)={0x1, r1}) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xf, &(0x7f0000000340)=@ringbuf={{}, {}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) 6.889759988s ago: executing program 7 (id=3116): sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x5) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8041, 0x0) write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000440)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0xf2ffffff) 5.934537757s ago: executing program 7 (id=3118): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="180100"/13], &(0x7f0000000100)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x43, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7fff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x40001e0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) pivot_root(&(0x7f0000000000)='./cgroup\x00', &(0x7f0000000040)='./cgroup\x00') socket$inet6_tcp(0xa, 0x1, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0x84042, 0x0) syz_open_dev$loop(&(0x7f0000000500), 0x47ffffa, 0x60500) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c000000030000000100000000f9000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x20) unshare(0x22020400) memfd_create(&(0x7f00000001c0)='\x00\x00\x00\x00\x00\x00z\x9b\xb6\xe8t;\xfc\x02\x00\x00\x009\xa0\v\x14d\xa2\xa1\xa8!\xe8\xd1\xa0\x8a\xce0\x1c\xb7\xf1\xccm\xce\xd4\xdb\x89\xe5\x8f\xe2\xb6\xd6\x9cF\xbd\xff\x14\x05\x00\x00\x00\x00\x00\x00\x00\xf3\xdc\x91\'\x06\\8\r\xfc\xeeG\xbe\x90C\xd5)5\x98\xa3\xfa\a\xf9\x98\xbb}\xeb\x86P=\xe51\x9d,\xb7\xe6_M\xbe\x19\xea#\xff[\xd1\xc3\x9a\xa3\x1b\xf9\xe9\x1d \xce1\xc9\x9f\xb0\x14\xc2\xeb\xf9\xceE\xad\xa4\x92\f\xef\x87g\xb6\xabW\xac\rP\xf42\xb7\xc8\xaajn\xd7\n\r\x802\xd7\x1b$\x95tO*\xf4\xae\xb8\xb8m\xbf\r\xd5\xbf*\xfd\xc7\x85\x1b\x8b\xe5\x97j`c\xe0\x88?\xda\x8a#t>r\xae\xe8\xc9)', 0x0) gettid() 5.8034016s ago: executing program 0 (id=3119): r0 = socket$inet_udplite(0x2, 0x2, 0x88) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00'}) getsockopt$inet_int(r0, 0x0, 0x16, 0x0, &(0x7f0000000400)) socket(0x10, 0x80002, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x220800, 0x0) socket$l2tp6(0xa, 0x2, 0x73) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0xfffffffffffffffe) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) write$proc_mixer(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB='ALTPCM \'Line Capture\' 00000000000000000000\nLINE2\nDIGITAL3\nSPEAKER \'Synth\' 0000000000C00000aster Playback\' '], 0xf7) 4.864166147s ago: executing program 7 (id=3120): r0 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi1\x00', 0x28444, 0x0) ioctl$KDSKBENT(0xffffffffffffffff, 0x4b47, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000002c0)={'\x00', 0x0, 0x3, 0x7f, 0xa9, 0xfffffffffffffff7}) read$msr(r1, &(0x7f000001b000)=""/102400, 0x19000) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) sendmsg(r2, &(0x7f00000012c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000ec0)}, 0x20040004) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000080)={'c6xdigio\x00', [0x401, 0x181, 0x2, 0x3, 0x14000000, 0x0, 0xfffffffc, 0x2, 0xffd, 0x7ffe, 0x3, 0x9, 0x404, 0x2, 0x8000013, 0xa7, 0xffffffa7, 0x8000b, 0x34d, 0x6e, 0x0, 0x4000009, 0x200, 0xe2df, 0x9, 0x20000001, 0x4, 0x505e, 0x7, 0xf58, 0x6]}) r3 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) ioctl$UFFDIO_WAKE(0xffffffffffffffff, 0x8010aa02, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, 0x0, 0x94) openat$nvram(0xffffffffffffff9c, 0x0, 0x41703, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={0xffffffffffffffff, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r5, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000640)={0x6, 0x3, &(0x7f0000000980)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', r6}, 0x94) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000380)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x2, '\x00', r6, 0xffffffffffffffff, 0x0, 0x5}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x0, 0x0, 0x0, 0x8, 0x29, &(0x7f00000001c0)=""/41, 0x41000, 0x18, '\x00', 0x0, 0x25, r3, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000300)={0x4, 0xb, 0x7f, 0x5}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xf51}, 0x94) 4.118945201s ago: executing program 7 (id=3121): r0 = syz_open_dev$vim2m(&(0x7f0000000300), 0x1b8, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1, 0x0, 0x4}) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000000)=0x1) close(r0) socket$packet(0x11, 0x3, 0x300) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$DRM_IOCTL_MODE_GETFB(r1, 0xc01c64ad, &(0x7f0000000240)) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/pm_wakeup_irq', 0x2, 0x0) write$FUSE_NOTIFY_STORE(r4, 0x0, 0x28) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x34) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) add_key$user(&(0x7f00000002c0), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000280), 0x0, 0xfffffffffffffffe) add_key$user(0x0, &(0x7f0000000440), 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0xfffffffffffffffe) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) newfstatat(0xffffffffffffff9c, 0x0, &(0x7f0000000300), 0x100) add_key$user(0x0, 0x0, &(0x7f0000000540), 0x0, 0xfffffffffffffffe) add_key$user(&(0x7f0000000040), &(0x7f0000000440), &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x20080, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$PIO_UNIMAPCLR(r6, 0x4b68, 0x0) ioctl$KDSETMODE(r6, 0x4b45, 0x1) ioctl$TIOCL_SETSEL(r6, 0x541c, &(0x7f00000000c0)={0x2, {0x2, 0x0, 0x2fd, 0xffff, 0x101, 0x300}}) ioctl$KVM_SET_CPUID2(r3, 0x4048aecb, &(0x7f0000000180)={0x4, 0x0, [{0x0, 0x0, 0x0, 0x6}, {0x0, 0x6}, {0x5e2796afef1a2f31, 0xffffffff, 0x0, 0x9, 0x1, 0x80000001, 0x8}, {0x80000001, 0xffffffff, 0x7, 0x8, 0x5, 0x110, 0x3}]}) 3.262417208s ago: executing program 0 (id=3122): socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r0 = syz_open_dev$MSR(0x0, 0x0, 0x0) syz_open_dev$sg(0x0, 0x0, 0x2000) read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8) msgget(0x0, 0x40) mount(&(0x7f0000000040)=@nullb, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='ntfs3\x00', 0x1000080, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) 3.089641591s ago: executing program 0 (id=3123): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x4, 0x0, &(0x7f0000000100)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x43, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7fff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x40001e0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) pivot_root(&(0x7f0000000000)='./cgroup\x00', &(0x7f0000000040)='./cgroup\x00') socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, 0x0, 0x0) r4 = syz_open_dev$dri(0x0, 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r4, 0xc01064b5, 0x0) openat$vcsa(0xffffffffffffff9c, 0x0, 0x800, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0x84042, 0x0) syz_open_dev$loop(&(0x7f0000000500), 0x47ffffa, 0x60500) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c000000030000000100000000f9000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x20) unshare(0x22020400) r5 = memfd_create(&(0x7f00000001c0)='\x00\x00\x00\x00\x00\x00z\x9b\xb6\xe8t;\xfc\x02\x00\x00\x009\xa0\v\x14d\xa2\xa1\xa8!\xe8\xd1\xa0\x8a\xce0\x1c\xb7\xf1\xccm\xce\xd4\xdb\x89\xe5\x8f\xe2\xb6\xd6\x9cF\xbd\xff\x14\x05\x00\x00\x00\x00\x00\x00\x00\xf3\xdc\x91\'\x06\\8\r\xfc\xeeG\xbe\x90C\xd5)5\x98\xa3\xfa\a\xf9\x98\xbb}\xeb\x86P=\xe51\x9d,\xb7\xe6_M\xbe\x19\xea#\xff[\xd1\xc3\x9a\xa3\x1b\xf9\xe9\x1d \xce1\xc9\x9f\xb0\x14\xc2\xeb\xf9\xceE\xad\xa4\x92\f\xef\x87g\xb6\xabW\xac\rP\xf42\xb7\xc8\xaajn\xd7\n\r\x802\xd7\x1b$\x95tO*\xf4\xae\xb8\xb8m\xbf\r\xd5\xbf*\xfd\xc7\x85\x1b\x8b\xe5\x97j`c\xe0\x88?\xda\x8a#t>r\xae\xe8\xc9)', 0x0) gettid() execveat(r5, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) 2.827391556s ago: executing program 7 (id=3124): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, 0x0) pread64(r0, &(0x7f000001a240)=""/102400, 0x19000, 0x100008) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x8000002000000, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) open(&(0x7f0000000000)='./bus\x00', 0x1a1043, 0xc5) syz_open_dev$MSR(&(0x7f00000002c0), 0x31, 0x0) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(r2, 0x40045402, &(0x7f0000000140)=0x1) read(r2, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f00000083c0)={{0x1}}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r3}, 0x18) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r4}, 0x18) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000200)="2e0400001c008102e00f80ecdb4cb9f207c8", 0x12}], 0x1, 0x0, 0x0, 0x5865}, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r2, 0x54a2) mount(&(0x7f0000000900)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='squashfs\x00', 0x1408009, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000a00)={0x11, 0x14, &(0x7f0000000340)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000181100", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x42, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r6}, 0x10) r7 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000000)=ANY=[@ANYBLOB="380000000314010000000000000000000900020073797a2f000000000800410072786500140033007465616d5f736c6176655f30"], 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x8844) syz_init_net_socket$llc(0x1a, 0x802, 0x0) 2.137734839s ago: executing program 0 (id=3125): sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x5) r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8041, 0x0) write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000440)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0xf2ffffff) 1.141905318s ago: executing program 0 (id=3126): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsopen(&(0x7f0000000500)='ramfs\x00', 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000001c0)=@generic={&(0x7f0000000180)='./file1/file0/file0\x00', 0x0, 0x18}, 0x18) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x40000, 0x120) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) r4 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x888000, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r4, 0xc018937c, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r3, {0x1}}, './file0\x00'}) 0s ago: executing program 0 (id=3127): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="180100"/13], &(0x7f0000000100)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x43, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7fff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x40001e0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) pivot_root(&(0x7f0000000000)='./cgroup\x00', &(0x7f0000000040)='./cgroup\x00') socket$inet6_tcp(0xa, 0x1, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0x84042, 0x0) syz_open_dev$loop(&(0x7f0000000500), 0x47ffffa, 0x60500) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c000000030000000100000000f9000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x20) unshare(0x22020400) memfd_create(&(0x7f00000001c0)='\x00\x00\x00\x00\x00\x00z\x9b\xb6\xe8t;\xfc\x02\x00\x00\x009\xa0\v\x14d\xa2\xa1\xa8!\xe8\xd1\xa0\x8a\xce0\x1c\xb7\xf1\xccm\xce\xd4\xdb\x89\xe5\x8f\xe2\xb6\xd6\x9cF\xbd\xff\x14\x05\x00\x00\x00\x00\x00\x00\x00\xf3\xdc\x91\'\x06\\8\r\xfc\xeeG\xbe\x90C\xd5)5\x98\xa3\xfa\a\xf9\x98\xbb}\xeb\x86P=\xe51\x9d,\xb7\xe6_M\xbe\x19\xea#\xff[\xd1\xc3\x9a\xa3\x1b\xf9\xe9\x1d \xce1\xc9\x9f\xb0\x14\xc2\xeb\xf9\xceE\xad\xa4\x92\f\xef\x87g\xb6\xabW\xac\rP\xf42\xb7\xc8\xaajn\xd7\n\r\x802\xd7\x1b$\x95tO*\xf4\xae\xb8\xb8m\xbf\r\xd5\xbf*\xfd\xc7\x85\x1b\x8b\xe5\x97j`c\xe0\x88?\xda\x8a#t>r\xae\xe8\xc9)', 0x0) gettid() kernel console output (not intermixed with test programs): , 0] type 2 family 0 port 6081 - 0 [ 732.174806][ T28] audit: type=1326 audit(1759356517.888:2322): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11560 comm="syz.3.1225" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fe4af58eec9 code=0x7ffc0000 [ 732.355880][ T28] audit: type=1326 audit(1759356517.888:2323): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11560 comm="syz.3.1225" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4af58eec9 code=0x7ffc0000 [ 732.409085][ T28] audit: type=1326 audit(1759356517.888:2324): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11560 comm="syz.3.1225" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4af58eec9 code=0x7ffc0000 [ 732.740858][ T28] audit: type=1326 audit(1759356517.888:2325): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11560 comm="syz.3.1225" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fe4af58eec9 code=0x7ffc0000 [ 732.861725][ T28] audit: type=1326 audit(1759356517.888:2326): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11560 comm="syz.3.1225" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4af58eec9 code=0x7ffc0000 [ 732.943749][ T28] audit: type=1326 audit(1759356517.888:2327): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11560 comm="syz.3.1225" exe="/root/syz-executor" sig=0 arch=c000003e syscall=186 compat=0 ip=0x7fe4af58eec9 code=0x7ffc0000 [ 732.966246][ C1] vkms_vblank_simulate: vblank timer overrun [ 732.974662][ T28] audit: type=1326 audit(1759356517.888:2328): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11560 comm="syz.3.1225" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4af58eec9 code=0x7ffc0000 [ 733.053752][ T28] audit: type=1326 audit(1759356517.898:2329): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11560 comm="syz.3.1225" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4af58eec9 code=0x7ffc0000 [ 733.460749][ T5801] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 733.477531][ T5801] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 733.491006][ T5801] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 733.507590][ T5801] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 733.518514][ T5801] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 733.527273][ T5801] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 733.586512][T11586] binder: 11578:11586 ioctl c0306201 0 returned -14 [ 733.705711][T11583] lo speed is unknown, defaulting to 1000 [ 734.542623][T11583] chnl_net:caif_netlink_parms(): no params data found [ 735.518474][T11619] cgroup: subsys name conflicts with all [ 735.623522][ T5801] Bluetooth: hci2: command tx timeout [ 736.763849][T11583] bridge0: port 1(bridge_slave_0) entered blocking state [ 736.805262][T11583] bridge0: port 1(bridge_slave_0) entered disabled state [ 736.812584][T11583] bridge_slave_0: entered allmulticast mode [ 736.905872][T11583] bridge_slave_0: entered promiscuous mode [ 737.702618][ T5801] Bluetooth: hci2: command tx timeout [ 737.824489][T11583] bridge0: port 2(bridge_slave_1) entered blocking state [ 737.850253][T11583] bridge0: port 2(bridge_slave_1) entered disabled state [ 737.902265][T11583] bridge_slave_1: entered allmulticast mode [ 737.919717][T11583] bridge_slave_1: entered promiscuous mode [ 738.069253][T11634] syz_tun (unregistering): left promiscuous mode [ 738.207491][T11642] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 738.224904][T11583] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 738.322159][T11583] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 738.566810][T11583] team0: Port device team_slave_0 added [ 738.595738][T11583] team0: Port device team_slave_1 added [ 738.807135][T11583] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 738.826913][T11583] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 738.853045][ C1] vkms_vblank_simulate: vblank timer overrun [ 738.928197][T11583] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 738.953933][T11583] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 738.961032][T11583] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 739.088841][T11583] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 739.131554][ T1124] hsr_slave_0: left promiscuous mode [ 739.156628][ T1124] hsr_slave_1: left promiscuous mode [ 739.168727][ T1124] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 739.246622][ T1124] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 739.345066][T11649] cgroup: subsys name conflicts with all [ 739.704617][ T1124] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 739.793779][ T5801] Bluetooth: hci2: command tx timeout [ 739.819198][ T1124] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 739.864443][ T1124] bridge_slave_1: left allmulticast mode [ 739.879257][ T1124] bridge_slave_1: left promiscuous mode [ 739.895578][ T1124] bridge0: port 2(bridge_slave_1) entered disabled state [ 739.918421][ T1124] bridge_slave_0: left allmulticast mode [ 739.935947][ T1124] bridge_slave_0: left promiscuous mode [ 739.954535][ T1124] bridge0: port 1(bridge_slave_0) entered disabled state [ 740.043487][ T1124] veth1_macvtap: left promiscuous mode [ 740.049274][ T1124] veth0_macvtap: left promiscuous mode [ 740.058038][ T1124] veth1_vlan: