last executing test programs: 19.28599428s ago: executing program 2 (id=74): r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000580)='2\x00', 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x4e21, @multicast2}, 0x10) socket$inet_mptcp(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0xb, &(0x7f00000001c0)=ANY=[@ANYBLOB], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) mbind(&(0x7f0000d47000/0x1000)=nil, 0x1000, 0x2, &(0x7f0000000000)=0x40004, 0x8000100c, 0x6) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_tcp(0x2, 0x1, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_open_dev$cec(&(0x7f0000000200), 0xffffffffffffffff, 0x4ae60) ioctl$CEC_ADAP_S_LOG_ADDRS(r2, 0xc05c6104, &(0x7f0000000040)={'\x00', 0x0, 0x5, 0x2, 0xfffffff9, 0xe, "00000000020000000000002100", "00000001", "0052008f", "0000f807", ["fdd5c01000", "0000000000000400", "00f638000000007c0300", "00d703500200"]}) ioctl$CEC_TRANSMIT(r2, 0xc0386105, &(0x7f0000000100)={0xfffffffffffffbf7, 0x1, 0x2, 0x0, 0x4, 0x7ffe, "7f2c00", 0x1, 0x56, 0x1, 0xfa, 0x9, 0x1}) ioctl$CEC_ADAP_S_LOG_ADDRS(r2, 0xc05c6104, &(0x7f0000000140)={"4497acf4", 0xb, 0x4, 0x0, 0x3, 0x1000006, "5500578ea5f4ffffffeb00001000", "1575b859", '\x00', '\'q6O', ["aabe8459c62224475793e8a7", "7f9ce2d2c4f439ff80e1d1c8", "fa0700f22b42a3023be516d1"]}) 16.015523265s ago: executing program 2 (id=81): memfd_create(&(0x7f0000001780)='[\vx\'\xa5)\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\x01\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xc7\x91%||\xa0\x8ez\xadT\xc0\f\xe5\x89\xbf3:\x99\x1e\xbd`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x9d\x83\xcd\b\xd1\x02R\x9b7\xaf\xb7o\x01\xf9\x15\xb8KB\x04\x06\xa5\xea\x0ft\xbb\x1er\x14\xdb\xd1\xcd\xfd\x00'/146, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000280)='syzkaller\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x6) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) unshare(0x6a040000) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x14, &(0x7f0000000240)={0xffffffffffffffff}, 0x111, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r3, &(0x7f0000000040)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e22, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4}, r4}}, 0x30) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, 0x0, 0x0) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r5, 0x0, r5, 0x0, 0x156) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000a80)='./file0/file0\x00', 0x300000d, 0x1) socket$inet6_sctp(0xa, 0x5, 0x84) socket(0x25, 0x80805, 0x8001) 15.665005309s ago: executing program 4 (id=85): openat$random(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) syz_open_dev$sndpcmc(0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x20000014) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={0xffffffffffffffff, 0x58, &(0x7f0000000180)}, 0x10) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_io_uring_setup(0xefe, &(0x7f0000000140)={0x0, 0xcc19, 0x10806}, &(0x7f0000000100), &(0x7f00000000c0), &(0x7f0000000000)) creat(&(0x7f00000002c0)='./file0\x00', 0x0) r3 = getpid() r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000100)={r4, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000280)='./file0\x00', &(0x7f00000000c0), &(0x7f0000000180), 0x4, 0x2000000000000357, 0x0, r3}}, 0x3c) 14.134602234s ago: executing program 4 (id=86): r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000580)='2\x00', 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x4e21, @multicast2}, 0x10) socket$inet_mptcp(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0xb, &(0x7f00000001c0)=ANY=[@ANYBLOB], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) mbind(&(0x7f0000d47000/0x1000)=nil, 0x1000, 0x2, &(0x7f0000000000)=0x40004, 0x8000100c, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$cec(&(0x7f0000000200), 0xffffffffffffffff, 0x4ae60) ioctl$CEC_TRANSMIT(r3, 0xc0386105, &(0x7f0000000100)={0xfffffffffffffbf7, 0x1, 0x2, 0x0, 0x4, 0x7ffe, "7f2c00", 0x1, 0x56, 0x1, 0xfa, 0x9, 0x1}) ioctl$CEC_ADAP_S_LOG_ADDRS(r3, 0xc05c6104, &(0x7f0000000140)={"4497acf4", 0xb, 0x4, 0x0, 0x3, 0x1000006, "5500578ea5f4ffffffeb00001000", "1575b859", '\x00', '\'q6O', ["aabe8459c62224475793e8a7", "7f9ce2d2c4f439ff80e1d1c8", "fa0700f22b42a3023be516d1"]}) ppoll(&(0x7f0000000780)=[{r3, 0xd292}], 0x1, 0x0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004845}, 0x480c5) ioctl$EVIOCGPHYS(r1, 0x80404507, &(0x7f0000000040)=""/56) pselect6(0x40, &(0x7f0000000240)={0x4, 0x800000000000, 0xcd, 0x7d, 0x0, 0x8000, 0x4, 0x4}, 0x0, &(0x7f0000000080)={0x3ff, 0x6, 0xffffffffffffff7f, 0xff, 0x1, 0x2a, 0x80000006, 0x400}, 0x0, 0x0) 9.729604746s ago: executing program 0 (id=87): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'streebog512-generic\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x80000) r2 = accept4(r1, 0x0, 0x0, 0x80800) sendmmsg$inet6(r2, &(0x7f0000003b80)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000440)='&', 0x1}], 0x1}, 0xff03}], 0x1, 0x8000) 9.727742307s ago: executing program 2 (id=88): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x20004080) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$audio(0xffffff9c, 0x0, 0x48100, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) mremap(&(0x7f000007e000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f000007f000/0x1000)=nil) getrandom(&(0x7f0000000580)=""/265, 0xffffff3f, 0x3) 9.383218086s ago: executing program 4 (id=89): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r1, 0x2000) write$binfmt_aout(r1, 0x0, 0xffffffdb) 9.198412372s ago: executing program 1 (id=90): r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYRES16=r2, @ANYRES16=r2, @ANYRES64=r1], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x30) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = openat$binder_debug(0xffffff9c, 0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xc, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$UBLK_U_CMD_END_USER_RECOVERY(r3, 0xc0207511, &(0x7f0000000240)) r5 = socket$kcm(0x29, 0x2, 0x0) sendmmsg$inet(r5, &(0x7f00000028c0)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000280)="7fe1b3", 0x3}], 0x1}}, {{0x0, 0x0, &(0x7f0000001800)=[{&(0x7f0000001440)="85ac6755b3", 0x5}], 0x1}}], 0x2, 0x40) close(r5) socket$nl_rdma(0x10, 0x3, 0x14) syz_io_uring_setup(0x117a, 0x0, 0x0, &(0x7f0000000140), 0x0) r6 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r6, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000), 0x41, 0x0) write$nbd(r8, &(0x7f0000000340)={0x1000000, 0x0, 0x0, 0x0, 0x200000, "82b0cfc4337965941538be02000000000000000000007400a391793ba7f40000000000fdf700"/48}, 0x40) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000002c0)={'wlan0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000600000006"], 0x66) 8.579847197s ago: executing program 2 (id=91): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r1, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r1, &(0x7f0000000140)='\x00', 0x1, 0x24008084, &(0x7f00000001c0)={0xa, 0x2, 0xdfff, @loopback, 0x2}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000240)='yeah', 0x4) shutdown(r1, 0x1) r2 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r2, 0x2000) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1d00000007"], 