last executing test programs: 28.358205827s ago: executing program 2 (id=3): socket$nl_sock_diag(0x10, 0x3, 0x4) syz_mount_image$ext4(&(0x7f0000001800)='ext4\x00', &(0x7f0000001840)='./file1\x00', 0x10000, &(0x7f0000001880)={[{@nobh}, {@auto_da_alloc}, {@grpquota}]}, 0x3, 0x4c7, &(0x7f00000018c0)="$eJzs3M9vFFUcAPDvbHdpAdGKiIIoBTQ2JrZQUDh4wcTEgyZGPMixaStBFjC0ByFESmK4k3g0MR6NN0286tF48g/AgwcTQ0IMF8DTmtmdabfb2W23P6n7+STbfW9+vfedmTf7dl53AuhZQ+mfJOKJiLgTEU81sgsXGGq8Pbx/feLR/esTMVurnfknqS/3IM1n8vV2ZpnhUkTpy6Rlgw3TV69dGK9Wp65k+dGZi5+NTl+99vr5i+Pnps5NXRo7derE8WMn3xx7o/ugCspL43qw/4vLB/a9e/b2+xPlfPpA9t4cR1vl7qox1GHeK91t6rG3qymdLN5PNza0MizbQHZaV9L2f716+Gx3qxe0NGCrqNVqtf72s2drrW4umgJsWUlsdg2AzZF/0Kfff/PXBnU9Hgv3Tje+AKVxP8xejTnlKGXLVFq+366loYj4ePbfb9JXdLoP8Wd8sE5VAAB6zC+n855ga/+vFHublnsyG0MZjIinI2J3RDwTEXsi4tmI+rLPRcTzrQUkEbUO5e9pyc+X/2M2ilC6u+ogO0j7f29lY1sL+3957y8G+7Lcroi8wzx1NNsnw1Hp/+R8depYm+1vW6L85v5f+krLz/uCWT3ulltu0E2Oz4yvLNrF7t2M2F9ujT8ppwcuH8ZJImJfROzvYruDTenzr313YC5Tyd6/brwtHX9drXCgocvxuCK1byNebRz/2Vhw/OdLTDqPT44ORHXq6Gh6FhwtLOO332+17bsvGf9Pf7Wu8s7Jn8+sNuw56fHf0XT+Rz5+Ox//YBKRzI3XTkfU+ror49Yf7VdY6fm/Lfmons7b1+fjMzNXjkVsS95bPH1sft08ny+fxj98pLj9787WSffECxGRnsQvRsRLEXEwq/uhiDgcEUc6xP/r2y9/uvL411ca/2Th9W/B8Z8fr19mIl85ndJ34dCdR20uHss7/ifqqeFsSvH1L1lwiVhuTVe39wAAAGBrKEX9f/9LI3PpUmlkpHEPaE/sKFUvT88cjIhLk43fCAxGpZTf6WrcD64k+f3Pwab8WEv+eHbf+Ku+7fX8yMTl6uRmBw89bme9zSeL2n/q7y7v8wJb0BqMowFb1FLtf+/tDaoIsOF8/gMRMVs41eMb4H/L5z/0rqL2fyO+7/jbBdcM2Ppq2jL0NO0felc5PpxL13/27LGe0DN8/kNP6vZ3/d0lav3Fswai4IkBA+tTje0FZW1KIu1ZreEGKxGxvIW3r6SIvAvY/gkPpe422B+LZ/VFp7WSLp7jkCfSvbLkwuf2rvnJnz8TZa1Pmx/m22ml6ViUlzo6q09s+KUIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgXfwXAAD//1Sz0lI=") prlimit64(0x0, 0xe, &(0x7f0000001dc0)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000001e80)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001ec0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000001f00)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000001f80), 0x651, 0x0) recvmmsg(r1, &(0x7f0000001fc0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f00000020c0)='./file1\x00', 0x80242, 0x1df2a23c5997fa5f) write$FUSE_CREATE_OPEN(r3, &(0x7f0000002140)={0xa0, 0xffffffffffffffda, 0x0, {{0x3, 0x0, 0x8000000200007, 0x282b, 0x20103, 0x80001, {0x200004, 0x10005c62, 0x203, 0x1000000000, 0x83, 0x4, 0x10000006, 0x6, 0x0, 0x0, 0x0, 0xee00, 0xee00, 0x8, 0x1}}, {0x0, 0xa}}}, 0xa0) sendfile(r3, r3, &(0x7f0000002200)=0x4, 0x8112) 25.92638827s ago: executing program 3 (id=5): rt_sigprocmask(0x0, &(0x7f0000000100)={[0xfffffffffffe]}, 0x0, 0x8) timer_create(0x9, 0x0, &(0x7f00000000c0)) clock_gettime(0x7, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1\x00', 0x1ff) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f00000003c0)=0x6, 0x4) r2 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=@newlink={0x40, 0x10, 0x403, 0x1ffffe, 0x0, {0x0, 0x0, 0x0, 0x0, 0x12080, 0x42}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gtp={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GTP_FD1={0x8, 0x2, @udp6=r1}, @IFLA_GTP_FD0={0x8, 0x1, @udp=r2}]}}}]}, 0x40}, 0x1, 0xba01}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/functions/uac2.0\x00', 0x1df) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/functions/uac2.0\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uac2.0/p_chmask\x00', 0x2, 0x0) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) memfd_create(&(0x7f00000009c0)='y\x105\xf3\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdbU\xb1\xe1br\xb6\x008\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\x90i\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\xc7\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14O\xf8\xb5C\x1f\xb6b8b\x06A2@D\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\x05\x00\x00\x00\x00\x00\x00\x00\'\x93\xef\x1d\xa0H\xd9\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00\x88\xd1\x1eQB\x18\xc1-\xc4\x8fK\xf8\xfa\xb6\xf8\v;\xaa\x8fW\xcc\n\x17\x7f\x98\xb7\xcdqV\xd4\xf0)\xfa\x0fG\xc8\xbf\xfd\xe8>K\f\xcd+\xb0\x99Q\xba/\xa8\xb9`k\b\xd1\xcc\xfc\xeaA\"\v=\x83fC\x90%\xa1d\x91\xf8:\x16<\xad\xc2\x18\xdf\x01\xe2\x96\xfcj\xe9\xa4\x065m\x03\x05Np\xda\"\xf1\xb6\xbcP\x8fP\x8d\x89%\xf2\x12T\xd0\xc3\x15W\x9c\x87\x1b\x8c\xc9\xd9\xc6\xad\x96-d\xa2wFB\xcaB\xa5\x15\xf8,\x04\x1c*\xd98\x8bG\x90\x81`\x03\xe0\xde\x9c\x9a\x0f\x1b\x8f\xd2%*&$Wc\xb3\xa6\xc4TK1}2\xb3\xab\xf4\xb7\xb7\x85\apa\xaf\x1c\x10i\xb9\x9f\x06\xff4%\"7f \x0e\xf5Bk\r\xac\"\x13tNx\xc0$\x85\x9f', 0x2) write(r3, &(0x7f00000005c0)='0', 0x1) execve(0x0, &(0x7f00000004c0)={[&(0x7f0000000400)='/dev/snd/pcmC#D#p\x00', &(0x7f0000000740)='%]:-%0j\x92\x80\xf0\x91\x87\\\x84', &(0x7f0000000440)='%]:-%0j\x92\x80\xf0\x91\x87\\\x84']}, &(0x7f00000006c0)) r4 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/UDC\x00', 0x2, 0x0) write(r4, &(0x7f0000000340)='dummy_udc.0', 0xb) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x9, 0x3, 0x1d0, 0x0, 0xffffffff, 0xffffffff, 0x98, 0xffffffff, 0x0, 0xffffffff, 0xffffffff, 0x138, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0xa0}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x1, 0xffffffff, 0xffffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x230) 23.895761994s ago: executing program 2 (id=7): syz_mount_image$ext4(&(0x7f0000000080)='ext3\x00', &(0x7f0000000480)='./file0\x00', 0x0, &(0x7f0000000100)={[{@noload}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x1}}, {@usrjquota}, {@noload}, {@data_err_ignore}, {@usrjquota}]}, 0xff, 0x44d, &(0x7f0000000900)="$eJzs3MtvG8UfAPDvrp30/Ut+UB4tLQQKouKRNOnzwKUIJA4gIcGhiFNI0qrUbaAJEq0qKBzKEVXijjgi8RdwggsCTkhc4Y4qVaiXFiQko13vpsa107hx6rb+fKRNZrzjzHx3d+zZGTsBDKyx7EcSsTkifouIkUb2vwXGGr+uXTk389eVczNJ1Otv/Jnk5a5eOTdTFi2ft6mRqdeL/Lo29V54O2K6Vps7XeQnFk++N7Fw5uzzx09OH5s7Nndq6tChfXt3Dh+Y2t+TOLO4rm7/aH7HtlfeuvjazJGL7/z0TdbezcX+5jh6ZaxxdNt6qteV9dmWpnRS7WND6EolIrLTNZT3/5GoxIalfSPx8qd9bRywpur1er3d+3PhfB24hyXR7xYA/VG+0Wf3v+V2m4Yed4TLhyPeP9iI/1qxNfZUIy3KDLXc3/bSWEQcOf/3l9kWazQPAQDQ7LvDEfFcu/FfGg82lftfsYYyGhH/j4j7IuL+iNgaEQ9E5GUfioiHu6y/dYXkxvFPeumWAluhbPz3QrG2tTT++6eex18YrRS5LXn8Q8nR47W5PcUx2R1D67L85DJ1fP/Sr5932tc8/su2rP5yLNiQXqq2TNDNTi9OrzLsJZc/idhebYk/l0S5jJNExLaI2N7VX75+h3H8ma93dCp18/iX0YN1pvpXEU83zv/5aIm/lHRcn5w8eGBq/8T6qM3tmSivihv9/MuF1zvVv6r4eyA7/xtbr//cUvyjyfqIhTNnT+TrtQvd13Hh98863tPc6vU/nLyZp4eLxz6cXlw8PRkxnLx64+NT159b5svyWfy7d7WLP81f48oj8UhEZBfxzoh4NCIeK9r+eEQ8ERG7lon/xxeffLf7+JeZle+hLP7Zm53/aD7/3ScqJ374tvv4S9n535endhePrOT1b6UNXM2xAwAAgLtFmn8GPknHl9JpOj7e+Az/1tiY1uYXFp89Ov/BqdnGZ+VHYygtZ7pGmuZDJ4u54TI/1ZLfW8wbf1HZkOfHZ+Zrs/0OHgbcpg79P/NHpd+tA9ac72vB4NL/YXDp/zC49H8YXPo/DK52/f/jPrQDuP28/8Pg0v9hcOn/MLj0fxhIHb8bn67qK/8S93wi0u6fVY07pPF3U6K64n9mcYuJdW139fuVCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoDf+DQAA//9X4u4v") keyctl$join(0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) futex_waitv(0x0, 0x0, 0x0, 0x0, 0x1) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) semctl$IPC_RMID(0x0, 0x0, 0x0) r3 = socket$inet(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x200007f9, &(0x7f00000000c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10) shutdown(r3, 0x1) pipe2(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) splice(r3, 0x0, r4, 0x0, 0x1, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file3\x00', 0x64042, 0x49) write$P9_RREADLINK(r5, &(0x7f0000000000)={0x6549bfc8e202b0dd, 0x17, 0x2, {0x7, './file0'}}, 0xfffffdab) 20.553618309s ago: executing program 2 (id=11): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000002900), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000002940)={0x8, 0x100008b}, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002980)=0x7) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000440)={0x0}, &(0x7f0000000480)=0xc) ptrace$getregset(0x4204, r0, 0x3, &(0x7f0000000600)={&(0x7f00000004c0)=""/173, 0xad}) r1 = syz_open_dev$sndmidi(&(0x7f00000029c0), 0x2, 0x143102) writev(r1, &(0x7f0000002a00)=[{&(0x7f0000002a40)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) syz_open_dev$media(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r2 = socket(0xa, 0x3, 0xff) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40, 0x800}}], 0x1, 0x0) r3 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r3, &(0x7f0000000340)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x8, @multicast2}}, 0x24) ioctl$sock_inet_SIOCGIFBRDADDR(r3, 0x8919, 0x0) sendmmsg(r3, &(0x7f0000000380)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0xe000}, 0x5}], 0x1, 0x0) recvmmsg(r3, 0x0, 0x0, 0x10002, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x60}}, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x4e22, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c) sendmsg$nl_xfrm(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="f80000001800100025bd7000ffdbdf25e00000020000003cf82e49000000000000000000008000000000ffffe00000024e230b064e2300040000e00000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc010000000000000000000000000000000004d233000000ffffffff0000000000000000000000000004000000000000020000000000000007000000000000000400000000000000040000000000000000000000000000003c0a00000000000000000000000000800f0000000000000003000000000000000400000000000000feffffffffffffff0a000000060000000500000028bd7000000000000200000100000000000000000900000000000000"], 0xf8}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000400)={'vxcan0\x00'}) socket$inet_udp(0x2, 0x2, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000009d00)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000009d40)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) 18.941604781s ago: executing program 0 (id=13): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000002900), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000002940)={0x8, 0x100008b}, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002980)=0x7) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000440)={0x0}, &(0x7f0000000480)=0xc) ptrace$getregset(0x4204, r0, 0x3, &(0x7f0000000600)={&(0x7f00000004c0)=""/173, 0xad}) r1 = syz_open_dev$sndmidi(&(0x7f00000029c0), 0x2, 0x143102) writev(r1, &(0x7f0000002a00)=[{&(0x7f0000002a40)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) syz_open_dev$media(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r2 = socket(0xa, 0x3, 0xff) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40, 0x800}}], 0x1, 0x0) r3 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r3, &(0x7f0000000340)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x8, @multicast2}}, 0x24) ioctl$sock_inet_SIOCGIFBRDADDR(r3, 0x8919, 0x0) sendmmsg(r3, &(0x7f0000000380)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0xe000}, 0x5}], 0x1, 0x0) recvmmsg(r3, 0x0, 0x0, 