left promiscuous mode [ 740.063787][ T1124] veth0_vlan: left promiscuous mode [ 740.105284][ T5801] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 740.126155][ T5801] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 740.139556][ T5801] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 740.151975][ T5801] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 740.165133][ T5801] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 740.182766][ T5801] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 741.819638][T11666] binder: 11664:11666 ioctl c0306201 0 returned -14 [ 741.859037][ T5801] Bluetooth: hci2: command tx timeout [ 742.253540][ T5801] Bluetooth: hci3: command tx timeout [ 742.574790][ T1124] team0 (unregistering): Port device team_slave_1 removed [ 742.720330][ T1124] team0 (unregistering): Port device team_slave_0 removed [ 742.855473][ T1124] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 743.032721][ T1124] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 743.424213][T11671] binder: 11669:11671 ioctl c0306201 0 returned -14 [ 744.344001][ T5801] Bluetooth: hci3: command tx timeout [ 746.413479][ T5801] Bluetooth: hci3: command tx timeout [ 746.693836][T11678] cgroup: subsys name conflicts with all [ 746.846698][ T1124] bond0 (unregistering): Released all slaves [ 747.138646][T11583] hsr_slave_0: entered promiscuous mode [ 747.189447][T11583] hsr_slave_1: entered promiscuous mode [ 747.196680][T11583] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 747.210780][T11583] Cannot create hsr debugfs directory [ 747.468183][ T1285] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.833955][ T1285] ieee802154 phy1 wpan1: encryption failed: -22 [ 748.284664][T11656] lo speed is unknown, defaulting to 1000 [ 748.512827][ T5801] Bluetooth: hci3: command tx timeout [ 748.628208][T11688] binder: 11686:11688 ioctl c0306201 0 returned -14 [ 749.710882][ T55] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 750.152030][ T55] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 750.352976][ T55] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 750.603163][ T55] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 750.797956][T11656] chnl_net:caif_netlink_parms(): no params data found [ 750.982536][T11583] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 751.053716][T11583] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 751.071360][T11583] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 751.091317][T11704] binder: 11700:11704 ioctl c0306201 0 returned -14 [ 751.152650][T11656] bridge0: port 1(bridge_slave_0) entered blocking state [ 751.165766][T11656] bridge0: port 1(bridge_slave_0) entered disabled state [ 751.175704][T11656] bridge_slave_0: entered allmulticast mode [ 751.189619][T11656] bridge_slave_0: entered promiscuous mode [ 751.218550][T11583] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 751.320059][T11656] bridge0: port 2(bridge_slave_1) entered blocking state [ 751.344414][T11656] bridge0: port 2(bridge_slave_1) entered disabled state [ 751.357969][T11656] bridge_slave_1: entered allmulticast mode [ 751.381962][T11656] bridge_slave_1: entered promiscuous mode [ 751.622067][T11709] cgroup: subsys name conflicts with all [ 751.700001][T11656] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 751.749985][T11656] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 751.781792][ T55] tipc: Left network mode [ 751.917805][T11656] team0: Port device team_slave_0 added [ 751.939875][T11656] team0: Port device team_slave_1 added [ 752.043071][T11656] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 752.050866][T11656] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 752.078143][T11656] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 752.121672][T11656] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 752.129745][T11656] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 752.158786][T11656] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 753.465371][T11656] hsr_slave_0: entered promiscuous mode [ 753.480254][T11656] hsr_slave_1: entered promiscuous mode [ 753.487414][T11656] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 753.495982][T11656] Cannot create hsr debugfs directory [ 754.371716][ T55] dvmrp0 (unregistering): left allmulticast mode [ 754.468816][T11583] 8021q: adding VLAN 0 to HW filter on device bond0 [ 754.718884][T11583] 8021q: adding VLAN 0 to HW filter on device team0 [ 754.764483][ T2949] bridge0: port 1(bridge_slave_0) entered blocking state [ 754.771660][ T2949] bridge0: port 1(bridge_slave_0) entered forwarding state [ 754.851271][T11724] binder: 11722:11724 ioctl c0306201 0 returned -14 [ 755.149825][ T2949] bridge0: port 2(bridge_slave_1) entered blocking state [ 755.157035][ T2949] bridge0: port 2(bridge_slave_1) entered forwarding state [ 756.642159][T11736] cgroup: subsys name conflicts with all [ 756.948145][ T55] batadv_slave_0: left promiscuous mode [ 757.001251][ T55] hsr_slave_0: left promiscuous mode [ 757.170062][ T55] hsr_slave_1: left promiscuous mode [ 757.181036][ T55] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 757.191242][ T55] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 757.983456][ T55] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 758.123748][ T55] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 758.204474][ T55] bridge_slave_1: left allmulticast mode [ 758.210337][ T55] bridge_slave_1: left promiscuous mode [ 758.233008][ T55] bridge0: port 2(bridge_slave_1) entered disabled state [ 758.311885][ T55] bridge0: port 1(bridge_slave_0) entered disabled state [ 758.536458][ T55] veth1_macvtap: left promiscuous mode [ 759.383602][ T55] veth0_macvtap: left promiscuous mode [ 759.400218][ T55] veth1_vlan: left promiscuous mode [ 760.246026][ T55] infiniband syz!: set down [ 761.190531][ T55] team0 (unregistering): Port device team_slave_1 removed [ 761.254156][ T55] team0 (unregistering): Port device team_slave_0 removed [ 761.268184][ T11] smc: removing ib device syz! [ 761.327728][ T55] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 761.411466][ T55] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 762.219821][T11759] ptrace attach of "./syz-executor exec"[11227] was attempted by ""[11759] [ 762.801258][ T55] bond0 (unregistering): Released all slaves [ 763.043463][ T8520] lo speed is unknown, defaulting to 1000 [ 763.482497][T11768] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 763.877225][T11770] syz.8.1299: attempt to access beyond end of device [ 763.877225][T11770] nbd8: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 763.924138][T11770] SQUASHFS error: Failed to read block 0x0: -5 [ 763.964769][T11770] unable to read squashfs_super_block [ 764.001289][T11771] (null): rxe_set_mtu: Set mtu to 1024 [ 764.030444][T11771] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 764.107732][T11763] netlink: 830 bytes leftover after parsing attributes in process `syz.8.1299'. [ 764.269443][T11656] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 764.367455][T11656] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 764.606258][T11656] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 764.621844][T11656] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 765.550459][T11583] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 765.815901][T11583] veth0_vlan: entered promiscuous mode [ 765.966443][T11656] 8021q: adding VLAN 0 to HW filter on device bond0 [ 765.998496][T11583] veth1_vlan: entered promiscuous mode [ 766.151701][T11656] 8021q: adding VLAN 0 to HW filter on device team0 [ 766.274797][ T34] bridge0: port 1(bridge_slave_0) entered blocking state [ 766.282062][ T34] bridge0: port 1(bridge_slave_0) entered forwarding state [ 766.363056][T11583] veth0_macvtap: entered promiscuous mode [ 766.424249][T11583] veth1_macvtap: entered promiscuous mode [ 766.498567][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 766.505841][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 766.574550][T11583] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 766.589791][T11583] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 766.600696][T11583] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 766.612420][T11583] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 766.893039][T11583] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 766.908456][T11583] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 766.925643][T11583] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 766.937979][T11583] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 766.948778][T11583] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 766.961374][T11583] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 767.052165][T11583] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 767.067942][T11583] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 767.078428][T11583] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 767.089554][T11791] cgroup: subsys name conflicts with all [ 767.096436][T11583] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 767.434231][ T55] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 767.466563][ T55] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 767.532666][ T7579] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 767.565585][ T7579] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 768.221076][T11802] kernel profiling enabled (shift: 17) [ 769.041178][T11656] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 769.207737][T11656] veth0_vlan: entered promiscuous mode [ 769.273886][T11656] veth1_vlan: entered promiscuous mode [ 769.420117][T11656] veth0_macvtap: entered promiscuous mode [ 769.885476][T11656] veth1_macvtap: entered promiscuous mode [ 769.957767][T11656] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 769.987461][T11656] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 770.006193][T11656] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 770.045657][T11656] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 770.060534][T11656] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 770.071124][T11656] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 770.083209][T11656] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 770.095552][T11656] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 770.223472][T11656] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 770.243677][T11656] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 770.266027][T11656] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 770.306179][T11656] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 770.401876][T11656] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 770.905596][T11656] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 770.954314][T11656] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 771.004546][T11656] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 771.043514][T11656] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 771.127345][T11656] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 772.337212][ T34] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 772.381476][ T34] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 773.168439][ T55] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 773.230275][ T55] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 774.279409][T11845] overlayfs: missing 'lowerdir' [ 778.394426][T11882] syz.1.1321 (11882) used greatest stack depth: 17960 bytes left [ 778.599558][T11884] binder: 11873:11884 ioctl c0306201 0 returned -14 [ 779.898567][T11902] overlayfs: missing 'lowerdir' [ 784.483197][T11951] binder: 11949:11951 ioctl c0306201 0 returned -14 [ 784.895038][T11961] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 785.132093][T11962] trusted_key: syz.3.1332 sent an empty control message without MSG_MORE. [ 785.941241][T11967] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 787.647358][T11977] overlayfs: missing 'lowerdir' [ 788.103931][ T967] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 788.415496][ T967] usb 2-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 788.436308][ T967] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 788.463685][ T967] usb 2-1: Product: syz [ 788.482128][ T967] usb 2-1: Manufacturer: syz [ 788.498294][ T967] usb 2-1: SerialNumber: syz [ 788.527072][ T967] usb 2-1: config 0 descriptor?? [ 788.793292][ T967] usb-storage 2-1:0.0: USB Mass Storage device detected [ 788.852980][T12000] binder: 11999:12000 ioctl c0306201 0 returned -14 [ 789.144315][T11986] tipc: Started in network mode [ 789.160254][T11986] tipc: Node identity a66717f1d3ba, cluster identity 4711 [ 789.213841][T11986] tipc: Enabled bearer , priority 0 [ 789.271993][T12009] syzkaller0: entered promiscuous mode [ 789.293034][T12009] syzkaller0: entered allmulticast mode [ 789.491099][T11986] tipc: Resetting bearer [ 790.168301][T12026] netlink: 830 bytes leftover after parsing attributes in process `syz.0.1344'. [ 790.203636][ T967] tipc: Node number set to 1977423857 [ 790.213197][T12026] syz.0.1344: attempt to access beyond end of device [ 790.213197][T12026] nbd0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 790.253029][T12026] SQUASHFS error: Failed to read block 0x0: -5 [ 790.265534][T12026] unable to read squashfs_super_block [ 790.276667][T12027] (null): rxe_set_mtu: Set mtu to 1024 [ 790.976097][ T5801] Bluetooth: hci3: command 0x0405 tx timeout [ 791.427999][T12027] infiniband syz!: set active [ 791.433460][T12027] infiniband syz!: added team_slave_0 [ 791.457578][T12027] syz!: rxe_create_cq: returned err = -12 [ 791.469851][T12027] infiniband syz!: Couldn't create ib_mad CQ [ 791.543547][T12027] infiniband syz!: Couldn't open port 1 [ 791.625957][T12027] RDS/IB: syz!: added [ 791.630107][T12027] smc: adding ib device syz! with port count 1 [ 791.664373][T12027] smc: ib device syz! port 1 has pnetid [ 793.167435][T11985] tipc: Resetting bearer [ 793.217945][T11985] tipc: Disabling bearer [ 793.280093][ T967] usb 2-1: USB disconnect, device number 13 [ 794.293378][T12059] vivid-003: kernel_thread() failed [ 794.619402][T12067] binder: 12065:12067 ioctl c0306201 0 returned -14 [ 798.880220][T12115] binder: 12114:12115 ioctl c0306201 0 returned -14 [ 802.163361][ T28] kauditd_printk_skb: 61 callbacks suppressed [ 802.163380][ T28] audit: type=1326 audit(1759356587.968:2391): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12152 comm="syz.0.1367" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f8ced18eec9 code=0x0 [ 802.273714][T12164] binder: 12163:12164 ioctl c0306201 0 returned -14 [ 802.421290][T12167] binder: 12165:12167 ioctl c0306201 0 returned -14 [ 805.196787][T12199] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 806.494419][T12214] binder: 12213:12214 ioctl c0306201 0 returned -14 [ 806.695377][T12219] netlink: 24 bytes leftover after parsing attributes in process `syz.8.1380'. [ 806.812172][T12221] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1380'. [ 808.900829][ T1285] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.907431][ T1285] ieee802154 phy1 wpan1: encryption failed: -22 [ 809.463796][ T5777] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 809.861161][ T5777] usb 9-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 809.981588][ T5777] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 810.219880][ T5777] usb 9-1: Product: syz [ 810.224269][ T5777] usb 9-1: Manufacturer: syz [ 810.229056][ T5777] usb 9-1: SerialNumber: syz [ 810.236020][ T5777] usb 9-1: config 0 descriptor?? [ 810.460321][ T5777] usb-storage 9-1:0.0: USB Mass Storage device detected [ 810.853206][T12250] tipc: Started in network mode [ 810.858451][T12250] tipc: Node identity 6ada8a2a2989, cluster identity 4711 [ 810.866504][T12250] tipc: Enabled bearer , priority 0 [ 810.880483][T12250] syzkaller0: entered promiscuous mode [ 810.894942][T12250] syzkaller0: entered allmulticast mode [ 810.928595][T12250] tipc: Resetting bearer [ 811.857860][T12277] binder: 12276:12277 ioctl c0306201 0 returned -14 [ 811.933564][ T5795] tipc: Node number set to 1129548330 [ 812.058413][T12280] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 812.763367][T12248] tipc: Resetting bearer [ 812.802517][T12248] tipc: Disabling bearer [ 813.078781][ T5777] usb 9-1: USB disconnect, device number 2 [ 813.351409][T12297] team_slave_0: entered promiscuous mode [ 813.357199][T12297] team_slave_1: entered promiscuous mode [ 813.393783][T12297] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 813.654016][T12298] vivid-003: kernel_thread() failed [ 818.515063][T12354] team_slave_0: entered promiscuous mode [ 818.521822][T12354] team_slave_1: entered promiscuous mode [ 818.542141][T12354] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 826.037389][ T5801] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 826.055175][ T5801] CPU: 0 PID: 5801 Comm: kworker/u5:5 Not tainted syzkaller #0 [ 826.062805][ T5801] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 826.072908][ T5801] Workqueue: hci3 hci_rx_work [ 826.077656][ T5801] Call Trace: [ 826.080943][ T5801] [ 826.083883][ T5801] dump_stack_lvl+0x16c/0x230 [ 826.088584][ T5801] ? show_regs_print_info+0x20/0x20 [ 826.093793][ T5801] ? load_image+0x3b0/0x3b0 [ 826.098309][ T5801] sysfs_create_dir_ns+0x256/0x280 [ 826.103446][ T5801] ? hci_rx_work+0x43a/0xd80 [ 826.108085][ T5801] ? sysfs_warn_dup+0xa0/0xa0 [ 826.112782][ T5801] ? do_raw_spin_unlock+0x121/0x230 [ 826.117999][ T5801] kobject_add_internal+0x6b8/0xc70 [ 826.123257][ T5801] kobject_add+0x156/0x220 [ 826.127704][ T5801] ? __rwlock_init+0x150/0x150 [ 826.132480][ T5801] ? kobject_init+0x1e0/0x1e0 [ 826.137190][ T5801] ? _raw_spin_unlock+0x28/0x40 [ 826.142049][ T5801] ? get_device_parent+0x366/0x390 [ 826.147176][ T5801] device_add+0x408/0xc20 [ 826.151525][ T5801] hci_conn_add_sysfs+0xd5/0x1e0 [ 826.156508][ T5801] le_conn_complete_evt+0xc37/0x1220 [ 826.161869][ T5801] ? hci_event_packet+0x4a7/0x1210 [ 826.167008][ T5801] ? trace_contention_end+0x39/0xe0 [ 826.172236][ T5801] ? hci_le_big_info_adv_report_evt+0x8e0/0x8e0 [ 826.178585][ T5801] ? __copy_skb_header+0xa7/0x550 [ 826.183650][ T5801] ? __mutex_unlock_slowpath+0x1a2/0x6a0 [ 826.189310][ T5801] ? skb_pull_data+0xfb/0x200 [ 826.194007][ T5801] hci_le_conn_complete_evt+0x187/0x440 [ 826.199571][ T5801] ? hci_remote_host_features_evt+0x160/0x160 [ 826.205665][ T5801] hci_event_packet+0x795/0x1210 [ 826.210633][ T5801] ? bis_list+0x290/0x290 [ 826.214981][ T5801] ? lockdep_hardirqs_on+0x98/0x150 [ 826.220200][ T5801] ? hci_send_to_monitor+0xd7/0x4f0 [ 826.225414][ T5801] hci_rx_work+0x43a/0xd80 [ 826.230144][ T5801] ? process_scheduled_works+0x957/0x15b0 [ 826.235877][ T5801] process_scheduled_works+0xa45/0x15b0 [ 826.241459][ T5801] ? assign_work+0x400/0x400 [ 826.246067][ T5801] ? assign_work+0x39e/0x400 [ 826.250670][ T5801] worker_thread+0xa55/0xfc0 [ 826.255293][ T5801] kthread+0x2fa/0x390 [ 826.259366][ T5801] ? pr_cont_work+0x560/0x560 [ 826.264062][ T5801] ? kthread_blkcg+0xd0/0xd0 [ 826.268658][ T5801] ret_from_fork+0x48/0x80 [ 826.273094][ T5801] ? kthread_blkcg+0xd0/0xd0 [ 826.277704][ T5801] ret_from_fork_asm+0x11/0x20 [ 826.282493][ T5801] [ 826.290953][ T5801] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 826.305250][ T5801] Bluetooth: hci3: failed to register connection device [ 826.316355][ T5801] Bluetooth: hci3: unexpected event for opcode 0x1004 [ 826.340712][ T9536] Bluetooth: hci1: command 0x0406 tx timeout [ 828.342243][T11277] Bluetooth: hci3: command 0x0405 tx timeout [ 830.354782][ T9536] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 830.364090][ T9536] Bluetooth: hci3: Injecting HCI hardware error event [ 830.377785][ T9536] Bluetooth: hci3: hardware error 0x00 [ 832.461709][T12478] netlink: 'syz.3.1428': attribute type 4 has an invalid length. [ 832.493579][ T9536] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 833.995722][T12492] team_slave_0: entered promiscuous mode [ 834.001435][T12492] team_slave_1: entered promiscuous mode [ 834.008201][T12492] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 834.607798][T12496] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 836.573708][T11277] Bluetooth: hci0: command 0x0406 tx timeout [ 840.431403][T12556] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 840.852579][T12566] overlayfs: missing 'lowerdir' [ 846.234005][T12602] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 846.779998][ T28] audit: type=1326 audit(1759356632.588:2392): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12604 comm="syz.8.1451" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fc0acd8eec9 code=0x0 [ 848.588693][T12626] overlayfs: missing 'lowerdir' [ 852.835908][T12666] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 855.162058][ T28] audit: type=1326 audit(1759356640.918:2393): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12683 comm="syz.1.1466" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f58dcd8eec9 code=0x0 [ 855.954627][T12695] vivid-001: kernel_thread() failed [ 857.278932][T11277] Bluetooth: hci2: command 0x0406 tx timeout [ 859.413308][T12724] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 859.505736][T12726] vivid-002: kernel_thread() failed [ 861.601807][T12753] vivid-002: kernel_thread() failed [ 863.261282][T12770] random: crng reseeded on system resumption [ 864.744074][T12791] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 866.616769][T12810] vivid-001: kernel_thread() failed [ 869.323766][T12840] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 869.523316][T12841] vivid-003: kernel_thread() failed [ 870.343892][ T1285] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.350393][ T1285] ieee802154 phy1 wpan1: encryption failed: -22 [ 871.459823][T12867] overlayfs: missing 'lowerdir' [ 880.768665][T12945] vlan0: entered promiscuous mode [ 881.338540][T12963] cgroup: subsys name conflicts with all [ 884.120305][T12991] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 887.893061][T13038] cgroup: subsys name conflicts with all [ 890.887065][T13065] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 891.306527][T13072] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 893.429236][T13093] netlink: 830 bytes leftover after parsing attributes in process `syz.8.1542'. [ 893.535708][T13093] syz.8.1542: attempt to access beyond end of device [ 893.535708][T13093] nbd8: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 893.578400][T13093] SQUASHFS error: Failed to read block 0x0: -5 [ 893.616091][T13093] unable to read squashfs_super_block [ 893.702131][T13093] (null): rxe_set_mtu: Set mtu to 1024 [ 893.708929][T13093] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 897.504537][T13139] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 899.568870][T13157] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 900.606852][T13168] overlayfs: missing 'lowerdir' [ 903.130204][T13204] team_slave_0: entered promiscuous mode [ 903.135986][T13204] team_slave_1: entered promiscuous mode [ 903.143165][T13204] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 903.654600][T13211] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 903.753791][T13216] netlink: 'syz.3.1568': attribute type 4 has an invalid length. [ 905.218646][T13234] overlayfs: missing 'lowerdir' [ 907.165988][T13255] 8021q: adding VLAN 0 to HW filter on device macvlan5 [ 907.605262][T13256] vivid-002: kernel_thread() failed [ 908.257378][T13260] vivid-002: kernel_thread() failed [ 910.296429][T13289] netlink: 'syz.3.1580': attribute type 4 has an invalid length. [ 912.413383][ T9536] Bluetooth: hci2: command 0x0406 tx timeout [ 915.127905][T13331] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 915.488913][T13339] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 916.293942][T13350] netlink: 'syz.0.1591': attribute type 4 has an invalid length. [ 917.280788][T13356] cgroup: subsys name conflicts with all [ 917.670887][T13362] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 918.674830][T13364] overlayfs: missing 'lowerdir' [ 920.356443][T13391] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 920.675228][T13394] netlink: 830 bytes leftover after parsing attributes in process `syz.0.1600'. [ 920.741808][T13394] syz.0.1600: attempt to access beyond end of device [ 920.741808][T13394] nbd0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 920.809070][T13394] SQUASHFS error: Failed to read block 0x0: -5 [ 920.822149][T13394] unable to read squashfs_super_block [ 920.840022][T13398] syz!: rxe_newlink: already configured on team_slave_0 [ 921.500768][T13403] 8021q: adding VLAN 0 to HW filter on device macvlan6 [ 922.250225][T13408] overlayfs: missing 'lowerdir' [ 922.649828][T13415] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 923.504799][T13417] cgroup: subsys name conflicts with all [ 926.500975][T13448] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 928.190730][T13463] overlayfs: missing 'lowerdir' [ 928.279468][T13465] 8021q: adding VLAN 0 to HW filter on device macvlan7 [ 928.809706][T13465] vivid-002: kernel_thread() failed [ 929.638917][T13485] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 931.789538][ T1285] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.801854][ T1285] ieee802154 phy1 wpan1: encryption failed: -22 [ 934.459969][T13525] 8021q: adding VLAN 0 to HW filter on device macvlan8 [ 934.790380][T13525] vivid-002: kernel_thread() failed [ 935.359163][T13537] overlayfs: missing 'lowerdir' [ 936.464291][T13554] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 936.628467][T13557] netlink: 'syz.8.1630': attribute type 4 has an invalid length. [ 939.759637][T13589] 8021q: adding VLAN 0 to HW filter on device macvlan5 [ 940.336080][T13589] vivid-003: kernel_thread() failed [ 942.041833][T13608] overlayfs: missing 'lowerdir' [ 944.687736][T13629] 8021q: adding VLAN 0 to HW filter on device macvlan6 [ 944.781012][T13620] netlink: 830 bytes leftover after parsing attributes in process `syz.0.1642'. [ 945.057483][T13634] syz!: rxe_newlink: already configured on team_slave_0 [ 945.058507][T13620] syz.0.1642: attempt to access beyond end of device [ 945.058507][T13620] nbd0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 945.247515][T13620] SQUASHFS error: Failed to read block 0x0: -5 [ 945.385087][T13620] unable to read squashfs_super_block [ 945.499506][T13638] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 947.022570][T13657] overlayfs: missing 'lowerdir' [ 949.278367][T13685] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 950.945174][T13711] netlink: 830 bytes leftover after parsing attributes in process `syz.8.1658'. [ 951.122101][T13716] syz.8.1658: attempt to access beyond end of device [ 951.122101][T13716] nbd8: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 951.139639][T13716] SQUASHFS error: Failed to read block 0x0: -5 [ 951.146348][T13716] unable to read squashfs_super_block [ 951.205952][T13711] (null): rxe_set_mtu: Set mtu to 1024 [ 951.217031][T13717] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 951.240784][T13711] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 953.161792][T13743] overlayfs: missing 'lowerdir' [ 956.101014][T13776] 8021q: adding VLAN 0 to HW filter on device macvlan9 [ 960.564940][T13828] netlink: 830 bytes leftover after parsing attributes in process `syz.8.1673'. [ 960.687881][T13828] syz.8.1673: attempt to access beyond end of device [ 960.687881][T13828] nbd8: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 960.724302][T13828] SQUASHFS error: Failed to read block 0x0: -5 [ 960.741248][T13828] unable to read squashfs_super_block [ 960.787612][T13833] (null): rxe_set_mtu: Set mtu to 1024 [ 960.809576][T13833] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 962.743887][ T9536] Bluetooth: hci2: command 0x0406 tx timeout [ 966.034241][T13893] overlayfs: missing 'lowerdir' [ 966.621444][T13898] netlink: 830 bytes leftover after parsing attributes in process `syz.1.1688'. [ 966.631443][T13900] syz.1.1688: attempt to access beyond end of device [ 966.631443][T13900] nbd1: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 966.645883][T13900] SQUASHFS error: Failed to read block 0x0: -5 [ 966.659099][T13900] unable to read squashfs_super_block [ 966.729433][T13898] (null): rxe_set_mtu: Set mtu to 1024 [ 966.740338][T13898] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 973.243389][ T9] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 974.239784][ T9] usb 2-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 974.249673][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 974.446956][ T9] usb 2-1: Product: syz [ 974.451204][ T9] usb 2-1: Manufacturer: syz [ 974.456521][ T9] usb 2-1: SerialNumber: syz [ 974.531710][ T9] usb 2-1: config 0 descriptor?? [ 974.769304][ T9] hso 2-1:0.0: Failed to find INT IN ep [ 974.874133][ T9] usb-storage 2-1:0.0: USB Mass Storage device detected [ 975.012546][T13964] tipc: Enabling of bearer rejected, failed to enable media [ 976.414287][T13998] netlink: 830 bytes leftover after parsing attributes in process `syz.0.1704'. [ 977.506925][T13998] syz.0.1704: attempt to access beyond end of device [ 977.506925][T13998] nbd0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 977.530407][T13998] SQUASHFS error: Failed to read block 0x0: -5 [ 977.537417][T13998] unable to read squashfs_super_block [ 977.858352][T14007] syz!: rxe_newlink: already configured on team_slave_0 [ 979.168717][ T9] usb 2-1: USB disconnect, device number 14 [ 982.442261][T14065] overlayfs: missing 'lowerdir' [ 982.751872][T14071] overlayfs: missing 'lowerdir' [ 986.845728][T14111] overlayfs: missing 'lowerdir' [ 987.166380][T14117] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 988.697842][T14127] overlayfs: missing 'lowerdir' [ 993.226387][ T1285] ieee802154 phy0 wpan0: encryption failed: -22 [ 993.232883][ T1285] ieee802154 phy1 wpan1: encryption failed: -22 [ 994.826852][T14176] tipc: Started in network mode [ 994.831792][T14176] tipc: Node identity ac14140f, cluster identity 4711 [ 994.839424][T14176] tipc: New replicast peer: 255.255.255.255 [ 994.845915][T14176] tipc: Enabled bearer , priority 10 [ 995.861677][ T5795] tipc: Node number set to 2886997007 [ 998.645159][T14224] overlayfs: missing 'lowerdir' [ 1003.312769][T14253] netlink: 'syz.3.1768': attribute type 4 has an invalid length. [ 1005.888435][T14268] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1008.726403][ T28] audit: type=1326 audit(1759356794.538:2394): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14283 comm="syz.8.1776" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fc0acd8eec9 code=0x0 [ 1015.786466][ T28] audit: type=1326 audit(1759356801.598:2395): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14328 comm="syz.1.1786" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f58dcd8eec9 code=0x0 [ 1022.202299][ T28] audit: type=1326 audit(1759356808.008:2396): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14375 comm="syz.8.1797" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fc0acd8eec9 code=0x0 [ 1029.149066][ T28] audit: type=1326 audit(1759356814.878:2397): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14421 comm="syz.0.1809" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f8ced18eec9 code=0x0 [ 1035.771525][T14470] cgroup: subsys name conflicts with all [ 1035.988080][ T28] audit: type=1326 audit(1759356821.798:2398): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14471 comm="syz.1.1822" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f58dcd8eec9 code=0x0 [ 1041.653271][ T28] audit: type=1326 audit(1759356827.458:2399): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14505 comm="syz.1.1832" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f58dcd8eec9 code=0x0 [ 1054.671584][ T1285] ieee802154 phy0 wpan0: encryption failed: -22 [ 1054.678628][ T1285] ieee802154 phy1 wpan1: encryption failed: -22 [ 1060.461581][T14644] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1061.394169][ T28] audit: type=1326 audit(1759356847.118:2400): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14641 comm="syz.3.1869" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fe4af58eec9 code=0x0 [ 1067.403443][ T5777] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 1068.059878][ T5777] usb 4-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 1068.072230][ T5777] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1068.094440][ T5777] usb 4-1: Product: syz [ 1068.104991][ T5777] usb 4-1: Manufacturer: syz [ 1068.114967][ T5777] usb 4-1: SerialNumber: syz [ 1068.128798][ T5777] usb 4-1: config 0 descriptor?? [ 1068.549611][ T5777] hso 4-1:0.0: Failed to find INT IN ep [ 1068.745049][ T5777] usb-storage 4-1:0.0: USB Mass Storage device detected [ 1073.270273][ T5795] usb 4-1: USB disconnect, device number 11 [ 1078.766802][T14754] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1078.809012][T14756] overlayfs: missing 'lowerdir' [ 1084.666164][T14795] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1089.253847][T14818] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1091.540025][T14834] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1091.911352][T14840] 8021q: adding VLAN 0 to HW filter on device macvlan10 [ 1097.431689][T14865] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1098.813514][ T28] audit: type=1326 audit(1759356884.618:2401): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14872 comm="syz.1.1927" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f58dcd8eec9 code=0x0 [ 1103.184209][T14906] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1108.089535][T14951] netlink: 'syz.0.1949': attribute type 4 has an invalid length. [ 1109.379371][T14958] overlayfs: missing 'lowerdir' [ 1109.789746][T14968] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1109.903521][ T23] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 