0x50) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000540)={r2, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f00000000c0)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4, &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0], 0x0, 0xb9, &(0x7f0000000340)=[{}, {}, {}, {}, {}], 0x28, 0x10, &(0x7f0000000380), &(0x7f00000003c0), 0x8, 0x62, 0x8, 0x8, &(0x7f0000000400)}}, 0x10) bind$bt_hci(r3, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r3, &(0x7f0000000000), 0xd) 8.42734893s ago: executing program 3 (id=92): r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000580)='2\x00', 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x4e21, @multicast2}, 0x10) socket$inet_mptcp(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0xb, &(0x7f00000001c0)=ANY=[@ANYBLOB], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) mbind(&(0x7f0000d47000/0x1000)=nil, 0x1000, 0x2, &(0x7f0000000000)=0x40004, 0x8000100c, 0x6) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_tcp(0x2, 0x1, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_open_dev$cec(&(0x7f0000000200), 0xffffffffffffffff, 0x4ae60) ioctl$CEC_ADAP_S_LOG_ADDRS(r2, 0xc05c6104, &(0x7f0000000040)={'\x00', 0x0, 0x5, 0x2, 0xfffffff9, 0xe, "00000000020000000000002100", "00000001", "0052008f", "0000f807", ["fdd5c01000", "0000000000000400", "00f638000000007c0300", "00d703500200"]}) ioctl$CEC_TRANSMIT(r2, 0xc0386105, &(0x7f0000000100)={0xfffffffffffffbf7, 0x1, 0x2, 0x0, 0x4, 0x7ffe, "7f2c00", 0x1, 0x56, 0x1, 0xfa, 0x9, 0x1}) ioctl$CEC_ADAP_S_LOG_ADDRS(r2, 0xc05c6104, &(0x7f0000000140)={"4497acf4", 0xb, 0x4, 0x0, 0x3, 0x1000006, "5500578ea5f4ffffffeb00001000", "1575b859", '\x00', '\'q6O', ["aabe8459c62224475793e8a7", "7f9ce2d2c4f439ff80e1d1c8", "fa0700f22b42a3023be516d1"]}) 8.402137395s ago: executing program 2 (id=93): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f00000000c0)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000180)={@hyper, 0x1}) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r0, 0x7cb, 0x0) 7.951856008s ago: executing program 0 (id=94): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000000140)='\x00', 0x1, 0x24008084, &(0x7f00000001c0)={0xa, 0x2, 0xdfff, @loopback, 0x2}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000240)='yeah', 0x4) shutdown(r0, 0x1) 7.59980717s ago: executing program 4 (id=95): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='dctcp', 0x5) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) sendto$inet6(r0, &(0x7f0000000840)="a6", 0x1, 0x200080c0, &(0x7f00000001c0)={0xa, 0x2, 0x8000, @loopback, 0x8}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000140)='bic', 0x3) shutdown(r0, 0x1) 6.831800405s ago: executing program 4 (id=96): openat$random(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) syz_open_dev$sndpcmc(0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x0, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x20000014) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={0xffffffffffffffff, 0x58, &(0x7f0000000180)}, 0x10) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_io_uring_setup(0xefe, &(0x7f0000000140)={0x0, 0xcc19, 0x10806}, &(0x7f0000000100), &(0x7f00000000c0), &(0x7f0000000000)) creat(&(0x7f00000002c0)='./file0\x00', 0x0) r2 = getpid() r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000100)={r3, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000280)='./file0\x00', &(0x7f00000000c0), &(0x7f0000000180), 0x4, 0x2000000000000357, 0x0, r2}}, 0x3c) 6.365120014s ago: executing program 2 (id=97): socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0xc0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000180)=0x4, 0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) r3 = openat$cgroup_subtree(r2, &(0x7f00000006c0), 0x2, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f0000000500)) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000340), 0x2440, 0x0) ioctl$PTP_EXTTS_REQUEST2(r4, 0xc4c03d12, &(0x7f0000000040)={0x5, 0x4}) write$cgroup_subtree(r3, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r3, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) setreuid(0xee00, 0x0) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x181c82, 0x0) write$sequencer(r5, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000200)=[@timestamp, @timestamp], 0x2) r6 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r6, 0x0, 0x27, &(0x7f0000000100)={@multicast2, @local}, 0xc) syz_emit_ethernet(0x36, &(0x7f0000001800)={@link_local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x64, 0x4000, 0x4, 0x2, 0x0, @empty, @multicast2}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x10001}}}}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/21], 0x50) 6.329336996s ago: executing program 0 (id=98): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000740)={'wlan1\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000380)={0x20, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}]}, 0x20}}, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000001c0)={0x40, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_FRAME={0x22, 0x33, @action={{{}, {0x8}, @broadcast, @device_a, @from_mac=@broadcast, {0x0, 0x400}}, @ext_ch_sw={0x4, 0x4, {{0x0, 0x3, 0xe, 0xf9}, @void}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0xc0}, 0x0) 6.323782681s ago: executing program 3 (id=99): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, 0x0) chdir(&(0x7f0000000100)='./file0\x00') renameat2(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0xffffffffffffff9c, &(0x7f0000000f40)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2) 6.119457067s ago: executing program 1 (id=100): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWRULE={0x28, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @numgen={{0xb}, @void}}]}]}], {0x14}}, 0x50}}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$rtc(0xffffffffffffff9c, 0x0, 0x140, 0x0) syz_io_uring_setup(0xf00, 0x0, 0x0, 0x0, 0x0) pread64(r3, 0x0, 0x0, 0x9) getsockopt$IP_VS_SO_GET_SERVICE(0xffffffffffffffff, 0x0, 0x483, 0x0, 0x0) ioctl$KVM_GET_VCPU_EVENTS(r2, 0xc048aeca, &(0x7f0000000140)) 5.859421058s ago: executing program 3 (id=101): mmap(&(0x7f000038a000/0x1000)=nil, 0x1000, 0x1000004, 0x11, 0xffffffffffffffff, 0x201000) r0 = open(0x0, 0x143142, 0x80) ftruncate(r0, 0x2007ffb) openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x18da82, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) syz_open_dev$tty1(0xc, 0x4, 0x4) socket$can_j1939(0x1d, 0x2, 0x7) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x300, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, &(0x7f00000001c0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0xfffc, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f00000000c0)={0xfd, 0x0, 0xfe, 0x22, 0x0, 0x7, 0x6, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x3}, 0xe) shutdown(r1, 0x1) recvmmsg(r1, &(0x7f0000000840)=[{{0x0, 0x0, 0x0}}], 0x414, 0x0, 0x0) 5.524229598s ago: executing program 0 (id=102): r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@newtclass={0x24, 0x28, 0x5ea11b84c59b353c, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x4, 0x1}, {0xa, 0x10}, {0x7, 0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000040)=ANY=[], 