0x10002, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x60}}, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x4e22, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c) sendmsg$nl_xfrm(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="f80000001800100025bd7000ffdbdf25e00000020000003cf82e49000000000000000000008000000000ffffe00000024e230b064e2300040000e00000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc010000000000000000000000000000000004d233000000ffffffff0000000000000000000000000004000000000000020000000000000007000000000000000400000000000000040000000000000000000000000000003c0a00000000000000000000000000800f0000000000000003000000000000000400000000000000feffffffffffffff0a000000060000000500000028bd7000000000000200000100000000000000000900000000000000"], 0xf8}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000400)={'vxcan0\x00'}) socket$inet_udp(0x2, 0x2, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000009d00)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000009d40)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) 18.84964277s ago: executing program 3 (id=14): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000002900), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000002940)={0x8, 0x100008b}, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002980)=0x7) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000440)={0x0}, &(0x7f0000000480)=0xc) ptrace$getregset(0x4204, r0, 0x3, &(0x7f0000000600)={&(0x7f00000004c0)=""/173, 0xad}) r1 = syz_open_dev$sndmidi(&(0x7f00000029c0), 0x2, 0x143102) writev(r1, &(0x7f0000002a00)=[{&(0x7f0000002a40)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) syz_open_dev$media(0x0, 0x0, 0x0) r2 = socket(0xa, 0x3, 0xff) r3 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r3, &(0x7f0000000340)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x8, @multicast2}}, 0x24) ioctl$sock_inet_SIOCGIFBRDADDR(r3, 0x8919, &(0x7f00000005c0)={'\x00', {0x2, 0x0, @dev}}) sendmmsg(r3, &(0x7f0000000380)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB], 0x18, 0xe000}, 0x5}], 0x1, 0x0) recvmmsg(r3, 0x0, 0x0, 0x10002, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x60}}, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x4e22, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c) sendmsg$nl_xfrm(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="f80000001800100025bd7000ffdbdf25e00000020000003cf82e49000000000000000000008000000000ffffe00000024e230b064e2300040000e00000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc010000000000000000000000000000000004d233000000ffffffff0000000000000000000000000004000000000000020000000000000007000000000000000400000000000000040000000000000000000000000000003c0a00000000000000000000000000800f0000000000000003000000000000000400000000000000feffffffffffffff0a000000060000000500000028bd7000000000000200000100000000000000000900000000000000"], 0xf8}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000400)={'vxcan0\x00'}) socket$inet_udp(0x2, 0x2, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000009d00)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000009d40)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) 18.740397641s ago: executing program 1 (id=15): mkdirat(0xffffffffffffff9c, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000001080)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000010c0)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000001100)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000001180)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000001200), 0x651, 0x0) recvmmsg(r1, &(0x7f0000001240), 0x10106, 0x2, 0x0) r3 = openat$comedi(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r3, 0x40946400, &(0x7f00000012c0)={'rti802\x00', [0x100, 0x4, 0x13600, 0x4, 0x0, 0x10005, 0x79, 0x0, 0x80008, 0x8, 0x2, 0x64, 0x5, 0x1, 0x6, 0xfd, 0x6, 0x9, 0x3, 0x7fffffff, 0x6, 0xca9f, 0x9, 0x20001e58, 0x3, 0xf39e, 0x7ff, 0x1539b804, 0x7, 0x801, 0x2]}) sched_setscheduler(0x0, 0x2, &(0x7f0000001380)=0x6) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001480), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000014c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r5, &(0x7f0000001500)={0x0, 0xfffffffffffffe26, &(0x7f0000001540)={&(0x7f0000001580)={0x2c, r4, 0x1, 0x4, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xa5}]}, 0x2c}}, 0x0) r7 = openat$md_node(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$SET_ARRAY_INFO(r7, 0x40480923, 0x0) ioctl$RUN_ARRAY(r7, 0x400c0930, &(0x7f0000000380)) 18.587818876s ago: executing program 2 (id=16): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000002900), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000002940)={0x8, 0x100008b}, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002980)=0x7) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000440)={0x0}, &(0x7f0000000480)=0xc) ptrace$getregset(0x4204, r0, 0x3, &(0x7f0000000600)={&(0x7f00000004c0)=""/173, 0xad}) r1 = syz_open_dev$sndmidi(&(0x7f00000029c0), 0x2, 0x143102) writev(r1, &(0x7f0000002a00)=[{&(0x7f0000002a40)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) syz_open_dev$media(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r2 = socket(0xa, 0x3, 0xff) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40, 0x800}}], 0x1, 0x0) r3 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r3, &(0x7f0000000340)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x8, @multicast2}}, 0x24) ioctl$sock_inet_SIOCGIFBRDADDR(r3, 0x8919, &(0x7f00000005c0)={'\x00', {0x2, 0x0, @dev}}) sendmmsg(r3, 0x0, 0x0, 0x0) recvmmsg(r3, 0x0, 0x0, 0x10002, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x60}}, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x4e22, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c) sendmsg$nl_xfrm(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="f80000001800100025bd7000ffdbdf25e00000020000003cf82e49000000000000000000008000000000ffffe00000024e230b064e2300040000e00000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc010000000000000000000000000000000004d233000000ffffffff0000000000000000000000000004000000000000020000000000000007000000000000000400000000000000040000000000000000000000000000003c0a00000000000000000000000000800f0000000000000003000000000000000400000000000000feffffffffffffff0a000000060000000500000028bd7000000000000200000100000000000000000900000000000000"], 0xf8}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000400)={'vxcan0\x00'}) socket$inet_udp(0x2, 0x2, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000009d00)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000009d40)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) 15.388053667s ago: executing program 1 (id=17): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000002900), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000002940)={0x8, 0x100008b}, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002980)=0x7) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000440)={0x0}, &(0x7f0000000480)=0xc) ptrace$getregset(0x4204, r0, 0x3, &(0x7f0000000600)={&(0x7f00000004c0)=""/173, 0xad}) r1 = syz_open_dev$sndmidi(&(0x7f00000029c0), 0x2, 0x143102) writev(r1, &(0x7f0000002a00)=[{&(0x7f0000002a40)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) syz_open_dev$media(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r2 = socket(0xa, 0x3, 0xff) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40, 0x800}}], 0x1, 0x0) r3 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r3, &(0x7f0000000340)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x8, @multicast2}}, 0x24) ioctl$sock_inet_SIOCGIFBRDADDR(r3, 0x8919, &(0x7f00000005c0)={'\x00', {0x2, 0x0, @dev}}) sendmmsg(r3, 0x0, 0x0, 0x0) recvmmsg(r3, 0x0, 0x0, 0x10002, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x60}}, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x4e22, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c) sendmsg$nl_xfrm(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="f80000001800100025bd7000ffdbdf25e00000020000003cf82e49000000000000000000008000000000ffffe00000024e230b064e2300040000e00000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc010000000000000000000000000000000004d233000000ffffffff0000000000000000000000000004000000000000020000000000000007000000000000000400000000000000040000000000000000000000000000003c0a00000000000000000000000000800f0000000000000003000000000000000400000000000000feffffffffffffff0a000000060000000500000028bd7000000000000200000100000000000000000900000000000000"], 0xf8}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000400)={'vxcan0\x00'}) socket$inet_udp(0x2, 0x2, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000009d00)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000009d40)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) 11.022932845s ago: executing program 0 (id=18): mkdirat(0xffffffffffffff9c, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000001080)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000010c0)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000001100)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000001180)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000001200), 0x651, 0x0) recvmmsg(r1, &(0x7f0000001240), 0x10106, 0x2, 0x0) r3 = openat$comedi(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r3, 0x40946400, &(0x7f00000012c0)={'rti802\x00', [0x100, 0x4, 0x13600, 0x4, 0x0, 0x10005, 0x79, 0x0, 0x80008, 0x8, 0x2, 0x64, 0x5, 0x1, 0x6, 0xfd, 0x6, 0x9, 0x3, 0x7fffffff, 0x6, 0xca9f, 0x9, 0x20001e58, 0x3, 0xf39e, 0x7ff, 0x1539b804, 0x7, 0x801, 0x2]}) sched_setscheduler(0x0, 0x2, &(0x7f0000001380)=0x6) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001480), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000014c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r5, &(0x7f0000001500)={0x0, 0xfffffffffffffe26, &(0x7f0000001540)={&(0x7f0000001580)={0x2c, r4, 0x1, 0x4, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xa5}]}, 0x2c}}, 0x0) r7 = openat$md_node(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$SET_ARRAY_INFO(r7, 0x40480923, 0x0) ioctl$RUN_ARRAY(r7, 0x400c0930, &(0x7f0000000380)) 9.947186242s ago: executing program 0 (id=19): syz_mount_image$ext4(&(0x7f0000000080)='ext3\x00', &(0x7f0000000480)='./file0\x00', 0x0, &(0x7f0000000100)={[{@noload}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x1}}, {@usrjquota}, {@noload}, {@data_err_ignore}, {@usrjquota}]}, 0xff, 