last executing test programs: 6m17.274371543s ago: executing program 0 (id=270): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_NEW(r0, 0x0, 0x8010) sendmsg$NFNL_MSG_ACCT_NEW(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="20000000000701030000000000000003"], 0x20}}, 0x0) sendmsg$NFNL_MSG_ACCT_DEL(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)={0x2c, 0x3, 0x7, 0x301, 0x0, 0x0, {0x5}, [@NFACCT_NAME={0x9, 0x1, 'syz0\x00'}, @NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0x6}]}, 0x2c}}, 0x5014) 6m17.141855003s ago: executing program 0 (id=273): r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) r1 = fsopen(&(0x7f0000000400)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000540)='\xd0\x9e^\xa0\xee\xc8\x17T\xb1GI\x90\xe2Q1\xb0\x8f\xe1\xa8\x95\xa0\xcd\fL\xf1\xf9\x9c\x83@\x1e\x99\xcah\x85\xb8\xbeSAk\xf4\xb6 \xdf\xa0P\x18\x19\xae\x8c\x9a\x19mm\r<|\xe8\x9e\xa0x\x84p2\xf9\xe2\xed\xb0\f\x7f;\xf6J18G\x84c\x88\x9d{\xf4~\xdby\xe1\xdf\x1a\xae\xd6ez\xe5\xa8\xe1\'', 0x0, r1) fsconfig$FSCONFIG_SET_BINARY(r1, 0x2, &(0x7f0000000a00)='wsync', &(0x7f0000000b40)="b2", 0x1) socket$inet6_sctp(0xa, 0x5, 0x84) socket$nl_sock_diag(0x10, 0x3, 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x800) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) sendmsg$NFT_BATCH(r2, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000580)={&(0x7f00000006c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0xe0, 0x9, 0xa, 0x5, 0x0, 0x0, {0x5, 0x0, 0x9}, [@NFTA_SET_EXPR={0x3c, 0x11, 0x0, 0x1, @objref={{0xb}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_OBJREF_SET_ID={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_OBJREF_IMM_TYPE={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_OBJREF_SET_ID={0x8}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0x12}]}}}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2d}, @NFTA_SET_DATA_TYPE={0x8}, @NFTA_SET_DESC={0x5c, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0x50, 0x2, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}]}, {0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}]}, {0x2c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xffffff7f}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x11}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}]}]}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x7}]}, @NFTA_SET_EXPR={0xc, 0x11, 0x0, 0x1, @cmp={{0x8}, @void}}]}, @NFT_MSG_NEWOBJ={0x1c, 0x12, 0xa, 0x101, 0x0, 0x0, {0x5, 0x0, 0x5}, @NFT_OBJECT_CT_EXPECT=@NFTA_OBJ_TYPE={0x8}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x124}, 0x1, 0x0, 0x0, 0x20014840}, 0xc010) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x0}, 0x20) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r6, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r7, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f0000000200)='\x00', 0x0, r1) r8 = openat$selinux_policy(0xffffff9c, &(0x7f0000001040), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r8, 0x0) write$selinux_load(r0, &(0x7f0000000000)=ANY=[], 0x44f0) 6m16.360133971s ago: executing program 0 (id=278): creat(&(0x7f0000000140)='./file0\x00', 0x4) renameat2(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./file7\x00', 0x5) creat(&(0x7f0000000100)='./file0\x00', 0xd931d3864d39dcca) unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000180)={'filter\x00', 0x0, [0xfffc, 0x4, 0x0, 0x5, 0x4]}, &(0x7f0000000000)=0x54) io_setup(0x3, &(0x7f0000000040)) ustat(0x789, 0x0) 6m13.194157059s ago: executing program 0 (id=286): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) chroot(&(0x7f0000000000)='./file0/../file0\x00') r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000008da4b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], &(0x7f0000000800)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f0000000200)='sys_enter\x00', r0, 0x0, 0x4}, 0x18) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x101091, 0x0) pivot_root(&(0x7f00000001c0)='./file0\x00', &(0x7f00000000c0)='./file0\x00') r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000000)) ioctl$SNDCTL_DSP_CHANNELS(r1, 0xc0045006, &(0x7f0000000180)=0x70) r2 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SNDCTL_DSP_SYNC(r2, 0x5001, 0x0) write$dsp(r1, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) ioctl$SNDCTL_DSP_SYNC(r2, 0x5001, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r3, 0x0, 0x8, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/65, 0x328000, 0x800}, 0x20) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) connect$llc(0xffffffffffffffff, &(0x7f0000000080)={0x1a, 0x201, 0x44, 0x0, 0x5, 0x9, @random="429825e40c16"}, 0x10) syz_clone(0x80040000, 0x0, 0x0, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) getsockopt$IP_VS_SO_GET_SERVICES(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000001640)=""/139, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) 6m12.842573193s ago: executing program 0 (id=289): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'ipvlan1\x00', 0x0}) syz_open_procfs(0x0, &(0x7f0000000340)='fd\x00') r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'netdevsim0\x00', 0x0}) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_inet6_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000280)={@empty, 0x44, r4}) r6 = socket$nl_rdma(0x10, 0x3, 0x14) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x8, 0x1, 0x40000333}, &(0x7f0000000dc0)=0x0, &(0x7f00000001c0)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) io_uring_enter(r8, 0x847ba, 0x0, 0xe, 0x0, 0x0) splice(r6, 0x0, r7, 0x0, 0x2, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="00010000031401"], 0x100}, 0x1, 0x0, 0x0, 0x4040024}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=@newlink={0x44, 0x10, 0x503, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3958b}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macsec={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACSEC_PROTECT={0x5}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x44}}, 0x0) 6m12.358288809s ago: executing program 0 (id=294): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x80) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='devpts\x00', 0x0, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000140)='./file0/../file0\x00', &(0x7f0000000100)='./file0/../file0\x00', 0x0, 0x1adc51, 0x0) mount$tmpfs(0x0, &(0x7f0000000400)='./file0/../file0\x00', &(0x7f00000001c0), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$xdp(0x2c, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0xf59}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x3) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) ioctl$TIOCSETD(r1, 0x5423, 0x0) ioctl$TCFLSH(r1, 0x540b, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x6) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, &(0x7f0000000080)={{0x1009, 0x0, 0x0, 0x80, 'syz0\x00'}, 0x5, 0x0, 0x1, 0x0, 0x0, 0x8, 'syz1\x00', 0x0}) openat$sndtimer(0xffffffffffffff9c, 0x0, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000140)={0xfffffffffffffffc, 0x132e000, 0x1800, 0x0, 0x1}, 0x20) umount2(&(0x7f00000002c0)='./file0\x00', 0x0) write(r0, &(0x7f0000000440)="d16963eaa69114114afeef46c1cb69ae8b8aad050dca2e3d210a2f57b29fb51646e941aad50e63b4fac98f32b9dfdf5776b3ae873a481b68bfe05ecf6345e4e3109ed563efee056fdea4ca1668470da8cd3ba64616d9eee810274ff32bccf96b0c304a7837f38592d7c797c705d3e9d4844d001a6282216087f9beb9d3bb5106ef379062603b1997cd61bbf61091b7cdc086366311db390da823c2aaf7", 0x9d) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_TUNNEL_GET(r3, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000340)={0x14, 0x0, 0x70d, 0x70bd26, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4040}, 0x8000) sendmsg$L2TP_CMD_TUNNEL_DELETE(r3, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x9717357f2b1f9364}, 0xc, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="2c0000f14b266000", @ANYRES16, @ANYBLOB="000225bd7000fbdbdf250200000008001900e000000108000900030000000500070003000000"], 0x2c}}, 0x4004800) 6m11.68052923s ago: executing program 32 (id=294): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x80) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='devpts\x00', 0x0, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000140)='./file0/../file0\x00', &(0x7f0000000100)='./file0/../file0\x00', 0x0, 0x1adc51, 0x0) mount$tmpfs(0x0, &(0x7f0000000400)='./file0/../file0\x00', &(0x7f00000001c0), 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$xdp(0x2c, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0xf59}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x3) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) ioctl$TIOCSETD(r1, 0x5423, 0x0) ioctl$TCFLSH(r1, 0x540b, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x6) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, &(0x7f0000000080)={{0x1009, 0x0, 0x0, 0x80, 'syz0\x00'}, 0x5, 0x0, 0x1, 0x0, 0x0, 0x8, 'syz1\x00', 0x0}) openat$sndtimer(0xffffffffffffff9c, 0x0, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000140)={0xfffffffffffffffc, 0x132e000, 0x1800, 0x0, 0x1}, 0x20) umount2(&(0x7f00000002c0)='./file0\x00', 0x0) write(r0, &(0x7f0000000440)="d16963eaa69114114afeef46c1cb69ae8b8aad050dca2e3d210a2f57b29fb51646e941aad50e63b4fac98f32b9dfdf5776b3ae873a481b68bfe05ecf6345e4e3109ed563efee056fdea4ca1668470da8cd3ba64616d9eee810274ff32bccf96b0c304a7837f38592d7c797c705d3e9d4844d001a6282216087f9beb9d3bb5106ef379062603b1997cd61bbf61091b7cdc086366311db390da823c2aaf7", 0x9d) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_TUNNEL_GET(r3, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000340)={0x14, 0x0, 0x70d, 0x70bd26, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4040}, 0x8000) sendmsg$L2TP_CMD_TUNNEL_DELETE(r3, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x9717357f2b1f9364}, 0xc, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="2c0000f14b266000", @ANYRES16, @ANYBLOB="000225bd7000fbdbdf250200000008001900e000000108000900030000000500070003000000"], 0x2c}}, 0x4004800) 1m29.942571216s ago: executing program 2 (id=1135): r0 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x0) syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc51b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x8, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1, 0x20, {0x9, 0x21, 0x4}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x0, 0x1, 0x2}}}}}]}}]}}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000400)={0x0, &(0x7f0000000080)}) r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) syz_emit_ethernet(0xe, &(0x7f0000000180)={@local, @local, @void, {@generic={0x8863}}}, 0x0) socket$inet6(0xa, 0x2, 0x0) r2 = socket(0x10, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000003e00)={0x0, 0x0, &(0x7f0000003dc0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000090000000a20000000000a05140000000000000000010000000900010073797a300000000058000000160a09000900000000000000010000000900010073797a30000000000900020073797a32000000002c00038018000380140001006d6163736563300000000000000000000800024000000000080001400000000014000000110001"], 0xa0}}, 0x20040010) (fail_nth: 5) sendmsg$NFT_BATCH(r6, 0x0, 0x8040080) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001680)={0x14, 0x3a, 0x229, 0x0, 0x0, {0xa}}, 0x14}}, 0x0) close_range(r0, r1, 0x2) 1m15.047918754s ago: executing program 2 (id=1135): r0 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x0) syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc51b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x8, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1, 0x20, {0x9, 0x21, 0x4}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x0, 0x1, 0x2}}}}}]}}]}}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000400)={0x0, &(0x7f0000000080)}) r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) syz_emit_ethernet(0xe, &(0x7f0000000180)={@local, @local, @void, {@generic={0x8863}}}, 0x0) socket$inet6(0xa, 0x2, 0x0) r2 = socket(0x10, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000003e00)={0x0, 0x0, &(0x7f0000003dc0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000090000000a20000000000a05140000000000000000010000000900010073797a300000000058000000160a09000900000000000000010000000900010073797a30000000000900020073797a32000000002c00038018000380140001006d6163736563300000000000000000000800024000000000080001400000000014000000110001"], 0xa0}}, 0x20040010) (fail_nth: 5) sendmsg$NFT_BATCH(r6, 0x0, 0x8040080) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001680)={0x14, 0x3a, 0x229, 0x0, 0x0, {0xa}}, 0x14}}, 0x0) close_range(r0, r1, 0x2) 1m2.011487339s ago: executing program 2 (id=1135): r0 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x0) syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc51b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x8, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1, 0x20, {0x9, 0x21, 0x4}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x0, 0x1, 0x2}}}}}]}}]}}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000400)={0x0, &(0x7f0000000080)}) r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) syz_emit_ethernet(0xe, &(0x7f0000000180)={@local, @local, @void, {@generic={0x8863}}}, 0x0) socket$inet6(0xa, 0x2, 0x0) r2 = socket(0x10, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000003e00)={0x0, 0x0, &(0x7f0000003dc0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000090000000a20000000000a05140000000000000000010000000900010073797a300000000058000000160a09000900000000000000010000000900010073797a30000000000900020073797a32000000002c00038018000380140001006d6163736563300000000000000000000800024000000000080001400000000014000000110001"], 0xa0}}, 0x20040010) (fail_nth: 5) sendmsg$NFT_BATCH(r6, 0x0, 0x8040080) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001680)={0x14, 0x3a, 0x229, 0x0, 0x0, {0xa}}, 0x14}}, 0x0) close_range(r0, r1, 0x2) 49.188894893s ago: executing program 2 (id=1135): r0 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x0) syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc51b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x8, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1, 0x20, {0x9, 0x21, 0x4}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x0, 0x1, 0x2}}}}}]}}]}}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000400)={0x0, &(0x7f0000000080)}) r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) syz_emit_ethernet(0xe, &(0x7f0000000180)={@local, @local, @void, {@generic={0x8863}}}, 0x0) socket$inet6(0xa, 0x2, 0x0) r2 = socket(0x10, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000003e00)={0x0, 0x0, &(0x7f0000003dc0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000090000000a20000000000a05140000000000000000010000000900010073797a300000000058000000160a09000900000000000000010000000900010073797a30000000000900020073797a32000000002c00038018000380140001006d6163736563300000000000000000000800024000000000080001400000000014000000110001"], 0xa0}}, 0x20040010) (fail_nth: 5) sendmsg$NFT_BATCH(r6, 0x0, 0x8040080) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001680)={0x14, 0x3a, 0x229, 0x0, 0x0, {0xa}}, 0x14}}, 0x0) close_range(r0, r1, 0x2) 32.863010377s ago: executing program 2 (id=1135): r0 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x0) syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc51b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x8, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1, 