0x0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$sock_int(r1, 0x1, 0x2d, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xf, &(0x7f0000000600)=0x9, 0x4) listen(r1, 0x7) syz_emit_ethernet(0x4a, &(0x7f0000000080)=ANY=[], 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000480)=ANY=[@ANYBLOB="48000000101400012abd7000fbdbdf2508004b001300000008000100666010720800030000210000280001000100000008004c080000000008c67ee237004c000100000008004a0073b5fa55f6a7e2be76c0a7e2e1e720ddeee952acca6db9019afcee3b691104515db65e91cbc7ce5aebe45c7bb168b48198b39601d2"], 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x4040) socket$kcm(0x10, 0x2, 0x10) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r5 = socket$inet_smc(0x2b, 0x1, 0x0) ppoll(&(0x7f0000000200)=[{r5, 0x4008}], 0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r5, 0x6, 0x21, &(0x7f0000000040)="5766b1020affff20c311df259149e300", 0x10) listen(r5, 0x0) ioctl$KVM_SET_MSRS(r4, 0xc048aeca, &(0x7f0000000100)={0x8, 0x0, [{0x0, 0x0, 0x7}, {0x400000b3, 0x0, 0x1}, {0x9bd, 0x0, 0x66}, {0x9a7, 0x0, 0x2000000f0a}, {0x809, 0x0, 0x3}, {0x879, 0x0, 0x8}, {0xada}, {0x827}]}) ioctl$KVM_SET_CPUID(0xffffffffffffffff, 0x4008ae8a, &(0x7f0000000380)={0x2, 0x0, [{0x0, 0x400, 0x9, 0x122, 0x1}, {0x1, 0x5, 0x7, 0xff, 0x8}]}) 5.501894648s ago: executing program 3 (id=103): openat$random(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) syz_open_dev$sndpcmc(0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000}, 0x94) 5.242430419s ago: executing program 1 (id=104): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000200)={0x11, 0x10, 0xfa00, {0x0}}, 0x18) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) getpgid(0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000014c0)=@base={0x6, 0x4, 0x2, 0x7, 0x0, 0x1, 0xe92}, 0x50) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={0xffffffffffffffff, r2}, 0xc) sendmsg$inet(0xffffffffffffffff, 0x0, 0xd007) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x50, 0x10, 0x401, 0xfffffffc, 0x0, {}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_STARTUP_QUERY_INTVL={0xc, 0x23, 0x7}, @IFLA_BR_PRIORITY={0x6, 0x6, 0x737}, @IFLA_BR_STP_STATE={0x8}]}}}]}, 0x50}}, 0x0) r3 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_REWIND(r3, 0xc0844123, &(0x7f0000000000)=0x6) 3.558260569s ago: executing program 0 (id=105): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x20004080) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$audio(0xffffff9c, 0x0, 0x48100, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) mremap(&(0x7f000007e000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f000007f000/0x1000)=nil) getrandom(&(0x7f0000000580)=""/265, 0xffffff3f, 0x3) 3.404728966s ago: executing program 1 (id=106): r0 = socket(0x11, 0x3, 0x1) setsockopt(r0, 0x107, 0xf, &(0x7f0000000100)="00008634", 0x4) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) sendmsg(r0, &(0x7f0000000180)={&(0x7f0000000040)=@xdp={0x2c, 0x8, r2, 0x6}, 0x80, 0x0}, 0x40011) 3.031135557s ago: executing program 0 (id=107): r0 = socket$inet6_udp(0xa, 0x2, 0x0) close(r0) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x14}}, 0x10) syz_usb_connect(0x5, 0x24, &(0x7f0000000c80)={{0x12, 0x1, 0x250, 0xe9, 0x97, 0x3f, 0x40, 0xc45, 0x800a, 0x5a9d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x3, 0x81, 0x90, 0x98, "", [{{0x9, 0x4, 0xf9, 0x7, 0x0, 0x6, 0xc2, 0x45, 0xe}}]}}]}}, &(0x7f0000000d80)={0x0, 0x0, 0x0, 0x0}) connect$inet(r3, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) connect$pppl2tp(r2, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x2, 0x0, 0x0, 0x0, {0xa, 0x0, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) r4 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r4, 0x1, 0x2c, &(0x7f0000000040)=0x80000001, 0x4) sendmmsg(r2, &(0x7f0000004380)=[{{0x0, 0x0, 0x0}}], 0x34000, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, 0x0) r6 = socket(0x10, 0x3, 0x4) sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000b80)=@newqdisc={0x40, 0x14, 0xf0b, 0xfffffffe, 0x0, {0x2, 0x0, 0x0, 0x0, {0x0, 0xb}, {0xfff1, 0x5}, {0x6, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_FLOW_MAX_RATE={0x8, 0x7, 0x1ff}, @TCA_FQ_FLOW_REFILL_DELAY={0x8, 0x9, 0x3}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x8000) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f00000000c0)={'pcl816\x00', [0x100, 0x7, 0x2, 0x1000, 0xe, 0x5, 0x79, 0x3, 0x80008, 0x0, 0xffffffff, 0x1, 0x8, 0x1, 0x100, 0xfd, 0xfffffffb, 0x9, 0x3, 0x7fffffff, 0x89, 0xca9f, 0xfffffffe, 0x20001e58, 0xffffffff, 0xf39e, 0x3, 0x8, 0xa6b5, 0x0, 0xfffffff8]}) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x300000a, 0x12, r0, 0x390b9000) rseq(&(0x7f0000000280), 0x20, 0x0, 0x0) 2.987582958s ago: executing program 1 (id=108): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'streebog512-generic\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x80000) r2 = accept4(r1, 0x0, 0x0, 0x80800) sendmmsg$inet6(r2, &(0x7f0000003b80)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000440)='&', 0x1}], 0x1}, 0xff03}], 0x1, 0x8000) 2.531928811s ago: executing program 1 (id=109): r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000580)='2\x00', 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x4e21, @multicast2}, 0x10) socket$inet_mptcp(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0xb, &(0x7f00000001c0)=ANY=[@ANYBLOB], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) mbind(&(0x7f0000d47000/0x1000)=nil, 0x1000, 0x2, &(0x7f0000000000)=0x40004, 0x8000100c, 0x6) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_tcp(0x2, 0x1, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_open_dev$cec(&(0x7f0000000200), 0xffffffffffffffff, 0x4ae60) ioctl$CEC_ADAP_S_LOG_ADDRS(r2, 0xc05c6104, &(0x7f0000000040)={'\x00', 0x0, 0x5, 0x2, 0xfffffff9, 0xe, "00000000020000000000002100", "00000001", "0052008f", "0000f807", ["fdd5c01000", "0000000000000400", "00f638000000007c0300", "00d703500200"]}) ioctl$CEC_TRANSMIT(r2, 0xc0386105, &(0x7f0000000100)={0xfffffffffffffbf7, 0x1, 0x2, 0x0, 0x4, 0x7ffe, "7f2c00", 0x1, 0x56, 0x1, 0xfa, 0x9, 0x1}) ioctl$CEC_ADAP_S_LOG_ADDRS(r2, 0xc05c6104, &(0x7f0000000140)={"4497acf4", 0xb, 0x4, 0x0, 0x3, 0x1000006, "5500578ea5f4ffffffeb00001000", "1575b859", '\x00', '\'q6O', ["aabe8459c62224475793e8a7", "7f9ce2d2c4f439ff80e1d1c8", "fa0700f22b42a3023be516d1"]}) 2.426778262s ago: executing program 4 (id=110): r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYRES16=r2, @ANYRES16=r2, @ANYRES64=r1], 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x30) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = openat$binder_debug(0xffffff9c, 0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xc, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$UBLK_U_CMD_END_USER_RECOVERY(r3, 0xc0207511, &(0x7f0000000240)) r5 = socket$kcm(0x29, 0x2, 0x0) sendmmsg$inet(r5, &(0x7f00000028c0)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000280)="7fe1b3", 0x3}], 0x1}}, {{0x0, 0x0, &(0x7f0000001800)=[{&(0x7f0000001440)="85ac6755b3", 0x5}], 0x1}}], 0x2, 0x40) close(r5) socket$nl_rdma(0x10, 0x3, 0x14) syz_io_uring_setup(0x117a, 0x0, 0x0, &(0x7f0000000140), 0x0) r6 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r6, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000), 