1111.833278][ T23] usb 4-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 1111.913236][ T23] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1111.921305][ T23] usb 4-1: Product: syz [ 1111.968751][ T23] usb 4-1: Manufacturer: syz [ 1111.987586][ T23] usb 4-1: SerialNumber: syz [ 1112.024549][ T23] usb 4-1: config 0 descriptor?? [ 1112.252850][ T23] hso 4-1:0.0: Failed to find INT IN ep [ 1112.281829][ T23] usb-storage 4-1:0.0: USB Mass Storage device detected [ 1113.096120][T14996] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1113.920764][T14995] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 1114.333565][T11277] Bluetooth: hci2: command 0x0406 tx timeout [ 1114.580114][ T23] usb 4-1: USB disconnect, device number 12 [ 1116.102138][ T1285] ieee802154 phy0 wpan0: encryption failed: -22 [ 1116.109966][ T1285] ieee802154 phy1 wpan1: encryption failed: -22 [ 1116.578099][T15013] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1119.737512][T15037] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1120.820067][ T28] audit: type=1326 audit(1759356906.628:2402): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15038 comm="syz.0.1970" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f8ced18eec9 code=0x0 [ 1121.723980][T15053] 8021q: adding VLAN 0 to HW filter on device macvlan11 [ 1122.505466][T15060] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1124.417286][T15075] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1128.069017][T15095] 8021q: adding VLAN 0 to HW filter on device macvlan5 [ 1128.536000][T15096] vivid-002: kernel_thread() failed [ 1129.060132][T15103] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1132.329080][T15116] netlink: 'syz.0.1989': attribute type 4 has an invalid length. [ 1133.095380][T15122] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1134.608154][T15136] 8021q: adding VLAN 0 to HW filter on device macvlan7 [ 1135.029976][T15137] vivid-003: kernel_thread() failed [ 1135.407586][T15144] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1138.073440][ T23] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 1138.459036][ T23] usb 1-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 1138.483363][ T23] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1138.507486][ T23] usb 1-1: Product: syz [ 1138.738487][ T23] usb 1-1: Manufacturer: syz [ 1138.773496][ T23] usb 1-1: SerialNumber: syz [ 1138.873958][ T23] usb 1-1: config 0 descriptor?? [ 1141.793124][ T23] usb-storage 1-1:0.0: USB Mass Storage device detected [ 1141.886430][ T23] usb 1-1: USB disconnect, device number 12 [ 1142.771404][T15185] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1146.773674][ T5878] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 1147.344790][ T5878] usb 4-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 1147.373995][ T5878] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1147.399105][ T5878] usb 4-1: Product: syz [ 1147.479682][ T5878] usb 4-1: Manufacturer: syz [ 1147.532653][ T5878] usb 4-1: SerialNumber: syz [ 1147.644544][ T5878] usb 4-1: config 0 descriptor?? [ 1147.865638][ T5878] hso 4-1:0.0: Failed to find INT IN ep [ 1148.044640][ T5878] usb-storage 4-1:0.0: USB Mass Storage device detected [ 1148.881328][T15233] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1152.497206][T15252] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1154.597411][ T23] usb 4-1: USB disconnect, device number 13 [ 1155.138498][T15273] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1158.578177][T15295] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1162.170663][ T5777] usb 1-1: new full-speed USB device number 13 using dummy_hcd [ 1162.371886][ T5777] usb 1-1: New USB device found, idVendor=05ac, idProduct=029f, bcdDevice= 0.00 [ 1162.393537][ T5777] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1162.422846][ T5777] usb 1-1: config 0 descriptor?? [ 1162.926794][ T5777] apple 0003:05AC:029F.0002: unbalanced delimiter at end of report description [ 1162.941918][ T5777] apple 0003:05AC:029F.0002: parse failed [ 1163.669909][ T5777] apple: probe of 0003:05AC:029F.0002 failed with error -22 [ 1163.808058][ T5777] usb 1-1: USB disconnect, device number 13 [ 1164.833280][ T23] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 1165.602114][ T23] usb 2-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice=b7.de [ 1165.872746][ T23] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1165.882356][ T23] usb 2-1: Product: syz [ 1165.886867][ T23] usb 2-1: Manufacturer: syz [ 1165.891661][ T23] usb 2-1: SerialNumber: syz [ 1166.352459][ T23] usb 2-1: config 0 descriptor?? [ 1166.370815][ T23] ttusb_dec_send_command: command bulk message failed: error -22 [ 1166.380846][ T23] ttusb-dec: probe of 2-1:0.0 failed with error -22 [ 1166.893119][T15322] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1166.917728][T15322] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1166.941550][ T9] usb 2-1: USB disconnect, device number 15 [ 1168.326586][T15357] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1173.878896][T11429] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 1174.191576][T15405] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1174.710431][T11429] usb 9-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 1174.724484][T11429] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1174.732632][T11429] usb 9-1: Product: syz [ 1174.769501][T11429] usb 9-1: Manufacturer: syz [ 1174.808891][T11429] usb 9-1: SerialNumber: syz [ 1174.847361][T11429] usb 9-1: config 0 descriptor?? [ 1175.120976][T11429] hso 9-1:0.0: Failed to find INT IN ep [ 1175.135505][T11429] usb-storage 9-1:0.0: USB Mass Storage device detected [ 1175.988906][T15395] syzkaller0: entered promiscuous mode [ 1176.007568][T15395] syzkaller0: entered allmulticast mode [ 1177.549275][ T1285] ieee802154 phy0 wpan0: encryption failed: -22 [ 1177.555713][ T1285] ieee802154 phy1 wpan1: encryption failed: -22 [ 1180.249092][ T5777] usb 9-1: USB disconnect, device number 3 [ 1182.126733][T15454] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1187.513234][ T5777] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 1187.723928][ T5777] usb 4-1: Using ep0 maxpacket: 16 [ 1187.750714][ T5777] usb 4-1: unable to get BOS descriptor or descriptor too short [ 1187.797291][ T5777] usb 4-1: New USB device found, idVendor=2040, idProduct=b764, bcdDevice=8e.4c [ 1187.827370][ T5777] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1187.876704][ T5777] usb 4-1: Product: syz [ 1187.908570][ T5777] usb 4-1: Manufacturer: syz [ 1187.939186][ T5777] usb 4-1: SerialNumber: syz [ 1188.294705][ T5777] usb 4-1: dvb_usb_v2: found a 'Hauppauge 117xxx DVBT' in warm state [ 1188.326552][ T5777] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1188.356019][ T5777] dvbdev: DVB: registering new adapter (Hauppauge 117xxx DVBT) [ 1188.374569][ T5777] usb 4-1: media controller created [ 1188.421708][ T5777] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1188.488552][ T5777] usb 4-1: selecting invalid altsetting 2 [ 1188.506331][ T5777] set interface failed [ 1188.506724][ T5777] usb 4-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 1188.550723][ T5777] error writing reg: 0xff, val: 0x00 [ 1188.774319][ T5777] dvb_usb_mxl111sf: probe of 4-1:46.0 failed with error -22 [ 1188.878897][ T5777] usb 4-1: USB disconnect, device number 14 [ 1190.646007][T15512] delete_channel: no stack [ 1192.500082][T15534] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1194.928849][T15547] team_slave_0: left promiscuous mode [ 1194.934736][T15547] team_slave_1: left promiscuous mode [ 1195.556801][T15547] infiniband syz!: set down [ 1195.563614][T15547] team0 (unregistering): Port device team_slave_0 removed [ 1195.977214][T15547] team0 (unregistering): Port device team_slave_1 removed [ 1198.544447][T15576] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1205.135513][T15621] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1206.368538][T15631] overlayfs: failed to clone upperpath [ 1207.367377][T15643] netlink: 'syz.8.2119': attribute type 4 has an invalid length. [ 1208.651354][T15655] vivid-001: kernel_thread() failed [ 1212.841307][T15688] netlink: 'syz.1.2128': attribute type 4 has an invalid length. [ 1213.363321][T15694] 8021q: adding VLAN 0 to HW filter on device macvlan6 [ 1213.901756][T15694] vivid-002: kernel_thread() failed [ 1217.841784][T15721] netlink: 'syz.8.2137': attribute type 4 has an invalid length. [ 1218.376988][T15732] 8021q: adding VLAN 0 to HW filter on device macvlan12 [ 1218.908100][T15732] vivid-002: kernel_thread() failed [ 1225.002363][T15765] netlink: 'syz.8.2148': attribute type 4 has an invalid length. [ 1225.021883][T15763] netlink: 830 bytes leftover after parsing attributes in process `syz.3.2147'. [ 1225.046772][T15763] syz.3.2147: attempt to access beyond end of device [ 1225.046772][T15763] nbd3: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1225.080696][T15763] SQUASHFS error: Failed to read block 0x0: -5 [ 1225.098762][T15763] unable to read squashfs_super_block [ 1225.151308][T15766] (null): rxe_set_mtu: Set mtu to 1024 [ 1225.231419][T15766] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 1229.786610][T15796] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1230.987839][T15803] netlink: 'syz.1.2157': attribute type 4 has an invalid length. [ 1231.498618][T15807] 8021q: adding VLAN 0 to HW filter on device macvlan8 [ 1235.477140][T15837] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1238.453465][ T9536] Bluetooth: hci2: command 0x0406 tx timeout [ 1238.980975][ T1285] ieee802154 phy0 wpan0: encryption failed: -22 [ 1238.987376][ T1285] ieee802154 phy1 wpan1: encryption failed: -22 [ 1241.223841][T15873] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1248.105625][T15913] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1252.962616][T15960] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1260.815891][T16011] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1264.440900][T16035] netlink: 'syz.0.2214': attribute type 4 has an invalid length. [ 1280.853524][T16166] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1282.383300][ T23] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 1283.702036][ T23] usb 4-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 1283.747696][ T23] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1283.773376][ T23] usb 4-1: Product: syz [ 1283.777672][ T23] usb 4-1: Manufacturer: syz [ 1283.815142][ T23] usb 4-1: SerialNumber: syz [ 1283.834184][ T23] usb 4-1: config 0 descriptor?? [ 1284.090400][ T23] hso 4-1:0.0: Failed to find INT IN ep [ 1284.142085][ T23] usb-storage 4-1:0.0: USB Mass Storage device detected [ 1284.365571][T16174] syzkaller0: entered promiscuous mode [ 1284.371679][T16174] syzkaller0: entered allmulticast mode [ 1286.945575][T16206] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1287.934933][T11429] usb 4-1: USB disconnect, device number 15 [ 1289.766965][T16227] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1292.124046][T16244] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1293.313640][ T9] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 1293.672443][ T9] usb 9-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 1293.706076][ T9] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1293.717266][ T9] usb 9-1: Product: syz [ 1294.155946][ T9] usb 9-1: Manufacturer: syz [ 1294.160627][ T9] usb 9-1: SerialNumber: syz [ 1294.172351][ T9] usb 9-1: config 0 descriptor?? [ 1294.413846][ T9] hso 9-1:0.0: Failed to find INT IN ep [ 1294.453848][ T9] usb-storage 9-1:0.0: USB Mass Storage device detected [ 1294.888670][T16250] syzkaller0: entered promiscuous mode [ 1294.894324][T16250] syzkaller0: entered allmulticast mode [ 1299.147711][ T9] usb 9-1: USB disconnect, device number 4 [ 1300.438540][ T1285] ieee802154 phy0 wpan0: encryption failed: -22 [ 1300.454128][ T1285] ieee802154 phy1 wpan1: encryption failed: -22 [ 1302.296977][T16310] vivid-002: kernel_thread() failed [ 1305.193213][ T9] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 1305.774456][ T9] usb 1-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 1306.525683][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1306.773244][ T9] usb 1-1: Product: syz [ 1306.778911][ T9] usb 1-1: Manufacturer: syz [ 1306.792785][ T9] usb 1-1: SerialNumber: syz [ 1306.861664][ T9] usb 1-1: config 0 descriptor?? [ 1309.637134][T16375] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1310.323363][ T9] usb 1-1: can't set config #0, error -71 [ 1310.352068][ T9] usb 1-1: USB disconnect, device number 14 [ 1315.556459][ T8520] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 1315.871334][ T8520] usb 9-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 1315.919800][ T8520] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1316.108837][ T8520] usb 9-1: Product: syz [ 1316.126087][ T8520] usb 9-1: Manufacturer: syz [ 1316.565302][ T8520] usb 9-1: SerialNumber: syz [ 1316.950982][ T8520] usb 9-1: config 0 descriptor?? [ 1319.305924][ T8520] usb 9-1: can't set config #0, error -71 [ 1319.380376][ T8520] usb 9-1: USB disconnect, device number 5 [ 1319.491314][T16451] netlink: 830 bytes leftover after parsing attributes in process `syz.0.2321'. [ 1320.286470][T16451] syz.0.2321: attempt to access beyond end of device [ 1320.286470][T16451] nbd0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1320.305176][T16451] SQUASHFS error: Failed to read block 0x0: -5 [ 1320.313316][T16451] unable to read squashfs_super_block [ 1320.416822][T16451] syz!: rxe_newlink: already configured on team_slave_0 [ 1324.823839][ T5777] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 1325.079226][ T5777] usb 9-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 1325.119587][ T5777] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1325.144832][ T5777] usb 9-1: Product: syz [ 1325.149132][ T5777] usb 9-1: Manufacturer: syz [ 1325.154347][ T5777] usb 9-1: SerialNumber: syz [ 1325.171263][ T5777] usb 9-1: config 0 descriptor?? [ 1325.680875][ T5777] hso 9-1:0.0: Failed to find INT IN ep [ 1325.688389][ T5777] usb-storage 9-1:0.0: USB Mass Storage device detected [ 1326.862284][T16494] syzkaller0: entered promiscuous mode [ 1326.872676][T16494] syzkaller0: entered allmulticast mode [ 1330.719389][T16529] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1331.850103][ T8520] usb 9-1: USB disconnect, device number 6 [ 1332.831033][T16540] fuse: Bad value for 'fd' [ 1338.637832][T16578] sd 0:0:1:0: PR command failed: 1026 [ 1338.653173][T16578] sd 0:0:1:0: Sense Key : Illegal Request [current] [ 1338.671265][T16578] sd 0:0:1:0: Add. Sense: Invalid command operation code [ 1340.255050][T16589] fuse: Bad value for 'fd' [ 1343.438419][ T967] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 1343.497342][T16612] netlink: 830 bytes leftover after parsing attributes in process `syz.8.2366'. [ 1343.538952][T16612] syz.8.2366: attempt to access beyond end of device [ 1343.538952][T16612] nbd8: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1343.562532][T16612] SQUASHFS error: Failed to read block 0x0: -5 [ 1343.569959][T16612] unable to read squashfs_super_block [ 1343.606506][T16612] (null): rxe_set_mtu: Set mtu to 1024 [ 1343.612998][T16612] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 1343.655192][ T967] usb 1-1: config 0 has an invalid interface number: 49 but max is 0 [ 1343.675976][ T967] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1343.708226][ T967] usb 1-1: config 0 has no interface number 0 [ 1343.725486][ T967] usb 1-1: config 0 interface 49 altsetting 0 endpoint 0x6 has an invalid bInterval 0, changing to 7 [ 1343.752988][ T967] usb 1-1: config 0 interface 49 altsetting 0 endpoint 0x6 has invalid wMaxPacketSize 0 [ 1343.786518][ T967] usb 1-1: config 0 interface 49 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1343.819756][ T967] usb 1-1: New USB device found, idVendor=045e, idProduct=0284, bcdDevice=2d.ad [ 1343.831016][ T967] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1343.871009][ T967] usb 1-1: config 0 descriptor?? [ 1343.891493][ T967] xbox_remote_probe: Unexpected endpoint_in [ 1344.117203][ T967] usb 1-1: USB disconnect, device number 15 [ 1345.454109][T16641] fuse: Bad value for 'fd' [ 1349.221757][T16669] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1353.630174][T16710] 9pnet_virtio: no channels available for device ./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 1353.641769][T16710] @0Ù: renamed from bond_slave_1 (while UP) [ 1354.788427][T16717] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1358.092187][T16736] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1359.603399][ T8] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 1359.835200][ T8] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1359.884368][ T8] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1359.900555][ T8] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1359.911659][ T8] usb 1-1: config 0 descriptor?? [ 1360.443107][ T8] keytouch 0003:0926:3333.0003: fixing up Keytouch IEC report descriptor [ 1360.671667][ T8] input: HID 0926:3333 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0926:3333.0003/input/input108 [ 1361.205283][ T8] keytouch 0003:0926:3333.0003: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.0-1/input0 [ 1361.279122][ T8] usb 1-1: USB disconnect, device number 16 [ 1361.455683][T16754] fido_id[16754]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/1-1/report_descriptor': No such file or directory [ 1362.025162][ T1285] ieee802154 phy0 wpan0: encryption failed: -22 [ 1362.036598][ T1285] ieee802154 phy1 wpan1: encryption failed: -22 [ 1365.103196][T16796] syz.1.2415: attempt to access beyond end of device [ 1365.103196][T16796] nbd1: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1365.117041][T16796] SQUASHFS error: Failed to read block 0x0: -5 [ 1365.123770][T16796] unable to read squashfs_super_block [ 1365.449934][T16794] fuse: Bad value for 'fd' [ 1365.506874][T16800] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1369.350443][T16825] sg_write: data in/out 91/14 bytes for SCSI command 0x0-- guessing data in; [ 1369.350443][T16825] program syz.0.2423 not setting count and/or reply_len properly [ 1373.269156][T16853] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1374.856119][T16865] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1376.203617][ T23] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 1376.463292][ T23] usb 9-1: Using ep0 maxpacket: 8 [ 1376.511552][ T23] usb 9-1: New USB device found, idVendor=2770, idProduct=930c, bcdDevice=8d.6a [ 1376.619406][ T23] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1376.757628][ T23] usb 9-1: Product: syz [ 1376.843365][ T23] usb 9-1: Manufacturer: syz [ 1377.204204][ T23] usb 9-1: SerialNumber: syz [ 1377.235685][ T23] usb 9-1: config 0 descriptor?? [ 1377.261312][ T23] gspca_main: sq930x-2.14.0 probing 2770:930c [ 1378.603273][ T23] gspca_sq930x: reg_w 0105 0c00 failed -71 [ 1378.903804][ T23] gspca_sq930x: Sensor ov9630 not yet treated [ 1378.916769][ T23] sq930x: probe of 9-1:0.0 failed with error -22 [ 1378.942368][ T23] usb 9-1: USB disconnect, device number 7 [ 1379.608144][T16909] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1386.263653][T16937] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1387.852804][T16956] comedi comedi3: 8255: I/O port conflict (0x5,4) [ 1387.860309][T16956] comedi comedi3: 8255: I/O port conflict (0x2,4) [ 1387.866933][T16956] comedi comedi3: 8255: I/O port conflict (0x1,4) [ 1387.873523][T16956] comedi comedi3: 8255: I/O port conflict (0x5c952399,4) [ 1387.880608][T16956] comedi comedi3: 8255: I/O port conflict (0x5,4) [ 1387.887160][T16956] comedi comedi3: 8255: I/O port conflict (0x3ff,4) [ 1387.893935][T16956] comedi comedi3: 8255: I/O port conflict (0x1,4) [ 1387.900410][T16956] comedi comedi3: 8255: I/O port conflict (0x1,4) [ 1387.906986][T16956] comedi comedi3: 8255: I/O port conflict (0x9,4) [ 1387.913626][T16956] comedi comedi3: 8255: I/O port conflict (0x6,4) [ 1387.920092][T16956] comedi comedi3: 8255: I/O port conflict (0x4,4) [ 1387.926607][T16956] comedi comedi3: 8255: I/O port conflict (0x3,4) [ 1387.933207][T16956] comedi comedi3: 8255: I/O port conflict (0xffffffff80000089,4) [ 1387.941278][T16956] comedi comedi3: 8255: I/O port conflict (0xfffffffffffffffd,4) [ 1387.950325][T16956] comedi comedi3: 8255: I/O port conflict (0xfffffffffffffff5,4) [ 1387.958167][T16956] comedi comedi3: 8255: I/O port conflict (0xffffffffffffeadb,4) [ 1387.966044][T16956] comedi comedi3: 8255: I/O port conflict (0x3,4) [ 1387.972559][T16956] comedi comedi3: 8255: I/O port conflict (0x8,4) [ 1387.979110][T16956] comedi comedi3: 8255: I/O port conflict (0x4,4) [ 1387.985716][T16956] comedi comedi3: 8255: I/O port conflict (0x8000000,4) [ 1387.992886][T16956] comedi comedi3: 8255: I/O port conflict (0xffffffffdffffffa,4) [ 1390.306342][T16971] netlink: 830 bytes leftover after parsing attributes in process `syz.3.2464'. [ 1390.370015][T16971] syz.3.2464: attempt to access beyond end of device [ 1390.370015][T16971] nbd3: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1390.423872][T16971] SQUASHFS error: Failed to read block 0x0: -5 [ 1390.483665][T16972] (null): rxe_set_mtu: Set mtu to 1024 [ 1390.491427][T16971] unable to read squashfs_super_block [ 1390.491866][T16972] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 1393.261488][T16990] input: syz1 as /devices/virtual/input/input109 [ 1397.920415][T17022] vivid-002: kernel_thread() failed [ 1400.481533][ T9536] Bluetooth: hci1: unexpected event for opcode 0x2002 [ 1403.253474][T17067] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1404.790074][T17077] fuse: Unknown parameter 'çä†KÏÆêCúõ¾[^k·ú¾;ªü16¡bWè3NiL퀵ˆ¤ ^wûWs΄d:Þ›Ö4ÃÛƒ©ƒ8ïÉhÒ*7`/éûÓBHB*‡„#ÃBÒÚÌ1¨/‹Ön´1¦…é‹0€a´: ¡îHNJ(?ífbû‹½xI$€^”0ÝT¼¢ÜI·-ª&*á$©ëÀµ+13çcço>xóÔüÙ' [ 1406.394443][T17094] netlink: 72 bytes leftover after parsing attributes in process `syz.3.2499'. [ 1406.573420][T17097] ntfs3: nullb0: Primary boot signature is not NTFS. [ 1406.584331][T17097] ntfs3: nullb0: try to read out of volume at offset 0x3e7ffffe00 [ 1408.766759][T17111] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1409.448183][T17119] netlink: 'syz.0.2508': attribute type 4 has an invalid length. [ 1409.462720][T17119] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2508'. [ 1410.358757][T17125] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2510'. [ 1412.626325][T17150] syz.3.2517: attempt to access beyond end of device [ 1412.626325][T17150] nbd3: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1412.641128][T17150] SQUASHFS error: Failed to read block 0x0: -5 [ 1412.648260][T17150] unable to read squashfs_super_block [ 1412.745865][T17155] netlink: 'syz.0.2519': attribute type 4 has an invalid length. [ 1412.821623][T17155] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2519'. [ 1413.243391][ T5848] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 1413.368659][T17169] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1413.953499][ T5848] usb 1-1: Using ep0 maxpacket: 16 [ 1414.074725][ T5848] usb 1-1: config 0 has an invalid interface number: 237 but max is 0 [ 1414.117694][ T5848] usb 1-1: config 0 has no interface number 0 [ 1414.140303][ T5848] usb 1-1: config 0 interface 237 has no altsetting 0 [ 1414.170320][ T5848] usb 1-1: New USB device found, idVendor=0e41, idProduct=5057, bcdDevice= 6.ad [ 1414.237547][ T5848] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1414.286815][ T5848] usb 1-1: Product: syz [ 1414.296767][ T5848] usb 1-1: Manufacturer: syz [ 1414.302368][ T5848] usb 1-1: SerialNumber: syz [ 1414.320456][ T5848] usb 1-1: config 0 descriptor?? [ 1414.360178][ T5848] snd_usb_podhd 1-1:0.237: Line 6 POD HD300 found [ 1414.579519][ T5848] snd_usb_podhd 1-1:0.237: cannot get proper max packet size [ 1414.599316][ T5848] snd_usb_podhd 1-1:0.237: Line 6 POD HD300 now disconnected [ 1414.615830][ T5848] snd_usb_podhd: probe of 1-1:0.237 failed with error -22 [ 1414.819372][T11429] usb 1-1: USB disconnect, device number 17 [ 1415.442156][T17187] Option 'D' to dns_resolver key: bad/missing value [ 1415.486249][T17187] hpfs: Bad magic ... probably not HPFS [ 1416.320368][ T5848] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 1416.573421][ T5848] usb 2-1: Using ep0 maxpacket: 32 [ 1416.588074][ T5848] usb 2-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 1416.606690][ T5848] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1416.775786][ T5848] usb 2-1: config 0 descriptor?? [ 1416.786100][ T5848] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 1417.613375][ T5848] gspca_nw80x: reg_w err -110 [ 1417.618167][ T5848] nw80x: probe of 2-1:0.0 failed with error -110 [ 1418.874163][T17204] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1418.950523][ T967] usb 2-1: USB disconnect, device number 16 [ 1420.856020][T17225] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1424.191420][ T1285] ieee802154 phy0 wpan0: encryption failed: -22 [ 1424.216416][ T1285] ieee802154 phy1 wpan1: encryption failed: -22 [ 1425.593507][T17250] netlink: 'syz.1.2549': attribute type 4 has an invalid length. [ 1425.611558][T17250] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2549'. [ 1425.885989][T17258] syz.0.2551: attempt to access beyond end of device [ 1425.885989][T17258] nbd0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1425.901557][T17258] SQUASHFS error: Failed to read block 0x0: -5 [ 1425.910117][T17258] unable to read squashfs_super_block [ 1425.989926][T17261] netlink: 28 bytes leftover after parsing attributes in process `syz.8.2554'. [ 1426.402316][T17258] fuse: Bad value for 'fd' [ 1426.763657][T17265] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1428.848870][T17274] IPVS: lc: UDP 224.0.0.2:0 - no destination available [ 1428.856215][ T6896] IPVS: starting estimator thread 0... [ 1429.033369][T17279] IPVS: using max 18 ests per chain, 43200 per kthread [ 1429.794922][T17286] netlink: 'syz.0.2560': attribute type 4 has an invalid length. [ 1429.829349][T17286] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2560'. [ 1431.173868][T17301] nvme_fabrics: unknown parameter or missing value 'P' in ctrl creation request [ 1432.525823][T17311] netlink: 'syz.1.2570': attribute type 4 has an invalid length. [ 1432.553513][T17311] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2570'. [ 1436.495814][T17349] 8021q: adding VLAN 0 to HW filter on device macvlan9 [ 1438.488208][T17363] input: syz1 as /devices/virtual/input/input110 [ 1438.715930][T17362] ceph: No mds server is up or the cluster is laggy [ 1439.027875][T11429] libceph: connect (1)[c::]:6789 error -101 [ 1439.036602][T11429] libceph: mon0 (1)[c::]:6789 connect error [ 1440.824452][ T9536] Bluetooth: hci2: command 0x0406 tx timeout [ 1441.201430][ T9536] Bluetooth: hci1: unexpected event for opcode 0x2002 [ 1442.413334][ T967] usb 1-1: new full-speed USB device number 18 using dummy_hcd [ 1442.604921][ T967] usb 1-1: config 0 has an invalid interface number: 251 but max is 0 [ 1442.620939][ T967] usb 1-1: config 0 has no interface number 0 [ 1442.639265][ T967] usb 1-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 1442.661591][ T967] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1442.689398][ T967] usb 1-1: Product: syz [ 1442.694306][ T967] usb 1-1: Manufacturer: syz [ 1442.698955][ T967] usb 1-1: SerialNumber: syz [ 1442.738290][ T967] usb 1-1: config 0 descriptor?? [ 1443.684460][ T967] asix 1-1:0.251 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 1443.699142][ T967] asix 1-1:0.251 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 1443.713822][ T967] asix: probe of 1-1:0.251 failed with error -71 [ 1443.726151][ T967] usb 1-1: USB disconnect, device number 18 [ 1445.496426][ T9536] Bluetooth: hci1: unexpected event for opcode 0x2002 [ 1445.988178][T17425] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1446.828711][T17438] 8021q: adding VLAN 0 to HW filter on device macvlan10 [ 1449.172057][T17456] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1452.691567][T17495] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1455.103335][ T9] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 1455.371717][ T9] usb 4-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 1455.879349][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1455.905323][ T9] usb 4-1: Product: syz [ 1455.917214][ T9] usb 4-1: Manufacturer: syz [ 1455.923554][ T9] usb 4-1: SerialNumber: syz [ 1455.942600][ T9] usb 4-1: config 0 descriptor?? [ 1456.208658][ T9] hso 4-1:0.0: Failed to find INT IN ep [ 1456.215150][ T9] usb-storage 4-1:0.0: USB Mass Storage device detected [ 1456.832483][T17535] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1457.016376][T17539] syzkaller0: entered promiscuous mode [ 1457.021934][T17539] syzkaller0: entered allmulticast mode [ 1459.974373][T17566] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1460.439843][T17571] ntfs3: nullb0: Primary boot signature is not NTFS. [ 1460.461753][T17571] ntfs3: nullb0: try to read out of volume at offset 0x3e7ffffe00 [ 1460.816101][ T5848] usb 4-1: USB disconnect, device number 16 [ 1465.344204][T17613] ntfs3: nullb0: Primary boot signature is not NTFS. [ 1465.353079][T17613] ntfs3: nullb0: try to read out of volume at offset 0x3e7ffffe00 [ 1465.943479][ T5878] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 1466.387901][ T5878] usb 1-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 1466.418815][ T5878] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1466.437738][ T5878] usb 1-1: Product: syz [ 1466.441958][ T5878] usb 1-1: Manufacturer: syz [ 1466.467629][ T5878] usb 1-1: SerialNumber: syz [ 1466.493757][ T5878] usb 1-1: config 0 descriptor?? [ 1466.926943][ T5878] hso 1-1:0.0: Failed to find INT IN ep [ 1466.940197][ T5878] usb-storage 1-1:0.0: USB Mass Storage device detected [ 1467.229344][ T9536] Bluetooth: hci0: unexpected event for opcode 0x2002 [ 1468.094837][T17629] syzkaller0: entered promiscuous mode [ 1468.204668][T17629] syzkaller0: entered allmulticast mode [ 1469.689297][T17643] netlink: 830 bytes leftover after parsing attributes in process `syz.1.2662'. [ 1469.839410][T17643] syz.1.2662: attempt to access beyond end of device [ 1469.839410][T17643] nbd1: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1469.869630][T17643] SQUASHFS error: Failed to read block 0x0: -5 [ 1469.877126][T17643] unable to read squashfs_super_block [ 1470.068076][T17648] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1470.088798][T17643] (null): rxe_set_mtu: Set mtu to 1024 [ 1470.119905][T17643] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 1470.919863][ T5848] usb 1-1: USB disconnect, device number 19 [ 1471.415776][T17651] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1473.533321][ T5848] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 1473.573705][T17366] Bluetooth: hci2: unexpected event for opcode 0x2002 [ 1473.658620][T17366] Bluetooth: hci0: unexpected event for opcode 0x2002 [ 1474.166765][ T5848] usb 1-1: config 1 interface 0 altsetting 3 bulk endpoint 0x1 has invalid maxpacket 64 [ 1474.193124][ T5848] usb 1-1: config 1 interface 0 has no altsetting 0 [ 1474.220876][ T5848] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 1474.245767][ T5848] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1474.256336][ T5848] usb 1-1: Product: syz [ 1474.264629][ T5848] usb 1-1: Manufacturer: syz [ 1474.269308][ T5848] usb 1-1: SerialNumber: syz [ 1474.306119][T17657] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1474.602768][ T5848] usb 1-1: USB disconnect, device number 20 [ 1475.458125][T17677] DRBG: could not allocate CTR cipher TFM handle: ctr(aes) [ 1476.984306][T17694] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 1477.431763][T17698] ntfs3: nullb0: Primary boot signature is not NTFS. [ 1477.439779][T17698] ntfs3: nullb0: try to read out of volume at offset 0x3e7ffffe00 [ 1478.076397][T17703] netlink: 830 bytes leftover after parsing attributes in process `syz.1.2677'. [ 1478.589200][T17703] syz.1.2677: attempt to access beyond end of device [ 1478.589200][T17703] nbd1: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1478.602913][T17703] SQUASHFS error: Failed to read block 0x0: -5 [ 1478.632672][T17703] unable to read squashfs_super_block [ 1478.754334][T17703] (null): rxe_set_mtu: Set mtu to 1024 [ 1478.761539][T17703] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 1480.821297][T17727] syz.3.2685: attempt to access beyond end of device [ 1480.821297][T17727] nbd3: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1480.825950][T17728] fuse: Bad value for 'fd' [ 1480.834478][T17727] SQUASHFS error: Failed to read block 0x0: -5 [ 1480.858431][T17727] unable to read squashfs_super_block [ 1482.108852][T17366] Bluetooth: hci0: unexpected event for opcode 0x2002 [ 1484.737047][ T1285] ieee802154 phy0 wpan0: encryption failed: -22 [ 1484.747325][ T1285] ieee802154 phy1 wpan1: encryption failed: -22 [ 1485.011396][T17764] syz.3.2697: attempt to access beyond end of device [ 1485.011396][T17764] nbd3: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1485.030071][T17764] SQUASHFS error: Failed to read block 0x0: -5 [ 1485.037352][T17764] unable to read squashfs_super_block [ 1485.337231][T17765] fuse: Bad value for 'fd' [ 1486.400488][T17366] Bluetooth: hci0: unexpected event for opcode 0x2002 [ 1492.345577][T17808] syz.1.2708: attempt to access beyond end of device [ 1492.345577][T17808] nbd1: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1492.359967][T17808] SQUASHFS error: Failed to read block 0x0: -5 [ 1492.366905][T17808] unable to read squashfs_super_block [ 1492.603644][T17808] fuse: Bad value for 'fd' [ 1497.560608][T17840] ntfs3: nullb0: Primary boot