0x20, {0x9, 0x21, 0x4}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x0, 0x1, 0x2}}}}}]}}]}}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000400)={0x0, &(0x7f0000000080)}) r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) syz_emit_ethernet(0xe, &(0x7f0000000180)={@local, @local, @void, {@generic={0x8863}}}, 0x0) socket$inet6(0xa, 0x2, 0x0) r2 = socket(0x10, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000003e00)={0x0, 0x0, &(0x7f0000003dc0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000090000000a20000000000a05140000000000000000010000000900010073797a300000000058000000160a09000900000000000000010000000900010073797a30000000000900020073797a32000000002c00038018000380140001006d6163736563300000000000000000000800024000000000080001400000000014000000110001"], 0xa0}}, 0x20040010) (fail_nth: 5) sendmsg$NFT_BATCH(r6, 0x0, 0x8040080) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001680)={0x14, 0x3a, 0x229, 0x0, 0x0, {0xa}}, 0x14}}, 0x0) close_range(r0, r1, 0x2) 15.689622455s ago: executing program 2 (id=1135): r0 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x0) syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc51b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x8, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1, 0x20, {0x9, 0x21, 0x4}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x0, 0x1, 0x2}}}}}]}}]}}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000400)={0x0, &(0x7f0000000080)}) r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) syz_emit_ethernet(0xe, &(0x7f0000000180)={@local, @local, @void, {@generic={0x8863}}}, 0x0) socket$inet6(0xa, 0x2, 0x0) r2 = socket(0x10, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000003e00)={0x0, 0x0, &(0x7f0000003dc0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000090000000a20000000000a05140000000000000000010000000900010073797a300000000058000000160a09000900000000000000010000000900010073797a30000000000900020073797a32000000002c00038018000380140001006d6163736563300000000000000000000800024000000000080001400000000014000000110001"], 0xa0}}, 0x20040010) (fail_nth: 5) sendmsg$NFT_BATCH(r6, 0x0, 0x8040080) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001680)={0x14, 0x3a, 0x229, 0x0, 0x0, {0xa}}, 0x14}}, 0x0) close_range(r0, r1, 0x2) 7.398198509s ago: executing program 4 (id=1567): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3f8, 0x0, 0x32}, 0x9c) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000040)='contention_end\x00', r3}, 0x10) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) readv(r4, &(0x7f0000001900)=[{&(0x7f00000002c0)=""/81, 0x51}], 0x1) bind$inet6(r2, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r2, 0x84, 0x13, &(0x7f0000000440)=0x8, 0x4) sendto$inet6(r2, &(0x7f0000847fff)='X', 0xfee4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) close_range(r0, 0xffffffffffffffff, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x28, 0x3, 0x8, 0x201, 0x0, 0x0, {0x7, 0x0, 0x8}, [@CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x6}, @CTA_TIMEOUT_DATA={0xc, 0x4, 0x0, 0x1, @tcp=[@CTA_TIMEOUT_TCP_CLOSE_WAIT={0x8, 0x5, 0x1, 0x0, 0xffffffb5}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x52, &(0x7f0000000000)=0x5481, 0x4) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYRES16=r1, @ANYRES8=r5], 0x0) 6.743202284s ago: executing program 4 (id=1569): r0 = syz_io_uring_setup(0x3ac6, &(0x7f00000001c0)={0x0, 0xfffffffd, 0x10100, 0x4, 0x37c}, &(0x7f0000000080)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r1, r2, 0x0) rename(0x0, 0x0) socket$packet(0x11, 0x3, 0x300) syz_emit_ethernet(0x6e, &(0x7f0000000080)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @multicast, @void, {@ipv4={0x800, @udp={{0x6, 0x4, 0x0, 0x33, 0x60, 0x67, 0x2, 0x0, 0x11, 0x0, @empty, @empty, {[@ssrr={0x89, 0x3, 0x4b}]}}, {0x0, 0x7, 0x48, 0x0, @wg=@cookie={0x3, 0x3, "b51044ec5d7e501968a539d33427d48541f3e79d52a4bfbd", "0c5376dcdd8113af239665040adcb03ba2e6c779d2d1f4f1c2212b10c2f86626"}}}}}}, 0x0) r3 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) connect$inet6(r3, &(0x7f0000000140)={0xa, 0x4e20, 0x401, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x1}, 0x1c) io_uring_enter(r0, 0x92, 0x0, 0x0, 0x0, 0x0) openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="2c00000018000902000000000000000002000000080f0000003a00"/43], 0x2c}}, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'bond0\x00'}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$loop(0x0, 0x81, 0x2a82) ioctl$sock_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000004b80)) sendmsg$NFC_CMD_DEP_LINK_UP(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000400000005000a0000000000080004000000000008000100", @ANYRES32=0x0, @ANYBLOB="af356fc6f2ecc31b3f707351f328b5d4229c9ac1882ee837a0fa8f38277082cc0874ef2bdca677aefb466584a03a07d4b993b6cc4b7e91298a6357d0a3bda1b96c0eeea5"], 0x2c}}, 0x0) fsopen(&(0x7f0000000240)='vfat\x00', 0x0) (fail_nth: 6) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r6, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r6, 0x0, 0x0) writev(r6, &(0x7f0000000200)=[{0x0}], 0x1) 6.740048743s ago: executing program 1 (id=1570): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000006680)) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) getitimer(0x2, &(0x7f0000000000)) 5.694022871s ago: executing program 4 (id=1573): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="180000001600010a"], 0x78}, 0x1, 0x0, 0x0, 0x8000}, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0xe, @private2={0xfc, 0x2, '\x00', 0x1}, 0x1}, 0x1c) recvmmsg(r0, &(0x7f000001ef40)=[{{0x0, 0x0, 0x0}, 0xf}, {{0x0, 0x0, 0x0}, 0x100}], 0x2, 0x20, 0x0) 5.614075162s ago: executing program 4 (id=1575): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket(0x2b, 0x1, 0x1) setsockopt$inet6_tcp_int(r0, 0x6, 0x3, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) sendmsg$kcm(r1, &(0x7f00000194c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="8043b35e25b0f955ed", 0x9}, {&(0x7f0000019200)="5c5e88cf56218c7a649689506ae6a62b7a434a8458cb2b542a02fe0565dd39b10e6eef065c7c245dc47cf2e0be5e1148e4452fbe498da9e6fb0a3ff9e2214af5714161954d45272d10a0bfaf067055d9b8d5019c9b290435ce46f21110f893473f51f6635ae45b79e475cc8dd7c7a7e644976cdb64d7f5d5fbd611", 0x7b}], 0x2, &(0x7f0000019280)=[{0x100, 0x112, 0xfb0, "14e397828c3db57e8727c8970776ef661a96a4bbc15ffab5a49cd4e41ab20c59416af204d24f04d4eebc842dfdfb65c6768c68871394aa2a1d63f2b1513e80305efcfee1cdbea43c810923cb16e92f594f57d9855c7c8d9da0061396ca80358e313c7928139c81f818e03a666e19acbe0869249c46824abd46fdf3f487092554c627ca13f7a3e6ec7a6f95c5985d90c6e4d65e1455001228e9a06473115f9c5a437dd541fc128e653d27f45d1c428d669e15d1c4abd44045b1e413042bad75b31e321a029886951521fd25081d1a8db2efebb03cfad2699f1e9738ba6028ed7b0c08962d07f35955e4"}, {0x100, 0x103, 0xb5ed, "5a32cec80ac3fd62f92bca6ec8943f0ffb64c28e71aac3f1103cf868a122f18bf8b6aeeecfe1c8c23ca3223ccec9e250f62c2dce88e2fa8db438c97b371d927b90be2ea7c15f38a51e99b858ce97655a36f27b2ff5e1904d36904d37252fb8df4e78776d46e00ed6a44d9d85c46886577e2f977dddd5bb1f35922912cfdbc108bb47511eedf7d6c6b93ebe726b0efa5097c2952407bf88a322047c5adf7b2fd52a66ccea8ed5157f0b2bf29a49d75ce8687f7b0eeed5c119b11a15c19ded1dfae70a9ed3ebe3ed1b92df910eb364a23b4ac5f597712adca6caa02684965ff70e656c428aa06db4a3de1dd591dbb6"}, {0x38, 0x10c, 0x5, "f2e0ea42483c75e260b26051b4b59db7661c134f10f4b5ccada4c077af05cd3c5bdb4c15643a"}], 0x238}, 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='tmpfs\x00', 0x0, &(0x7f00000001c0)='grpquota') madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600707, 0x18) socket$nl_route(0x10, 0x3, 0x0) r2 = creat(&(0x7f0000000440)='./file0/file0\x00', 0x188) quotactl_fd$Q_SETINFO(r2, 0xffffffff80000601, 0x0, &(0x7f0000000300)={0x8, 0x8, 0x0, 0x1}) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x28801, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x42280, 0x0) close(r7) ioctl$KVM_CHECK_EXTENSION(r8, 0xae01, 0x1) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r7, 0x4020aed2, &(0x7f0000000040)={0x0, 0x399000, 0x8}) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r7, 0x4020aed2, &(0x7f0000000080)={0x1000, 0x100000, 0x8}) clock_gettime(0x5, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) 4.971482863s ago: executing program 3 (id=1576): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000012100), 0xe078}}, 0x0) recvmmsg(r1, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}, 0xf000000}, {{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000580)=""/230, 0xe6}, {&(0x7f00000004c0)=""/168, 0xa8}, {0x0}, {&(0x7f00000000c0)=""/26, 0x1a}], 0x4}, 0x2000000}], 0x2, 0x101, 0x0) 4.830631658s ago: executing program 3 (id=1577): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) (async) creat(&(0x7f0000000100)='./file0\x00', 0xd931d3864d39dcca) (async) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x4, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f00000013c0)=0x80000000001, 0x4) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) dup3(r0, r1, 0x0) (async) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000280)={&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0, &(0x7f0000001500)=""/4106, 0x100a, 0x0, 0x0}, &(0x7f0000000080)=0x40) (async) utimes(&(0x7f0000000280)='./file0\x00', 0x0) 3.876079054s ago: executing program 5 (id=1578): r0 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x46, '\x00', 0x0, 0x2}, 0x94) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, r2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$sndseq(0xffffffffffffff9c, 0x0, 0x446102) open_by_handle_at(0xffffffffffffffff, &(0x7f0000000340)=@GFS2_SMALL_FH_SIZE={0x10, 0x4, {0x0, 0x6, 0x3, 0x8}}, 0x101000) socket$packet(0x11, 0x3, 0x300) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x8031, 0xffffffffffffffff, 0x4dd4a000) r6 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) write$tcp_congestion(r6, &(0x7f0000000100)='reno\x00', 0x5) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) capset(&(0x7f00000004c0)={0x20080522}, &(0x7f0000000500)) ioctl$TIOCSTI(r7, 0x5412, 0x0) syz_emit_ethernet(0xc6, &(0x7f0000000480)={@multicast, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0xb8, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010100, @local}, @time_exceeded={0xb, 0x0, 0x0, 0x3, 0x2c, 0x0, {0x27, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @private, @local, {[@cipso={0x86, 0x2f, 0x0, [{0x0, 0x12, "5e000000ff000000b9371c2f82000000"}, {0x5, 0x5, "4eb8a6"}, {0x0, 0x12, "9606053d0006ff00800000b61af93a93"}]}, @lsrr={0x83, 0x13, 0x0, [@rand_addr=0x64010101, @broadcast, @loopback, @multicast2]}, @cipso={0x86, 0x43, 0x0, [{0x0, 0x7, "4b6cefc500"}, {0x0, 0xc, "df61168c24ac88ad078c"}, {0x0, 0xa, "2189ea43a2149b84"}, {0x0, 0xb, "f7d11634eea26b75af"}, {0x0, 0x8, "02a20948fd74"}, {0x0, 0xd, "ccf0294e2a3bdb4aa40b24"}]}]}}}}}}}, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x17, 0x3, &(0x7f0000000200)=@framed, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sysctl=0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xa0) r9 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup\x00', 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000340)={@cgroup=r9, r8, 0x12, 0x0, 0x0, @void, @value=0x0}, 0x20) r10 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) sendfile(r10, r0, 0x0, 0x2000000000000002) 3.758351223s ago: executing program 1 (id=1579): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000000)={0x4800}, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000003900)={0x24, 0x16, 0xa01, 0x0, 0x0, {0x2}, [@typed={0x4}, @typed={0xc, 0xb, 0x0, 0x0, @u64}]}, 0x24}}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001200), 0x0, 0x23, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x7d, &(0x7f0000000080)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x1d}, @broadcast, @val={@val={0x88a8, 0x7, 0x0, 0x2}, {0x8100, 0x0, 0x1, 0x3}}, {@can={0xc, {{}, 0x4, 0xc23371d8f8dd8b2d, 0x0, 0x0, "1392cc0d1d0e783f"}}}}, 0x0) 3.756054652s ago: executing program 3 (id=1580): r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000140), 0x8, 0x0) mmap$KVM_VCPU(&(0x7f0000ffc000/0x2000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0) socket(0x6, 0x5, 0x1) r1 = userfaultfd(0x80801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) r2 = syz_io_uring_setup(0xa5, &(0x7f0000000640)={0x0, 0xe8ce, 0x0, 0x1, 0xcf, 0x0, r0}, &(0x7f00000006c0)=0x0, &(0x7f00000020c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0100000001001000090000000500000041000000", @ANYRES32, @ANYBLOB="0000000000000000bf1500"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x20044084) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000000c0)={r5, &(0x7f0000000340), 0x0}, 0x20) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) r6 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) write$binfmt_elf64(r6, &(0x7f0000000180)=ANY=[], 0x78) r7 = socket$inet(0x2, 0x3, 0xffff) sendfile(r1, r7, &(0x7f00000004c0)=0xfffffffffffffffc, 0x6) fcntl$addseals(r6, 0x409, 0x8) fallocate(r6, 0x3, 0x9100, 0x3) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) close_range(r8, 0xffffffffffffffff, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x6007, @fd_index=0x4, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001800)=""/211, 0xd3}], 0x1}) io_uring_enter(r2, 0x47ba, 0x0, 0x0, 0x0, 0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000002800)={{&(0x7f0000ffa000/0x3000)=nil, 0x3000}, 0x1}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@newqdisc={0xfffffffffffffea6, 0x24, 0x800, 0x70bd29, 0x25dfdc00, {0x60, 0x0, 0x0, 0x0, {0xfff1, 0xfff2}, {0x1, 0xc}, {0xfff3, 0x8}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_MEMORY={0x8, 0xa, 0x80000000}, @TCA_CAKE_INGRESS={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x44045}, 0x10) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0, r9, 0x0, 0x20000}, 0x18) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x6004, 0x1) r10 = creat(&(0x7f00000000c0)='./file0\x00', 0xd4) r11 = dup2(r10, r10) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) ioctl$BLKTRACESETUP(r11, 0xc0481273, &(0x7f0000000000)={'\x00', 0x0, 0x200000a, 0x1, 0x8}) 3.679607686s ago: executing program 1 (id=1581): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x48, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt(0xffffffffffffffff, 0x0, 0x12, 0x0, &(0x7f0000000040)) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x3, [@volatile={0x10, 0x0, 0x0, 0x9, 0x2}, @union={0x401}]}, {0x0, [0x61]}}, 0x0, 0x33, 0x0, 0x1}, 0x28) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r1, 0x0, 0xd}, 0x18) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80280, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x400, 0x0, 0x32, 0x0, 0xfe}, 0x9c) socket$nl_generic(0x10, 0x3, 0x10) ioctl$vim2m_VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000400)=@overlay={0x8, 0x0, 0x4, 0x0, 0xfffffffd, {0x0, 0xea60}, {0x1, 0x1, 0x3, 0x9, 0x21, 0x3, "bc5c938a"}, 0x1ff, 0x3, {}, 0x9}) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r3, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r4 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r4, 0x6, 0x0, 0x0, 0x0) openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000100), 