0x44d, &(0x7f0000000900)="$eJzs3MtvG8UfAPDvrp30/Ut+UB4tLQQKouKRNOnzwKUIJA4gIcGhiFNI0qrUbaAJEq0qKBzKEVXijjgi8RdwggsCTkhc4Y4qVaiXFiQko13vpsa107hx6rb+fKRNZrzjzHx3d+zZGTsBDKyx7EcSsTkifouIkUb2vwXGGr+uXTk389eVczNJ1Otv/Jnk5a5eOTdTFi2ft6mRqdeL/Lo29V54O2K6Vps7XeQnFk++N7Fw5uzzx09OH5s7Nndq6tChfXt3Dh+Y2t+TOLO4rm7/aH7HtlfeuvjazJGL7/z0TdbezcX+5jh6ZaxxdNt6qteV9dmWpnRS7WND6EolIrLTNZT3/5GoxIalfSPx8qd9bRywpur1er3d+3PhfB24hyXR7xYA/VG+0Wf3v+V2m4Yed4TLhyPeP9iI/1qxNfZUIy3KDLXc3/bSWEQcOf/3l9kWazQPAQDQ7LvDEfFcu/FfGg82lftfsYYyGhH/j4j7IuL+iNgaEQ9E5GUfioiHu6y/dYXkxvFPeumWAluhbPz3QrG2tTT++6eex18YrRS5LXn8Q8nR47W5PcUx2R1D67L85DJ1fP/Sr5932tc8/su2rP5yLNiQXqq2TNDNTi9OrzLsJZc/idhebYk/l0S5jJNExLaI2N7VX75+h3H8ma93dCp18/iX0YN1pvpXEU83zv/5aIm/lHRcn5w8eGBq/8T6qM3tmSivihv9/MuF1zvVv6r4eyA7/xtbr//cUvyjyfqIhTNnT+TrtQvd13Hh98863tPc6vU/nLyZp4eLxz6cXlw8PRkxnLx64+NT159b5svyWfy7d7WLP81f48oj8UhEZBfxzoh4NCIeK9r+eEQ8ERG7lon/xxeffLf7+JeZle+hLP7Zm53/aD7/3ScqJ374tvv4S9n535endhePrOT1b6UNXM2xAwAAgLtFmn8GPknHl9JpOj7e+Az/1tiY1uYXFp89Ov/BqdnGZ+VHYygtZ7pGmuZDJ4u54TI/1ZLfW8wbf1HZkOfHZ+Zrs/0OHgbcpg79P/NHpd+tA9ac72vB4NL/YXDp/zC49H8YXPo/DK52/f/jPrQDuP28/8Pg0v9hcOn/MLj0fxhIHb8bn67qK/8S93wi0u6fVY07pPF3U6K64n9mcYuJdW139fuVCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoDf+DQAA//9X4u4v") keyctl$join(0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x5607, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) futex_waitv(0x0, 0x0, 0x0, 0x0, 0x1) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) semctl$IPC_RMID(0x0, 0x0, 0x0) r3 = socket$inet(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x200007f9, &(0x7f00000000c0)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10) shutdown(r3, 0x1) pipe2(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) splice(r3, 0x0, r4, 0x0, 0x1, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file3\x00', 0x64042, 0x49) write$P9_RREADLINK(r5, &(0x7f0000000000)={0x6549bfc8e202b0dd, 0x17, 0x2, {0x7, './file0'}}, 0xfffffdab) 9.87323752s ago: executing program 2 (id=20): syz_open_dev$sndmidi(0x0, 0x2, 0x141102) syz_init_net_socket$x25(0x9, 0x5, 0x0) open$dir(&(0x7f0000000400)='./file0\x00', 0xe8c40, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000640)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000680)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000006c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1000000000000001, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000700)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000740), 0x0, 0x0) read$msr(r3, &(0x7f000000d000)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000026000)=0x7) syz_io_uring_setup(0x13fc, 0x0, &(0x7f00000260c0), &(0x7f0000026100), &(0x7f0000026140)) acct(&(0x7f0000026200)='./file0\x00') 9.849066663s ago: executing program 3 (id=21): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000002900), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000002940)={0x8, 0x100008b}, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002980)=0x7) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000440)={0x0}, &(0x7f0000000480)=0xc) ptrace$getregset(0x4204, r0, 0x3, &(0x7f0000000600)={&(0x7f00000004c0)=""/173, 0xad}) r1 = syz_open_dev$sndmidi(&(0x7f00000029c0), 0x2, 0x143102) writev(r1, &(0x7f0000002a00)=[{&(0x7f0000002a40)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) syz_open_dev$media(0x0, 0x0, 0x0) r2 = socket(0xa, 0x3, 0xff) r3 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r3, &(0x7f0000000340)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x8, @multicast2}}, 0x24) ioctl$sock_inet_SIOCGIFBRDADDR(r3, 0x8919, &(0x7f00000005c0)={'\x00', {0x2, 0x0, @dev}}) sendmmsg(r3, &(0x7f0000000380)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000"], 0x18, 0xe000}, 0x5}], 0x1, 0x0) recvmmsg(r3, 0x0, 0x0, 0x10002, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x60}}, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x4e22, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c) sendmsg$nl_xfrm(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="f80000001800100025bd7000ffdbdf25e00000020000003cf82e49000000000000000000008000000000ffffe00000024e230b064e2300040000e00000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc010000000000000000000000000000000004d233000000ffffffff0000000000000000000000000004000000000000020000000000000007000000000000000400000000000000040000000000000000000000000000003c0a00000000000000000000000000800f0000000000000003000000000000000400000000000000feffffffffffffff0a000000060000000500000028bd7000000000000200000100000000000000000900000000000000"], 0xf8}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000400)={'vxcan0\x00'}) socket$inet_udp(0x2, 0x2, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000009d00)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000009d40)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) 9.748681613s ago: executing program 1 (id=22): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000002900), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000002940)={0x8, 0x100008b}, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002980)=0x7) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000440)={0x0}, &(0x7f0000000480)=0xc) ptrace$getregset(0x4204, r0, 0x3, &(0x7f0000000600)={&(0x7f00000004c0)=""/173, 0xad}) r1 = syz_open_dev$sndmidi(&(0x7f00000029c0), 0x2, 0x143102) writev(r1, &(0x7f0000002a00)=[{&(0x7f0000002a40)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) syz_open_dev$media(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r2 = socket(0xa, 0x3, 0xff) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[@cred={{0x1c}}], 0x20, 0x800}}], 0x1, 0x0) r3 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r3, &(0x7f0000000340)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x8, @multicast2}}, 0x24) ioctl$sock_inet_SIOCGIFBRDADDR(r3, 0x8919, &(0x7f00000005c0)={'\x00', {0x2, 0x0, @dev}}) sendmmsg(r3, &(0x7f0000000380)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0xe000}, 0x5}], 0x1, 0x0) recvmmsg(r3, 0x0, 0x0, 0x10002, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x60}}, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x4e22, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c) sendmsg$nl_xfrm(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="f80000001800100025bd7000ffdbdf25e00000020000003cf82e49000000000000000000008000000000ffffe00000024e230b064e2300040000e00000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc010000000000000000000000000000000004d233000000ffffffff0000000000000000000000000004000000000000020000000000000007000000000000000400000000000000040000000000000000000000000000003c0a00000000000000000000000000800f0000000000000003000000000000000400000000000000feffffffffffffff0a000000060000000500000028bd7000000000000200000100000000000000000900000000000000"], 0xf8}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000400)={'vxcan0\x00'}) socket$inet_udp(0x2, 0x2, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000009d00)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000009d40)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) 6.508927807s ago: executing program 2 (id=23): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000002900), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000002940)={0x8, 0x100008b}, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002980)=0x7) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000440)={0x0}, &(0x7f0000000480)=0xc) ptrace$getregset(0x4204, r0, 0x3, &(0x7f0000000600)={&(0x7f00000004c0)=""/173, 0xad}) r1 = syz_open_dev$sndmidi(&(0x7f00000029c0), 0x2, 0x143102) writev(r1, &(0x7f0000002a00)=[{&(0x7f0000002a40)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) syz_open_dev$media(0x0, 0x0, 0x0) r2 = socket(0xa, 0x3, 0xff) r3 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r3, &(0x7f0000000340)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x8, @multicast2}}, 0x24) ioctl$sock_inet_SIOCGIFBRDADDR(r3, 0x8919, &(0x7f00000005c0)={'\x00', {0x2, 0x0, @dev}}) sendmmsg(r3, &(0x7f0000000380)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0xe000}, 0x5}], 0x1, 0x0) recvmmsg(r3, 0x0, 0x0, 0x10002, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x60}}, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x4e22, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c) sendmsg$nl_xfrm(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="f80000001800100025bd7000ffdbdf25e00000020000003cf82e49000000000000000000008000000000ffffe00000024e230b064e2300040000e00000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc010000000000000000000000000000000004d233000000ffffffff0000000000000000000000000004000000000000020000000000000007000000000000000400000000000000040000000000000000000000000000003c0a00000000000000000000000000800f0000000000000003000000000000000400000000000000feffffffffffffff0a000000060000000500000028bd7000000000000200000100000000000000000900000000000000"], 0xf8}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000400)={'vxcan0\x00'}) socket$inet_udp(0x2, 0x2, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000009d00)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000009d40)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) 6.265941752s ago: executing program 3 (id=24): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000002900), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000002940)={0x8, 0x100008b}, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002980)=0x7) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000440)={0x0}, &(0x7f0000000480)=0xc) ptrace$getregset(0x4204, r0, 0x3, &(0x7f0000000600)={&(0x7f00000004c0)=""/173, 0xad}) r1 = syz_open_dev$sndmidi(&(0x7f00000029c0), 0x2, 0x143102) writev(r1, &(0x7f0000002a00)=[{&(0x7f0000002a40)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) syz_open_dev$media(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r2 = socket(0xa, 0x3, 0xff) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000002c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[@cred={{0x1c}}], 0x20, 0x800}}], 0x1, 0x0) r3 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r3, &(0x7f0000000340)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x8, @multicast2}}, 0x24) ioctl$sock_inet_SIOCGIFBRDADDR(r3, 0x8919, &(0x7f00000005c0)={'\x00', {0x2, 0x0, @dev}}) sendmmsg(r3, &(0x7f0000000380)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0xe000}, 0x5}], 0x1, 0x0) recvmmsg(r3, 0x0, 0x0, 0x10002, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x60}}, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x4e22, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c) sendmsg$nl_xfrm(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="f80000001800100025bd7000ffdbdf25e00000020000003cf82e49000000000000000000008000000000ffffe00000024e230b064e2300040000e00000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc010000000000000000000000000000000004d233000000ffffffff0000000000000000000000000004000000000000020000000000000007000000000000000400000000000000040000000000000000000000000000003c0a00000000000000000000000000800f0000000000000003000000000000000400000000000000feffffffffffffff0a000000060000000500000028bd7000000000000200000100000000000000000900000000000000"], 0xf8}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000400)={'vxcan0\x00'}) socket$inet_udp(0x2, 