signature is not NTFS. [ 1497.567576][T17840] ntfs3: nullb0: try to read out of volume at offset 0x3e7ffffe00 [ 1500.360091][T17861] netlink: 'syz.1.2724': attribute type 4 has an invalid length. [ 1500.381157][T17861] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2724'. [ 1501.700138][T17880] binder: BINDER_SET_CONTEXT_MGR already set [ 1501.710239][T17880] binder: 17879:17880 ioctl 4018620d 200000004a80 returned -16 [ 1506.493266][T17912] binder: BINDER_SET_CONTEXT_MGR already set [ 1506.510176][T17912] binder: 17909:17912 ioctl 4018620d 200000004a80 returned -16 [ 1506.520228][T17911] netlink: 12 bytes leftover after parsing attributes in process `syz.8.2737'. [ 1506.813602][T17915] ntfs3: nullb0: Primary boot signature is not NTFS. [ 1506.820482][T17915] ntfs3: nullb0: try to read out of volume at offset 0x3e7ffffe00 [ 1511.708901][T17954] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2753'. [ 1512.822460][T17964] netlink: 830 bytes leftover after parsing attributes in process `syz.0.2756'. [ 1513.065474][T17964] syz.0.2756: attempt to access beyond end of device [ 1513.065474][T17964] nbd0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1513.079373][T17964] SQUASHFS error: Failed to read block 0x0: -5 [ 1513.087132][T17964] unable to read squashfs_super_block [ 1513.221081][T17969] syz!: rxe_newlink: already configured on team_slave_0 [ 1515.424257][T17991] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2764'. [ 1516.478918][T17998] netlink: 56 bytes leftover after parsing attributes in process `syz.3.2766'. [ 1516.690248][T18005] netlink: 'syz.0.2769': attribute type 4 has an invalid length. [ 1516.698476][T18005] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2769'. [ 1517.723284][T18014] netlink: 830 bytes leftover after parsing attributes in process `syz.0.2771'. [ 1519.208266][T18017] syz.0.2771: attempt to access beyond end of device [ 1519.208266][T18017] nbd0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1519.259765][T18017] SQUASHFS error: Failed to read block 0x0: -5 [ 1519.271932][T18017] unable to read squashfs_super_block [ 1519.272021][T18014] syz!: rxe_newlink: already configured on team_slave_0 [ 1521.696328][T18036] netlink: 'syz.0.2780': attribute type 4 has an invalid length. [ 1521.717755][T18036] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2780'. [ 1525.725604][ T9536] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1525.736732][ T9536] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1525.745679][ T9536] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1525.775917][ T9536] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1525.786434][ T9536] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 1525.794735][ T9536] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1526.369427][ T7579] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1526.506838][ T7579] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1526.717995][ T7579] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1526.856357][ T7579] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1527.854337][ T9536] Bluetooth: hci4: command tx timeout [ 1528.033532][T18063] chnl_net:caif_netlink_parms(): no params data found [ 1528.156771][T18089] sg_write: data in/out 91/14 bytes for SCSI command 0x0-- guessing data in; [ 1528.156771][T18089] program syz.8.2795 not setting count and/or reply_len properly [ 1528.189380][ T7579] tipc: Left network mode [ 1529.198234][T18100] vivid-002: kernel_thread() failed [ 1529.944525][ T9536] Bluetooth: hci4: command tx timeout [ 1530.410141][T18063] bridge0: port 1(bridge_slave_0) entered blocking state [ 1530.426731][T18063] bridge0: port 1(bridge_slave_0) entered disabled state [ 1530.435120][T18063] bridge_slave_0: entered allmulticast mode [ 1530.447429][T18063] bridge_slave_0: entered promiscuous mode [ 1530.612609][T18063] bridge0: port 2(bridge_slave_1) entered blocking state [ 1530.621072][T18063] bridge0: port 2(bridge_slave_1) entered disabled state [ 1530.637282][T18063] bridge_slave_1: entered allmulticast mode [ 1530.657187][T18063] bridge_slave_1: entered promiscuous mode [ 1530.757124][T18063] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1530.769879][T18063] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1530.837805][T18063] team0: Port device team_slave_0 added [ 1530.847899][T18063] team0: Port device team_slave_1 added [ 1530.904468][T18063] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1530.911538][T18063] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1530.941594][T18063] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1530.965514][T18063] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1530.977880][T18063] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1531.053185][T18063] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1531.828554][T18063] hsr_slave_0: entered promiscuous mode [ 1531.842760][T18127] sg_write: data in/out 91/14 bytes for SCSI command 0x0-- guessing data in; [ 1531.842760][T18127] program syz.0.2806 not setting count and/or reply_len properly [ 1531.875702][T18063] hsr_slave_1: entered promiscuous mode [ 1532.083219][ T9536] Bluetooth: hci4: command tx timeout [ 1534.103168][ T9536] Bluetooth: hci4: command tx timeout [ 1534.919989][ T7579] hsr_slave_0: left promiscuous mode [ 1534.926710][ T7579] hsr_slave_1: left promiscuous mode [ 1534.934473][ T7579] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1534.942024][ T7579] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1534.973752][ T7579] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1535.542307][ T7579] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1535.554062][ T7579] bridge_slave_1: left allmulticast mode [ 1535.559774][ T7579] bridge_slave_1: left promiscuous mode [ 1535.567623][ T7579] bridge0: port 2(bridge_slave_1) entered disabled state [ 1535.577998][ T7579] bridge_slave_0: left allmulticast mode [ 1535.608027][ T7579] bridge_slave_0: left promiscuous mode [ 1535.615180][ T7579] bridge0: port 1(bridge_slave_0) entered disabled state [ 1535.680876][ T7579] team_slave_0: left promiscuous mode [ 1535.686456][ T7579] team_slave_1: left promiscuous mode [ 1535.693117][ T7579] veth1_macvtap: left promiscuous mode [ 1535.698729][ T7579] veth0_macvtap: left promiscuous mode [ 1535.710384][ T7579] veth1_vlan: left promiscuous mode [ 1536.496908][T18166] vivid-001: kernel_thread() failed [ 1539.740185][ T7579] team0 (unregistering): Port device team_slave_1 removed [ 1539.797766][ T7579] team0 (unregistering): Port device team_slave_0 removed [ 1539.853243][ T7579] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1539.910391][ T7579] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1540.569000][ T7579] bond0 (unregistering): Released all slaves [ 1541.489972][T18063] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1541.502251][T18063] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1541.512663][T18063] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1541.529614][T18063] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1541.624808][T18063] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1541.649388][T18063] 8021q: adding VLAN 0 to HW filter on device team0 [ 1541.664332][ T2949] bridge0: port 1(bridge_slave_0) entered blocking state [ 1541.671577][ T2949] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1541.691412][ T2949] bridge0: port 2(bridge_slave_1) entered blocking state [ 1541.698650][ T2949] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1541.709243][ T96] null_blk: rq ffff888021fa8000 timed out [ 1541.717640][ T96] timeout error, dev nullb0, sector 393216 op 0x0:(READ) flags 0xe00000 phys_seg 2 prio class 1 [ 1541.728468][ T96] null_blk: rq ffff888021fa8180 timed out [ 1541.836616][T18063] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1541.847954][ T96] timeout error, dev nullb0, sector 393216 op 0x0:(READ) flags 0xe00000 phys_seg 2 prio class 1 [ 1541.858717][ T96] null_blk: rq ffff888021fa8300 timed out [ 1541.866272][ T96] timeout error, dev nullb0, sector 393216 op 0x0:(READ) flags 0xe00000 phys_seg 2 prio class 1 [ 1541.876954][ T96] null_blk: rq ffff888021fa8480 timed out [ 1541.882692][ T96] timeout error, dev nullb0, sector 393216 op 0x0:(READ) flags 0xe00000 phys_seg 2 prio class 1 [ 1541.894079][ T96] null_blk: rq ffff888021fa8600 timed out [ 1541.899827][ T96] timeout error, dev nullb0, sector 393216 op 0x0:(READ) flags 0xe00000 phys_seg 2 prio class 1 [ 1541.910471][ T96] null_blk: rq ffff888021fa8780 timed out [ 1541.916281][ T96] timeout error, dev nullb0, sector 393216 op 0x0:(READ) flags 0xe00000 phys_seg 2 prio class 1 [ 1541.926835][ T96] null_blk: rq ffff888021fa8900 timed out [ 1541.932567][ T96] timeout error, dev nullb0, sector 393216 op 0x0:(READ) flags 0xe00000 phys_seg 2 prio class 1 [ 1541.943256][ T96] null_blk: rq ffff888021fa8a80 timed out [ 1541.949187][ T96] timeout error, dev nullb0, sector 393216 op 0x0:(READ) flags 0xe00000 phys_seg 2 prio class 1 [ 1541.961447][ T96] null_blk: rq ffff888021fa8c00 timed out [ 1541.967632][ T96] timeout error, dev nullb0, sector 393216 op 0x0:(READ) flags 0xe00000 phys_seg 2 prio class 1 [ 1541.978273][ T96] null_blk: rq ffff888021fa8d80 timed out [ 1541.984095][ T96] timeout error, dev nullb0, sector 393216 op 0x0:(READ) flags 0xe00000 phys_seg 2 prio class 1 [ 1541.994603][ T96] null_blk: rq ffff888021fa8f00 timed out [ 1542.000355][ T96] null_blk: rq ffff888021fa9080 timed out [ 1542.006295][ T96] null_blk: rq ffff888021fa9200 timed out [ 1542.012046][ T96] null_blk: rq ffff888021fa9380 timed out [ 1542.017967][ T96] null_blk: rq ffff888021fa9500 timed out [ 1542.023836][ T96] null_blk: rq ffff888021fa9680 timed out [ 1542.029584][ T96] null_blk: rq ffff888021fa9800 timed out [ 1542.035444][ T96] null_blk: rq ffff888021fa9980 timed out [ 1542.041352][ T96] null_blk: rq ffff888021fa9b00 timed out [ 1542.047203][ T96] null_blk: rq ffff888021fa9c80 timed out [ 1542.053270][ T96] null_blk: rq ffff888021fa9e00 timed out [ 1542.059003][ T96] null_blk: rq ffff888021fa9f80 timed out [ 1542.064960][ T96] null_blk: rq ffff888021faa100 timed out [ 1542.070695][ T96] null_blk: rq ffff888021faa280 timed out [ 1542.076506][ T96] null_blk: rq ffff888021faa400 timed out [ 1542.082257][ T96] null_blk: rq ffff888021faa580 timed out [ 1542.088039][ T96] null_blk: rq ffff888021faa700 timed out [ 1542.095577][ T96] null_blk: rq ffff888021faa880 timed out [ 1542.101360][ T96] null_blk: rq ffff888021faaa00 timed out [ 1542.107154][ T96] null_blk: rq ffff888021faab80 timed out [ 1542.112878][ T96] null_blk: rq ffff888021faad00 timed out [ 1542.118639][ T96] null_blk: rq ffff888021faae80 timed out [ 1542.124543][ T96] null_blk: rq ffff888021fab000 timed out [ 1542.130299][ T96] null_blk: rq ffff888021fab180 timed out [ 1542.136103][ T96] null_blk: rq ffff888021fab300 timed out [ 1542.141828][ T96] null_blk: rq ffff888021fab480 timed out [ 1542.147607][ T96] null_blk: rq ffff888021fab600 timed out [ 1542.153760][ T96] null_blk: rq ffff888021fab780 timed out [ 1542.159493][ T96] null_blk: rq ffff888021fab900 timed out [ 1542.165268][ T96] null_blk: rq ffff888021faba80 timed out [ 1542.171020][ T96] null_blk: rq ffff888021fabc00 timed out [ 1542.254756][ T96] null_blk: rq ffff888021fabd80 timed out [ 1542.260653][ T96] null_blk: rq ffff888021fabf00 timed out [ 1542.266452][ T96] null_blk: rq ffff888021fac080 timed out [ 1542.272183][ T96] null_blk: rq ffff888021fac200 timed out [ 1542.278174][ T96] null_blk: rq ffff888021fac380 timed out [ 1542.293785][ T96] null_blk: rq ffff888021fac500 timed out [ 1542.299668][ T96] null_blk: rq ffff888021fac680 timed out [ 1542.306178][ T96] null_blk: rq ffff888021fac800 timed out [ 1542.311949][ T96] null_blk: rq ffff888021fac980 timed out [ 1542.318220][ T96] null_blk: rq ffff888021facb00 timed out [ 1542.324049][ T96] null_blk: rq ffff888021facc80 timed out [ 1542.329890][ T96] null_blk: rq ffff888021face00 timed out [ 1542.335783][ T96] null_blk: rq ffff888021facf80 timed out [ 1542.341534][ T96] null_blk: rq ffff888021fad100 timed out [ 1542.347588][ T96] null_blk: rq ffff888021fad280 timed out [ 1542.353946][ T96] null_blk: rq ffff888021fad400 timed out [ 1542.360273][ T96] null_blk: rq ffff888021fad580 timed out [ 1542.367198][ T96] null_blk: rq ffff888021fad700 timed out [ 1542.373345][ T96] null_blk: rq ffff888021fad880 timed out [ 1542.379429][ T96] null_blk: rq ffff888021fada00 timed out [ 1542.386179][T18063] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1544.911178][T18063] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1545.325018][T18231] sg_write: data in/out 91/14 bytes for SCSI command 0x0-- guessing data in; [ 1545.325018][T18231] program syz.3.2833 not setting count and/or reply_len properly [ 1546.191224][ T1285] ieee802154 phy0 wpan0: encryption failed: -22 [ 1546.199577][ T9536] Bluetooth: hci0: unexpected event for opcode 0x2002 [ 1546.203688][ T1285] ieee802154 phy1 wpan1: encryption failed: -22 [ 1549.805633][T18063] veth0_vlan: entered promiscuous mode [ 1549.877461][T18063] veth1_vlan: entered promiscuous mode [ 1550.526007][T18063] veth0_macvtap: entered promiscuous mode [ 1550.551090][T18063] veth1_macvtap: entered promiscuous mode [ 1550.710833][T18063] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1550.830579][T18063] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1550.845335][T18063] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1551.051534][T18063] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1551.183579][T18063] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1551.242110][T18063] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1551.273988][T18063] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1551.383705][T18063] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1551.401079][T18063] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1551.420065][T18063] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1551.430764][T18063] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1551.499347][T18063] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1551.551853][T18063] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1551.684864][T18063] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1553.527504][T18063] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1553.537769][T18063] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1553.546769][T18063] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1553.579031][T18063] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1553.912742][ T60] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1553.943118][ T60] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1554.054710][ T1124] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1554.077446][ T1124] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1554.493814][T18105] usb 9-1: new full-speed USB device number 8 using dummy_hcd [ 1554.600212][ T9536] Bluetooth: hci0: unexpected event for opcode 0x2002 [ 1554.671542][T18105] usb 9-1: device descriptor read/64, error -71 [ 1555.100034][T18105] usb 9-1: new full-speed USB device number 9 using dummy_hcd [ 1555.445040][T18105] usb 9-1: device descriptor read/64, error -71 [ 1556.022794][T18105] usb usb9-port1: attempt power cycle [ 1556.503652][T18105] usb 9-1: new full-speed USB device number 10 using dummy_hcd [ 1556.563187][T18314] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1556.589548][T18105] usb 9-1: device descriptor read/8, error -71 [ 1557.234742][T18105] usb 9-1: new full-speed USB device number 11 using dummy_hcd [ 1557.463056][T18105] usb 9-1: device not accepting address 11, error -71 [ 1557.528280][T18105] usb usb9-port1: unable to enumerate USB device [ 1561.153088][ T5878] usb 1-1: new full-speed USB device number 21 using dummy_hcd [ 1561.593443][ T5878] usb 1-1: device descriptor read/64, error -71 [ 1561.885230][ T5878] usb 1-1: new full-speed USB device number 22 using dummy_hcd [ 1562.063249][ T5878] usb 1-1: device descriptor read/64, error -71 [ 1562.424665][ T5878] usb usb1-port1: attempt power cycle [ 1562.843150][ T5878] usb 1-1: new full-speed USB device number 23 using dummy_hcd [ 1562.888498][ T5878] usb 1-1: device descriptor read/8, error -71 [ 1563.263627][ T5878] usb 1-1: new full-speed USB device number 24 using dummy_hcd [ 1563.329813][ T5878] usb 1-1: device descriptor read/8, error -71 [ 1563.513351][ T5878] usb usb1-port1: unable to enumerate USB device [ 1565.012560][T18390] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1567.013120][ T5878] usb 6-1: new full-speed USB device number 2 using dummy_hcd [ 1567.203307][ T5878] usb 6-1: device descriptor read/64, error -71 [ 1567.493163][ T5878] usb 6-1: new full-speed USB device number 3 using dummy_hcd [ 1567.665169][ T5878] usb 6-1: device descriptor read/64, error -71 [ 1567.794088][ T5878] usb usb6-port1: attempt power cycle [ 1568.283201][ T5878] usb 6-1: new full-speed USB device