0x41, 0x0) write$nbd(r8, &(0x7f0000000340)={0x1000000, 0x0, 0x0, 0x0, 0x200000, "82b0cfc4337965941538be02000000000000000000007400a391793ba7f40000000000fdf700"/48}, 0x40) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000002c0)={'wlan0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000600000006"], 0x66) 2.204420076s ago: executing program 3 (id=111): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f00000000c0)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000180)={@hyper, 0x1}) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r0, 0x7cb, &(0x7f0000000100)={0x0, 0x0, 0x8}) 0s ago: executing program 3 (id=112): openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000300), 0xffffffffffffffff) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000100)='syzkaller\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x40f00, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000000), 0xc002, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.102' (ED25519) to the list of known hosts. [ 90.914457][ T5592] cgroup: Unknown subsys name 'net' [ 91.154069][ T5592] cgroup: Unknown subsys name 'cpuset' [ 91.208622][ T5592] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 92.033990][ T9] cfg80211: failed to load regulatory.db [ 93.301255][ T5592] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 96.073555][ T5620] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 96.090966][ T5617] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 96.116939][ T5617] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 96.126308][ T5620] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 96.176110][ T5621] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 96.182613][ T5617] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 96.210891][ T5621] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 96.217357][ T5625] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 96.220614][ T5625] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 96.224324][ T5625] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 96.227132][ T5625] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 96.228639][ T5622] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 96.232210][ T5625] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 96.243003][ T5622] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 96.298344][ T5621] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 96.304279][ T5621] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 96.305071][ T5621] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 96.322884][ T5622] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 96.323251][ T5622] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 96.324421][ T5625] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 96.325208][ T5625] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 96.351693][ T5625] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 96.366193][ T5622] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 96.399839][ T60] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 96.487673][ T5620] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 98.422611][ T5615] Bluetooth: hci0: command tx timeout [ 98.658074][ T5615] Bluetooth: hci2: command tx timeout [ 98.658254][ T5615] Bluetooth: hci4: command tx timeout [ 98.658343][ T5615] Bluetooth: hci1: command tx timeout [ 98.658422][ T5615] Bluetooth: hci3: command tx timeout [ 99.250009][ T5608] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.250976][ T5608] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.251218][ T5608] bridge_slave_0: entered allmulticast mode [ 99.253879][ T5608] bridge_slave_0: entered promiscuous mode [ 99.330261][ T5608] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.330509][ T5608] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.330734][ T5608] bridge_slave_1: entered allmulticast mode [ 99.337170][ T5608] bridge_slave_1: entered promiscuous mode [ 99.565443][ T5608] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 99.586502][ T5607] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.586821][ T5607] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.587059][ T5607] bridge_slave_0: entered allmulticast mode [ 99.600365][ T5607] bridge_slave_0: entered promiscuous mode [ 99.651833][ T5608] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 99.677340][ T5607] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.677685][ T5607] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.681825][ T5607] bridge_slave_1: entered allmulticast mode [ 99.691810][ T5607] bridge_slave_1: entered promiscuous mode [ 99.704510][ T5610] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.705652][ T5610] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.707378][ T5610] bridge_slave_0: entered allmulticast mode [ 99.721064][ T5610] bridge_slave_0: entered promiscuous mode [ 99.810155][ T5610] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.810522][ T5610] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.810979][ T5610] bridge_slave_1: entered allmulticast mode [ 99.813667][ T5610] bridge_slave_1: entered promiscuous mode [ 99.876276][ T5609] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.876667][ T5609] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.876910][ T5609] bridge_slave_0: entered allmulticast mode [ 99.896897][ T5609] bridge_slave_0: entered promiscuous mode [ 99.944564][ T5606] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.944863][ T5606] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.945064][ T5606] bridge_slave_0: entered allmulticast mode [ 99.947496][ T5606] bridge_slave_0: entered promiscuous mode [ 99.982559][ T5608] team0: Port device team_slave_0 added [ 99.983038][ T5609] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.983381][ T5609] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.984269][ T5609] bridge_slave_1: entered allmulticast mode [ 99.986778][ T5609] bridge_slave_1: entered promiscuous mode [ 100.011930][ T5607] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.055053][ T5606] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.055430][ T5606] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.056125][ T5606] bridge_slave_1: entered allmulticast mode [ 100.063112][ T5606] bridge_slave_1: entered promiscuous mode [ 100.088867][ T5608] team0: Port device team_slave_1 added [ 100.117171][ T5607] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.130819][ T5610] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.214821][ T5610] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.265733][ T5609] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.316052][ T5606] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 100.324844][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 100.324927][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.325010][ T5608] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 100.357695][ T5609] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.371674][ T5607] team0: Port device team_slave_0 added [ 100.405878][ T5606] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 100.407633][ T5608] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 