0x2, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000009d00)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000009d40)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) 6.140923734s ago: executing program 0 (id=25): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000002900), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000002940)={0x8, 0x100008b}, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002980)=0x7) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000440)={0x0}, &(0x7f0000000480)=0xc) ptrace$getregset(0x4204, r0, 0x3, &(0x7f0000000600)={&(0x7f00000004c0)=""/173, 0xad}) r1 = syz_open_dev$sndmidi(&(0x7f00000029c0), 0x2, 0x143102) writev(r1, &(0x7f0000002a00)=[{&(0x7f0000002a40)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) syz_open_dev$media(0x0, 0x0, 0x0) r2 = socket(0xa, 0x3, 0xff) r3 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r3, &(0x7f0000000340)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x8, @multicast2}}, 0x24) ioctl$sock_inet_SIOCGIFBRDADDR(r3, 0x8919, &(0x7f00000005c0)={'\x00', {0x2, 0x0, @dev}}) sendmmsg(r3, &(0x7f0000000380)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB], 0x18, 0xe000}, 0x5}], 0x1, 0x0) recvmmsg(r3, 0x0, 0x0, 0x10002, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x60}}, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x4e22, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c) sendmsg$nl_xfrm(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="f80000001800100025bd7000ffdbdf25e00000020000003cf82e49000000000000000000008000000000ffffe00000024e230b064e2300040000e00000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc010000000000000000000000000000000004d233000000ffffffff0000000000000000000000000004000000000000020000000000000007000000000000000400000000000000040000000000000000000000000000003c0a00000000000000000000000000800f0000000000000003000000000000000400000000000000feffffffffffffff0a000000060000000500000028bd7000000000000200000100000000000000000900000000000000"], 0xf8}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000400)={'vxcan0\x00'}) socket$inet_udp(0x2, 0x2, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000009d00)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000009d40)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) 5.956912733s ago: executing program 1 (id=26): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000700)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f0000000740)={&(0x7f0000000780)={0xa, 0x4e24, 0xb, @loopback, 0x4}, 0x1c, &(0x7f00000007c0)=[{&(0x7f0000000800)="96", 0x1}], 0x1}, 0x4048042) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f0000000840)={'lo\x00', 0x3}) pipe2$9p(&(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RSETATTR(r3, &(0x7f00000008c0)={0x7, 0x1b, 0x2}, 0xffffff9a) r4 = socket$inet_udp(0x2, 0x2, 0x0) write$sequencer(r1, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r4, 0x89fb, &(0x7f0000000a00)={'sit0\x00', &(0x7f0000000a40)={@empty, @dev={0xac, 0x14, 0x14, 0x23}, 0xb, 0x20}}) write$cgroup_int(r1, &(0x7f0000000a80)=0x4, 0x12) splice(r2, 0x0, r0, 0x0, 0xffff, 0x2) 3.540994905s ago: executing program 3 (id=27): sendmsg$inet(0xffffffffffffffff, 0x0, 0x4000004) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0x51, 0xffffffff}, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1, 0x14, &(0x7f0000000540)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @call={0x85, 0x0, 0x0, 0x7}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000600)='GPL\x00', 0x4, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r1, 0xfca804a0, 0x0, 0x8, 0x0, &(0x7f0000000700)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20004004) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(0xffffffffffffffff, 0x28, 0x2, &(0x7f0000000340), 0x8) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10000, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000006, 0x204031, 0xffffffffffffffff, 0xec776000) timer_create(0x1, &(0x7f00000024c0)={0x0, 0x1c, 0x1, @thr={&(0x7f00000004c0)="f4f63f1f04626a81a3ca91ba80afab626250641060184bd61ff2d9071964f74a95c04ee11c1a824676fce216f46938d614caa4562ff4921fbeeb25f0491a4bfd0b29f96d117fc2bd3991c0c688d5f8e08fa9cea1f0", 0x0}}, &(0x7f0000002500)) fsopen(&(0x7f0000000080)='udf\x00', 0x0) r3 = socket$rds(0x15, 0x5, 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r4, &(0x7f0000000180)=@pppol2tp={0x18, 0x1, {0x0, r5, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r6 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r6, 0x0, 0x0) ioctl$PPPIOCGL2TPSTATS(r4, 0x80487436, &(0x7f00000002c0)="43210098") bind$rds(r3, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$inet(r3, &(0x7f0000000480)={&(0x7f0000000000)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000380)=[{&(0x7f00000001c0)="91cfdfefdb", 0x1a000}], 0x1}, 0x0) sendmsg$rds(r3, &(0x7f0000000140)={&(0x7f0000000240)={0x2, 0xce21, @private=0xa010102}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x8c0}, 0x0) 3.481364971s ago: executing program 0 (id=28): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000002900), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000002940)={0x8, 0x100008b}, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002980)=0x7) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000440)={0x0}, &(0x7f0000000480)=0xc) ptrace$getregset(0x4204, r0, 0x3, &(0x7f0000000600)={&(0x7f00000004c0)=""/173, 0xad}) r1 = syz_open_dev$sndmidi(&(0x7f00000029c0), 0x2, 0x143102) writev(r1, &(0x7f0000002a00)=[{&(0x7f0000002a40)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) syz_open_dev$media(0x0, 0x0, 0x0) r2 = socket(0xa, 0x3, 0xff) r3 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r3, &(0x7f0000000340)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x8, @multicast2}}, 0x24) ioctl$sock_inet_SIOCGIFBRDADDR(r3, 0x8919, &(0x7f00000005c0)={'\x00', {0x2, 0x0, @dev}}) sendmmsg(r3, &(0x7f0000000380)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0xe000}, 0x5}], 0x1, 0x0) recvmmsg(r3, 0x0, 0x0, 0x10002, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x60}}, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x4e22, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c) sendmsg$nl_xfrm(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="f80000001800100025bd7000ffdbdf25e00000020000003cf82e49000000000000000000008000000000ffffe00000024e230b064e2300040000e00000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc010000000000000000000000000000000004d233000000ffffffff0000000000000000000000000004000000000000020000000000000007000000000000000400000000000000040000000000000000000000000000003c0a00000000000000000000000000800f0000000000000003000000000000000400000000000000feffffffffffffff0a000000060000000500000028bd7000000000000200000100000000000000000900000000000000"], 0xf8}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000400)={'vxcan0\x00'}) socket$inet_udp(0x2, 0x2, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000009d00)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000009d40)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) 3.342459655s ago: executing program 1 (id=29): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000002900), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000002940)={0x8, 0x100008b}, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002980)=0x7) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000440)={0x0}, &(0x7f0000000480)=0xc) ptrace$getregset(0x4204, r0, 0x3, &(0x7f0000000600)={&(0x7f00000004c0)=""/173, 0xad}) r1 = syz_open_dev$sndmidi(&(0x7f00000029c0), 0x2, 0x143102) writev(r1, &(0x7f0000002a00)=[{&(0x7f0000002a40)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) syz_open_dev$media(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r2 = socket(0xa, 0x3, 0xff) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000002c0), 0x0, 0x0) r3 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r3, &(0x7f0000000340)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x8, @multicast2}}, 0x24) ioctl$sock_inet_SIOCGIFBRDADDR(r3, 0x8919, &(0x7f00000005c0)={'\x00', {0x2, 0x0, @dev}}) sendmmsg(r3, &(0x7f0000000380)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0xe000}, 0x5}], 0x1, 0x0) recvmmsg(r3, 0x0, 0x0, 0x10002, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x60}}, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x4e22, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c) sendmsg$nl_xfrm(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="f80000001800100025bd7000ffdbdf25e00000020000003cf82e49000000000000000000008000000000ffffe00000024e230b064e2300040000e00000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc010000000000000000000000000000000004d233000000ffffffff0000000000000000000000000004000000000000020000000000000007000000000000000400000000000000040000000000000000000000000000003c0a00000000000000000000000000800f0000000000000003000000000000000400000000000000feffffffffffffff0a000000060000000500000028bd7000000000000200000100000000000000000900000000000000"], 0xf8}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000400)={'vxcan0\x00'}) socket$inet_udp(0x2, 0x2, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000009d00)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000009d40)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) 1.951323174s ago: executing program 3 (id=30): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000002900), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000002940)={0x8, 0x100008b}, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002980)=0x7) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000440)={0x0}, &(0x7f0000000480)=0xc) ptrace$getregset(0x4204, r0, 0x3, &(0x7f0000000600)={&(0x7f00000004c0)=""/173, 0xad}) r1 = syz_open_dev$sndmidi(&(0x7f00000029c0), 0x2, 0x143102) writev(r1, &(0x7f0000002a00)=[{&(0x7f0000002a40)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) syz_open_dev$media(0x0, 0x0, 0x0) r2 = socket(0xa, 0x3, 0xff) r3 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r3, &(0x7f0000000340)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x8, @multicast2}}, 0x24) ioctl$sock_inet_SIOCGIFBRDADDR(r3, 0x8919, &(0x7f00000005c0)={'\x00', {0x2, 0x0, @dev}}) sendmmsg(r3, &(0x7f0000000380), 0x0, 0x0) recvmmsg(r3, 0x0, 0x0, 0x10002, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x60}}, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x4e22, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c) sendmsg$nl_xfrm(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="f80000001800100025bd7000ffdbdf25e00000020000003cf82e49000000000000000000008000000000ffffe00000024e230b064e2300040000e00000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fc010000000000000000000000000000000004d233000000ffffffff0000000000000000000000000004000000000000020000000000000007000000000000000400000000000000040000000000000000000000000000003c0a00000000000000000000000000800f0000000000000003000000000000000400000000000000feffffffffffffff0a000000060000000500000028bd7000000000000200000100000000000000000900000000000000"], 