0x2, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000340)=@file={0x1, './file0\x00'}, 0x6e) sendto$inet6(r3, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r3, 0x2) 3.461085212s ago: executing program 4 (id=1582): r0 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) fanotify_init(0x20, 0x800) ppoll(&(0x7f0000000040)=[{r2, 0x858f}], 0x1, 0x0, 0x0, 0x0) close(r1) r4 = fsmount(r0, 0x0, 0x2) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000140)=0x15) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x4, 0x0, 0x2, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000001a40)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) mount$cgroup(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x2010042, &(0x7f0000000000)={[{@subsystem='hugetlb'}, {@subsystem='memory'}, {@subsystem='cpuacct'}]}) ioctl$TCSETS2(0xffffffffffffffff, 0x402c542b, 0x0) mount(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x40078, 0x0) ioctl$TIOCSTI(r5, 0x5412, &(0x7f0000000180)=0x13) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0500000004000000ff0f0000073887b179259a15d12048b218e042a96cff3b77af34c10365f0bd09be571846dadc1a8f3c8797f01b4367e7a54ff69f01f0cc1d5a97adf4414617add364384e12b4cd2cd047b3922cce69f04f9ed7df2ea1ba16d3eb29f42a3d3645ad80978aa9646ed99678a6eaaeb03eebdff7e9d6d4cdb5e4f4931cbf17fa39554fb7d8980efa83c4a1a63c373e792ae893b44a052fe3afb157d9f80b6953d5b54c364ce84ba86f746acf24c5344900c5120daac56747aa5d728fa4a53851eedc2f5a83ab6514cb8153eea085c514254b80c55588df6f9aa0c2d01f65b49f9ebf9c8f2b842528dc8b4c39b5aa34e6a240b42a7c313059ab102372f0b13d97f932de3f4b3451b1a476a67173e430d06f395ff1b1ef8b6d1f3c9ab9ea0eefbf0b57db68f2308d4fb7cf16983cc9cde7179dfaf57d7d312c4710"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r8, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f00000002c0)='Sou\x02ae', &(0x7f0000000240)='c:::\x00=9RN\xed\xf5\xf3c\xa6\b\x9e\x06R\x12\x88\x1bT/\xa1\xa6\x14BU\xcd\xe9$\xa6}\xcd\x8e\x89\xf4\xcb\xa4O\xe9\x93w\xdd\\\x81\x19\xe2\xa7\xee', 0x0) socket$nl_route(0x10, 0x3, 0x0) chdir(&(0x7f0000000000)='./file0\x00') 2.877112669s ago: executing program 5 (id=1583): r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x20000000000fc, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, 0x0) 2.85936083s ago: executing program 3 (id=1584): r0 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000780)=@gettaction={0x14, 0x32, 0x1, 0x70bd29, 0x25dfdbfc}, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x5, 0xa, 0xffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000001140)=@newtfilter={0x3c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0x7, 0x4}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_route={{0xa}, {0xc, 0x2, [@TCA_ROUTE4_TO={0x8, 0x2, 0x48}]}}]}, 0x3c}}, 0x24000000) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) r3 = syz_open_dev$cec(&(0x7f0000000040), 0x0, 0x880) ioctl$CEC_RECEIVE(r3, 0xc0386106, &(0x7f0000000100)={0x2, 0x1e021fe1, 0x9, 0xa40, 0x8, 0x6f8e, "6aa5f6c3a55353193d4a33335756767e", 0x40, 0xa0, 0x6, 0x6, 0x7, 0x4, 0x3}) 2.211438108s ago: executing program 5 (id=1585): socket$nl_generic(0x10, 0x3, 0x10) setresuid(0xee01, 0xee00, 0x0) iopl(0x7) setresuid(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="600000001a00010029bd700000000000022020050003c80000000000080002000a01010008000100ac1414aa08000300", @ANYRESDEC], 0x60}}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='wchan\x00') read$FUSE(r1, &(0x7f0000002200)={0x2020}, 0x2020) 2.19460132s ago: executing program 1 (id=1586): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x101142, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = socket$kcm(0x2, 0x200000000000001, 0x0) r4 = socket(0x40000000015, 0x5, 0x0) r5 = userfaultfd(0x80001) setsockopt$RDS_CONG_MONITOR(r4, 0x114, 0x6, &(0x7f0000000680)=0x1, 0x4) ppoll(&(0x7f00000002c0)=[{r4, 0x10}, {r5, 0x2000}], 0x2, 0x0, 0x0, 0x0) sendmsg$inet(r3, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x240048c1) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.throttle.io_serviced_recursive\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r3, 0x1, 0x3e, &(0x7f0000000100)=r6, 0x4) ioctl$KVM_CAP_DISABLE_QUIRKS(r1, 0x4068aea3, &(0x7f0000000240)={0x74, 0x0, 0x8}) ioctl$TIOCL_GETKMSGREDIRECT(r6, 0x541c, &(0x7f0000000100)) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r2, 0x4068aea3, &(0x7f0000001280)={0x94, 0x0, 0x1}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r8 = openat$cgroup_int(r7, &(0x7f0000000080)='hugetlb.1GB.rsvd.limit_in_bytes\x00', 0x2, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000380)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) getgroups(0x2, &(0x7f0000001080)=[0xee01, 0xffffffffffffffff]) keyctl$chown(0x4, r10, 0xee01, r11) keyctl$setperm(0x5, r10, 0x20030934) keyctl$KEYCTL_MOVE(0x3, r10, 0x0, 0x0, 0x0) sendmsg$nl_route_sched(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@deltfilter={0x38, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0x0, 0x5}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x38}}, 0x0) r12 = openat$cgroup_devices(r7, &(0x7f0000000040)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r12, &(0x7f00000000c0)={'c', ' *:* ', 'rm\x00'}, 0x9) writev(r8, &(0x7f0000004380)=[{&(0x7f00000007c0)='e', 0x1}], 0x1) 2.170592032s ago: executing program 4 (id=1587): openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000004882, 0x0) getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) pidfd_send_signal(r0, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) mount$tmpfs(0x0, 0x0, &(0x7f0000000300), 0x0, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="9febee00180000000000000028000000000000080000000000000000000000d57c9b2100006100616100fd0a1e25d8876178bb12f7840570f35886aa73f48299f9d3032dc3378a5f578de5025dae1aeef4271f3e9b98825451d8d3546beaa0587328eef4cddcc9000afdc9e62d01c615b5c31120008ca8198e44e99ea9593287aaaf119d"], 0x0, 0x46}, 0x28) r2 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) write$binfmt_script(r2, &(0x7f0000000040)={'#! ', './file0', [{0x20, '[}^).)^$$@'}, {0x20, '@^('}], 0xa, "85d1f9d4f31d8959ef"}, 0x23) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x1a, 0xd, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000bc00000018110000", @ANYRESHEX=r3], &(0x7f0000000480)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r4, 0x5, 0x0, 0x0, 0x0, 0x0, 0x29d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}, 0x50) r5 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r5, 0xc04064a0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000440)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r5, 0xc05064a7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000100)=[0x0, 0x0, 0x0], &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0], 0x0, 0x3, 0x0, 0x0, r6, 0x0, 0x2200}) 2.122421896s ago: executing program 3 (id=1588): ioctl$F2FS_IOC_START_ATOMIC_WRITE(0xffffffffffffffff, 0xf501, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x13f, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDFONTOP_SET(r1, 0x4b72, &(0x7f0000000040)={0x4, 0x0, 0x3, 0x1d, 0x13f, &(0x7f00000000c0)="387ed7626d850509a2d6c1aa38f15cd00f85c263cb226db671261fff7ce9c555f18dafae3530db6dd493f2a3cc88721b9ae21b3e3b4523ae2594f47d8f62b480c4160b1f90ac9c41fae6ab12ac4c113fef588684ef494c89092883b902a41cd75387ef6f7bc7d460d5e665f398ff95596dc94ec97003c7e6f3c82fbd8de6e11aa4031a61c51caf7a65a2b613bda33f3eaeae635d7cd81761e74c38a7695800a15516eb337056e02335f9a7d10aa2eaf7beb7e1aed6e850ecb3421143c5c4ded0f06affc524dcf3208272619b6a952db5bc96141b26c54d13c7a5416287a3b6f7aadf50bc549974b6401a19cdb130282b955592efa94242065a4c8d695a2cdd9ada350defd58c775b92d348305774d3a256c7520b285d8da0dbf5e20d604413ed2ddf9bcbf881caf811852806175d63892a15234fbcd7a88a2a0aea45d19148f0e7dada7d6d0d77881387fdeaa0284abe90b88dfff412bff40c31c6415c54ae3335e54a49d315851feffe30d999c36def4df7df747695efbd649f42f310859122c0d2c1e558dc6586958a283762386ecf369274e43003a0fdff59ea515eb44504901ef0d00baa91c10a8e44a76aac3468a15bd3d45ad389977467f306f9bcde071b30769795eed2f1580414d168f557cd90040c4bd2a3d6bc5092548feaef7204a12cece59181fcb5bad8c24bd9f8f78d17ab82831325501e80d899e9252f99d3a2666343392fda11504800f4dd9f45657f8224fc78eb1168fe0527fac33466aadf48f16994d29a47778566e0f3945b2bf36b6eecc7fa18914beb66ac9e519bd333b30d3ce2f50dddeea3447aebbe3bed781e39d5a0fb0cdc60e196f2261305feb596b68986af3eee7b199fefb5f79ffb2d1050e46982af1c14a88dd9000400002f56a8404755c73e74bb90e64bab9647c70ed5afca1c3d87907d01000100df6f40a80ace2bb8a2aad3b0c66915927db4233181943d88c0c76d5969e2043db5bd77fd60ba0f013139929ccfec965c0c769785a4d23332ba1f0875e3146afef5b20cc306d3ecee65944fe9829e0ad0c3f6bb2fd81bc31152538db50f47dc38ba908a0d808687e478a609fe0daa02d4e9c618b99266e7f2e98597e2813e1dba9c3c16e9fab3bda6ed33cb1c75513e2264b69d472dd0e1338688ba782b41bde141f99c4894ded98eff9aa53d22eb77c9d93169c04ab2490bf28106f770e07eb7a9e87dde71929f918b98c4cbfcb11a90139264a9ee8081973167f493760278df0cc34be9e8f86f948d9a62e63ad6ca9d2195ff9c6320c85bddc42915e4f3a5db642447bc2195a3d64e04c9ecd1c313c08e29b814bd8fed1ab6d2846c73345962895d289ac77152cac2e0e32b75ce814731c542091f218dd1e68a15f8226577bf9481ae0555db64a717eb23a811356d00"}) 1.024709503s ago: executing program 3 (id=1589): socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x50, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) r2 = socket(0x2b, 0x80801, 0x1) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040)={0xffffffffffffffff}, 0x106}}, 0x20) r5 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r6}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000480)='\xf5\xfc\xd2\xec]\x95zx8*\xa2d\x11\xb5\xb1\x01\x00\x00\x00\xe49{\x8a{\x81s\xea$\xdfg\xb1\x03DY!\x97\xadM\xd7\xff\x8a\xcd[>\x12e\xc3]d8\xba\x8ec\x00\x00\x00\x00\x00\x00\x00\xa0\xe2\xd5y\xec\x90\x00\x98Y\x91\x19\x16\x89\xd0\x1a\xad\xcd\xd6\xd0\xc6\xb9\xeb\x95\xd3\x9cl\x9cu#\xb4\xee\xe5\x9d\t\fV\xd4\xda\xfc`2?\x15P\xba\x14b\x1c\xcc\xd5\xb9jA$s\xb9g3\x15M\xd9\xb9 \xca[\xc7\xec\xa9;\xee\x01\xc9\xc4\x1f\xc3\xe4\xfa\xd3fU\x0e\x86\xc8\xa7\xaf\xaf\x04p\xa3\x8bb\xbf\\\xdb\x83\x00\x96sy\x14\x1eo\xcc9&\x946\xf9\xf5v\xee\xb5m$;\x01\xb8\xeau\x00\xd1S=\x920H\xc2z\xb5\xbe\x95\xef\xeb\xd1\xc8\xa1\xba\xach\xbef\xa8\x86\xc2\x18\x9cC\x15\x9c^\xcf\xe9\xbcp\xb4Ff\x00\x9d>p\"\x19\xd8}|~\xae\xdb\a59f\xb8?\xba\xf2\x8e\xa5y\\\xf0\fkd??-\x983\xf3\x19\xc7\xc0/\xe9\x1a\x80=\xa72)\xd2\x00'/277, &(0x7f0000000340)='/\x00\x01\x00H\x98', 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, &(0x7f0000000180)={0x3, 0x40, 0xfa02, {{0x6000000, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x7, @remote}, r4}}, 0x48) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, &(0x7f0000000480)={0x3, 0x40, 0xfa00, {{0xa, 0xfffc, 0x0, @dev={0xfe, 0x80, '\x00', 0x11}, 0x5}, {0xa, 0x0, 0x0, @loopback}, r4}}, 0x48) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000180)={0xe, 0x18, 0xfa00, @ib_path={&(0x7f00000000c0)=[{0x2, 0x0, [0x1, 0x5, 0xffffffff, 0xe76, 0xffff, 0x2, 0xc491, 0x9, 0x3, 0x9, 0x9, 0x4, 0x30000, 0x9, 0x7cb, 0x44]}], r4, 0x1, 0x1, 0x48}}, 0x20) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000011c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x2d0, 0x140, 0x5c, 0x160, 0x0, 0x3e0, 0x250, 0x228, 0x25a, 0x250, 0x228, 0x4, 0x0, {[{{@uncond, 0x5002, 0xa8, 0xf0, 0x52020000, {0x0, 0x6802000000000000}}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x7fff, 0x9, 0x7, 'syz0\x00', {0x719}}}}, {{@ipv6={@private0, @private2, [0xff, 0x0, 0xffffff00, 0xff], [0xff, 0xffffff00, 0xffffff00, 0xffffff00], 'tunl0\x00', 'pimreg0\x00', {0xff}, {0xff}, 0x33, 0x4, 0x9456fff08070a538, 0x70}, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x82b, 0x0, 0x0, 'syz0\x00', 'syz0\x00', {0x8000800000000000}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x330) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x40080, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) 1.005038563s ago: executing program 5 (id=1590): r0 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r0, &(0x7f0000000c80)=[{{&(0x7f0000000040)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000180)="fd", 0x33b40}], 0x1}}, {{&(0x7f0000001180)={0x2, 0x4e24, @rand_addr=0x64010100}, 0x10, &(0x7f00000011c0)=[{&(0x7f0000004d00)='f', 0x1}], 0x1}}], 0x2, 0x0) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000500)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000440)={0xa0, 0x3, 0x1, 0x801, 0x0, 0x0, {0x1, 0x0, 0x8}, [@CTA_TUPLE_ORIG={0x6c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010101}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x67}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @empty}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @multicast1}}}]}, @CTA_LABELS={0x20, 0x16, 0x1, 0x0, [0x7, 0x1, 0x5, 0x3, 0xe, 0x3, 0x0]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x4080}, 0x4) r1 = syz_open_dev$vim2m(&(0x7f0000000680), 0x8, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x2, 0x0) sendmsg$SMC_PNETID_GET(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000540)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100fdffff000000000003000000200001800e0001006574683a766c616e300000000c00028008000300ff0f00000163e1897cc08551251bf2728e56afceafa887cd22e99981cf71ec435b7fb0b683c32a9ca478a599dd9d8b19639ed572c5edde40bc0b2236fa5591d85b5f343399de8036b06c307580095f46173e07e401e71252f33ea4ee0d2594c313c37020997a5a80aacc33593853148a3fe7f3a19b59c34b189efc8f49541c857fc277f8e55e49d1cd9191677a885f932077ab3549c4e6e304d4efb283620de33ec56068ec1f9ea5acd9493a22f60330ba9aa96e0fc7a16e539548a87372c1e74859d47d947d"], 0x34}, 0x1, 0x0, 0x0, 0x840}, 0x20004080) getsockname$packet(r4, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c0000001000370400000000f8541549b670c46a", @ANYRES32=r7, @ANYBLOB="83040500000000001c0012800e00010069703665727370616e00000008000280040012"], 0x3c}}, 0x0) sendmmsg$inet(r2, &(0x7f0000002b00)=[{{&(0x7f0000000200)={0x2, 0x4e23, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r7, @empty, @private=0xa010100}}}], 0x20}}], 0x1, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$vim2m_VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000100)=@userptr={0x9, 0x1, 0x4, 0x10, 0x5, {0x0, 0xea60}, {0x4, 0xc, 0x32, 0x9, 0x4, 0x0, "beb47cd0"}, 0x7, 0x2, {&(0x7f0000000040)}, 0x0, 0x0, r8}) ioctl$vim2m_VIDIOC_QBUF(r1, 0xc058560f, &(0x7f00000002c0)=@multiplanar_mmap={0x0, 0x2, 0x4, 0x0, 0x9, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "fafc00"}, 0x0, 0x1, {0x0}}) creat(&(0x7f0000000000)='./file0\x00', 0x19) 855.215486ms ago: executing program 1 (id=1591): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0xfffffffe, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000026008188040f80ec59acbc0413a1f8480d0000005e140604000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) kexec_load(0x0, 0x1, &(0x7f0000000900)=[{0x0, 0x0, 0x200000000, 0x3e0000000000}], 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$KDFONTOP_SET(0xffffffffffffffff, 0x4b72, &(0x7f0000000040)={0x4, 0x0, 0x13, 0x8, 0x100, 0x0}) r2 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2284, &(0x7f0000000040)) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r1) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r1) r5 = syz_open_procfs(0x0, &(0x7f0000000000)='task\x00') getdents(r5, &(0x7f0000000080)=""/70, 0x46) getdents(r5, &(0x7f0000000040)=""/36, 