number 4 using dummy_hcd [ 1568.317512][ T5878] usb 6-1: device descriptor read/8, error -71 [ 1568.743278][ T5878] usb 6-1: new full-speed USB device number 5 using dummy_hcd [ 1568.778140][ T5878] usb 6-1: device descriptor read/8, error -71 [ 1568.914257][ T5878] usb usb6-port1: unable to enumerate USB device [ 1568.921338][ T9536] Bluetooth: hci0: unexpected event for opcode 0x2002 [ 1569.399347][T18430] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1572.453296][ T8] usb 4-1: new full-speed USB device number 17 using dummy_hcd [ 1572.633106][ T8] usb 4-1: device descriptor read/64, error -71 [ 1573.565541][ T8] usb 4-1: new full-speed USB device number 18 using dummy_hcd [ 1573.747939][ T8] usb 4-1: device descriptor read/64, error -71 [ 1573.898661][ T8] usb usb4-port1: attempt power cycle [ 1574.148179][T18475] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1574.823125][ T9536] Bluetooth: hci4: command 0x0405 tx timeout [ 1575.987706][T18489] sg_write: data in/out 91/14 bytes for SCSI command 0x0-- guessing data in; [ 1575.987706][T18489] program syz.5.2914 not setting count and/or reply_len properly [ 1577.322482][ T9536] Bluetooth: hci0: unexpected event for opcode 0x2002 [ 1577.592943][T18502] ntfs3: nullb0: Primary boot signature is not NTFS. [ 1577.633441][T18502] ntfs3: nullb0: try to read out of volume at offset 0x3e7ffffe00 [ 1577.859558][T18506] vcan0: tx drop: invalid da for name 0x00000000000000f5 [ 1578.793138][ T8] usb 1-1: new full-speed USB device number 25 using dummy_hcd [ 1578.953290][ T8] usb 1-1: device descriptor read/64, error -71 [ 1579.543083][ T8] usb 1-1: new full-speed USB device number 26 using dummy_hcd [ 1579.845321][ T8] usb 1-1: device descriptor read/64, error -71 [ 1580.649558][ T8] usb usb1-port1: attempt power cycle [ 1580.934614][T18525] sg_write: data in/out 91/14 bytes for SCSI command 0x0-- guessing data in; [ 1580.934614][T18525] program syz.8.2926 not setting count and/or reply_len properly [ 1581.393512][ T8] usb 1-1: new full-speed USB device number 27 using dummy_hcd [ 1581.424607][ T8] usb 1-1: device descriptor read/8, error -71 [ 1584.963072][T18561] sg_write: data in/out 91/14 bytes for SCSI command 0x0-- guessing data in; [ 1584.963072][T18561] program syz.8.2937 not setting count and/or reply_len properly [ 1585.776626][T18563] ntfs3: nullb0: Primary boot signature is not NTFS. [ 1585.783666][T18563] ntfs3: nullb0: try to read out of volume at offset 0x3e7ffffe00 [ 1590.087760][T18605] ntfs3: nullb0: Primary boot signature is not NTFS. [ 1590.123574][T18605] ntfs3: nullb0: try to read out of volume at offset 0x3e7ffffe00 [ 1594.053023][T18637] sg_write: data in/out 91/14 bytes for SCSI command 0x0-- guessing data in; [ 1594.053023][T18637] program syz.3.2961 not setting count and/or reply_len properly [ 1594.280962][T18638] syz.0.2962: attempt to access beyond end of device [ 1594.280962][T18638] nbd0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1594.294361][T18638] SQUASHFS error: Failed to read block 0x0: -5 [ 1594.300553][T18638] unable to read squashfs_super_block [ 1594.335185][T18638] fuse: Bad value for 'fd' [ 1596.903042][T18674] sg_write: data in/out 91/14 bytes for SCSI command 0x0-- guessing data in; [ 1596.903042][T18674] program syz.5.2973 not setting count and/or reply_len properly [ 1597.407987][T18678] syz.5.2974: attempt to access beyond end of device [ 1597.407987][T18678] nbd5: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1597.421158][T18678] SQUASHFS error: Failed to read block 0x0: -5 [ 1597.427519][T18678] unable to read squashfs_super_block [ 1597.435831][T18678] fuse: Bad value for 'fd' [ 1600.013162][T18703] ntfs3: nullb0: Primary boot signature is not NTFS. [ 1600.021247][T18703] ntfs3: nullb0: try to read out of volume at offset 0x3e7ffffe00 [ 1600.622302][T18706] syz.5.2984: attempt to access beyond end of device [ 1600.622302][T18706] nbd5: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1600.635578][T18706] SQUASHFS error: Failed to read block 0x0: -5 [ 1600.641781][T18706] unable to read squashfs_super_block [ 1600.688444][T18705] fuse: Bad value for 'fd' [ 1602.863756][T18729] sg_write: data in/out 91/14 bytes for SCSI command 0x0-- guessing data in; [ 1602.863756][T18729] program syz.3.2992 not setting count and/or reply_len properly [ 1603.692302][T18736] ntfs3: nullb0: Primary boot signature is not NTFS. [ 1603.716494][T18736] ntfs3: nullb0: try to read out of volume at offset 0x3e7ffffe00 [ 1604.289170][T18740] syz.3.2996: attempt to access beyond end of device [ 1604.289170][T18740] nbd3: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1604.394424][T18740] SQUASHFS error: Failed to read block 0x0: -5 [ 1604.402359][T18740] unable to read squashfs_super_block [ 1604.773409][T18740] fuse: Bad value for 'fd' [ 1607.624141][ T1285] ieee802154 phy0 wpan0: encryption failed: -22 [ 1607.630513][ T1285] ieee802154 phy1 wpan1: encryption failed: -22 [ 1608.017233][ T5777] usb 9-1: new full-speed USB device number 12 using dummy_hcd [ 1608.215280][ T5777] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1608.238803][ T5777] usb 9-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1608.290253][ T5777] usb 9-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 1608.313117][ T5777] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1608.321236][ T5777] usb 9-1: Product: syz [ 1608.325890][ T5777] usb 9-1: Manufacturer: syz [ 1608.330623][ T5777] usb 9-1: SerialNumber: syz [ 1608.342391][ T5777] usb 9-1: config 0 descriptor?? [ 1608.649403][T18776] syz.5.3007: attempt to access beyond end of device [ 1608.649403][T18776] nbd5: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1608.904399][T18776] SQUASHFS error: Failed to read block 0x0: -5 [ 1608.996484][T18776] unable to read squashfs_super_block [ 1609.085322][T18777] fuse: Bad value for 'fd' [ 1609.381029][ T9536] Bluetooth: hci4: unexpected event for opcode 0x2002 [ 1610.773582][ T23] usb 9-1: USB disconnect, device number 12 [ 1613.916290][T18818] syz.0.3018: attempt to access beyond end of device [ 1613.916290][T18818] nbd0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1613.929391][T18818] SQUASHFS error: Failed to read block 0x0: -5 [ 1613.936188][T18818] unable to read squashfs_super_block [ 1613.944516][T18818] fuse: Bad value for 'fd' [ 1614.761511][T18819] syz.3.3019: attempt to access beyond end of device [ 1614.761511][T18819] nbd3: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1614.807747][T18819] SQUASHFS error: Failed to read block 0x0: -5 [ 1614.814929][T18819] unable to read squashfs_super_block [ 1614.884282][T18823] (null): rxe_set_mtu: Set mtu to 1024 [ 1614.930535][T18823] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 1617.988076][T18852] ntfs3: nullb0: Primary boot signature is not NTFS. [ 1618.008662][T18852] ntfs3: nullb0: try to read out of volume at offset 0x3e7ffffe00 [ 1620.867985][T18877] syz.0.3038: attempt to access beyond end of device [ 1620.867985][T18877] nbd0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1620.886764][T18877] SQUASHFS error: Failed to read block 0x0: -5 [ 1620.894553][T18877] unable to read squashfs_super_block [ 1621.014988][T18877] fuse: Bad value for 'fd' [ 1621.021961][ T8] usb 4-1: new full-speed USB device number 20 using dummy_hcd [ 1621.271416][ T8] usb 4-1: config 0 has an invalid interface number: 251 but max is 0 [ 1621.401494][ T8] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1621.466625][ T8] usb 4-1: config 0 has no interface number 0 [ 1621.477600][ T8] usb 4-1: config 0 interface 251 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 1621.511287][ T8] usb 4-1: config 0 interface 251 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1621.529260][ T8] usb 4-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 1621.543308][ T8] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1621.551431][ T8] usb 4-1: Product: syz [ 1621.560244][ T8] usb 4-1: Manufacturer: syz [ 1621.703026][ T8] usb 4-1: SerialNumber: syz [ 1621.729788][ T8] usb 4-1: config 0 descriptor?? [ 1621.748857][ T8] asix: probe of 4-1:0.251 failed with error -22 [ 1623.763421][ T8] usb 4-1: USB disconnect, device number 20 [ 1624.155414][T18900] ntfs3: nullb0: Primary boot signature is not NTFS. [ 1624.182820][T18900] ntfs3: nullb0: try to read out of volume at offset 0x3e7ffffe00 [ 1625.753061][ T5878] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 1626.043942][ T5878] usb 1-1: Using ep0 maxpacket: 8 [ 1626.203713][ T5878] usb 1-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 1626.288702][ T5878] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1626.581223][ T5878] pvrusb2: Hardware description: Terratec Grabster AV400 [ 1626.730391][ T5878] pvrusb2: ********** [ 1626.753105][ T5878] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 1626.783196][ T5878] pvrusb2: Important functionality might not be entirely working. [ 1626.795939][ T5878] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 1626.843172][ T5878] pvrusb2: ********** [ 1626.854150][ T2320] pvrusb2: Invalid write control endpoint [ 1627.143420][ T5878] usb 4-1: new full-speed USB device number 21 using dummy_hcd [ 1627.292327][ T8] usb 1-1: USB disconnect, device number 29 [ 1627.390965][ T5878] usb 4-1: config 0 has an invalid interface number: 251 but max is 0 [ 1627.392890][ T2320] pvrusb2: Invalid write control endpoint [ 1627.399368][ T5878] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1627.423276][ T5878] usb 4-1: config 0 has no interface number 0 [ 1627.430489][ T5878] usb 4-1: config 0 interface 251 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 1627.440012][ T2320] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 1627.441588][ T5878] usb 4-1: config 0 interface 251 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1627.479671][ T5878] usb 4-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 1627.489398][ T5878] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1627.497582][ T5878] usb 4-1: Product: syz [ 1627.502135][ T5878] usb 4-1: Manufacturer: syz [ 1627.506962][ T5878] usb 4-1: SerialNumber: syz [ 1627.542276][ T5878] usb 4-1: config 0 descriptor?? [ 1627.575630][ T5878] asix: probe of 4-1:0.251 failed with error -22 [ 1627.580316][ T2320] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 1627.625297][ T2320] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 1627.647409][ T2320] pvrusb2: Device being rendered inoperable [ 1627.656349][ T2320] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 1627.666201][ T2320] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 1627.690732][ T2320] pvrusb2: Attached sub-driver cx25840 [ 1627.697971][ T2320] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 1627.712620][ T2320] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 1628.057649][T18932] syz.0.3053: attempt to access beyond end of device [ 1628.057649][T18932] nbd0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1628.075843][T18932] SQUASHFS error: Failed to read block 0x0: -5 [ 1628.083039][T18932] unable to read squashfs_super_block [ 1628.355693][T18932] fuse: Bad value for 'fd' [ 1630.322221][T18105] usb 4-1: USB disconnect, device number 21 [ 1633.774790][T17366] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1633.796724][T17366] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1633.822790][T17366] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1633.852679][T17366] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1633.862701][T17366] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 1633.870788][T17366] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1634.040038][ T7579] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1634.210221][ T7579] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1634.324689][ T7579] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1634.518269][ T7579] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1636.000355][ T9536] Bluetooth: hci2: command tx timeout [ 1636.699263][T18975] chnl_net:caif_netlink_parms(): no params data found [ 1637.157181][T19001] ntfs3: nullb0: Primary boot signature is not NTFS. [ 1637.164198][T19001] ntfs3: nullb0: try to read out of volume at offset 0x3e7ffffe00 [ 1637.835483][T18975] bridge0: port 1(bridge_slave_0) entered blocking state [ 1637.842860][T18975] bridge0: port 1(bridge_slave_0) entered disabled state [ 1637.876759][T18975] bridge_slave_0: entered allmulticast mode [ 1637.898091][T18975] bridge_slave_0: entered promiscuous mode [ 1637.963891][T18975] bridge0: port 2(bridge_slave_1) entered blocking state [ 1637.972743][T18975] bridge0: port 2(bridge_slave_1) entered disabled state [ 1637.998653][T18975] bridge_slave_1: entered allmulticast mode [ 1638.013098][ T9536] Bluetooth: hci2: command tx timeout [ 1638.039354][T18975] bridge_slave_1: entered promiscuous mode [ 1638.570246][T18975] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1638.700933][T18975] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1639.224831][T18975] team0: Port device team_slave_0 added [ 1639.270732][T18975] team0: Port device team_slave_1 added [ 1639.587981][T18975] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1639.636487][T18975] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1639.739376][T18975] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1639.800252][ T7579] hsr_slave_0: left promiscuous mode [ 1639.819392][ T7579] hsr_slave_1: left promiscuous mode [ 1639.836488][ T7579] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1639.844810][ T7579] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1639.860986][ T7579] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1639.869088][ T7579] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1639.883815][ T7579] bridge_slave_1: left allmulticast mode [ 1639.889869][ T7579] bridge_slave_1: left promiscuous mode [ 1639.898504][ T7579] bridge0: port 2(bridge_slave_1) entered disabled state [ 1639.923575][ T7579] bridge_slave_0: left allmulticast mode [ 1639.929589][ T7579] bridge_slave_0: left promiscuous mode [ 1639.951013][ T7579] bridge0: port 1(bridge_slave_0) entered disabled state [ 1640.103154][ T9536] Bluetooth: hci2: command tx timeout [ 1640.424562][ T7579] veth1_macvtap: left promiscuous mode [ 1640.430388][ T7579] veth0_macvtap: left promiscuous mode [ 1641.262600][ T7579] veth1_vlan: left promiscuous mode [ 1641.283743][ T7579] veth0_vlan: left promiscuous mode [ 1642.173927][ T9536] Bluetooth: hci2: command tx timeout [ 1642.590642][ T7579] team0 (unregistering): Port device team_slave_1 removed [ 1642.655354][ T7579] team0 (unregistering): Port device team_slave_0 removed [ 1642.719486][ T7579] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1642.782580][ T7579] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1643.498222][ T7579] bond0 (unregistering): Released all slaves [ 1643.612202][T18975] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1643.619804][T18975] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1643.646293][T18975] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1643.794856][T18975] hsr_slave_0: entered promiscuous mode [ 1643.819407][T18975] hsr_slave_1: entered promiscuous mode [ 1644.125696][T19044] ntfs3: nullb0: Primary boot signature is not NTFS. [ 1644.193398][T19044] ntfs3: nullb0: try to read out of volume at offset 0x3e7ffffe00 [ 1645.452695][T18975] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 1645.473625][T18975] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 1645.495400][T18975] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 1645.525616][T18975] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 1645.724659][T18975] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1645.762799][T18975] 8021q: adding VLAN 0 to HW filter on device team0 [ 1645.780050][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 1645.788813][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1645.819352][ T2949] bridge0: port 2(bridge_slave_1) entered blocking state [ 1645.826544][ T2949] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1646.230980][T18975] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1647.171881][T18975] veth0_vlan: entered promiscuous mode [ 1647.262859][T18975] veth1_vlan: entered promiscuous mode [ 1647.388994][T18975] veth0_macvtap: entered promiscuous mode [ 1647.421677][T18975] veth1_macvtap: entered promiscuous mode [ 