0xf8}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000400)={'vxcan0\x00'}) socket$inet_udp(0x2, 0x2, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000009d00)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000009d40)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) 1.061367633s ago: executing program 0 (id=31): sendmsg$inet(0xffffffffffffffff, 0x0, 0x4000004) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0x51, 0xffffffff}, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1, 0x14, &(0x7f0000000540)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @call={0x85, 0x0, 0x0, 0x7}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000600)='GPL\x00', 0x4, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r1, 0xfca804a0, 0x0, 0x8, 0x0, &(0x7f0000000700)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20004004) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(0xffffffffffffffff, 0x28, 0x2, &(0x7f0000000340), 0x8) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10000, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000006, 0x204031, 0xffffffffffffffff, 0xec776000) timer_create(0x1, &(0x7f00000024c0)={0x0, 0x1c, 0x1, @thr={&(0x7f00000004c0)="f4f63f1f04626a81a3ca91ba80afab626250641060184bd61ff2d9071964f74a95c04ee11c1a824676fce216f46938d614caa4562ff4921fbeeb25f0491a4bfd0b29f96d117fc2bd3991c0c688d5f8e08fa9cea1f0", 0x0}}, &(0x7f0000002500)) fsopen(&(0x7f0000000080)='udf\x00', 0x0) r3 = socket$rds(0x15, 0x5, 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r4, &(0x7f0000000180)=@pppol2tp={0x18, 0x1, {0x0, r5, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r6 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r6, &(0x7f0000000200)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x4e22, @broadcast}, 0x2, 0x9800}}, 0x2e) ioctl$PPPIOCGL2TPSTATS(r4, 0x80487436, &(0x7f00000002c0)) bind$rds(r3, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$inet(r3, &(0x7f0000000480)={&(0x7f0000000000)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000380)=[{&(0x7f00000001c0)="91cfdfefdb", 0x1a000}], 0x1}, 0x0) sendmsg$rds(r3, &(0x7f0000000140)={&(0x7f0000000240)={0x2, 0xce21, @private=0xa010102}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x8c0}, 0x0) 0s ago: executing program 1 (id=32): r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x1212000, &(0x7f00000000c0), 0xfe, 0x7cb, &(0x7f0000000380)="$eJzs3ctrW1caAPDvynb8SAZ7YJjHzjCQCYTIccaTzMAsMsyiFBoItOsmRlZMatkKlhxiY6hDKXRTaEsXhXaTdR8p3XTbF121/0UXJSFtnNCULorLla78lBw5tuW2/v3gWufcc6/P+e65jyPdixTAoTWc/slF/C0iXksiBrP5SUT01FLdEefryz1aXuyLiEISKyvPfp/Ulnm4vFiIdeukjmaZv0bEZy9HnMxtrbcyvzA1XioVZ7P8SHX62khlfuHU1enxyeJkcebs6NjYmXP/Ond2lwF2rSV/+Hrh2N3Xn/rHB+d/eukvt1/9PInzcSwrWx/HXhmO4Wyb9KSbcIP/73VlByw56AbwRHLZIdId6TlgMLpqqRb6O9kyAGC/vBgRKwDAIZO4/gPAIdP4HODh8mKhMR3sJxKdde9/EdFXj/9RNtVLurN7dn21+6ADD5MNd0aSiBjag/qHI+Kdj58/3rhNmbbDvTSgE5ZuRsTloeGt5/9kyzMLO3V6u8KV3trL8KbZh+36Awfpk3T88+9m47/c6vgnmox/euvH7p93W3/L4391cJW702y9bZ5S2ZF0/Pff+rNtm8Z/qw+tDXVluT/UmtWTXLlaKp7OtkEqzY/WUs1Hbice/PygVf3Z+O+9dLr/xgvvpvWnr2tL5O50925cZ2K82v3lboJe597NGMiSm+JPVvs/aTH+vdhmHU//55W3W5Wl8afxNqat8e+vlVsRx5v2/1pfJts+nzhS2x1GGjtFEx9+89ZAq/rX9386pfWnr3sfaXP3bkYM3B+MJFnbBvWS1fiHkvXPa1Z2XsdXtwY/bVX2+Pib7v/jR5Lnaukj2bwb49Xq7GjEkeSZrfPPrK3byDeWT+M/8ffmx3+92ub7f/qe8HKb8Xff/e79J49/f6XxT2y//2/q/75s9tqcxyVuP5rqalV/e/0/VkudyOak/f+4uNpp15PtzQAAAAAAAAAAAAAAAAAAAAAAAACwc7mIOBZJLr+azuXy+fpveP8pBnKlcqV68kp5bmYiar+VPRQ9ucZXXQ6u+z7U0ewrWxv5M5vy/4yIP0bEm739tXy+UC5NHHTwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJA52uL3/1Pf9h506wCAfdN30A0AADrO9R8ADp+dXf/7960dAEDneP8PAIdP29f/y/vbDgCgc7z/BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYJ9dvHAhnVZ+XF4spPmJ6/NzU+XrpyaKlan89FwhXyjPXstPlsuTpWK+UJ5u+Y+W6i+lcvna2NLM3I2RarFSHanML1yaLs/NVC9dnR6fLF4q9nQsMgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABoX2V+YWq8VCrO/i4SS2uBNYq++Kie3+V/7t/7NndH2wsPdGwb5va+8Yc20Ru/imZsTJwdaPPAX3+W6O/oOQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgt+SXAAAA//+zpxI9") read(r0, &(0x7f0000000b80)=""/192, 0xc0) prlimit64(0x0, 0xe, &(0x7f0000000c40)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000c80)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000cc0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000d00)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000d40)=@file={0x0, './file0\x00'}, 0x6e) r4 = syz_open_dev$dvb_demux(&(0x7f0000000100), 0x0, 0x41) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r4, 0x40146f2c, &(0x7f0000000140)={0x1, 0x0, 0x3, 0x14, 0x4}) ioctl$DVB_DEMUX_DMX_ADD_PID(r4, 0x40026f33, &(0x7f0000000180)) ioctl$DVB_DEMUX_DMX_REMOVE_PID(r4, 0x40026f34, &(0x7f00000001c0)=0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000dc0)={0x0, 0xc, &(0x7f0000000e80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000f80)=ANY=[@ANYBLOB], 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmmsg$unix(r3, &(0x7f0000000fc0), 0x651, 0x0) recvmmsg(r2, &(0x7f0000001000), 0x10106, 0x2, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000001040)={0x1f, 0xffff, 0x3}, 0x6) unshare(0x22020600) r6 = bpf$MAP_CREATE(0x0, 0x0, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000001100)={0x6, 0xc, &(0x7f00000011c0)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r6}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x5a6}}]}, &(0x7f0000001240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000001280)=@base={0x1, 0x7, 0x6, 0x9, 0x0, 0xffffffffffffffff, 0x100}, 0x50) bpf$PROG_BIND_MAP(0x23, &(0x7f0000001300)={r7, r8}, 0xc) write(r5, &(0x7f0000001340), 0x0) syz_mount_image$ext4(&(0x7f0000001380)='ext4\x00', &(0x7f00000013c0)='./file0\x00', 0x20044, &(0x7f0000007d80)={[{@acl}]}, 0x0, 0x587, &(0x7f0000001440)="$eJzs3V1rHFUcB+D/mWzSl7QmFUFrEQMFW1CTJq0oIthivfPCl4JXgjFJS+m2DU0EWyttoX4D/QCCd96Il0WkqCDeeif4AUQs0ubGu8hsZtJtu5vmZdOpneeBbebMyXDOZPn1zJydmQ2gtkbyf7KI3RExmyKG2uoaUVSOLP3erZsXpxZuXpxKsbj43j8pUrGu/P1U/BwsNt4aEb/9mOLxvnvbnTt/4dRkszlzriiPzZ+eHZs7f+HFk6cnT8ycmDkzMf7y+EuHDk4cOtCT/dwZET+PHm1cPf7Gnm+nvt516ftvrqU4HDuK+vb96JWRGFn+m7TL/66v9LqxivQV+9P+FqdGhR1iTcr3rz8inoyh6Ivbb95QfP5OpZ0DNtViilgEairJP9RUeRyQn/+Wr2qPSIAH5caRpQmAW2lpbm9hOf+NpbnB2NqaG9i+kKJ9WidFRC9m5vI2Zp9LQ/krNmkeDujs8pWIeKrT+J9a2RxuzeLn+c/uyH8WEW8XP/P1766z/ZG7yvIPD85G8v9hW/4/Wmf78g8AAAAAAAC9c/1IRLzQ6fO/bPn6n+hw/c9gRBzuQfv3//wvu9SDZoAObhyJeC0iymv/FtryXxjuK0o7W9cD9KfjJ5szByLisYjYH/1b8vL4Cm2M7Pm1v2td2/V/+Stvv7wWsOjHX40td24zPTk/uZF9BpbcuBLxdKNT/tPy+J/uHP9/eaYY+2dX2cbi0dd/6lZ3//wDm2Xxq4h9Hcf/20+uSCs/n2OsdTwwVh4V3OvTD6591619+Yfq5OP/9pXzP5zan9czt/Y2Pvv7jw3kv/Px/0A61nrkzECx7pPJ+flz4xED6a1710+svc/wKCrzUOYlz//+vZ3P/7sc/7dsi4jLq2zz2A9vXu1WZ/yH6uT5n17T+L/2hb3vf/lvt/ZXN/4fao3p+4s15v9gZasNaNX9BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID/oywidkTKRpeXs2x0NGIwIp6I7Vnz7Nz888fPfnxmOq9rff9/Vn7T79BSOZXf/z/cVp64q3wwInZFxBd921rl0amzzemqdx4AAAAAAAAAAAAAAAAAAAAeEoNd7v/P/dlXde+ATdeougNAZeQf6kv+ob7kH+pL/qG+5B/qS/6hvuQf6kv+ob7kHwAAAAAAHim7nr3+e4qIy69ua71yA0Vdf6U9Azbb4ao7AFTGI36gvlz6A/XlHB9I96nfuu4tAQAAAAAAAAAAAIBe2bfb/f9QV1nVHQAq0/3+f08GgEed+/+hvpzjA+7/BwAAAAAAAAAAAICH39z5C6cmm82Zc+td2LKxzS1YqM9CpB4k7gEtVP0/EwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUPovAAD//0C19y8=") syz_open_dev$tty20(0xc, 0x4, 0x1) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.189' (ED25519) to the list of known hosts. [ 115.103073][ T5776] cgroup: Unknown subsys name 'net' [ 115.250222][ T5776] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 115.764276][ T971] cfg80211: failed to load regulatory.db [ 117.374739][ T5776] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 119.509131][ T5801] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 119.520791][ T5801] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 119.532528][ T5805] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 119.542070][ T5805] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 119.551993][ T5805] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 119.571647][ T5805] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 119.607642][ T5804] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 119.618040][ T5804] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 119.626852][ T5804] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 119.636124][ T5804] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 119.645588][ T5804] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 119.654619][ T5804] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 119.664105][ T5804] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 119.675840][ T5804] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 119.687930][ T5804] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 119.700549][ T5804] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 119.724731][ T5808] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 119.732170][ T5809] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 119.742524][ T5808] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 119.750126][ T5809] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 119.761163][ T5808] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 119.768991][ T5809] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 119.778425][ T5808] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 119.794632][ T5808] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 119.907761][ T5795] (null): rxe_set_mtu: Set mtu to 1024 [ 119.916375][ T5795] rxe_eth0 speed is unknown, defaulting to 1000 [ 119.924004][ T5797] (null): rxe_set_mtu: Set mtu to 1024 [ 119.943883][ T5796] (null): rxe_set_mtu: Set mtu to 1024 [ 119.954940][ T5797] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 119.966459][ T5795] rxe_eth0 speed is unknown, defaulting to 1000 [ 119.975313][ T5796] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 119.992547][ T5794] (null): rxe_set_mtu: Set mtu to 1024 [ 120.013359][ T5795] rxe_eth0 speed is unknown, defaulting to 1000 [ 120.030570][ T5794] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 120.388417][ T5795] infiniband rxe0: set active [ 120.395265][ T5795] infiniband rxe0: added rxe_eth0 [ 120.408050][ T23] rxe_eth0 speed is unknown, defaulting to 1000 [ 120.489556][ T5795] RDS/IB: rxe0: added [ 120.496110][ T5795] smc: adding ib device rxe0 with port count 1 [ 120.505090][ T5795] smc: ib device rxe0 port 1 has pnetid [ 120.522630][ T23] rxe_eth0 speed is unknown, defaulting to 1000 [ 120.567510][ T5795] rxe_eth0 speed is unknown, defaulting to 1000 [ 120.821259][ T5794] chnl_net:caif_netlink_parms(): no params data found [ 120.878675][ T5796] chnl_net:caif_netlink_parms(): no params data found [ 120.937811][ T5797] chnl_net:caif_netlink_parms(): no params data found [ 121.098247][ T5795] rxe_eth0 speed is unknown, defaulting to 1000 [ 121.291315][ T5794] bridge0: port 1(bridge_slave_0) entered blocking state [ 121.307867][ T5794] bridge0: port 1(bridge_slave_0) entered disabled state [ 121.318648][ T5794] bridge_slave_0: entered allmulticast mode [ 121.331879][ T5794] bridge_slave_0: entered promiscuous mode [ 121.348402][ T5794] bridge0: port 2(bridge_slave_1) entered blocking state [ 121.357239][ T5794] bridge0: port 2(bridge_slave_1) entered disabled state [ 121.370869][ T5794] bridge_slave_1: entered allmulticast mode [ 121.392638][ T5794] bridge_slave_1: entered promiscuous mode [ 121.438346][ T5795] rxe_eth0 speed is unknown, defaulting to 1000 [ 121.612888][ T5794] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 121.651470][ T5794] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 121.681624][ T5796] bridge0: port 1(bridge_slave_0) entered blocking state [ 121.713991][ T5796] bridge0: port 1(bridge_slave_0) entered disabled state [ 121.723063][ T5796] bridge_slave_0: entered allmulticast mode [ 121.736641][ T5796] bridge_slave_0: entered promiscuous mode [ 121.755782][ T5797] bridge0: port 1(bridge_slave_0) entered blocking state [ 121.765718][ T5797] bridge0: port 1(bridge_slave_0) entered disabled state [ 121.765733][ T5801] Bluetooth: hci0: command tx timeout [ 121.783335][ T5797] bridge_slave_0: entered allmulticast mode [ 121.793852][ T5797] bridge_slave_0: entered promiscuous mode [ 121.840682][ T5801] Bluetooth: hci2: command tx timeout [ 121.845461][ T5796] bridge0: port 2(bridge_slave_1) entered blocking state [ 121.848326][ T5801] Bluetooth: hci1: command tx timeout [ 121.858007][ T5798] Bluetooth: hci3: command tx timeout [ 121.880690][ T5796] bridge0: port 2(bridge_slave_1) entered disabled state [ 121.888947][ T5796] bridge_slave_1: entered allmulticast mode [ 121.898355][ T5796] bridge_slave_1: entered promiscuous mode [ 121.908231][ T5797] bridge0: port 2(bridge_slave_1) entered blocking state [ 121.917806][ T5797] bridge0: port 2(bridge_slave_1) entered disabled state [ 121.927022][ T5797] bridge_slave_1: entered allmulticast mode [ 121.934861][ T5797] bridge_slave_1: entered promiscuous mode [ 121.972070][ T5794] team0: Port device team_slave_0 added [ 121.979750][ T5795] rxe_eth0 speed is unknown, defaulting to 1000 [ 122.032455][ T5797] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 122.074164][ T5797] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 122.132148][ T5794] team0: Port device team_slave_1 added [ 122.143955][ T5796] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 122.256810][ T5796] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 122.339215][ T5797] team0: Port device team_slave_0 added [ 122.399861][ T5797] team0: Port device team_slave_1 added [ 122.439423][ T5796] team0: Port device team_slave_0 added [ 122.455006][ T5796] team0: Port device team_slave_1 added [ 122.466125][ T5794] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 122.479388][ T5794] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 122.514687][ T5794] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 122.534647][ T5794] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 122.544139][ T5794] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 122.579918][ T5794] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 122.617871][ T5797] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 122.650632][ T5797] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 122.686191][ T5797] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 122.788141][ T5797] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 122.797414][ T5797] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 122.829376][ T5797] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 122.855543][ T5796] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 122.866727][ T5796] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 122.896665][ T5796] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 122.912575][ T5796] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 122.924347][ T5796] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 122.955334][ T5796] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 123.093765][ T5797] hsr_slave_0: entered promiscuous mode [ 123.106592][ T5797] hsr_slave_1: entered promiscuous mode [ 123.124618][ T5794] hsr_slave_0: entered promiscuous mode [ 123.133986][ T5794] hsr_slave_1: entered promiscuous mode [ 123.141812][ T5794] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 123.151072][ T5794] Cannot create hsr debugfs directory [ 123.182458][ T8] rxe_eth0 speed is unknown, defaulting to 1000 [ 123.266103][ T5796] hsr_slave_0: entered promiscuous mode [ 123.277993][ T5796] hsr_slave_1: entered promiscuous mode [ 123.289521][ T5796] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 123.304456][ T5796] Cannot create hsr debugfs directory [ 123.828495][ T5795] chnl_net:caif_netlink_parms(): no params data found [ 123.851025][ T5809] Bluetooth: hci0: command tx timeout [ 123.923780][ T5809] Bluetooth: hci3: command tx timeout [ 123.930206][ T5809] Bluetooth: hci1: command tx timeout [ 123.938580][ T5798] Bluetooth: hci2: command tx timeout [ 124.058678][ T5795] bridge0: port 1(bridge_slave_0) entered blocking state [ 124.070262][ T5795] bridge0: port 1(bridge_slave_0) entered disabled state [ 124.083074][ T5795] bridge_slave_0: entered allmulticast mode [ 124.091608][ T5795] bridge_slave_0: entered promiscuous mode [ 124.109707][ T5795] bridge0: port 2(bridge_slave_1) entered blocking state [ 124.119449][ T5795] bridge0: port 2(bridge_slave_1) entered disabled state [ 124.128528][ T5795] bridge_slave_1: entered allmulticast mode [ 124.139645][ T5795] bridge_slave_1: entered promiscuous mode [ 124.190369][ T5447] infiniband rxe0: set active [ 124.200936][ T9] rxe_eth0 speed is unknown, defaulting to 1000 [ 124.213617][ T5795] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 124.243610][ T5794] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 124.288994][ T5795] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 124.311501][ T5794] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 124.356244][ T5794] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 124.369334][ T5794] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 124.406132][ T5795] team0: Port device team_slave_0 added [ 124.419532][ T5795] team0: Port device team_slave_1 added [ 124.493967][ T5795] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 124.503190][ T5795] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 124.535831][ T5795] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 124.549869][ T5795] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 124.557084][ T5795] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 124.589051][ T5795] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 124.633741][ T5797] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 124.655725][ T5797] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 124.693169][ T5797] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 124.707396][ T5797] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 124.805118][ T5795] hsr_slave_0: entered promiscuous mode [ 124.815427][ T5795] hsr_slave_1: entered promiscuous mode [ 124.824219][ T5795] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 124.834301][ T5795] Cannot create hsr debugfs directory [ 124.922987][ T5796] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 124.969966][ T5796] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 124.983614][ T5796] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 125.016770][ T5796] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 125.292816][ T5795] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 125.313564][ T5795] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 125.328675][ T5795] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 125.352966][ T5794] 8021q: adding VLAN 0 to HW filter on device bond0 [ 125.365375][ T5795] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 125.455455][ T5797] 8021q: adding VLAN 0 to HW filter on device bond0 [ 125.488156][ T5794] 8021q: adding VLAN 0 to HW filter on device team0 [ 125.516372][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 125.526230][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 125.557452][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 125.566416][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 125.636685][ T5797] 8021q: adding VLAN 0 to HW filter on device team0 [ 125.669835][ T4817] bridge0: port 1(bridge_slave_0) entered blocking state [ 125.680757][ T4817] bridge0: port 1(bridge_slave_0) entered forwarding state [ 125.716567][ T4817] bridge0: port 2(bridge_slave_1) entered blocking state [ 125.726021][ T4817] bridge0: port 2(bridge_slave_1) entered forwarding state [ 125.772181][ T5796] 8021q: adding VLAN 0 to HW filter on device bond0 [ 125.899348][ T5796] 8021q: adding VLAN 0 to HW filter on device team0 [ 125.921188][ T5809] Bluetooth: hci0: command tx timeout [ 125.926212][ T5795] 8021q: adding VLAN 0 to HW filter on device bond0 [ 125.968041][ T62] bridge0: port 1(bridge_slave_0) entered blocking state [ 125.977019][ T62] bridge0: port 1(bridge_slave_0) entered forwarding state [ 126.000909][ T5798] Bluetooth: hci2: command tx timeout [ 126.004057][ T5801] Bluetooth: hci3: command tx timeout [ 126.008062][ T5809] Bluetooth: hci1: command tx timeout [ 126.078302][ T62] bridge0: port 2(bridge_slave_1) entered blocking state [ 126.087821][ T62] bridge0: port 2(bridge_slave_1) entered forwarding state [ 126.212319][ T5795] 8021q: adding VLAN 0 to HW filter on device team0 [ 126.239919][ T5796] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 126.275442][ T4817] bridge0: port 1(bridge_slave_0) entered blocking state [ 126.284549][ T4817] bridge0: port 1(bridge_slave_0) entered forwarding state [ 126.310371][ T4817] bridge0: port 2(bridge_slave_1) entered blocking state [ 126.319318][ T4817] bridge0: port 2(bridge_slave_1) entered forwarding state [ 126.569173][ T5797] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 126.694529][ T5794] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 126.817357][ T5797] veth0_vlan: entered promiscuous mode [ 126.913239][ T5796] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 126.930110][ T5797] veth1_vlan: entered promiscuous mode [ 126.987737][ T5794] veth0_vlan: entered promiscuous mode [ 127.022247][ T5794] veth1_vlan: entered promiscuous mode [ 127.089127][ T5797] veth0_macvtap: entered promiscuous mode [ 127.106132][ T5797] veth1_macvtap: entered promiscuous mode [ 127.133936][ T5795] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 