0x24) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000180)={'syztnl0\x00', &(0x7f00000003c0)={'erspan0\x00', 0x0, 0x700, 0x7800, 0x8, 0x7, {{0xf, 0x4, 0x0, 0x8, 0x3c, 0x64, 0x0, 0x5, 0x29, 0x0, @loopback, @remote, {[@rr={0x7, 0x1f, 0xca, [@multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @dev={0xac, 0x14, 0x14, 0x11}, @loopback, @remote, @empty]}, @ra={0x94, 0x4, 0x1}, @ra={0x94, 0x4}]}}}}}) socket$inet(0x2, 0x800, 0xc) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r1, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x9000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0x7c, r4, 0x2, 0x70bd28, 0x25dfdbff, {}, [@ETHTOOL_A_LINKMODES_DUPLEX={0x5, 0x6, 0x8}, @ETHTOOL_A_LINKMODES_DUPLEX={0x5, 0x6, 0x6a}, @ETHTOOL_A_LINKMODES_DUPLEX={0x5, 0x6, 0xca}, @ETHTOOL_A_LINKMODES_AUTONEG={0x5, 0x2, 0x5}, @ETHTOOL_A_LINKMODES_HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x71abd69a23800895}, @ETHTOOL_A_HEADER_DEV_NAME={0x14}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}, @ETHTOOL_A_LINKMODES_AUTONEG={0x5, 0x2, 0x9}, @ETHTOOL_A_LINKMODES_DUPLEX={0x5, 0x6, 0xf}, @ETHTOOL_A_LINKMODES_SPEED={0x8, 0x5, 0x5}, @ETHTOOL_A_LINKMODES_SPEED={0x8, 0x5, 0x1}]}, 0x7c}, 0x1, 0x0, 0x0, 0x40000}, 0x40000) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000880)={0x1c, r3, 0x51f4af310aafa50f, 0x70bd2d, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r7}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x8000) 526.498177ms ago: executing program 5 (id=1592): openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000), 0x4c200, 0x0) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) write$uinput_user_dev(r0, &(0x7f0000000080)={'syz0\x00', {0x0, 0x2}, 0x0, [0x3, 0x3, 0x3ff, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x9, 0x0, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x4, 0xfffffffc, 0x0, 0x0, 0x4, 0x0, 0x0, 0x3, 0x10000000, 0x99, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x7, 0x0, 0x1, 0xfffffffe, 0x5, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x4, 0x0, 0x8, 0x0, 0x3, 0x0, 0x6, 0x3, 0x0, 0x3], [0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x6d, 0xffffffff, 0x8000edc0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xa0000000, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0xa, 0x2, 0x0, 0x2000079, 0x0, 0x0, 0x0, 0x10000, 0x40000, 0x8, 0xc0000001, 0x0, 0x0, 0xffffffff, 0x0, 0x3, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4], [0xffffffff, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xfffffffe, 0x0, 0x2, 0x7, 0x0, 0x0, 0x0, 0x3, 0xffffffff, 0x20000000, 0x0, 0x0, 0x0, 0x3, 0xfffffffc, 0x4000, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x44, 0x4000400, 0x0, 0x0, 0xfffffffd], [0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, 0x0, 0x0, 0x0, 0x3, 0x10000000, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5, 0x0, 0x0, 0x2000000, 0x0, 0x4, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffd, 0x10000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x3, 0x0, 0x0, 0x0, 0x100000]}, 0x45c) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000000f478e"]) r1 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0x0, 0x2, 0x10000, 0x0, 0x4002004c4, 0x1000, 0x0, 0x200, 0x0, 0x0, 0x3, 0x0, 0x0, 0x8c], 0xeeee8000}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x500000000000000) 118.073887ms ago: executing program 1 (id=1593): socket$l2tp6(0xa, 0x2, 0x73) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, &(0x7f0000000240)="8a", 0x1, 0x51, &(0x7f0000000080)={0xa, 0x3, 0x2, @local, 0x9}, 0x1c) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f00000000c0)={0x3c}, 0x8) listen(r0, 0x100101) accept4(r0, 0x0, 0x0, 0x80800) set_mempolicy(0x8002, 0x0, 0x5) socket$inet(0x2, 0x3, 0x100) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$key(0xf, 0x3, 0x2) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x0) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x18000) mkdir(0x0, 0x92) chdir(&(0x7f0000000140)='./bus\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) lseek(r2, 0xffffffffffffa937, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r4, &(0x7f0000000e00)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x2}}, 0x12) bind$x25(r3, &(0x7f0000000080), 0x12) r5 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000700)={'bond0\x00'}) 0s ago: executing program 5 (id=1594): r0 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x46, '\x00', 0x0, 0x2}, 0x94) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, r2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getsockopt$bt_BT_FLUSHABLE(0xffffffffffffffff, 0x112, 0x8, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$sndseq(0xffffffffffffff9c, 0x0, 0x446102) open_by_handle_at(0xffffffffffffffff, &(0x7f0000000340)=@GFS2_SMALL_FH_SIZE={0x10, 0x4, {0x0, 0x6, 0x3, 0x8}}, 0x101000) socket$packet(0x11, 0x3, 0x300) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x8031, 0xffffffffffffffff, 0x4dd4a000) r6 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) write$tcp_congestion(r6, &(0x7f0000000100)='reno\x00', 0x5) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) capset(&(0x7f00000004c0)={0x20080522}, &(0x7f0000000500)) ioctl$TIOCSTI(r7, 0x5412, 0x0) syz_emit_ethernet(0xca, &(0x7f0000000480)={@multicast, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0xbc, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010100, @local}, @time_exceeded={0xb, 0x0, 0x0, 0x3, 0x2c, 0x0, {0x28, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @private, @local, {[@cipso={0x86, 0x2f, 0x0, [{0x0, 0x12, "5e000000ff000000b9371c2f82000000"}, {0x5, 0x5, "4eb8a6"}, {0x0, 0x12, "9606053d0006ff00800000b61af93a93"}]}, @lsrr={0x83, 0x13, 0x0, [@rand_addr=0x64010101, @broadcast, @loopback, @multicast2]}, @cipso={0x86, 0x43, 0x0, [{0x0, 0x7, "4b6cefc500"}, {0x0, 0xc, "df61168c24ac88ad078c"}, {0x0, 0xa, "2189ea43a2149b84"}, {0x0, 0xb, "f7d11634eea26b75af"}, {0x0, 0x8, "02a20948fd74"}, {0x0, 0xd, "ccf0294e2a3bdb4aa40b24"}]}, @timestamp={0x44, 0x4, 0x56}]}}}}}}}, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x17, 0x3, &(0x7f0000000200)=@framed, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sysctl=0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xa0) r9 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./cgroup\x00', 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000340)={@cgroup=r9, r8, 0x12, 0x0, 0x0, @void, @value=0x0}, 0x20) r10 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/sys/net/ipv4/vs/sync_qlen_max\x00', 0x2, 0x0) sendfile(r10, r0, 0x0, 0x2000000000000002) kernel console output (not intermixed with test programs): T64] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 419.911520][ T5830] Bluetooth: hci2: command tx timeout [ 420.052807][ T5871] usb 4-1: config 0 has no interfaces? [ 420.146532][ T5871] usb 4-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ec.7e [ 420.159260][ T5871] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 420.175228][ T5871] usb 4-1: Product: syz [ 420.179523][ T5871] usb 4-1: Manufacturer: syz [ 420.184118][ T5871] usb 4-1: SerialNumber: syz [ 420.190050][ T5871] usb 4-1: config 0 descriptor?? [ 420.500742][T10592] team0: Port device team_slave_0 added [ 420.529287][T10684] dummy0 speed is unknown, defaulting to 1000 [ 420.531405][T10592] team0: Port device team_slave_1 added [ 420.551325][T10688] x_tables: ip_tables: osf match: only valid for protocol 6 [ 420.591274][T10682] pim6reg: entered allmulticast mode [ 420.597907][ T5871] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 420.661594][T10679] pim6reg: left allmulticast mode [ 420.668894][ T1206] usb 4-1: USB disconnect, device number 43 [ 420.729152][T10592] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 420.736312][T10592] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 420.768912][T10592] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 420.788049][ T5871] usb 6-1: Using ep0 maxpacket: 16 [ 420.799902][T10592] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 420.808300][T10592] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 420.808434][ T5871] usb 6-1: config 0 has no interfaces? [ 420.834959][ T5864] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 420.878283][T10592] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 420.907430][ T5871] usb 6-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ec.7e [ 420.917614][ T5871] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 420.929160][ T5871] usb 6-1: Product: syz [ 420.941900][ T5871] usb 6-1: Manufacturer: syz [ 420.946511][ T5871] usb 6-1: SerialNumber: syz [ 420.968832][ T5871] usb 6-1: config 0 descriptor?? [ 420.975558][T10592] hsr_slave_0: entered promiscuous mode [ 420.981482][ T5864] usb 2-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 420.981510][ T5864] usb 2-1: config 0 interface 0 has no altsetting 0 [ 420.983367][ T5864] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 420.995047][T10592] hsr_slave_1: entered promiscuous mode [ 421.010826][ T5864] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 421.014537][T10592] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 421.029707][T10475] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 421.046766][ T5864] usb 2-1: Product: syz [ 421.055200][ T5864] usb 2-1: Manufacturer: syz [ 421.067805][ T5864] usb 2-1: SerialNumber: syz [ 421.084345][T10592] Cannot create hsr debugfs directory [ 421.211930][ T5864] usb 2-1: config 0 descriptor?? [ 421.254414][ T5864] usb 2-1: selecting invalid altsetting 0 [ 421.310774][ T5871] usb 6-1: USB disconnect, device number 30 [ 421.435621][ T5941] usb 2-1: USB disconnect, device number 49 [ 421.597873][ T5864] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 421.672746][T10592] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 421.681631][T10592] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 421.692799][T10592] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 421.701977][T10592] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 421.749470][ T5864] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 421.774104][ T5864] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 421.787329][T10592] 8021q: adding VLAN 0 to HW filter on device bond0 [ 421.794943][ T5864] usb 4-1: New USB device found, idVendor=1d34, idProduct=0004, bcdDevice= 0.00 [ 421.815515][T10592] 8021q: adding VLAN 0 to HW filter on device team0 [ 421.822483][ T5864] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 421.836403][ T5864] usb 4-1: config 0 descriptor?? [ 421.844646][ T771] bridge0: port 1(bridge_slave_0) entered blocking state [ 421.851825][ T771] bridge0: port 1(bridge_slave_0) entered forwarding state [ 421.890270][ T771] bridge0: port 2(bridge_slave_1) entered blocking state [ 421.897397][ T771] bridge0: port 2(bridge_slave_1) entered forwarding state [ 422.020936][T10592] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 422.032486][T10592] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 422.269404][ T5864] hid-led 0003:1D34:0004.0039: unknown main item tag 0x0 [ 422.350362][T10592] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 422.416941][T10592] veth0_vlan: entered promiscuous mode [ 422.433856][T10592] veth1_vlan: entered promiscuous mode [ 422.448919][T10716] binder: 10714:10716 ioctl c0306201 200000000640 returned -22 [ 422.471511][ T5864] hid-led 0003:1D34:0004.0039: probe with driver hid-led failed with error -71 [ 422.492885][T10592] veth0_macvtap: entered promiscuous mode [ 422.500025][ T5864] usb 4-1: USB disconnect, device number 44 [ 422.505723][T10592] veth1_macvtap: entered promiscuous mode [ 422.533554][T10592] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 422.556658][T10592] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 422.575553][T10592] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 422.584633][T10592] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 422.595834][T10592] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 422.621061][T10592] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 422.757651][T10475] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 422.765728][T10475] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 422.931493][T10475] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 422.947730][T10475] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 423.053151][T10722] random: crng reseeded on system resumption [ 423.206983][T10715] binder: 10714:10715 ioctl c0306201 2000000000c0 returned -14 [ 423.246515][T10725] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 423.253796][T10725] IPv6: NLM_F_CREATE should be set when creating new route [ 423.318770][ T917] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 423.478369][ T917] usb 5-1: Using ep0 maxpacket: 32 [ 423.490664][ T917] usb 5-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 423.513063][ T917] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 423.527378][ T917] usb 5-1: config 0 descriptor?? [ 423.541243][ T917] as10x_usb: device has been detected [ 423.553287][ T917] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 423.571240][ T917] usb 5-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 423.599702][ T917] as10x_usb: error during firmware upload part1 [ 423.606844][ T917] Registered device nBox DVB-T Dongle [ 423.707581][T10736] netlink: 'syz.5.1311': attribute type 33 has an invalid length. [ 423.777847][ T5965] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 423.850937][ T30] audit: type=1804 audit(1751016443.093:855): pid=10737 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.5.1311" name="/newroot/211/file0" dev="tmpfs" ino=1141 res=1 errno=0 [ 424.677178][T10741] dummy0 speed is unknown, defaulting to 1000 [ 424.778060][ T5965] usb 2-1: Using ep0 maxpacket: 32 [ 424.786111][ T5965] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 424.802892][ T5965] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 424.814885][ T5965] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0 [ 424.826962][ T5965] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 424.839792][ T5965] usb 2-1: New USB device found, idVendor=05ef, idProduct=020a, bcdDevice=91.36 [ 424.852397][ T5965] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 424.860585][ T5965] usb 2-1: Product: syz [ 424.864819][ T5965] usb 2-1: Manufacturer: syz [ 424.873721][ T5965] usb 2-1: SerialNumber: syz [ 424.879665][ T5965] usb 2-1: config 0 descriptor?? [ 424.997839][ T5941] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 425.097522][ T917] usb 2-1: USB disconnect, device number 50 [ 425.116685][ T12] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 425.148074][ T5941] usb 6-1: Using ep0 maxpacket: 16 [ 425.159057][ T5941] usb 6-1: config 0 has no interfaces? [ 425.173362][ T5941] usb 6-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ec.7e [ 425.192145][ T5941] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 425.212325][ T5941] usb 6-1: Product: syz [ 425.221776][ T5941] usb 6-1: Manufacturer: syz [ 425.231517][ T5941] usb 6-1: SerialNumber: syz [ 425.244176][ T5941] usb 6-1: config 0 descriptor?? [ 425.459118][ T917] usb 6-1: USB disconnect, device number 31 [ 425.508427][ T64] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 425.793321][T10747] netlink: 100 bytes leftover after parsing attributes