100.407646][ T5608] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.407668][ T5608] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 100.471631][ T5607] team0: Port device team_slave_1 added [ 100.475158][ T5610] team0: Port device team_slave_0 added [ 100.498067][ T5625] Bluetooth: hci0: command tx timeout [ 100.564177][ T5610] team0: Port device team_slave_1 added [ 100.596143][ T5609] team0: Port device team_slave_0 added [ 100.645575][ T5606] team0: Port device team_slave_0 added [ 100.738178][ T5625] Bluetooth: hci3: command tx timeout [ 100.738214][ T5625] Bluetooth: hci1: command tx timeout [ 100.738237][ T5625] Bluetooth: hci4: command tx timeout [ 100.738260][ T5625] Bluetooth: hci2: command tx timeout [ 100.994899][ T5609] team0: Port device team_slave_1 added [ 100.996604][ T5607] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 100.996616][ T5607] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 100.996638][ T5607] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.055491][ T5606] team0: Port device team_slave_1 added [ 101.106499][ T5607] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.106514][ T5607] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.106535][ T5607] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.126132][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.126186][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.126267][ T5610] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.252158][ T5610] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.252173][ T5610] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.252194][ T5610] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.319823][ T5608] hsr_slave_0: entered promiscuous mode [ 101.321640][ T5608] hsr_slave_1: entered promiscuous mode [ 101.325350][ T5609] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.325363][ T5609] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.325384][ T5609] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.393978][ T5606] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 101.393992][ T5606] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.394013][ T5606] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 101.405325][ T5609] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.405339][ T5609] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.405360][ T5609] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.464429][ T5606] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 101.464481][ T5606] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 101.464557][ T5606] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 101.671104][ T5607] hsr_slave_0: entered promiscuous mode [ 101.672780][ T5607] hsr_slave_1: entered promiscuous mode [ 101.674257][ T5607] debugfs: 'hsr0' already exists in 'hsr' [ 101.674354][ T5607] Cannot create hsr debugfs directory [ 101.812006][ T5610] hsr_slave_0: entered promiscuous mode [ 101.813605][ T5610] hsr_slave_1: entered promiscuous mode [ 101.814976][ T5610] debugfs: 'hsr0' already exists in 'hsr' [ 101.815005][ T5610] Cannot create hsr debugfs directory [ 101.936849][ T5609] hsr_slave_0: entered promiscuous mode [ 101.940247][ T5609] hsr_slave_1: entered promiscuous mode [ 101.942350][ T5609] debugfs: 'hsr0' already exists in 'hsr' [ 101.942375][ T5609] Cannot create hsr debugfs directory [ 101.992031][ T5606] hsr_slave_0: entered promiscuous mode [ 101.993636][ T5606] hsr_slave_1: entered promiscuous mode [ 101.994996][ T5606] debugfs: 'hsr0' already exists in 'hsr' [ 101.995025][ T5606] Cannot create hsr debugfs directory [ 102.578285][ T5615] Bluetooth: hci0: command tx timeout [ 102.818273][ T5615] Bluetooth: hci1: command tx timeout [ 102.818307][ T5622] Bluetooth: hci2: command tx timeout [ 102.818333][ T5622] Bluetooth: hci4: command tx timeout [ 102.818355][ T5622] Bluetooth: hci3: command tx timeout [ 103.024086][ T5608] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 103.091874][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 103.097246][ T5608] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 103.132570][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 103.149935][ T5608] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 103.173824][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 103.216934][ T5608] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 103.247244][ T5608] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 103.404048][ T5607] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 103.435252][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 103.449109][ T5607] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 103.493860][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 103.505504][ T5607] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 103.548793][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 103.598685][ T5607] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 103.632802][ T5607] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 103.788230][ T5610] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 103.822726][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 103.838959][ T5610] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 103.877339][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 103.896495][ T5610] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 103.936310][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 103.977805][ T5610] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 104.013523][ T5610] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 104.178959][ T5609] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 104.216759][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 104.232931][ T5609] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 104.263499][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 104.291595][ T5609] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 104.333878][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 104.372085][ T5609] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 104.402835][ T5609] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 104.586602][ T5608] 8021q: adding VLAN 0 to HW filter on device bond0 [ 104.612907][ T5606] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 104.644158][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 104.659884][ T5606] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 104.660331][ T5615] Bluetooth: hci0: command tx timeout [ 104.702381][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 104.715754][ T5606] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 104.742487][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 104.766972][ T5606] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 104.813615][ T5606] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 104.898135][ T5615] Bluetooth: hci1: command tx timeout [ 104.898770][ T5625] Bluetooth: hci4: command tx timeout [ 104.898798][ T5625] Bluetooth: hci2: command tx timeout [ 104.898856][ T5615] Bluetooth: hci3: command tx timeout [ 104.944243][ T5608] 8021q: adding VLAN 0 to HW filter on device team0 [ 104.994375][ T5607] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.034484][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.036345][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.129422][ T1136] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.129622][ T1136] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.243122][ T5607] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.324323][ T5610] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.344572][ T154] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.344744][ T154] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.434810][ T67] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.434954][ T67] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.555825][ T5610] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.592395][ T5609] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.629249][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.629942][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 105.720028][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 105.720238][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 105.843287][ T5609] 8021q: adding VLAN 0 to HW filter on device team0 [ 105.945296][ T5606] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.957463][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 105.957723][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.034022][ T1409] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.034232][ T1409] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.200299][ T5606] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.325978][ T1409] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.326214][ T1409] bridge0: port 1(bridge_slave_0) entered forwarding state [ 106.392908][ T67] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.393082][ T67] bridge0: port 2(bridge_slave_1) entered forwarding state [ 106.874961][ T5608] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.479395][ T5608] veth0_vlan: entered promiscuous mode [ 107.605412][ T5607] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 107.632440][ T5608] veth1_vlan: entered promiscuous mode [ 108.012358][ T5610] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.093070][ T5608] veth0_macvtap: entered promiscuous mode [ 108.199087][ T5609] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.255838][ T5608] veth1_macvtap: entered promiscuous mode [ 108.344177][ T5607] veth0_vlan: entered promiscuous mode [ 108.493670][ T5606] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 108.515157][ T5607] veth1_vlan: entered promiscuous mode [ 108.545737][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 108.616280][ T5608] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 108.709168][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.715449][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.761592][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.803674][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 108.893767][ T5609] veth0_vlan: entered promiscuous mode [ 109.063917][ T5607] veth0_macvtap: entered promiscuous mode [ 109.102601][ T5610] veth0_vlan: entered promiscuous mode [ 109.280757][ T5607] veth1_macvtap: entered promiscuous mode [ 109.296389][ T5609] veth1_vlan: entered promiscuous mode [ 109.351597][ T5606] veth0_vlan: entered promiscuous mode [ 109.401273][ T5610] veth1_vlan: entered promiscuous mode [ 109.500091][ T5606] veth1_vlan: entered promiscuous mode [ 109.501878][ T67] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.501905][ T67] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.555614][ T5607] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 109.616813][ T5607] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 109.718994][ T1136] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.719080][ T1136] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.719096][ T1136] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.725891][ T1136] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.781803][ T5609] veth0_macvtap: entered promiscuous mode [ 109.795440][ T1136] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.863130][ T1136] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.895804][ T5610] veth0_macvtap: entered promiscuous mode [ 109.908830][ T5609] veth1_macvtap: entered promiscuous mode [ 110.011936][ T5610] veth1_macvtap: entered promiscuous mode [ 110.122027][ T5606] veth0_macvtap: entered promiscuous mode [ 110.242189][ T5606] veth1_macvtap: entered promiscuous mode [ 110.550980][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.653316][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.697612][ T5609] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.717435][ T3387] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 110.717457][ T3387] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 110.765478][ T5610] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.790388][ T5606] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 110.877652][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.912268][ T5606] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 110.912785][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.948626][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 110.965880][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.004090][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.006121][ T3387] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.006142][ T3387] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.037149][ T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.070800][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.070949][ T5338] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 111.140247][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.233288][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.250055][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.307036][ T5338] usb 1-1: unable to get BOS descriptor or descriptor too short [ 111.352815][ T5338] usb 1-1: config 3 has an invalid interface number: 249 but max is 0 [ 111.352839][ T5338] usb 1-1: config 3 has no interface number 0 [ 111.352864][ T5338] usb 1-1: config 3 interface 249 has no altsetting 0 [ 111.389958][ T5338] usb 1-1: New USB device found, idVendor=0c45, idProduct=800a, bcdDevice=5a.9d [ 111.389995][ T5338] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 111.390017][ T5338] usb 1-1: Product: syz [ 111.390034][ T5338] usb 1-1: Manufacturer: syz [ 111.390049][ T5338] usb 1-1: SerialNumber: syz [ 111.447005][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.654105][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.005323][ T5338] gspca_main: sn9c2028-2.14.0 probing 0c45:800a [ 113.019013][ T5338] gspca_sn9c2028: read1 error -71 [ 113.020444][ T5338] gspca_sn9c2028: read1 error -71 [ 113.022092][ T5338] gspca_sn9c2028: read1 error -71 [ 113.022188][ T5338] sn9c2028 1-1:3.249: probe with driver sn9c2028 failed with error -71 [ 113.085436][ T5338] usb 1-1: USB disconnect, device number 2 [ 113.143827][ T168] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.143849][ T168] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.381022][ T5816] Zero length message leads to an empty skb [ 116.325420][ T3387] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 116.325445][ T3387] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 116.658357][ T3387] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 116.658380][ T3387] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 116.901759][ T5827] syz.3.8 uses obsolete (PF_INET,SOCK_PACKET) [ 116.925097][ T1136] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 116.925114][ T1136] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 117.271878][ T3387] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 117.271899][ T3387] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 117.732513][ T5837] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 118.036535][ T1409] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 118.036555][ T1409] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.089476][ T5594] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 121.734570][ T5594] usb 4-1: unable to get BOS descriptor or descriptor too short [ 121.763338][ T5594] usb 4-1: config 3 has an invalid interface number: 249 but max is 0 [ 121.763372][ T5594] usb 4-1: config 3 has no interface number 0 [ 121.919004][ T5594] usb 4-1: config 3 interface 249 has no altsetting 0 [ 121.962010][ T5594] usb 4-1: New USB device found, idVendor=0c45, idProduct=800a, bcdDevice=5a.9d [ 121.962048][ T5594] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 121.962071][ T5594] usb 4-1: Product: syz [ 121.962088][ T5594] usb 4-1: Manufacturer: syz [ 121.962105][ T5594] usb 4-1: SerialNumber: syz [ 124.337638][ T5844] syz.1.2 (5844): drop_caches: 2 [ 126.454722][ T5594] usb 4-1: can't set config #3, error -71 [ 126.525212][ T5594] usb 4-1: USB disconnect, device number 2 [ 127.918244][ T10] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 128.103849][ T5896] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 128.119064][ T10] usb 5-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 128.119101][ T10] usb 5-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 128.119122][ T10] usb 5-1: Product: syz [ 128.119137][ T10] usb 5-1: Manufacturer: syz [ 128.119151][ T10] usb 5-1: SerialNumber: syz [ 128.331573][ T10] usb 5-1: config 0 descriptor?? [ 128.472251][ T5808] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 128.623737][ T5808] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 128.623773][ T5808] usb 1-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 128.623795][ T5808] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 128.623856][ T5808] usb 1-1: config 1 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 128.623885][ T5808] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 128.623916][ T5808] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 128.627620][ T5808] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 128.627654][ T5808] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 128.627677][ T5808] usb 1-1: Product: syz [ 128.627693][ T5808] usb 1-1: Manufacturer: syz [ 128.803473][ T5901] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 129.877410][ T5808] cdc_wdm 1-1:1.0: skipping garbage [ 129.877435][ T5808] cdc_wdm 1-1:1.0: skipping garbage [ 130.028685][ T5808] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 130.028723][ T5808] cdc_wdm 1-1:1.0: Unknown control protocol [ 130.115089][ T5808] usb 1-1: USB disconnect, device number 3 [ 130.447754][ T10] usb 5-1: USB disconnect, device number 2 [ 133.215178][ T1337] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.215327][ T1337] ieee802154 phy1 wpan1: encryption failed: -22 [ 135.119122][ T5933] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 136.674046][ T5928] syz.3.29 (5928): drop_caches: 2 [ 139.505933][ T5933] usb 3-1: unable to get BOS descriptor or descriptor too short [ 139.957909][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 140.017909][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 140.027896][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 140.037898][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 140.047906][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 140.057902][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 140.067887][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 140.952121][ T5933] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 140.952164][ T5933] usb 3-1: can't read configurations, error -71 [ 141.867094][ T5969] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 146.008515][ T6000] bridge1: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 147.139536][ T5808] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 147.383189][ T5808] usb 1-1: unable to get BOS descriptor or descriptor too short [ 147.407356][ T5808] usb 1-1: config 3 has an invalid interface number: 249 but max is 0 [ 147.407386][ T5808] usb 1-1: config 3 has no interface number 0 [ 147.426021][ T5808] usb 1-1: config 3 interface 249 has no altsetting 0 [ 147.444909][ T5808] usb 1-1: New USB device found, idVendor=0c45, idProduct=800a, bcdDevice=5a.9d [ 147.444939][ T5808] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 147.444960][ T5808] usb 1-1: Product: syz [ 147.444973][ T5808] usb 1-1: Manufacturer: syz [ 147.444987][ T5808] usb 1-1: SerialNumber: syz [ 152.090883][ T5808] gspca_main: sn9c2028-2.14.0 probing 0c45:800a [ 152.217635][ T5808] gspca_sn9c2028: read1 error -71 [ 152.237627][ T5808] gspca_sn9c2028: read1 error -71 [ 152.316002][ T5808] gspca_sn9c2028: read1 error -71 [ 152.383519][ T5808] sn9c2028 1-1:3.249: probe with driver sn9c2028 failed with error -71 [ 153.090744][ T5808] usb 1-1: USB disconnect, device number 4 [ 154.695004][ T5997] syz.3.46 (5997): drop_caches: 2 [ 155.282577][ T6043] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 155.403260][ T5933] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 155.436582][ T6046] bridge1: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 155.572564][ T5933] usb 4-1: unable to get BOS descriptor or descriptor too short [ 155.573947][ T5933] usb 4-1: not running at top speed; connect to a high speed hub [ 155.576225][ T5933] usb 4-1: config 3 has an invalid interface number: 36 but max is 0 [ 155.576251][ T5933] usb 4-1: config 3 has no interface number 0 [ 155.576284][ T5933] usb 4-1: config 3 interface 36 has no altsetting 0 [ 155.625332][ T5933] usb 4-1: New USB device found, idVendor=05ac, idProduct=0264, bcdDevice=31.fc [ 155.625365][ T5933] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 155.625387][ T5933] usb 4-1: Product: syz [ 155.625402][ T5933] usb 4-1: Manufacturer: syz [ 155.625418][ T5933] usb 4-1: SerialNumber: syz [ 156.181678][ T6042] random: crng reseeded on system resumption [ 157.503925][ T5933] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:3.36/input/input5 [ 157.685607][ T4957] bcm5974 4-1:3.36: could not read from device [ 157.745674][ T4957] bcm5974 4-1:3.36: could not read from device [ 158.708373][ T5933] usb 4-1: USB disconnect, device number 3 [ 158.807793][ T4957] bcm5974 4-1:3.36: could not read from device [ 163.207914][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 163.227901][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 163.237893][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 167.704764][ T6092] bridge1: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 169.301265][ T6078] syz.3.69 (6078): drop_caches: 2 [ 170.886942][ T6131] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 177.036726][ T6159] Bluetooth: MGMT ver 1.23 [ 179.136532][ T6160] syz.1.90 (6160): drop_caches: 2 [ 179.416558][ T6184] 9pnet_virtio: no channels available for device syz [ 181.826763][ T6202] bridge2: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 183.162478][ T5876] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 183.525220][ T5876] usb 1-1: unable to get BOS descriptor or descriptor too short [ 183.530287][ T5876] usb 1-1: config 3 has an invalid interface number: 249 but max is 0 [ 183.530310][ T5876] usb 1-1: config 3 has no interface number 0 [ 183.530333][ T5876] usb 1-1: config 3 interface 249 has no altsetting 0 [ 183.656271][ T5876] usb 1-1: New USB device found, idVendor=0c45, idProduct=800a, bcdDevice=5a.9d [ 183.656315][ T5876] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 183.656389][ T5876] usb 1-1: Product: syz [ 183.656454][ T5876] usb 1-1: Manufacturer: syz [ 183.656510][ T5876] usb 1-1: SerialNumber: syz [ 185.122334][ T5876] gspca_main: sn9c2028-2.14.0 probing 0c45:800a [ 185.159151][ T5876] gspca_sn9c2028: read1 error -71 [ 185.329690][ T5876] gspca_sn9c2028: read1 error -71 [ 185.330775][ T5876] gspca_sn9c2028: read1 error -71 [ 185.330869][ T5876] sn9c2028 1-1:3.249: probe with driver sn9c2028 failed with error -71 [ 185.487289][ T6229] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN PTI [ 185.487313][ T6229] KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] [ 185.487342][ T6229] CPU: 0 UID: 0 PID: 6229 Comm: syz.1.109 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 185.487363][ T6229] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 185.487380][ T6229] RIP: 0010:__schedule+0x4030/0x5550 [ 185.487409][ T6229] Code: 24 80 00 00 00 e8 80 67 fc f6 48 8b 84 24 80 00 00 00 48 8b 18 4c 8d 7b 14 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 87 04 00 00 45 8b 3f 49 83 ff 08 0f 83 98 [ 185.487424][ T6229] RSP: 0018:ffffc90006b3f2e0 EFLAGS: 00010003 [ 185.487449][ T6229] RAX: 0000000000000002 RBX: 0000000000000000 RCX: dffffc0000000000 [ 185.487462][ T6229] RDX: 0000000000000003 RSI: 0000000000000000 RDI: ffff8880b8620c60 [ 185.487473][ T6229] RBP: ffffc90006b3f4d8 R08: ffffffff8f8d70f7 R09: 1ffffffff1f1ae1e [ 185.487487][ T6229] R10: dffffc0000000000 R11: fffffbfff1f1ae1f R12: ffff8880b863c658 [ 185.487502][ T6229] R13: ffff888125eb8000 R14: 1ffff110170c7922 R15: 0000000000000014 [ 185.487515][ T6229] FS: 0000000000000000(0000) GS:ffff888125eb8000(0000) knlGS:0000000000000000 [ 185.487530][ T6229] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 185.487542][ T6229] CR2: 00007fffece3dca0 CR3: 000000003516c000 CR4: 00000000003526f0 [ 185.487558][ T6229] Call Trace: [ 185.487569][ T6229] [ 185.487587][ T6229] ? __pfx___schedule+0x10/0x10 [ 185.487610][ T6229] ? rt_spin_lock+0x1e0/0x400 [ 185.487632][ T6229] preempt_schedule_irq+0x4d/0xa0 [ 185.487654][ T6229] irqentry_exit+0x14f/0x8c0 [ 185.487683][ T6229] asm_sysvec_reschedule_ipi+0x1a/0x20 [ 185.487703][ T6229] RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x80 [ 185.487726][ T6229] Code: 89 fb e8 23 00 00 00 48 8b 3d b4 c4 ca 0b 48 89 de 5b e9 43 78 60 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 48 8b 04 24 65 48 8b 0d 58 f4 b0 10 65 8b 35 79 f4 b0 [ 185.487740][ T6229] RSP: 0018:ffffc90006b3f608 EFLAGS: 00000246 [ 185.487756][ T6229] RAX: ffffffff821a0a0c RBX: ffff888032dc4380 RCX: ffff8880262d0000 [ 185.487770][ T6229] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 185.487780][ T6229] RBP: ffffc90006b3f930 R08: 0000000000000000 R09: 0000000000000000 [ 185.487792][ T6229] R10: dffffc0000000000 R11: fffffbfff1f1ae1f R12: dffffc0000000000 [ 185.487805][ T6229] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 185.487820][ T6229] ? add_mm_rss_vec+0x18c/0x320 [ 185.487845][ T6229] add_mm_rss_vec+0x1de/0x320 [ 185.487873][ T6229] __zap_vma_range+0x366d/0x4ab0 [ 185.487918][ T6229] ? __pfx___zap_vma_range+0x10/0x10 [ 185.487947][ T6229] ? mas_find+0xb0e/0xd30 [ 185.487971][ T6229] ? unmap_vmas+0x1c5/0x570 [ 185.487996][ T6229] unmap_vmas+0x3ac/0x570 [ 185.488024][ T6229] ? __pfx_unmap_vmas+0x10/0x10 [ 185.488058][ T6229] exit_mmap+0x280/0x9e0 [ 185.488078][ T6229] ? __pfx_exit_mmap+0x10/0x10 [ 185.488096][ T6229] ? do_raw_spin_lock+0x12b/0x2f0 [ 185.488123][ T6229] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 185.488150][ T6229] ? __pfx_exit_aio+0x10/0x10 [ 185.488175][ T6229] ? uprobe_clear_state+0x2bf/0x3f0 [ 185.488199][ T6229] __mmput+0xcb/0x3e0 [ 185.488228][ T6229] exit_mm+0x18e/0x250 [ 185.488252][ T6229] do_exit+0x6a2/0x22c0 [ 185.488278][ T6229] ? __pfx_do_exit+0x10/0x10 [ 185.488301][ T6229] ? rcu_is_watching+0x15/0xb0 [ 185.488321][ T6229] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 185.488339][ T6229] __x64_sys_exit+0x40/0x40 [ 185.488362][ T6229] x64_sys_call+0x2231/0x2240 [ 185.488391][ T6229] do_syscall_64+0x174/0x580 [ 185.488414][ T6229] ? trace_irq_disable+0x3b/0x140 [ 185.488439][ T6229] ? clear_bhb_loop+0x40/0x90 [ 185.488458][ T6229] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 185.488476][ T6229] RIP: 0033:0x7fc5f264ce59 [ 185.488495][ T6229] Code: Unable to access opcode bytes at 0x7fc5f264ce2f. [ 185.488504][ T6229] RSP: 002b:00007fc5f087cfd8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 185.488521][ T6229] RAX: ffffffffffffffda RBX: 00007fc5f28c6090 RCX: 00007fc5f264ce59 [ 185.488535][ T6229] RDX: 00007fc5f087d9c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 185.488547][ T6229] RBP: 00007fc5f26e2d6f R08: 0000000000000000 R09: 0000000000000000 [ 185.488558][ T6229] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 185.488568][ T6229] R13: 00007fc5f28c6128 R14: 00007fc5f28c6090 R15: 00007fffc0bf2b18 [ 185.488588][ T6229] [ 185.488594][ T6229] Modules linked in: [ 185.488610][ T6229] ---[ end trace 0000000000000000 ]--- [ 185.488626][ T6229] RIP: 0010:__schedule+0x4030/0x5550 [ 185.488647][ T6229] Code: 24 80 00 00 00 e8 80 67 fc f6 48 8b 84 24 80 00 00 00 48 8b 18 4c 8d 7b 14 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <0f> b6 04 08 84 c0 0f 85 87 04 00 00 45 8b 3f 49 83 ff 08 0f 83 98 [ 185.488661][ T6229] RSP: 0018:ffffc90006b3f2e0 EFLAGS: 00010003 [ 185.488676][ T6229] RAX: 0000000000000002 RBX: 0000000000000000 RCX: dffffc0000000000 [ 185.488688][ T6229] RDX: 0000000000000003 RSI: 0000000000000000 RDI: ffff8880b8620c60 [ 185.488699][ T6229] RBP: ffffc90006b3f4d8 R08: ffffffff8f8d70f7 R09: 1ffffffff1f1ae1e [ 185.488713][ T6229] R10: dffffc0000000000 R11: fffffbfff1f1ae1f R12: ffff8880b863c658 [ 185.488726][ T6229] R13: ffff888125eb8000 R14: 1ffff110170c7922 R15: 0000000000000014 [ 185.488739][ T6229] FS: 0000000000000000(0000) GS:ffff888125eb8000(0000) knlGS:0000000000000000 [ 185.488768][ T6229] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 185.488780][ T6229] CR2: 00007fffece3dca0 CR3: 000000003516c000 CR4: 00000000003526f0 [ 185.488798][ T6229] Kernel panic - not syncing: Fatal exception [ 186.591844][ T6229] Shutting down cpus with NMI [ 186.592052][ T6229] Kernel Offset: disabled