127.187867][ T5796] veth0_vlan: entered promiscuous mode [ 127.205950][ T5797] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 127.235402][ T5794] veth0_macvtap: entered promiscuous mode [ 127.256866][ T5796] veth1_vlan: entered promiscuous mode [ 127.277468][ T5794] veth1_macvtap: entered promiscuous mode [ 127.308104][ T5797] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 127.351393][ T5795] veth0_vlan: entered promiscuous mode [ 127.371486][ T5795] veth1_vlan: entered promiscuous mode [ 127.392799][ T5797] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 127.403331][ T5797] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 127.415105][ T5797] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 127.426426][ T5797] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 127.445309][ T5794] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 127.458697][ T5794] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 127.472969][ T5794] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 127.550003][ T5794] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 127.563500][ T5794] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 127.576134][ T5794] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 127.590382][ T5794] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 127.604953][ T5794] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 127.615859][ T5794] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 127.626427][ T5794] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 127.674172][ T5796] veth0_macvtap: entered promiscuous mode [ 127.752858][ T5796] veth1_macvtap: entered promiscuous mode [ 127.824324][ T1325] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 127.826880][ T5796] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 127.849900][ T1325] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 127.858350][ T5796] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 127.874651][ T5796] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 127.889558][ T5796] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 127.905103][ T5796] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 127.918382][ T5795] veth0_macvtap: entered promiscuous mode [ 127.946311][ T5796] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 127.961156][ T5796] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 127.973457][ T5796] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 127.986107][ T5796] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 128.001352][ T5809] Bluetooth: hci0: command tx timeout [ 128.008718][ T5796] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 128.063516][ T5795] veth1_macvtap: entered promiscuous mode [ 128.078357][ T5796] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.083165][ T5809] Bluetooth: hci1: command tx timeout [ 128.095379][ T5801] Bluetooth: hci2: command tx timeout [ 128.098233][ T5798] Bluetooth: hci3: command tx timeout [ 128.114662][ T5796] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.125256][ T5796] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.138617][ T5796] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.169694][ T3452] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 128.186531][ T3452] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 128.269810][ T50] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 128.288365][ T3507] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 128.301478][ T50] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 128.310332][ T3507] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 128.363600][ T5795] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 128.396582][ T5795] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 128.409236][ T5795] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 128.422058][ T5795] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 128.437695][ T5795] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 128.451791][ T5795] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 128.469570][ T5795] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 128.518238][ T5795] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 128.544234][ T5795] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 128.561409][ T5795] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 128.580288][ T5795] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 128.596892][ T5795] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 128.609913][ T5794] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 128.613934][ T5795] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 128.662096][ T5795] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 128.716453][ T5795] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.729069][ T5795] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.738923][ T5795] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.750303][ T5795] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.773776][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 128.784807][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 128.971141][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 128.985726][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 130.195671][ T5907] Process accounting resumed [ 131.392321][ T5909] syz.2.3[5909]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 131.432603][ T5909] loop2: detected capacity change from 0 to 512 [ 131.452077][ T1325] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 131.496088][ T1325] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 131.523732][ T5909] EXT4-fs: Ignoring removed nobh option [ 131.636174][ T5909] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #11: comm syz.2.3: invalid indirect mapped block 256 (level 2) [ 131.674318][ T5916] loop1: detected capacity change from 0 to 512 [ 131.694456][ T5916] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 131.708110][ T5909] EXT4-fs (loop2): 2 truncates cleaned up [ 131.723718][ T5909] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 131.727201][ T50] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 131.812081][ T50] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 131.857803][ T5916] EXT4-fs (loop1): 1 truncate cleaned up [ 131.947091][ T5916] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 132.619720][ T28] audit: type=1800 audit(1794249003.691:2): pid=5921 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2" name="file3" dev="loop1" ino=16 res=0 errno=0 [ 133.135182][ T5796] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 133.158707][ T28] audit: type=1800 audit(1794249004.341:3): pid=5922 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1" name="p_chmask" dev="configfs" ino=7384 res=0 errno=0 [ 133.208363][ T5922] Need at least one configuration in g1. [ 133.228900][ T5922] udc dummy_udc.0: failed to start g1: -22 [ 133.237515][ T5922] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 133.252148][ T28] audit: type=1800 audit(1794249004.381:4): pid=5922 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.1" name="UDC" dev="configfs" ino=7385 res=0 errno=0 [ 133.268427][ T5924] ip_tables: iptables: counters copy to user failed while replacing table [ 133.332375][ T5922] UDC core: g1: couldn't find an available UDC or it's busy [ 133.405166][ T5794] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 134.538841][ T5932] loop1: detected capacity change from 0 to 512 [ 134.569483][ T5933] loop2: detected capacity change from 0 to 512 [ 134.667266][ T5932] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 134.727080][ T5933] EXT4-fs (loop2): mounting ext3 file system using the ext4 subsystem [ 135.020130][ T5932] EXT4-fs (loop1): 1 truncate cleaned up [ 135.159125][ T5933] EXT4-fs (loop2): 1 truncate cleaned up [ 135.271289][ T5932] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 135.357910][ T5933] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 136.338439][ T28] audit: type=1800 audit(1794249007.221:5): pid=5946 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.9" name="file3" dev="loop1" ino=16 res=0 errno=0 [ 136.669989][ T28] audit: type=1800 audit(1794249007.271:6): pid=5948 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.7" name="file3" dev="loop2" ino=16 res=0 errno=0 [ 136.747644][ T28] audit: type=1800 audit(1794249007.911:7): pid=5944 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.5" name="p_chmask" dev="configfs" ino=7415 res=0 errno=0 [ 136.776083][ T5796] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 136.798292][ T5794] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 136.837557][ T5944] Need at least one configuration in g1. [ 136.890881][ T5944] udc dummy_udc.0: failed to start g1: -22 [ 136.894688][ T28] audit: type=1800 audit(1794249008.021:8): pid=5944 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.5" name="UDC" dev="configfs" ino=8217 res=0 errno=0 [ 136.921080][ T5944] configfs-gadget.g1: probe of gadget.0 failed with error -22 [ 136.967936][ T5944] UDC core: g1: couldn't find an available UDC or it's busy [ 136.971498][ T5949] ip_tables: iptables: counters copy to user failed while replacing table [ 141.832658][ T1293] ieee802154 phy0 wpan0: encryption failed: -22 [ 141.854822][ T1293] ieee802154 phy1 wpan1: encryption failed: -22 [ 143.690507][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 144.100571][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 147.388275][ T6014] loop0: detected capacity change from 0 to 512 [ 147.532183][ T6014] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 147.598923][ T6014] EXT4-fs (loop0): 1 truncate cleaned up [ 147.642060][ T6014] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 148.810570][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 148.931211][ T6025] Process accounting resumed [ 149.220629][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 149.630546][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 149.980489][ C1] sched: RT throttling activated [ 151.094646][ T5795] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 152.473023][ T27] rxe_eth0 speed is unknown, defaulting to 1000 [ 157.473645][ T6091] loop1: detected capacity change from 0 to 2048 [ 157.970585][ T6098] loop1: detected capacity change from 0 to 1024 [ 157.978493][ T6098] ======================================================= [ 157.978493][ T6098] WARNING: The mand mount option has been deprecated and [ 157.978493][ T6098] and is ignored by this kernel. Remove the mand [ 157.978493][ T6098] option from the mount to silence this warning. [ 157.978493][ T6098] ======================================================= [ 158.232017][ C1] ------------[ cut here ]------------ [ 158.232118][ C1] WARNING: CPU: 1 PID: 6095 at