in process `syz.1.1313'. [ 426.041089][ T5965] usb 5-1: USB disconnect, device number 60 [ 426.557674][ T64] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 426.604601][ T5965] Unregistered device nBox DVB-T Dongle [ 426.605896][ T5965] as10x_usb: device has been disconnected [ 426.632157][ T5829] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 426.642652][ T5829] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 426.652278][ T5829] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 426.664755][ T5829] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 426.673803][ T5829] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 426.673920][T10757] FAULT_INJECTION: forcing a failure. [ 426.673920][T10757] name failslab, interval 1, probability 0, space 0, times 0 [ 426.680846][T10757] CPU: 1 UID: 0 PID: 10757 Comm: syz.4.1316 Not tainted 6.16.0-rc3-syzkaller-00116-ge34a79b96ab9 #0 PREEMPT(full) [ 426.680873][T10757] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 426.680883][T10757] Call Trace: [ 426.680889][T10757] [ 426.680896][T10757] dump_stack_lvl+0x16c/0x1f0 [ 426.680927][T10757] should_fail_ex+0x512/0x640 [ 426.680948][T10757] ? __kmalloc_cache_noprof+0x57/0x3e0 [ 426.680971][T10757] should_failslab+0xc2/0x120 [ 426.680996][T10757] __kmalloc_cache_noprof+0x6a/0x3e0 [ 426.681017][T10757] ? vkms_plane_duplicate_state+0x87/0x130 [ 426.681046][T10757] ? kasan_save_track+0x14/0x30 [ 426.681071][T10757] vkms_plane_duplicate_state+0x87/0x130 [ 426.681099][T10757] drm_atomic_get_plane_state+0x20b/0x590 [ 426.681129][T10757] drm_client_modeset_commit_atomic+0x237/0x7e0 [ 426.681158][T10757] ? __pfx___might_resched+0x10/0x10 [ 426.681187][T10757] ? __pfx_drm_client_modeset_commit_atomic+0x10/0x10 [ 426.681214][T10757] ? __mutex_lock+0x1ca/0xb90 [ 426.681258][T10757] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 426.681294][T10757] drm_client_modeset_commit_locked+0x14d/0x580 [ 426.681326][T10757] drm_fb_helper_pan_display+0x32d/0xa40 [ 426.681360][T10757] fb_pan_display+0x479/0x7d0 [ 426.681382][T10757] ? __pfx_drm_fb_helper_pan_display+0x10/0x10 [ 426.681409][T10757] bit_update_start+0x49/0x1f0 [ 426.681437][T10757] fbcon_modechanged+0x5ab/0x700 [ 426.681464][T10757] fbcon_set_all_vcs+0x1d6/0x450 [ 426.681491][T10757] fbcon_update_vcs+0x2c/0x50 [ 426.681513][T10757] do_fb_ioctl+0x787/0x7e0 [ 426.681531][T10757] ? __pfx_do_fb_ioctl+0x10/0x10 [ 426.681553][T10757] ? do_vfs_ioctl+0x523/0x1a60 [ 426.681609][T10757] ? selinux_file_ioctl+0x180/0x270 [ 426.681638][T10757] fb_ioctl+0xe5/0x150 [ 426.681651][T10757] ? __pfx_fb_ioctl+0x10/0x10 [ 426.681668][T10757] __x64_sys_ioctl+0x18b/0x210 [ 426.681690][T10757] do_syscall_64+0xcd/0x4c0 [ 426.681725][T10757] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 426.681743][T10757] RIP: 0033:0x7fd76c18e929 [ 426.681758][T10757] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 426.681774][T10757] RSP: 002b:00007fd76d02a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 426.681791][T10757] RAX: ffffffffffffffda RBX: 00007fd76c3b5fa0 RCX: 00007fd76c18e929 [ 426.681803][T10757] RDX: 0000200000000380 RSI: 0000000000004601 RDI: 0000000000000003 [ 426.681813][T10757] RBP: 00007fd76d02a090 R08: 0000000000000000 R09: 0000000000000000 [ 426.681823][T10757] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 426.681833][T10757] R13: 0000000000000000 R14: 00007fd76c3b5fa0 R15: 00007fff34911988 [ 426.681859][T10757] [ 426.748438][T10752] dummy0 speed is unknown, defaulting to 1000 [ 427.303304][ T5871] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 427.474097][ T5871] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 427.474188][ T5871] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 427.474414][ T5871] usb 4-1: New USB device found, idVendor=1d34, idProduct=0004, bcdDevice= 0.00 [ 427.474444][ T5871] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 427.519005][ T5871] usb 4-1: config 0 descriptor?? [ 428.043031][ T5871] hid-led 0003:1D34:0004.003A: unknown main item tag 0x0 [ 428.202965][ T5871] hid-led 0003:1D34:0004.003A: probe with driver hid-led failed with error -71 [ 428.347155][ T5871] usb 4-1: USB disconnect, device number 45 [ 428.363532][T10773] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1320'. [ 428.365659][ T12] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.398819][T10752] chnl_net:caif_netlink_parms(): no params data found [ 428.400135][T10773] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1320'. [ 428.437362][T10779] x_tables: ip_tables: osf match: only valid for protocol 6 [ 428.477289][ T12] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.534089][T10752] bridge0: port 1(bridge_slave_0) entered blocking state [ 428.542030][T10752] bridge0: port 1(bridge_slave_0) entered disabled state [ 428.550415][T10752] bridge_slave_0: entered allmulticast mode [ 428.558785][T10752] bridge_slave_0: entered promiscuous mode [ 428.580857][ T12] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.597026][T10752] bridge0: port 2(bridge_slave_1) entered blocking state [ 428.604429][T10752] bridge0: port 2(bridge_slave_1) entered disabled state [ 428.611752][T10752] bridge_slave_1: entered allmulticast mode [ 428.619670][T10752] bridge_slave_1: entered promiscuous mode [ 428.628056][ T5926] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 428.675069][T10752] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 428.687931][ T5965] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 428.690562][T10752] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 428.786613][T10752] team0: Port device team_slave_0 added [ 428.793163][ T5829] Bluetooth: hci2: command tx timeout [ 428.800458][ T5926] usb 2-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 428.821478][T10752] team0: Port device team_slave_1 added [ 428.833707][ T5926] usb 2-1: config 0 interface 0 has no altsetting 0 [ 428.852770][ T5926] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 428.868036][ T5926] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 428.879809][ T5965] usb 5-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 428.899445][ T5926] usb 2-1: Product: syz [ 428.915018][ T5965] usb 5-1: config 0 interface 0 has no altsetting 0 [ 428.922389][ T5926] usb 2-1: Manufacturer: syz [ 428.987474][T10752] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 428.994604][ T5926] usb 2-1: SerialNumber: syz [ 429.001320][ T5965] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 429.011963][T10752] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 429.038632][ T5926] usb 2-1: config 0 descriptor?? [ 429.043780][ T5965] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 429.062499][T10789] MPI: mpi too large (32768 bits) [ 429.161685][ T5965] usb 5-1: Product: syz [ 429.220351][ T5926] usb 2-1: selecting invalid altsetting 0 [ 429.228153][ T5965] usb 5-1: Manufacturer: syz [ 429.233220][ T5965] usb 5-1: SerialNumber: syz [ 429.327830][T10752] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 429.342889][ T5965] usb 5-1: config 0 descriptor?? [ 429.377050][T10752] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 429.389254][ T5965] usb 5-1: selecting invalid altsetting 0 [ 429.396666][ T5926] usb 2-1: USB disconnect, device number 51 [ 429.405108][T10752] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 429.437332][T10752] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 429.503159][ T12] bridge_slave_1: left allmulticast mode [ 429.508910][ T12] bridge_slave_1: left promiscuous mode [ 429.516015][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 429.525485][ T12] bridge_slave_0: left allmulticast mode [ 429.531453][ T12] bridge_slave_0: left promiscuous mode [ 429.537159][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 429.564794][ T5965] usb 5-1: USB disconnect, device number 61 [ 430.424986][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 430.529355][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 430.678087][ T12] bond0 (unregistering): Released all slaves [ 430.868030][ T5829] Bluetooth: hci2: command tx timeout [ 430.897545][T10752] hsr_slave_0: entered promiscuous mode [ 430.909709][T10752] hsr_slave_1: entered promiscuous mode [ 430.922899][T10752] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 430.931612][T10752] Cannot create hsr debugfs directory [ 431.017371][T10816] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1331'. [ 431.118003][ T30] audit: type=1400 audit(1751016450.403:856): avc: denied { create } for pid=10815 comm="syz.1.1331" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 431.148838][ T30] audit: type=1400 audit(1751016450.413:857): avc: denied { ioctl } for pid=10815 comm="syz.1.1331" path="socket:[31990]" dev="sockfs" ino=31990 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 431.215990][ T12] hsr_slave_0: left promiscuous mode [ 431.222738][ T12] hsr_slave_1: left promiscuous mode [ 431.228695][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 431.236730][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 431.245549][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 431.253427][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 431.579444][ T12] veth1_macvtap: left promiscuous mode [ 431.593070][ T12] veth0_macvtap: left promiscuous mode [ 431.599191][ T12] veth1_vlan: left promiscuous mode [ 432.195349][ T12] veth0_vlan: left promiscuous mode [ 432.416624][T10835] netlink: 160 bytes leftover after parsing attributes in process `syz.1.1335'. [ 432.701945][ T5864] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 432.737879][ T5965] usb 5-1: new high-speed USB device number 62 using dummy_hcd [ 432.821357][ T12] team0 (unregistering): Port device team_slave_1 removed [ 432.862728][ T12] team0 (unregistering): Port device team_slave_0 removed [ 432.863137][ T5864] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 432.882380][ T5864] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 432.892593][ T5864] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 432.902926][ T5864] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 432.911172][ T5965] usb 5-1: Using ep0 maxpacket: 32 [ 432.916497][ T5864] usb 2-1: SerialNumber: syz [ 432.922380][ T5965] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 432.934549][ T5965] usb 5-1: New USB device found, idVendor=1b96, idProduct=000a, bcdDevice= 0.00 [ 432.944492][ T5965] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 432.953644][ T5829] Bluetooth: hci2: command tx timeout [ 432.968073][ T5965] usb 5-1: config 0 descriptor?? [ 433.359883][T10847] bridge0: port 3(vlan2) entered blocking state [ 433.389563][ T5965] ntrig 0003:1B96:000A.003B: unknown main item tag 0x0 [ 433.396760][T10847] bridge0: port 3(vlan2) entered disabled state [ 433.404323][T10847] vlan2: entered allmulticast mode [ 433.411545][ T5965] ntrig 0003:1B96:000A.003B: unknown main item tag 0x0 [ 433.418538][T10847] bridge0: entered allmulticast mode [ 433.426148][ T5965] ntrig 0003:1B96:000A.003B: hidraw0: USB HID v0.00 Device [HID 1b96:000a] on usb-dummy_hcd.4-1/input0 [ 433.440587][T10847] vlan2: left allmulticast mode [ 433.445524][T10847] bridge0: left allmulticast mode [ 433.521545][ T5864] usb 2-1: 0:2 : does not exist [ 433.548749][ T5864] usb 2-1: unit 5: unexpected type 0x0a [ 433.585510][ T5864] usb 2-1: USB disconnect, device number 52 [ 433.594106][ T5965] ntrig 0003:1B96:000A.003B: Firmware version: 0.1.27.36.0 (0730 806c) [ 434.370532][ T5965] usb 5-1: USB disconnect, device number 62 [ 434.468871][ T30] audit: type=1400 audit(1751016453.753:858): avc: denied { map } for pid=10858 comm="syz.3.1342" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 434.469250][ T3521] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 434.573448][ T30] audit: type=1400 audit(1751016453.753:859): avc: denied { execute } for pid=10858 comm="syz.3.1342" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 434.654685][T10867] netlink: 300 bytes leftover after parsing attributes in process `syz.3.1342'. [ 434.736108][T10752] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 434.754142][T10752] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 434.770072][T10752] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 434.781386][T10752] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 434.859387][T10752] 8021q: adding VLAN 0 to HW filter on device bond0 [ 434.877204][T10752] 8021q: adding VLAN 0 to HW filter on device team0 [ 434.891495][ T54] bridge0: port 1(bridge_slave_0) entered blocking state [ 434.898675][ T54] bridge0: port 1(bridge_slave_0) entered forwarding state [ 434.907872][ T917] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 434.908014][ T5965] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 434.932223][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 434.939310][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 435.027927][ T5829] Bluetooth: hci2: command tx timeout [ 435.059625][ T917] usb 2-1: Using ep0 maxpacket: 8 [ 435.119254][ T917] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 435.171468][ T917] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 435.336422][ T917] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 435.410208][ T917] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 435.492152][ T917] usb 2-1: SerialNumber: syz [ 435.840823][ T5965] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 435.978576][ T917] cdc_acm 2-1:1.0: Control and data interfaces are not separated! [ 435.992413][ T5965] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 436.002748][ T917] cdc_acm 2-1:1.0: This needs exactly 3 endpoints [ 436.009514][ T917] cdc_acm 2-1:1.0: probe with driver cdc_acm failed with error -22 [ 436.024918][ T5965] usb 6-1: New USB device found, idVendor=1d34, idProduct=0004, bcdDevice= 0.00 [ 436.034021][ T5965] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 436.047134][ T5965] usb 6-1: config 0 descriptor?? [ 436.102883][T10752] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 436.141000][ T917] usb 2-1: USB disconnect, device number 53 [ 436.202308][T10752] veth0_vlan: entered promiscuous mode [ 436.240254][T10752] veth1_vlan: entered promiscuous mode [ 436.793521][ T5965] hid-led 0003:1D34:0004.003C: unknown main item tag 0x0 [ 436.807040][T10752] veth0_macvtap: entered promiscuous mode [ 436.813608][ T5965] hid-led 0003:1D34:0004.003C: probe with driver hid-led failed with error -71 [ 436.829740][T10752] veth1_macvtap: entered promiscuous mode [ 436.861310][ T5965] usb 6-1: USB disconnect, device number 32 [ 436.978211][T10752] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 437.000355][T10752] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 437.017234][T10752] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 437.034028][T10752] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 437.059350][T10752] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 437.068180][T10752] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 437.264793][ T771] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 437.316893][ T771] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 437.358931][ T1105] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 437.385903][ T1105] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 