1647.470658][T18975] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1647.487517][T18975] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1647.497604][T18975] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1647.513168][T18975] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1647.523772][T18975] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1647.537683][T18975] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1647.570478][T18975] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1647.598955][T18975] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1647.609697][T18975] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1647.621675][T18975] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1647.632849][T18975] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1647.646772][T18975] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1647.657436][T18975] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1647.669284][T18975] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1647.689551][T18975] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1647.699365][T18975] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1647.708246][T18975] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1647.718699][T18975] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1647.823265][ T5878] usb 1-1: new full-speed USB device number 30 using dummy_hcd [ 1647.847900][ T2949] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1647.869908][ T2949] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1647.920840][T18169] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1647.930020][T18169] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1648.015848][ T5878] usb 1-1: config 0 has an invalid interface number: 251 but max is 0 [ 1648.047610][ T5878] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1648.058968][ T5878] usb 1-1: config 0 has no interface number 0 [ 1648.066956][ T5878] usb 1-1: config 0 interface 251 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1648.122645][ T5878] usb 1-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 1648.131985][ T5878] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1648.143133][ T5878] usb 1-1: Product: syz [ 1648.147541][ T5878] usb 1-1: Manufacturer: syz [ 1648.152310][ T5878] usb 1-1: SerialNumber: syz [ 1648.187019][ T5878] usb 1-1: config 0 descriptor?? [ 1648.238933][ T5878] asix: probe of 1-1:0.251 failed with error -22 [ 1648.338131][T18105] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 1648.703443][T18105] usb 9-1: Using ep0 maxpacket: 32 [ 1648.755580][T18105] usb 9-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xA6, skipping [ 1648.768736][T18105] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 255, changing to 11 [ 1648.780670][T18105] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 59391, setting to 1024 [ 1648.795342][T18105] usb 9-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 1648.812606][T18105] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1648.842653][T18105] usb 9-1: Product: syz [ 1648.847360][T18105] usb 9-1: Manufacturer: syz [ 1648.852239][T18105] usb 9-1: SerialNumber: syz [ 1648.864255][T18105] usb 9-1: config 0 descriptor?? [ 1650.300055][ T9536] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 1650.313520][ T9536] CPU: 1 PID: 9536 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 1650.321117][ T9536] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1650.331214][ T9536] Workqueue: hci2 hci_rx_work [ 1650.335955][ T9536] Call Trace: [ 1650.339261][ T9536] [ 1650.342226][ T9536] dump_stack_lvl+0x16c/0x230 [ 1650.346949][ T9536] ? show_regs_print_info+0x20/0x20 [ 1650.352182][ T9536] ? load_image+0x3b0/0x3b0 [ 1650.356741][ T9536] sysfs_create_dir_ns+0x256/0x280 [ 1650.361898][ T9536] ? hci_rx_work+0x43a/0xd80 [ 1650.366525][ T9536] ? sysfs_warn_dup+0xa0/0xa0 [ 1650.371250][ T9536] ? do_raw_spin_unlock+0x121/0x230 [ 1650.376579][ T9536] kobject_add_internal+0x6b8/0xc70 [ 1650.381837][ T9536] kobject_add+0x156/0x220 [ 1650.386298][ T9536] ? __rwlock_init+0x150/0x150 [ 1650.391102][ T9536] ? kobject_init+0x1e0/0x1e0 [ 1650.395827][ T9536] ? _raw_spin_unlock+0x28/0x40 [ 1650.400720][ T9536] ? get_device_parent+0x366/0x390 [ 1650.405877][ T9536] device_add+0x408/0xc20 [ 1650.410263][ T9536] hci_conn_add_sysfs+0xd5/0x1e0 [ 1650.415256][ T9536] le_conn_complete_evt+0xc37/0x1220 [ 1650.420576][ T9536] ? hci_event_packet+0x4a7/0x1210 [ 1650.425739][ T9536] ? trace_contention_end+0x39/0xe0 [ 1650.430993][ T9536] ? hci_le_big_info_adv_report_evt+0x8e0/0x8e0 [ 1650.437267][ T9536] ? __copy_skb_header+0xa7/0x550 [ 1650.442330][ T9536] ? __mutex_unlock_slowpath+0x1a2/0x6a0 [ 1650.448006][ T9536] ? skb_pull_data+0xfb/0x200 [ 1650.452729][ T9536] hci_le_conn_complete_evt+0x187/0x440 [ 1650.458318][ T9536] ? hci_remote_host_features_evt+0x160/0x160 [ 1650.464428][ T9536] hci_event_packet+0x795/0x1210 [ 1650.469415][ T9536] ? bis_list+0x290/0x290 [ 1650.473791][ T9536] ? kcov_remote_start+0x2b/0x7f0 [ 1650.478940][ T9536] ? hci_send_to_monitor+0xd7/0x4f0 [ 1650.484183][ T9536] hci_rx_work+0x43a/0xd80 [ 1650.488658][ T9536] ? process_scheduled_works+0x957/0x15b0 [ 1650.494429][ T9536] process_scheduled_works+0xa45/0x15b0 [ 1650.500047][ T9536] ? assign_work+0x400/0x400 [ 1650.504680][ T9536] ? assign_work+0x39e/0x400 [ 1650.509315][ T9536] worker_thread+0xa55/0xfc0 [ 1650.513946][ T9536] ? _raw_spin_unlock_irqrestore+0xae/0x110 [ 1650.519894][ T9536] kthread+0x2fa/0x390 [ 1650.523987][ T9536] ? pr_cont_work+0x560/0x560 [ 1650.528701][ T9536] ? kthread_blkcg+0xd0/0xd0 [ 1650.533320][ T9536] ret_from_fork+0x48/0x80 [ 1650.537852][ T9536] ? kthread_blkcg+0xd0/0xd0 [ 1650.542467][ T9536] ret_from_fork_asm+0x11/0x20 [ 1650.547283][ T9536] [ 1650.585334][T18105] usb 1-1: USB disconnect, device number 30 [ 1650.596048][ T9536] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 1650.626465][ T9536] Bluetooth: hci2: failed to register connection device [ 1651.087345][T18105] usb 9-1: USB disconnect, device number 13 [ 1652.653090][ T9536] Bluetooth: hci2: command tx timeout [ 1654.655218][ T9536] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 1654.665165][ T9536] Bluetooth: hci2: Injecting HCI hardware error event [ 1654.677035][ T9536] Bluetooth: hci2: hardware error 0x00 [ 1657.374899][ T9536] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 1658.250010][ T2949] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1658.401120][ T2949] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1658.460323][T11277] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1658.472328][T11277] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1658.481754][T11277] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1658.511929][ T2949] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1658.538003][T11277] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1658.550943][T11277] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 1658.561915][T11277] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1658.718299][ T2949] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1659.473759][ T8] usb 8-1: new high-speed USB device number 14 using dummy_hcd [ 1659.653826][ T2949] tipc: Disabling bearer [ 1659.698684][ T2949] tipc: Left network mode [ 1659.707276][ T8] usb 8-1: config 1 interface 0 altsetting 3 bulk endpoint 0x1 has invalid maxpacket 64 [ 1659.727556][ T8] usb 8-1: config 1 interface 0 has no altsetting 0 [ 1659.751892][ T8] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 1659.771411][ T8] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1659.803095][ T8] usb 8-1: Product: syz [ 1659.813937][ T8] usb 8-1: Manufacturer: syz [ 1659.830047][ T8] usb 8-1: SerialNumber: syz [ 1659.841685][T19155] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 1659.885907][T19151] chnl_net:caif_netlink_parms(): no params data found [ 1660.165851][ T8] usb 8-1: USB disconnect, device number 14 [ 1660.299041][T19151] bridge0: port 1(bridge_slave_0) entered blocking state [ 1660.320834][T19151] bridge0: port 1(bridge_slave_0) entered disabled state [ 1660.337025][T19151] bridge_slave_0: entered allmulticast mode [ 1660.355863][T19151] bridge_slave_0: entered promiscuous mode [ 1660.402120][T19151] bridge0: port 2(bridge_slave_1) entered blocking state [ 1660.410290][T19151] bridge0: port 2(bridge_slave_1) entered disabled state [ 1660.423872][T19151] bridge_slave_1: entered allmulticast mode [ 1660.438171][T19151] bridge_slave_1: entered promiscuous mode [ 1660.628235][T19151] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1660.651639][T19151] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1660.653961][ T9536] Bluetooth: hci0: command tx timeout [ 1660.808370][T19151] team0: Port device team_slave_0 added [ 1660.837981][T19151] team0: Port device team_slave_1 added [ 1660.930346][T19151] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1660.937829][T19151] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1660.965081][T19151] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1661.020433][T19151] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1661.029466][T19151] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1661.058873][T19151] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1661.289081][T19151] hsr_slave_0: entered promiscuous mode [ 1661.327014][T19151] hsr_slave_1: entered promiscuous mode [ 1661.350022][T19151] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1661.360860][T19151] Cannot create hsr debugfs directory [ 1661.682816][ T2949] hsr_slave_0: left promiscuous mode [ 1661.689604][ T2949] hsr_slave_1: left promiscuous mode [ 1661.696923][ T2949] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1661.704932][ T2949] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1661.713736][ T2949] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1661.726223][ T2949] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1661.735893][ T2949] bridge_slave_1: left promiscuous mode [ 1661.742487][ T2949] bridge0: port 2(bridge_slave_1) entered disabled state [ 1661.754917][ T2949] bridge_slave_0: left allmulticast mode [ 1661.760952][ T2949] bridge_slave_0: left promiscuous mode [ 1661.767870][ T2949] bridge0: port 1(bridge_slave_0) entered disabled state [ 1661.812811][ T2949] team_slave_0: left promiscuous mode [ 1661.818412][ T2949] team_slave_1: left promiscuous mode [ 1661.831185][ T2949] veth1_macvtap: left promiscuous mode [ 1661.837098][ T2949] veth0_macvtap: left promiscuous mode [ 1661.843613][ T2949] veth1_vlan: left promiscuous mode [ 1661.849121][ T2949] veth0_vlan: left promiscuous mode [ 1662.736791][ T9536] Bluetooth: hci0: command tx timeout [ 1664.931287][ T9536] Bluetooth: hci0: command tx timeout [ 1665.116084][T19190] ntfs3: nullb0: Primary boot signature is not NTFS. [ 1665.123067][T19190] ntfs3: nullb0: try to read out of volume at offset 0x3e7ffffe00 [ 1665.424006][ T2949] team0 (unregistering): Port device team_slave_1 removed [ 1665.541193][ T2949] team0 (unregistering): Port device team_slave_0 removed [ 1665.632056][T19198] syz.7.3124: attempt to access beyond end of device [ 1665.632056][T19198] nbd7: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1665.645694][T19198] SQUASHFS error: Failed to read block 0x0: -5 [ 1665.652238][T19198] unable to read squashfs_super_block [ 1665.695256][ T2949] bond0 (unregistering): (slave c@0Ù): Releasing backup interface [ 1665.704904][T19198] (null): rxe_set_mtu: Set mtu to 1024 [ 1665.718580][T19198] rdma_rxe: rxe_newlink: failed to add team_slave_0 [ 1665.805091][ T2949] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1666.772392][ T2949] bond0 (unregistering): Released all slaves [ 1666.973489][ T9536] Bluetooth: hci0: command tx timeout [ 1668.391498][ T2949] ------------[ cut here ]------------ [ 1668.397771][ T2949] WARNING: CPU: 0 PID: 2949 at net/xfrm/xfrm_state.c:2997 xfrm_state_fini+0x25c/0x2b0 [ 1668.407747][ T2949] Modules linked in: [ 1668.411848][ T2949] CPU: 0 PID: 2949 Comm: kworker/u4:9 Not tainted syzkaller #0 [ 1668.419575][ T2949] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1668.429774][ T2949] Workqueue: netns cleanup_net [ 1668.434654][ T2949] RIP: 0010:xfrm_state_fini+0x25c/0x2b0 [ 1668.440258][ T2949] Code: 5c 41 5d 41 5e 41 5f 5d e9 81 20 00 00 e8 fc b7 66 f8 0f 0b e9 2c fe ff ff e8 f0 b7 66 f8 0f 0b e9 91 fe ff ff e8 e4 b7 66 f8 <0f> 0b 43 80 3c 2c 00 0f 85 fa fe ff ff e9 fd fe ff ff e8 cd b7 66 [ 1668.460301][ T2949] RSP: 0018:ffffc9000bcf7a98 EFLAGS: 00010293 [ 1668.466939][ T2949] RAX: ffffffff891edfbc RBX: ffff88805cecd7c0 RCX: ffff88802b899e00 [ 1668.475305][ T2949] RDX: 0000000000000000 RSI: ffffffff8aaabca0 RDI: ffffffff8afc71c0 [ 1668.483356][ T2949] RBP: 0000000000000040 R08: ffffffff90da650f R09: 1ffffffff21b4ca1 [ 1668.491373][ T2949] R10: dffffc0000000000 R11: fffffbfff21b4ca2 R12: 1ffff1100b9d9d6c [ 1668.499485][ T2949] R13: dffffc0000000000 R14: ffff88805ceceb60 R15: ffff88806acac700 [ 1668.507603][ T2949] FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 1668.517074][ T2949] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1668.523832][ T2949] CR2: 000000110c2e5c3d CR3: 000000005d605000 CR4: 00000000003506f0 [ 1668.531868][ T2949] Call Trace: [ 1668.535287][ T2949] [ 1668.538268][ T2949] xfrm_net_exit+0x25/0x60 [ 1668.542736][ T2949] cleanup_net+0x6f4/0xb90 [ 1668.547256][ T2949] ? ops_free_list+0x3b0/0x3b0 [ 1668.552080][ T2949] ? _raw_spin_unlock_irq+0x23/0x50 [ 1668.557391][ T2949] ? process_scheduled_works+0x957/0x15b0 [ 1668.563180][ T2949] ? process_scheduled_works+0x957/0x15b0 [ 1668.568956][ T2949] process_scheduled_works+0xa45/0x15b0 [ 1668.574577][ T2949] ? assign_work+0x400/0x400 [ 1668.579190][ T2949] ? assign_work+0x39e/0x400 [ 1668.583886][ T2949] worker_thread+0xa55/0xfc0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1668.588492][ T2949] ? _raw_spin_unlock_irqrestore+0xae/0x110 [ 1668.594470][ T2949] ? _raw_spin_unlock+0x40/0x40 [ 1668.599362][ T2949] ? _raw_spin_unlock_irqrestore+0x86/0x110 [ 1668.605364][ T2949] kthread+0x2fa/0x390 [ 1668.609483][ T2949] ? pr_cont_work+0x560/0x560 [ 1668.614568][ T2949] ? kthread_blkcg+0xd0/0xd0 [ 1668.619214][ T2949] ret_from_fork+0x48/0x80 [ 1668.624148][ T2949] ? kthread_blkcg+0xd0/0xd0 [ 1668.629163][ T2949] ret_from_fork_asm+0x11/0x20 [ 1668.634201][ T2949] [ 1668.637234][ T2949] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1668.644518][ T2949] CPU: 0 PID: 2949 Comm: kworker/u4:9 Not tainted syzkaller #0 [ 1668.652076][ T2949] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1668.662142][ T2949] Workqueue: netns cleanup_net [ 1668.666929][ T2949] Call Trace: [ 1668.670216][ T2949] [ 1668.673158][ T2949] dump_stack_lvl+0x16c/0x230 [ 1668.677869][ T2949] ? show_regs_print_info+0x20/0x20 [ 1668.683088][ T2949] ? load_image+0x3b0/0x3b0 [ 1668.687619][ T2949] panic+0x2c0/0x710 [ 1668.691543][ T2949] ? bpf_jit_dump+0xd0/0xd0 [ 1668.696095][ T2949] ? ret_from_fork_asm+0x11/0x20 [ 1668.701095][ T2949] __warn+0x2e0/0x470 [ 1668.705127][ T2949] ? xfrm_state_fini+0x25c/0x2b0 [ 1668.710119][ T2949] ? xfrm_state_fini+0x25c/0x2b0 [ 1668.715109][ T2949] report_bug+0x2be/0x4f0 [ 1668.719491][ T2949] ? xfrm_state_fini+0x25c/0x2b0 [ 1668.724474][ T2949] ? xfrm_state_fini+0x25c/0x2b0 [ 1668.729430][ T2949] ? xfrm_state_fini+0x25e/0x2b0 [ 1668.734382][ T2949] handle_bug+0xcf/0x120 [ 1668.738646][ T2949] exc_invalid_op+0x1a/0x50 [ 1668.743180][ T2949] asm_exc_invalid_op+0x1a/0x20 [ 1668.748072][ T2949] RIP: 0010:xfrm_state_fini+0x25c/0x2b0 [ 1668.753657][ T2949] Code: 5c 41 5d 41 5e 41 5f 5d e9 81 20 00 00 e8 fc b7 66 f8 0f 0b e9 2c fe ff ff e8 f0 b7 66 f8 0f 0b e9 91 fe ff ff e8 e4 b7 66 f8 <0f> 0b 43 80 3c 2c 00 0f 85 fa fe ff ff e9 fd fe ff ff e8 cd b7 66 [ 1668.773288][ T2949] RSP: 0018:ffffc9000bcf7a98 EFLAGS: 00010293 [ 1668.779386][ T2949] RAX: ffffffff891edfbc RBX: ffff88805cecd7c0 RCX: ffff88802b899e00 [ 1668.787381][ T2949] RDX: 0000000000000000 RSI: ffffffff8aaabca0 RDI: ffffffff8afc71c0 [ 1668.795375][ T2949] RBP: 0000000000000040 R08: ffffffff90da650f R09: 1ffffffff21b4ca1 [ 1668.803413][ T2949] R10: dffffc0000000000 R11: fffffbfff21b4ca2 R12: 1ffff1100b9d9d6c [ 1668.811401][ T2949] R13: dffffc0000000000 R14: ffff88805ceceb60 R15: ffff88806acac700 [ 1668.819403][ T2949] ? xfrm_state_fini+0x25c/0x2b0 [ 1668.824384][ T2949] ? xfrm_state_fini+0x25c/0x2b0 [ 1668.829350][ T2949] xfrm_net_exit+0x25/0x60 [ 1668.833784][ T2949] cleanup_net+0x6f4/0xb90 [ 1668.838228][ T2949] ? ops_free_list+0x3b0/0x3b0 [ 1668.843023][ T2949] ? _raw_spin_unlock_irq+0x23/0x50 [ 1668.848252][ T2949] ? process_scheduled_works+0x957/0x15b0 [ 1668.853997][ T2949] ? process_scheduled_works+0x957/0x15b0 [ 1668.859737][ T2949] process_scheduled_works+0xa45/0x15b0 [ 1668.865323][ T2949] ? assign_work+0x400/0x400 [ 1668.869939][ T2949] ? assign_work+0x39e/0x400 [ 1668.874638][ T2949] worker_thread+0xa55/0xfc0 [ 1668.879252][ T2949] ? _raw_spin_unlock_irqrestore+0xae/0x110 [ 1668.885206][ T2949] ? _raw_spin_unlock+0x40/0x40 [ 1668.890075][ T2949] ? _raw_spin_unlock_irqrestore+0x86/0x110 [ 1668.896002][ T2949] kthread+0x2fa/0x390 [ 1668.900091][ T2949] ? pr_cont_work+0x560/0x560 [ 1668.904788][ T2949] ? kthread_blkcg+0xd0/0xd0 [ 1668.909397][ T2949] ret_from_fork+0x48/0x80 [ 1668.913846][ T2949] ? kthread_blkcg+0xd0/0xd0 [ 1668.918448][ T2949] ret_from_fork_asm+0x11/0x20 [ 1668.923246][ T2949] [ 1668.926637][ T2949] Kernel Offset: disabled [ 1668.931152][ T2949] Rebooting in 86400 seconds..