net/mac80211/tx.c:5135 __ieee80211_beacon_get+0x1141/0x1520 [ 158.232179][ C1] Modules linked in: [ 158.232212][ C1] CPU: 1 PID: 6095 Comm: syz.1.32 Not tainted syzkaller #0 [ 158.232233][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 158.232249][ C1] RIP: 0010:__ieee80211_beacon_get+0x1141/0x1520 [ 158.232272][ C1] Code: f7 4c 89 ef e8 90 08 b1 f7 45 31 ed 4c 8b bc 24 a0 00 00 00 e9 7f fe ff ff e8 5b aa 72 f7 0f 0b e9 61 f8 ff ff e8 4f aa 72 f7 <0f> 0b e9 85 fb ff ff e8 43 aa 72 f7 48 c7 c7 a0 f3 66 8f 4c 89 e6 [ 158.232290][ C1] RSP: 0000:ffffc900001f0a18 EFLAGS: 00010246 [ 158.232309][ C1] RAX: ffffffff8a153451 RBX: dffffc0000000000 RCX: ffff88802c3cbc00 [ 158.232359][ C1] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 158.232372][ C1] RBP: 0000000000000000 R08: ffff88802c3cbc00 R09: 0000000000000003 [ 158.232386][ C1] R10: 0000000000000007 R11: 0000000000000100 R12: ffff88805b74a420 [ 158.232399][ C1] R13: ffff88802de78824 R14: ffff88805b74a910 R15: ffff88802de78800 [ 158.232414][ C1] FS: 00007fc226ff66c0(0000) GS:ffff8880b8d00000(0000) knlGS:0000000000000000 [ 158.232433][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 158.232447][ C1] CR2: 0000001b2ef1affc CR3: 000000001ff96000 CR4: 00000000003506e0 [ 158.232466][ C1] Call Trace: [ 158.232474][ C1] [ 158.232484][ C1] ? __ieee80211_beacon_get+0x36/0x1520 [ 158.232518][ C1] ieee80211_beacon_get_tim+0xbf/0x580 [ 158.232544][ C1] ? ieee80211_beacon_get_template_ema_list+0x90/0x90 [ 158.232576][ C1] mac80211_hwsim_beacon_tx+0x3bd/0x770 [ 158.232609][ C1] __iterate_interfaces+0x225/0x4c0 [ 158.232635][ C1] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 158.232659][ C1] ? ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 [ 158.232686][ C1] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 158.232710][ C1] ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 [ 158.232739][ C1] mac80211_hwsim_beacon+0xbb/0x1b0 [ 158.232760][ C1] ? hw_scan_work+0xf10/0xf10 [ 158.232781][ C1] __hrtimer_run_queues+0x525/0xc10 [ 158.232825][ C1] ? hrtimer_interrupt+0x980/0x980 [ 158.232846][ C1] ? read_tsc+0x9/0x20 [ 158.232878][ C1] hrtimer_run_softirq+0x177/0x290 [ 158.232907][ C1] handle_softirqs+0x27d/0x820 [ 158.232927][ C1] ? read_tsc+0x9/0x20 [ 158.232948][ C1] ? ktime_get+0x24b/0x280 [ 158.232974][ C1] ? __irq_exit_rcu+0xd3/0x190 [ 158.232999][ C1] ? do_softirq+0x1a0/0x1a0 [ 158.233030][ C1] __irq_exit_rcu+0xd3/0x190 [ 158.233052][ C1] ? irq_exit_rcu+0x20/0x20 [ 158.233080][ C1] irq_exit_rcu+0x9/0x20 [ 158.233098][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 158.233128][ C1] [ 158.233135][ C1] [ 158.233143][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 158.233171][ C1] RIP: 0010:__sanitizer_cov_trace_const_cmp8+0x17/0x80 [ 158.233198][ C1] Code: 48 89 44 11 20 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 48 8b 04 24 65 48 8b 0d 10 d5 7b 7e 65 8b 15 11 d5 7b 7e <81> e2 00 01 ff 00 74 11 81 fa 00 01 00 00 75 57 83 b9 24 16 00 00 [ 158.233214][ C1] RSP: 0000:ffffc90004fd78d8 EFLAGS: 00000246 [ 158.233234][ C1] RAX: ffffffff887f9bab RBX: 0000000000000000 RCX: ffff88802c3cbc00 [ 158.233248][ C1] RDX: 0000000080000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 158.233261][ C1] RBP: ffffc90004fd7a70 R08: ffffc90004fd76a7 R09: 1ffff920009faed4 [ 158.233276][ C1] R10: dffffc0000000000 R11: fffff520009faed5 R12: 0000000000000002 [ 158.233290][ C1] R13: 0000000000000000 R14: 0000000000000000 R15: 00002000000d3e28 [ 158.233311][ C1] ? ____sys_recvmsg+0x44b/0x5d0 [ 158.233350][ C1] ____sys_recvmsg+0x44b/0x5d0 [ 158.233384][ C1] ? __sys_recvmsg_sock+0x50/0x50 [ 158.233422][ C1] ? import_iovec+0x73/0xa0 [ 158.233451][ C1] ___sys_recvmsg+0x214/0x590 [ 158.233478][ C1] ? __sys_recvmsg+0x2a0/0x2a0 [ 158.233522][ C1] ? __lock_acquire+0x7eb0/0x7eb0 [ 158.233553][ C1] ? __might_fault+0xc6/0x120 [ 158.233574][ C1] ? __might_fault+0xaa/0x120 [ 158.233598][ C1] do_recvmmsg+0x377/0x810 [ 158.233629][ C1] ? __sys_recvmmsg+0x290/0x290 [ 158.233663][ C1] ? __ia32_sys_get_robust_list+0x110/0x110 [ 158.233683][ C1] ? rcu_read_lock_sched_held+0x8a/0x110 [ 158.233721][ C1] __x64_sys_recvmmsg+0x199/0x250 [ 158.233747][ C1] ? do_recvmmsg+0x810/0x810 [ 158.233773][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 158.233796][ C1] do_syscall_64+0x55/0xb0 [ 158.233821][ C1] ? clear_bhb_loop+0x40/0x90 [ 158.233847][ C1] ? clear_bhb_loop+0x40/0x90 [ 158.233875][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 158.233901][ C1] RIP: 0033:0x7fc228d9fb19 [ 158.233929][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 158.233945][ C1] RSP: 002b:00007fc226ff6028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 158.233968][ C1] RAX: ffffffffffffffda RBX: 00007fc229026090 RCX: 00007fc228d9fb19 [ 158.233983][ C1] RDX: 0000000000010106 RSI: 0000200000001000 RDI: 0000000000000003 [ 158.233997][ C1] RBP: 00007fc228e37b70 R08: 0000000000000000 R09: 0000000000000000 [ 158.234010][ C1] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 158.234022][ C1] R13: 00007fc229026128 R14: 00007fc229026090 R15: 00007ffcc2774618 [ 158.234053][ C1] [ 158.234063][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 158.234072][ C1] CPU: 1 PID: 6095 Comm: syz.1.32 Not tainted syzkaller #0 [ 158.234091][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 [ 158.234101][ C1] Call Trace: [ 158.234108][ C1] [ 158.234114][ C1] dump_stack_lvl+0x18c/0x250 [ 158.234142][ C1] ? show_regs_print_info+0x20/0x20 [ 158.234167][ C1] ? load_image+0x420/0x420 [ 158.234201][ C1] panic+0x2ca/0x720 [ 158.234225][ C1] ? bpf_jit_dump+0xd0/0xd0 [ 158.234260][ C1] __warn+0x2e0/0x470 [ 158.234276][ C1] ? __ieee80211_beacon_get+0x1141/0x1520 [ 158.234298][ C1] ? __ieee80211_beacon_get+0x1141/0x1520 [ 158.234325][ C1] report_bug+0x2be/0x4f0 [ 158.234351][ C1] ? __ieee80211_beacon_get+0x1141/0x1520 [ 158.234370][ C1] ? __ieee80211_beacon_get+0x1141/0x1520 [ 158.234388][ C1] ? __ieee80211_beacon_get+0x1143/0x1520 [ 158.234406][ C1] handle_bug+0xcf/0x120 [ 158.234431][ C1] exc_invalid_op+0x1a/0x50 [ 158.234456][ C1] asm_exc_invalid_op+0x1a/0x20 [ 158.234479][ C1] RIP: 0010:__ieee80211_beacon_get+0x1141/0x1520 [ 158.234504][ C1] Code: f7 4c 89 ef e8 90 08 b1 f7 45 31 ed 4c 8b bc 24 a0 00 00 00 e9 7f fe ff ff e8 5b aa 72 f7 0f 0b e9 61 f8 ff ff e8 4f aa 72 f7 <0f> 0b e9 85 fb ff ff e8 43 aa 72 f7 48 c7 c7 a0 f3 66 8f 4c 89 e6 [ 158.234519][ C1] RSP: 0000:ffffc900001f0a18 EFLAGS: 00010246 [ 158.234535][ C1] RAX: ffffffff8a153451 RBX: dffffc0000000000 RCX: ffff88802c3cbc00 [ 158.234549][ C1] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 158.234566][ C1] RBP: 0000000000000000 R08: ffff88802c3cbc00 R09: 0000000000000003 [ 158.234578][ C1] R10: 0000000000000007 R11: 0000000000000100 R12: ffff88805b74a420 [ 158.234590][ C1] R13: ffff88802de78824 R14: ffff88805b74a910 R15: ffff88802de78800 [ 158.234612][ C1] ? __ieee80211_beacon_get+0x1141/0x1520 [ 158.234637][ C1] ? __ieee80211_beacon_get+0x1141/0x1520 [ 158.234654][ C1] ? __ieee80211_beacon_get+0x36/0x1520 [ 158.234683][ C1] ieee80211_beacon_get_tim+0xbf/0x580 [ 158.234705][ C1] ? ieee80211_beacon_get_template_ema_list+0x90/0x90 [ 158.234734][ C1] mac80211_hwsim_beacon_tx+0x3bd/0x770 [ 158.234764][ C1] __iterate_interfaces+0x225/0x4c0 [ 158.234788][ C1] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 158.234811][ C1] ? ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 [ 158.234838][ C1] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 158.234860][ C1] ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 [ 158.234888][ C1] mac80211_hwsim_beacon+0xbb/0x1b0 [ 158.234907][ C1] ? hw_scan_work+0xf10/0xf10 [ 158.234928][ C1] __hrtimer_run_queues+0x525/0xc10 [ 158.234969][ C1] ? hrtimer_interrupt+0x980/0x980 [ 158.234989][ C1] ? read_tsc+0x9/0x20 [ 158.235020][ C1] hrtimer_run_softirq+0x177/0x290 [ 158.235047][ C1] handle_softirqs+0x27d/0x820 [ 158.235066][ C1] ? read_tsc+0x9/0x20 [ 158.235085][ C1] ? ktime_get+0x24b/0x280 [ 158.235110][ C1] ? __irq_exit_rcu+0xd3/0x190 [ 158.235134][ C1] ? do_softirq+0x1a0/0x1a0 [ 158.235163][ C1] __irq_exit_rcu+0xd3/0x190 [ 158.235182][ C1] ? irq_exit_rcu+0x20/0x20 [ 158.235209][ C1] irq_exit_rcu+0x9/0x20 [ 158.235226][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 158.235254][ C1] [ 158.235260][ C1] [ 158.235267][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 158.235292][ C1] RIP: 0010:__sanitizer_cov_trace_const_cmp8+0x17/0x80 [ 158.235325][ C1] Code: 48 89 44 11 20 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 48 8b 04 24 65 48 8b 0d 10 d5 7b 7e 65 8b 15 11 d5 7b 7e <81> e2 00 01 ff 00 74 11 81 fa 00 01 00 00 75 57 83 b9 24 16 00 00 [ 158.235340][ C1] RSP: 0000:ffffc90004fd78d8 EFLAGS: 00000246 [ 158.235356][ C1] RAX: ffffffff887f9bab RBX: 0000000000000000 RCX: ffff88802c3cbc00 [ 158.235369][ C1] RDX: 0000000080000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 158.235381][ C1] RBP: ffffc90004fd7a70 R08: ffffc90004fd76a7 R09: 1ffff920009faed4 [ 158.235395][ C1] R10: dffffc0000000000 R11: fffff520009faed5 R12: 0000000000000002 [ 158.235408][ C1] R13: 0000000000000000 R14: 0000000000000000 R15: 00002000000d3e28 [ 158.235427][ C1] ? ____sys_recvmsg+0x44b/0x5d0 [ 158.235455][ C1] ____sys_recvmsg+0x44b/0x5d0 [ 158.235488][ C1] ? __sys_recvmsg_sock+0x50/0x50 [ 158.235523][ C1] ? import_iovec+0x73/0xa0 [ 158.235551][ C1] ___sys_recvmsg+0x214/0x590 [ 158.235577][ C1] ? __sys_recvmsg+0x2a0/0x2a0 [ 158.235619][ C1] ? __lock_acquire+0x7eb0/0x7eb0 [ 158.235648][ C1] ? __might_fault+0xc6/0x120 [ 158.235667][ C1] ? __might_fault+0xaa/0x120 [ 158.235689][ C1] do_recvmmsg+0x377/0x810 [ 158.235719][ C1] ? __sys_recvmmsg+0x290/0x290 [ 158.235752][ C1] ? __ia32_sys_get_robust_list+0x110/0x110 [ 158.235771][ C1] ? rcu_read_lock_sched_held+0x8a/0x110 [ 158.235807][ C1] __x64_sys_recvmmsg+0x199/0x250 [ 158.235832][ C1] ? do_recvmmsg+0x810/0x810 [ 158.235855][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 158.235877][ C1] do_syscall_64+0x55/0xb0 [ 158.235898][ C1] ? clear_bhb_loop+0x40/0x90 [ 158.235931][ C1] ? clear_bhb_loop+0x40/0x90 [ 158.235958][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 158.235982][ C1] RIP: 0033:0x7fc228d9fb19 [ 158.235998][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 158.236012][ C1] RSP: 002b:00007fc226ff6028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 158.236032][ C1] RAX: ffffffffffffffda RBX: 00007fc229026090 RCX: 00007fc228d9fb19 [ 158.236045][ C1] RDX: 0000000000010106 RSI: 0000200000001000 RDI: 0000000000000003 [ 158.236057][ C1] RBP: 00007fc228e37b70 R08: 0000000000000000 R09: 0000000000000000 [ 158.236068][ C1] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 158.236079][ C1] R13: 00007fc229026128 R14: 00007fc229026090 R15: 00007ffcc2774618 [ 158.236107][ C1] [ 158.236968][ C1] Kernel Offset: disabled