437.550926][T10908] netlink: 'syz.5.1351': attribute type 33 has an invalid length. [ 437.813810][ T30] audit: type=1804 audit(1751016456.923:860): pid=10909 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.5.1351" name="/newroot/225/file0" dev="tmpfs" ino=1216 res=1 errno=0 [ 439.591316][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.597611][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 439.607111][ T771] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 439.715353][ T12] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 440.020954][ T5965] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 440.187571][T10920] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1354'. [ 440.268603][ T3521] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 440.362603][ T5965] usb 6-1: Using ep0 maxpacket: 32 [ 440.500741][T10924] fuse: Bad value for 'group_id' [ 440.505831][T10924] fuse: Bad value for 'group_id' [ 440.639761][ T5965] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 440.671838][ T5965] usb 6-1: New USB device found, idVendor=041e, idProduct=403c, bcdDevice=cc.d7 [ 440.717868][ T5965] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 440.740712][ T5965] usb 6-1: config 0 descriptor?? [ 440.835319][ T3521] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 441.032248][ T5965] usb 6-1: USB disconnect, device number 33 [ 441.044367][ T3521] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 441.112308][ T3521] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 441.194782][ T3521] bridge_slave_1: left allmulticast mode [ 441.201250][ T3521] bridge_slave_1: left promiscuous mode [ 441.206899][ T3521] bridge0: port 2(bridge_slave_1) entered disabled state [ 441.216805][ T3521] bridge_slave_0: left allmulticast mode [ 441.222540][ T3521] bridge_slave_0: left promiscuous mode [ 441.229672][ T3521] bridge0: port 1(bridge_slave_0) entered disabled state [ 441.479905][ T3521] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 441.490698][ T3521] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 441.502604][ T3521] bond0 (unregistering): Released all slaves [ 441.749186][T10935] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1359'. [ 441.796231][T10937] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 442.393911][T10948] CUSE: unknown device info "KJ éH+ßãÛ¤2Lh¸änLþ1Õ`†CcÝòn§õ†îì8­¨×0º©®(À3Õ¶ië®â>f¡Çè_Ù®,°ð<Ö_e¤FÀÆ" [ 442.437986][T10948] CUSE: unknown device info "3ÜŸ•,²¥Ì˜õ" [ 442.454043][T10948] CUSE: unknown device info "Jô©Ð2S Zûü !e/ëÅúãõž‘­J½+-n´¸a4¼ßØÁDÿ|G$öó­5O~©q ´ƒ [ 442.454043][T10948] fð™£aìýzóÚr¹SAäx¡Ùjª½T¾Ç”¨åw— üæšxRÉQ÷®(hÒj pøVdY0¨Æ|M?2JÿúIšvö^RÎ@´å" [ 442.497863][T10948] CUSE: unknown device info "!ToÛ}Ý&|L+U²®oæõϲ±„Ð"–¨FstVµ:׌E• gJºî‹ÂÁ<@cÁ”²ûŽ4ÊT" [ 442.517890][T10948] CUSE: DEVNAME unspecified [ 442.590961][T10953] netlink: 'syz.1.1364': attribute type 33 has an invalid length. [ 442.604360][T10953] netlink: 152 bytes leftover after parsing attributes in process `syz.1.1364'. [ 442.631506][T10953] xt_CT: You must specify a L4 protocol and not use inversions on it [ 442.644848][ T3521] hsr_slave_0: left promiscuous mode [ 442.644917][T10953] binder: 10952:10953 ioctl c0306201 200000000640 returned -22 [ 442.668568][ T5830] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 442.670632][ T5830] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 442.671804][ T5830] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 442.673083][ T5830] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 442.673593][ T5830] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 442.701058][ T3521] hsr_slave_1: left promiscuous mode [ 442.719219][ T3521] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 442.727368][ T3521] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 442.735371][ T3521] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 442.743653][ T3521] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 442.763557][ T3521] veth1_macvtap: left promiscuous mode [ 442.770458][ T3521] veth0_macvtap: left promiscuous mode [ 442.776110][ T3521] veth1_vlan: left promiscuous mode [ 442.781507][ T3521] veth0_vlan: left promiscuous mode [ 442.798539][ T5950] usb 6-1: new high-speed USB device number 34 using dummy_hcd [ 442.960889][ T5950] usb 6-1: Using ep0 maxpacket: 8 [ 442.971826][ T5950] usb 6-1: New USB device found, idVendor=0bc3, idProduct=0001, bcdDevice=81.67 [ 442.991234][ T5950] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 443.008020][ T5950] usb 6-1: Product: syz [ 443.017806][ T5950] usb 6-1: Manufacturer: syz [ 443.023722][ T5950] usb 6-1: SerialNumber: syz [ 443.039998][ T5950] usb 6-1: config 0 descriptor?? [ 443.049962][ T5950] ipw 6-1:0.0: IPWireless converter converter detected [ 443.253838][ T5941] usb 6-1: USB disconnect, device number 34 [ 443.263757][ T5941] ipw 6-1:0.0: device disconnected [ 443.279685][ T3521] team0 (unregistering): Port device team_slave_1 removed [ 443.314407][ T3521] team0 (unregistering): Port device team_slave_0 removed [ 443.429239][ T5950] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 443.597997][ T5950] usb 2-1: Using ep0 maxpacket: 8 [ 443.607865][ T5950] usb 2-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 443.617100][ T5950] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 443.625415][ T5950] usb 2-1: Product: syz [ 443.629699][ T5950] usb 2-1: Manufacturer: syz [ 443.634308][ T5950] usb 2-1: SerialNumber: syz [ 443.641111][ T5950] usb 2-1: config 0 descriptor?? [ 443.719602][T10958] dummy0 speed is unknown, defaulting to 1000 [ 443.798971][T10977] netlink: 'syz.3.1370': attribute type 33 has an invalid length. [ 443.897305][ T30] audit: type=1804 audit(1751016463.183:861): pid=10979 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.3.1370" name="/newroot/273/file0" dev="tmpfs" ino=1458 res=1 errno=0 [ 444.708521][ T5829] Bluetooth: hci2: command tx timeout [ 444.842849][ T5950] dvb_usb_rtl28xxu 2-1:0.0: chip type detection failed -110 [ 444.869081][ T5950] dvb_usb_rtl28xxu 2-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -110 [ 445.009772][T10984] openvswitch: netlink: IPv4 tunnel dst address is zero [ 445.039008][T10985] random: crng reseeded on system resumption [ 445.186379][T10958] chnl_net:caif_netlink_parms(): no params data found [ 445.348913][T10475] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 445.362420][ T1160] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 446.313196][ T5864] usb 2-1: USB disconnect, device number 54 [ 446.350320][T11004] FAULT_INJECTION: forcing a failure. [ 446.350320][T11004] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 446.487968][T11004] CPU: 1 UID: 0 PID: 11004 Comm: syz.3.1376 Not tainted 6.16.0-rc3-syzkaller-00116-ge34a79b96ab9 #0 PREEMPT(full) [ 446.487996][T11004] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 446.488007][T11004] Call Trace: [ 446.488013][T11004] [ 446.488021][T11004] dump_stack_lvl+0x16c/0x1f0 [ 446.488051][T11004] should_fail_ex+0x512/0x640 [ 446.488078][T11004] should_fail_alloc_page+0xe7/0x130 [ 446.488104][T11004] prepare_alloc_pages+0x3c2/0x610 [ 446.488126][T11004] __alloc_frozen_pages_noprof+0x18b/0x23f0 [ 446.488156][T11004] ? __pfx_stack_trace_save+0x10/0x10 [ 446.488179][T11004] ? stack_depot_save_flags+0x28/0xa40 [ 446.488204][T11004] ? __alloc_frozen_pages_noprof+0x294/0x23f0 [ 446.488229][T11004] ? kasan_save_stack+0x42/0x60 [ 446.488250][T11004] ? kasan_save_stack+0x33/0x60 [ 446.488270][T11004] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 446.488291][T11004] ? __pmd_alloc+0xbf/0x930 [ 446.488306][T11004] ? handle_mm_fault+0x589/0xd10 [ 446.488324][T11004] ? exc_page_fault+0x5c/0xb0 [ 446.488345][T11004] ? asm_exc_page_fault+0x26/0x30 [ 446.488361][T11004] ? __put_user_4+0xd/0x20 [ 446.488384][T11004] ? sk_ioctl+0x1d0/0x360 [ 446.488401][T11004] ? pn_socket_ioctl+0x66/0x360 [ 446.488420][T11004] ? sock_do_ioctl+0x118/0x280 [ 446.488434][T11004] ? sock_ioctl+0x227/0x6b0 [ 446.488461][T11004] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 446.488483][T11004] ? policy_nodemask+0xea/0x4e0 [ 446.488525][T11004] alloc_pages_mpol+0x1fb/0x550 [ 446.488550][T11004] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 446.488572][T11004] ? css_rstat_updated+0x9d/0xd30 [ 446.488603][T11004] alloc_pages_noprof+0x131/0x390 [ 446.488633][T11004] pte_alloc_one+0x1c/0x3a0 [ 446.488651][T11004] __pte_alloc+0x6d/0x3c0 [ 446.488680][T11004] ? __pfx___pte_alloc+0x10/0x10 [ 446.488705][T11004] ? _raw_spin_unlock+0x28/0x50 [ 446.488725][T11004] ? __pmd_alloc+0x3fb/0x930 [ 446.488744][T11004] __handle_mm_fault+0x4358/0x5490 [ 446.488771][T11004] ? __pfx___handle_mm_fault+0x10/0x10 [ 446.488788][T11004] ? __pfx_mt_find+0x10/0x10 [ 446.488835][T11004] ? find_vma+0xbf/0x140 [ 446.488859][T11004] ? __pfx_find_vma+0x10/0x10 [ 446.488886][T11004] handle_mm_fault+0x589/0xd10 [ 446.488907][T11004] ? __pkru_allows_pkey+0x41/0xb0 [ 446.488932][T11004] do_user_addr_fault+0x7a6/0x1370 [ 446.488959][T11004] ? rcu_is_watching+0x12/0xc0 [ 446.488983][T11004] exc_page_fault+0x5c/0xb0 [ 446.489006][T11004] asm_exc_page_fault+0x26/0x30 [ 446.489023][T11004] RIP: 0010:__put_user_4+0xd/0x20 [ 446.489047][T11004] Code: 66 89 01 31 c9 0f 01 ca e9 d0 5a 03 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 89 cb 48 c1 fb 3f 48 09 d9 0f 01 cb <89> 01 31 c9 0f 01 ca c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90 90 [ 446.489063][T11004] RSP: 0018:ffffc900045bf9d8 EFLAGS: 00050202 [ 446.489078][T11004] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000200000000280 [ 446.489089][T11004] RDX: ffff88807a5d8000 RSI: ffffffff894fd434 RDI: ffffffff8c157ba0 [ 446.489099][T11004] RBP: 0000000000000000 R08: 3b8f596bbd88045d R09: 0000000000000000 [ 446.489110][T11004] R10: 0000000000000000 R11: 0000000000000001 R12: 0000200000000280 [ 446.489120][T11004] R13: 1ffff920008b7f3c R14: 000000000000541b R15: 0000000000000002 [ 446.489138][T11004] ? sk_ioctl+0x1c4/0x360 [ 446.489160][T11004] sk_ioctl+0x1d0/0x360 [ 446.489177][T11004] ? __pfx_sk_ioctl+0x10/0x10 [ 446.489203][T11004] pn_socket_ioctl+0x66/0x360 [ 446.489224][T11004] sock_do_ioctl+0x118/0x280 [ 446.489241][T11004] ? __pfx_sock_do_ioctl+0x10/0x10 [ 446.489269][T11004] ? kasan_quarantine_put+0x10a/0x240 [ 446.489292][T11004] sock_ioctl+0x227/0x6b0 [ 446.489311][T11004] ? __pfx_sock_ioctl+0x10/0x10 [ 446.489328][T11004] ? find_held_lock+0x2b/0x80 [ 446.489350][T11004] ? avc_has_perm_noaudit+0x117/0x3b0 [ 446.489383][T11004] ? avc_has_perm_noaudit+0x149/0x3b0 [ 446.489411][T11004] ? __pfx_sock_ioctl+0x10/0x10 [ 446.489430][T11004] do_vfs_ioctl+0x1542/0x1a60 [ 446.489450][T11004] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 446.489478][T11004] ? inode_has_perm+0x16f/0x1d0 [ 446.489496][T11004] ? file_has_perm+0x27d/0x350 [ 446.489515][T11004] ? __pfx_file_has_perm+0x10/0x10 [ 446.489531][T11004] ? find_held_lock+0x2b/0x80 [ 446.489559][T11004] ? selinux_file_ioctl+0xb4/0x270 [ 446.489588][T11004] __x64_sys_ioctl+0x114/0x210 [ 446.489609][T11004] do_syscall_64+0xcd/0x4c0 [ 446.489636][T11004] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 446.489653][T11004] RIP: 0033:0x7fac0678e929 [ 446.489667][T11004] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 446.489682][T11004] RSP: 002b:00007fac07587038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 446.489697][T11004] RAX: ffffffffffffffda RBX: 00007fac069b5fa0 RCX: 00007fac0678e929 [ 446.489707][T11004] RDX: 0000200000000280 RSI: 000000000000541b RDI: 0000000000000003 [ 446.489718][T11004] RBP: 00007fac07587090 R08: 0000000000000000 R09: 0000000000000000 [ 446.489728][T11004] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 446.489738][T11004] R13: 0000000000000000 R14: 00007fac069b5fa0 R15: 00007fffed3cb8d8 [ 446.489762][T11004] [ 447.068835][ T5829] Bluetooth: hci2: command tx timeout [ 447.174232][T10958] bridge0: port 1(bridge_slave_0) entered blocking state [ 447.181461][T10958] bridge0: port 1(bridge_slave_0) entered disabled state [ 447.188951][T10958] bridge_slave_0: entered allmulticast mode [ 447.196208][T10958] bridge_slave_0: entered promiscuous mode [ 447.204578][T10958] bridge0: port 2(bridge_slave_1) entered blocking state [ 447.211726][T10958] bridge0: port 2(bridge_slave_1) entered disabled state [ 447.219105][T10958] bridge_slave_1: entered allmulticast mode [ 447.225751][T10958] bridge_slave_1: entered promiscuous mode [ 447.389899][T10958] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 447.420144][T11017] netlink: 52 bytes leftover after parsing attributes in process `syz.5.1377'. [ 447.463284][T10958] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 447.521900][T11017] netlink: 14 bytes leftover after parsing attributes in process `syz.5.1377'. [ 447.532410][T11017] netlink: 52 bytes leftover after parsing attributes in process `syz.5.1377'. [ 447.544299][T11017] netlink: 14 bytes leftover after parsing attributes in process `syz.5.1377'. [ 447.553509][T11017] netlink: 52 bytes leftover after parsing attributes in process `syz.5.1377'. [ 447.794059][T10958] team0: Port device team_slave_0 added [ 447.823834][T10958] team0: Port device team_slave_1 added [ 448.170791][T11032] netlink: 'syz.4.1381': attribute type 33 has an invalid length. [ 448.829109][T10958] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 448.836080][T10958] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 448.862106][ T30] audit: type=1804 audit(1751016467.543:862): pid=11035 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.4.1381" name="/newroot/286/file0" dev="tmpfs" ino=1559 res=1 errno=0 [ 448.896896][T10958] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 448.944860][T11037] netlink: 'syz.3.1382': attribute type 33 has an invalid length. [ 448.984176][T10958] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 449.027456][T11041] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1384'. [ 449.034677][T10958] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 449.109424][ T5829] Bluetooth: hci2: command tx timeout [ 449.145669][T10958] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 449.148568][ T30] audit: type=1804 audit(1751016468.443:863): pid=11042 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.3.1382" name="/newroot/278/file0" dev="tmpfs" ino=1484 res=1 errno=0 [ 449.248495][ T5941] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 449.279239][T10958] hsr_slave_0: entered promiscuous mode [ 449.285629][T10958] hsr_slave_1: entered promiscuous mode [ 449.292089][T10958] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 449.299746][T10958] Cannot create hsr debugfs directory [ 449.335810][T11052] random: crng reseeded on system resumption [ 449.409126][ T5941] usb 6-1: Using ep0 maxpacket: 8 [ 449.421274][ T30] audit: type=1400 audit(1751016468.713:864): avc: denied { setopt } for pid=11049 comm="syz.3.1387" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 449.448340][ T5941] usb 6-1: New USB device found, idVendor=0bc3, idProduct=0001, bcdDevice=81.67 [ 449.462097][ T5941] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 449.475166][ T5941] usb 6-1: Product: syz [ 449.485460][ T5941] usb 6-1: Manufacturer: syz [ 449.490502][ T5941] usb 6-1: SerialNumber: syz [ 449.491929][T11056] FAULT_INJECTION: forcing a failure. [ 449.491929][T11056] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 449.499073][ T5941] usb 6-1: config 0 descriptor?? [ 449.520259][ T5941] ipw 6-1:0.0: IPWireless converter converter detected [ 449.532940][T11056] CPU: 1 UID: 0 PID: 11056 Comm: syz.1.1388 Not tainted 6.16.0-rc3-syzkaller-00116-ge34a79b96ab9 #0 PREEMPT(full) [ 449.532966][T11056] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 449.532973][T11056] Call Trace: [ 449.532976][T11056] [ 449.532981][T11056] dump_stack_lvl+0x16c/0x1f0 [ 449.533000][T11056] should_fail_ex+0x512/0x640 [ 449.533017][T11056] _copy_from_user+0x2e/0xd0 [ 449.533032][T11056] restore_sigcontext+0xcb/0x6a0 [ 449.533045][T11056] ? __pfx_restore_sigcontext+0x10/0x10 [ 449.533067][T11056] ? __pfx_restore_altstack+0x10/0x10 [ 449.533085][T11056] ? _raw_spin_unlock_irq+0x23/0x50 [ 449.533098][T11056] ? lockdep_hardirqs_on+0x7c/0x110 [ 449.533115][T11056] __do_sys_rt_sigreturn+0x1bb/0x230 [ 449.533127][T11056] ? __pfx___do_sys_rt_sigreturn+0x10/0x10 [ 449.533144][T11056] do_syscall_64+0xcd/0x4c0 [ 449.533161][T11056] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 449.533172][T11056] RIP: 0033:0x7fb59192ab19 [ 449.533181][T11056] Code: 64 c7 00 16 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 90 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 c7 c0 0f 00 00 00 0f 05 <0f> 1f 80 00 00 00 00 48 81 ec 48 01 00 00 49 89 d0 64 48 8b 04 25 [ 449.533192][T11056] RSP: 002b:00007fb592833340 EFLAGS: 00000206 ORIG_RAX: 000000000000000f [ 449.533202][T11056] RAX: ffffffffffffffda RBX: 00007fb591bb6160 RCX: 00007fb59192ab19 [ 449.533209][T11056] RDX: 00007fb592833340 RSI: 00007fb592833470 RDI: 0000000000000021 [ 449.533215][T11056] RBP: 00007fb592834090 R08: 0000000000000000 R09: 0000000000000000 [ 449.533221][T11056] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000002 [ 449.533227][T11056] R13: 0000000000000000 R14: 00007fb591bb6160 R15: 00007ffc0b99f908 [ 449.533240][T11056] [ 449.723552][ T5941] usb 6-1: USB disconnect, device number 35 [ 449.730101][ T5941] ipw 6-1:0.0: device disconnected [ 449.778022][ T5864] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 449.851177][T10958] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 449.860066][T10958] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 449.869122][T10958] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 449.879885][T10958] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 449.936325][T10958] 8021q: adding VLAN 0 to HW filter on device bond0 [ 449.951591][T10958] 8021q: adding VLAN 0 to HW filter on device team0 [ 449.960405][ T5864] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 449.973259][ T5864] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 449.986312][ T54] bridge0: port 1(bridge_slave_0) entered blocking state [ 449.987930][ T5864] usb 4-1: New USB device found, idVendor=1d34, idProduct=0004, bcdDevice= 0.00 [ 449.993462][ T54] bridge0: port 1(bridge_slave_0) entered forwarding state [ 450.003216][ T5864] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 450.021687][ T5864] usb 4-1: config 0 descriptor?? [ 450.032997][ T64] bridge0: port 2(bridge_slave_1) entered blocking state [ 450.040122][ T64] bridge0: port 2(bridge_slave_1) entered forwarding state [ 451.110238][ T3521] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 451.110238][ T1160] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 451.148635][ T5864] hid-led 0003:1D34:0004.003D: unknown main item tag 0x0 [ 451.158386][ T5864] hid-led 0003:1D34:0004.003D: probe with driver hid-led failed with error -71 [ 451.171959][ T5864] usb 4-1: USB disconnect, device number 46 [ 451.175654][T10958] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 451.192327][ T5829] Bluetooth: hci2: command tx timeout [ 451.247399][T10958] veth0_vlan: entered promiscuous mode [ 451.274464][T10958] veth1_vlan: entered promiscuous mode [ 451.320366][T10958] veth0_macvtap: entered promiscuous mode [ 451.334235][T10958] veth1_macvtap: entered promiscuous mode [ 451.356183][T10958] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 451.373084][T10958] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 451.397166][T10958] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 451.419656][T10958] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 451.435231][T10958] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 451.451135][T10958] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 451.574880][ T1160] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 451.595324][ T1160] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 451.665968][T11090] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1396'. [ 451.693589][T11091] Bluetooth: hci0: service_discovery: expected 4 bytes, got 7 bytes [ 451.698536][ T64] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 451.718098][ T64] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 451.890234][T11095] x_tables: ip_tables: osf match: only valid for protocol 6 [ 451.944794][T11097] netlink: 'syz.3.1398': attribute type 33 has an invalid length. [ 452.061760][ T30] audit: type=1804 audit(1751016471.343:865): pid=11098 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.3.1398" name="/newroot/283/file0" dev="tmpfs" ino=1512 res=1 errno=0 [ 452.219471][ T5965] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 452.878959][ T5965] usb 5-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 452.891634][ T5965] usb 5-1: config 0 interface 0 has no altsetting 0 [ 452.901616][ T5965] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 452.917920][ T5965] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 452.951008][T11105] random: crng reseeded on system resumption [ 452.965420][ T5965] usb 5-1: Product: syz [ 452.981928][ T5965] usb 5-1: Manufacturer: syz [ 453.001904][ T5965] usb 5-1: SerialNumber: syz [ 453.022929][ T5965] usb 5-1: config 0 descriptor?? [ 453.053314][ T5965] usb 5-1: selecting invalid altsetting 0 [ 453.071117][ T12] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 453.292864][ T5941] usb 5-1: USB disconnect, device number 63 [ 453.845926][ T12] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 453.901541][ T12] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 454.583186][T11119] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 454.758108][T11120] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 454.852229][ T12] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 454.968110][ T5965] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 455.077978][ T5871] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 455.219174][ T5965] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 455.238433][ T5871] usb 5-1: Using ep0 maxpacket: 16 [ 455.238517][ T5965] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 455.290482][ T5871] usb 5-1: config 1 interface 0 altsetting 255 endpoint 0x1 has invalid wMaxPacketSize 0 [ 455.351880][ T5871] usb 5-1: config 1 interface 0 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 0 [ 455.370728][ T5965] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 455.380725][ T12] bridge_slave_1: left allmulticast mode [ 455.386348][ T12] bridge_slave_1: left promiscuous mode [ 455.407236][ T5965] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 455.423108][ T5871] usb 5-1: config 1 interface 0 altsetting 255 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 455.424846][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 455.443557][ T5871] usb 5-1: config 1 interface 0 has no altsetting 0 [ 455.456058][ T5871] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 455.492975][ T5871] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 455.527273][ T5830] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 455.573096][ T5830] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 455.587092][ T5830] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 455.597782][ T5871] usb 5-1: Product: syz [ 455.597937][ T5965] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 455.615407][ T5871] usb 5-1: Manufacturer: syz [ 455.623020][ T5871] usb 5-1: SerialNumber: syz [ 455.629203][ T5830] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 455.679016][ T5830] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 455.745810][ T5965] usb 4-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 455.771730][ T12] bridge_slave_0: left allmulticast mode [ 455.778205][ T12] bridge_slave_0: left promiscuous mode [ 455.786496][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 455.845950][ T5965] usb 4-1: Manufacturer: syz [ 455.957008][ T5871] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 64 if 0 alt 255 proto 1 vid 0x0525 pid 0xA4A8 [ 455.958365][ T5965] usb 4-1: config 0 descriptor?? [ 456.704519][T11120] iommufd_mock iommufd_mock2: Adding to iommu group 2 [ 456.713623][ T5965] appleir 0003:05AC:8243.003E: unknown main item tag 0x0 [ 456.720841][ T5926] usb 2-1: new full-speed USB device number 55 using dummy_hcd [ 456.729374][ T5965] appleir 0003:05AC:8243.003E: No inputs registered, leaving [ 456.744064][ T5965] appleir 0003:05AC:8243.003E: hiddev1,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.3-1/input0 [ 456.767642][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 456.782982][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 456.801695][ T12] bond0 (unregistering): Released all slaves [ 456.843489][T11131] dummy0 speed is unknown, defaulting to 1000 [ 456.870833][ T1105] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 456.882236][ T64] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 456.894406][ T5926] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 456.914854][ T5926] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 457.034218][ T5926] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 457.070843][ T5926] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 457.094013][ T5926] usb 2-1: SerialNumber: syz [ 457.113869][ T5926] usb 2-1: 0:2 : does not exist [ 457.117225][T11131] chnl_net:caif_netlink_parms(): no params data found [ 457.137656][T11147] random: crng reseeded on system resumption [ 457.277377][T11131] bridge0: port 1(bridge_slave_0) entered blocking state [ 457.286335][T11131] bridge0: port 1(bridge_slave_0) entered disabled state [ 457.301983][T11131] bridge_slave_0: entered allmulticast mode [ 457.311876][T11131] bridge_slave_0: entered promiscuous mode [ 457.332367][ T12] hsr_slave_0: left promiscuous mode [ 457.341442][ T12] hsr_slave_1: left promiscuous mode [ 457.347486][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 457.361038][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 457.372223][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 457.381439][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 457.405013][ T12] veth1_macvtap: left promiscuous mode [ 457.410960][ T12] veth0_macvtap: left promiscuous mode [ 457.416701][ T12] veth1_vlan: left promiscuous mode [ 457.422149][ T12] veth0_vlan: left promiscuous mode [ 457.448002][ T5871] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 457.611352][ T5871] usb 6-1: Using ep0 maxpacket: 32 [ 457.618057][ T5871] usb 6-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 457.633456][T11152] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 457.640800][ T5871] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 457.655301][ T5871] usb 6-1: config 0 descriptor?? [ 457.658064][T11152] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 457.673583][ T5871] as10x_usb: device has been detected [ 457.697379][ T5871] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 457.736128][ T5871] usb 6-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 457.759363][ T5830] Bluetooth: hci2: command tx timeout [ 457.768706][ T5871] as10x_usb: error during firmware upload part1 [ 457.775179][ T5871] Registered device nBox DVB-T Dongle [ 457.859732][ T5950] usb 5-1: USB disconnect, device number 64 [ 457.881608][ T5950] usblp0: removed [ 457.886169][ T5871] usb 4-1: USB disconnect, device number 47 [ 457.893280][T11109] ALSA: mixer_oss: invalid OSS volume '' [ 458.045563][ T30] audit: type=1400 audit(1751016477.243:866): avc: denied { write } for pid=11153 comm="syz.4.1413" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 458.460882][ T12] team0 (unregistering): Port device team_slave_1 removed [ 458.499665][ T12] team0 (unregistering): Port device team_slave_0 removed [ 458.837141][T11131] bridge0: port 2(bridge_slave_1) entered blocking state [ 458.844802][T11131] bridge0: port 2(bridge_slave_1) entered disabled state [ 458.853600][T11131] bridge_slave_1: entered allmulticast mode [ 458.863142][T11131] bridge_slave_1: entered promiscuous mode [ 458.925198][T11131] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 458.940421][T11131] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 459.030947][T11131] team0: Port device team_slave_0 added [ 459.048408][T11131] team0: Port device team_slave_1 added [ 459.682282][ T5871] usb 2-1: USB disconnect, device number 55 [ 459.848736][ T5830] Bluetooth: hci2: command tx timeout [ 460.017018][T11131] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 460.026278][T11131] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 460.075212][T11131] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 460.098436][T11131] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 460.103274][ T5950] usb 6-1: USB disconnect, device number 36 [ 460.105413][T11131] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 460.144865][T11131] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 460.172429][ T5950] Unregistered device nBox DVB-T Dongle [ 460.184310][ T5950] as10x_usb: device has been disconnected [ 460.211360][T11177] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1422'. [ 460.282007][T11131] hsr_slave_0: entered promiscuous mode [ 460.290211][T11131] hsr_slave_1: entered promiscuous mode [ 460.317485][T11131] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 460.325475][T11131] Cannot create hsr debugfs directory [ 460.507841][ T5950] usb 6-1: new full-speed USB device number 37 using dummy_hcd [ 460.593321][T11190] Invalid ELF header magic: != ELF [ 460.629739][ T30] audit: type=1400 audit(1751016479.883:867): avc: denied { setattr } for pid=11187 comm="syz.4.1424" name="ptype" dev="proc" ino=4026532814 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 460.671866][ T5950] usb 6-1: config index 0 descriptor too short (expected 156, got 27) [ 460.680353][ T5950] usb 6-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 460.691589][ T5926] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 460.694167][ T30] audit: type=1400 audit(1751016479.883:868): avc: denied { module_load } for pid=11187 comm="syz.4.1424" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 460.724020][ T5950] usb 6-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 10 [ 460.735725][ T5950] usb 6-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 460.754009][ T5950] usb 6-1: config 0 interface 0 has no altsetting 0 [ 460.767256][ T5950] usb 6-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 460.779072][ T5950] usb 6-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 460.787615][ T5950] usb 6-1: Product: syz [ 460.793842][ T5950] usb 6-1: Manufacturer: syz [ 460.799291][ T5950] usb 6-1: SerialNumber: syz [ 460.835133][ T5950] usb 6-1: config 0 descriptor?? [ 460.844111][ T5950] ldusb 6-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 460.897292][ T5950] ldusb 6-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 460.913688][ T5926] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 460.932536][ T5926] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 461.251767][ T5926] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 461.262267][ T5926] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 461.276460][ T5926] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 461.285772][ T5926] usb 4-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 461.293852][ T5926] usb 4-1: Manufacturer: syz [ 461.315008][ T5926] usb 4-1: config 0 descriptor?? [ 461.568526][T11131] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 461.591239][T11131] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 461.623159][T11131] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 461.649123][T11131] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 461.726118][ T5926] appleir 0003:05AC:8243.003F: unknown main item tag 0x0 [ 461.733698][ T5926] appleir 0003:05AC:8243.003F: No inputs registered, leaving [ 461.764882][ T5926] appleir 0003:05AC:8243.003F: hiddev1,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.3-1/input0 [ 461.903930][T11131] 8021q: adding VLAN 0 to HW filter on device bond0 [ 461.907991][ T5830] Bluetooth: hci2: command tx timeout [ 461.967598][T11131] 8021q: adding VLAN 0 to HW filter on device team0 [ 461.988989][ T12] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 462.047860][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 462.054989][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 462.154697][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 462.161817][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 462.462834][T11210] random: crng reseeded on system resumption [ 462.628671][ T64] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 462.739907][T11131] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 462.849404][T11131] veth0_vlan: entered promiscuous mode [ 462.884222][T11131] veth1_vlan: entered promiscuous mode [ 462.965999][T11131] veth0_macvtap: entered promiscuous mode [ 463.004998][T11131] veth1_macvtap: entered promiscuous mode [ 463.076965][T11131] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 463.278532][T11185] ALSA: mixer_oss: invalid OSS volume '' [ 463.288843][ T5871] usb 6-1: USB disconnect, device number 37 [ 463.296161][ T5871] ldusb 6-1:0.0: LD USB Device #0 now disconnected [ 463.302750][ T5950] usb 4-1: USB disconnect, device number 48 [ 463.414303][T11131] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 463.446652][T11131] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 463.508167][T11131] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 463.521410][T11131] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 463.534744][T11131] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 464.074839][ T5830] Bluetooth: hci2: command tx timeout [ 464.904324][ T771] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 464.917846][ T771] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 464.994267][ T1105] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 465.014430][ T1105] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 465.109488][T11240] netlink: 'syz.5.1435': attribute type 39 has an invalid length. [ 465.197339][T11243] x_tables: ip_tables: osf match: only valid for protocol 6 [ 465.308486][T11240] veth0_macvtap: left promiscuous mode [ 465.363032][T11245] CUSE: unknown device info "KJ éH+ßãÛ¤2Lh¸änLþ1Õ`†CcÝòn§õ†îì8­¨×0º©®(À3Õ¶ië®â>f¡Çè_Ù®,°ð<Ö_e¤FÀÆ" [ 465.400058][T11245] CUSE: unknown device info "3ÜŸ•,²¥Ì˜õ" [ 465.405974][T11245] CUSE: unknown device info "Jô©Ð2S Zûü !e/ëÅúãõž‘­J½+-n´¸a4¼ßØÁDÿ|G$öó­5O~©q ´ƒ [ 465.405974][T11245] fð™£aìýzóÚr¹SAäx¡Ùjª½T¾Ç”¨åw— üæšxRÉQ÷®(hÒj pøVdY0¨Æ|M?2JÿúIšvö^RÎ@´å" [ 465.424979][T11245] CUSE: unknown device info "!ToÛ}Ý&|L+U²®oæõϲ±„Ð"–¨FstVµ:׌E• gJºî‹ÂÁ<@cÁ”²ûŽ4ÊTáM" [ 465.435828][T11245] CUSE: DEVNAME unspecified [ 465.450410][ T5941] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 465.633411][ T5941] usb 2-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 465.643960][ T5941] usb 2-1: config 0 interface 0 has no altsetting 0 [ 465.655823][ T5941] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 465.666515][ T5941] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 465.683149][ T5941] usb 2-1: Product: syz [ 465.687355][ T5941] usb 2-1: Manufacturer: syz [ 465.693632][ T5941] usb 2-1: SerialNumber: syz [ 465.702232][ T5941] usb 2-1: config 0 descriptor?? [ 465.711119][ T5941] usb 2-1: selecting invalid altsetting 0 [ 465.828563][ T5871] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 465.893352][ T771] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 465.961013][ T917] usb 2-1: USB disconnect, device number 56 [ 465.978217][ T30] audit: type=1326 audit(1751016485.263:869): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11253 comm="syz.5.1440" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcacc38e929 code=0x7ffc0000 [ 466.020138][ T30] audit: type=1326 audit(1751016485.303:870): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11253 comm="syz.5.1440" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcacc38e929 code=0x7ffc0000 [ 466.036872][ T5871] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 466.044770][ T30] audit: type=1326 audit(1751016485.303:871): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11253 comm="syz.5.1440" exe="/root/syz-executor" sig=0 arch=c000003e syscall=425 compat=0 ip=0x7fcacc38e929 code=0x7ffc0000 [ 466.079131][ T5871] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 466.102038][ T5871] usb 5-1: New USB device found, idVendor=1d34, idProduct=0004, bcdDevice= 0.00 [ 466.115130][ T5871] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 466.137076][ T771] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 466.140865][ T30] audit: type=1326 audit(1751016485.303:872): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11253 comm="syz.5.1440" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcacc38e929 code=0x7ffc0000 [ 466.173124][ T5871] usb 5-1: config 0 descriptor?? [ 466.176539][ T30] audit: type=1326 audit(1751016485.303:873): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11253 comm="syz.5.1440" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcacc38e929 code=0x7ffc0000 [ 466.204667][ T30] audit: type=1326 audit(1751016485.303:874): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11253 comm="syz.5.1440" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fcacc38e929 code=0x7ffc0000 [ 466.231038][ T30] audit: type=1326 audit(1751016485.303:875): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11253 comm="syz.5.1440" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcacc38e929 code=0x7ffc0000 [ 466.257093][ T30] audit: type=1326 audit(1751016485.303:876): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11253 comm="syz.5.1440" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcacc38e929 code=0x7ffc0000 [ 466.281989][ T30] audit: type=1326 audit(1751016485.313:877): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11253 comm="syz.5.1440" exe="/root/syz-executor" sig=0 arch=c000003e syscall=49 compat=0 ip=0x7fcacc38e929 code=0x7ffc0000 [ 466.305477][ T30] audit: type=1400 audit(1751016485.313:878): avc: denied { bind } for pid=11253 comm="syz.5.1440" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 466.364577][ T771] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 466.424371][ T771] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 466.500593][ T771] bridge_slave_1: left allmulticast mode [ 466.506264][ T771] bridge_slave_1: left promiscuous mode [ 466.512154][ T771] bridge0: port 2(bridge_slave_1) entered disabled state [ 466.523993][ T771] bridge_slave_0: left allmulticast mode [ 466.531900][ T771] bridge_slave_0: left promiscuous mode [ 466.537677][ T771] bridge0: port 1(bridge_slave_0) entered disabled state [ 466.613660][ T5871] hid-led 0003:1D34:0004.0040: unknown main item tag 0x0 [ 466.804157][ T5871] hid-led 0003:1D34:0004.0040: probe with driver hid-led failed with error -71 [ 466.816719][ T5871] usb 5-1: USB disconnect, device number 65 [ 466.893662][ T771] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 466.904909][ T771] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 466.914858][ T771] bond0 (unregistering): Released all slaves [ 467.108773][ T12] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 467.195505][ T5829] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 467.207423][ T5829] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 467.218689][ T5829] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 467.226914][ T5829] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 467.238561][ T5829] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 467.248991][ T771] hsr_slave_0: left promiscuous mode [ 467.255003][ T771] hsr_slave_1: left promiscuous mode [ 467.262368][ T771] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 467.270827][ T771] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 467.279085][ T5871] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 467.279160][ T771] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 467.294237][ T771] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 467.312540][ T771] veth1_macvtap: left promiscuous mode [ 467.318220][ T771] veth0_macvtap: left promiscuous mode [ 467.325043][ T771] veth1_vlan: left promiscuous mode [ 467.327986][ T917] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 467.331154][ T771] veth0_vlan: left promiscuous mode [ 467.430029][ T5871] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 467.455736][ T5871] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 467.492051][ T917] usb 6-1: Using ep0 maxpacket: 8 [ 467.504930][ T5871] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 467.536289][ T5871] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 467.554978][ T917] usb 6-1: New USB device found, idVendor=0bc3, idProduct=0001, bcdDevice=81.67 [ 467.589764][ T917] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 467.642265][ T917] usb 6-1: Product: syz [ 467.672704][T11258] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 467.680765][ T917] usb 6-1: Manufacturer: syz [ 467.724491][ T917] usb 6-1: SerialNumber: syz [ 467.748805][ T12] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 467.837358][ T5871] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 467.891011][ T917] usb 6-1: config 0 descriptor?? [ 468.044655][ T917] ipw 6-1:0.0: IPWireless converter converter detected [ 468.277927][ T5864] usb 6-1: USB disconnect, device number 38 [ 468.287851][ T5864] ipw 6-1:0.0: device disconnected [ 468.396535][ T917] usb 2-1: USB disconnect, device number 57 [ 468.568226][T11269] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 468.575474][T11269] IPv6: NLM_F_CREATE should be set when creating new route [ 468.729950][T11277] netlink: 256 bytes leftover after parsing attributes in process `syz.3.1447'. [ 468.991476][ T771] team0 (unregistering): Port device team_slave_1 removed [ 469.028077][ T771] team0 (unregistering): Port device team_slave_0 removed [ 469.140773][ T5864] usb 6-1: new high-speed USB device number 39 using dummy_hcd [ 469.268723][ T5829] Bluetooth: hci2: command tx timeout [ 469.297856][ T5864] usb 6-1: Using ep0 maxpacket: 32 [ 469.304926][ T5864] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 469.318327][ T5864] usb 6-1: New USB device found, idVendor=1b96, idProduct=000a, bcdDevice= 0.00 [ 469.327493][ T5864] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 469.346290][ T5864] usb 6-1: config 0 descriptor?? [ 469.609452][T11291] loop4: detected capacity change from 0 to 7 [ 469.631210][T11291] FAULT_INJECTION: forcing a failure. [ 469.631210][T11291] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 469.672413][T11291] CPU: 0 UID: 0 PID: 11291 Comm: syz.4.1452 Not tainted 6.16.0-rc3-syzkaller-00116-ge34a79b96ab9 #0 PREEMPT(full) [ 469.672443][T11291] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 469.672453][T11291] Call Trace: [ 469.672459][T11291] [ 469.672466][T11291] dump_stack_lvl+0x16c/0x1f0 [ 469.672499][T11291] should_fail_ex+0x512/0x640 [ 469.672526][T11291] should_fail_alloc_page+0xe7/0x130 [ 469.672554][T11291] prepare_alloc_pages+0x3c2/0x610 [ 469.672580][T11291] __alloc_frozen_pages_noprof+0x18b/0x23f0 [ 469.672606][T11291] ? look_up_lock_class+0x6b/0x150 [ 469.672631][T11291] ? register_lock_class+0x41/0x4c0 [ 469.672657][T11291] ? find_held_lock+0x2b/0x80 [ 469.672677][T11291] ? ima_match_policy+0x7ed/0x22d0 [ 469.672697][T11291] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 469.672719][T11291] ? __lock_acquire+0xb8a/0x1c90 [ 469.672759][T11291] ? __lock_acquire+0x622/0x1c90 [ 469.672784][T11291] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 469.672807][T11291] ? policy_nodemask+0xea/0x4e0 [ 469.672834][T11291] alloc_pages_mpol+0x1fb/0x550 [ 469.672859][T11291] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 469.672886][T11291] ? filemap_get_entry+0x1a7/0x3b0 [ 469.672915][T11291] folio_alloc_noprof+0x20/0x2d0 [ 469.672932][T11291] filemap_alloc_folio_noprof+0x3a1/0x470 [ 469.672954][T11291] ? __pfx_filemap_alloc_folio_noprof+0x10/0x10 [ 469.672974][T11291] ? __lock_acquire+0x622/0x1c90 [ 469.673004][T11291] __filemap_get_folio+0x5e1/0xc30 [ 469.673035][T11291] iomap_write_begin+0x914/0x1840 [ 469.673060][T11291] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 469.673084][T11291] ? is_bpf_text_address+0x94/0x1a0 [ 469.673105][T11291] ? __pfx_iomap_write_begin+0x10/0x10 [ 469.673121][T11291] ? fault_in_readable+0x179/0x1d0 [ 469.673147][T11291] ? __pfx_fault_in_readable+0x10/0x10 [ 469.673170][T11291] ? rcu_is_watching+0x12/0xc0 [ 469.673190][T11291] ? I_BDEV+0xd/0x20 [ 469.673214][T11291] ? inode_to_bdi+0x9e/0x160 [ 469.673244][T11291] iomap_file_buffered_write+0x49f/0xaf0 [ 469.673273][T11291] ? __pfx_iomap_file_buffered_write+0x10/0x10 [ 469.673320][T11291] ? __pfx_down_read+0x10/0x10 [ 469.673336][T11291] ? preempt_count_add+0x76/0x150 [ 469.673355][T11291] ? mnt_put_write_access_file+0xc1/0xf0 [ 469.673381][T11291] blkdev_write_iter+0x56f/0xdf0 [ 469.673409][T11291] vfs_write+0x6c4/0x1150 [ 469.673432][T11291] ? __pfx_blkdev_write_iter+0x10/0x10 [ 469.673457][T11291] ? __pfx_vfs_write+0x10/0x10 [ 469.673476][T11291] ? find_held_lock+0x2b/0x80 [ 469.673512][T11291] ksys_write+0x12a/0x250 [ 469.673533][T11291] ? __pfx_ksys_write+0x10/0x10 [ 469.673562][T11291] do_syscall_64+0xcd/0x4c0 [ 469.673594][T11291] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 469.673611][T11291] RIP: 0033:0x7fd76c18e929 [ 469.673626][T11291] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 469.673642][T11291] RSP: 002b:00007fd76d02a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 469.673659][T11291] RAX: ffffffffffffffda RBX: 00007fd76c3b5fa0 RCX: 00007fd76c18e929 [ 469.673670][T11291] RDX: 0000000000000050 RSI: 00002000000000c0 RDI: 0000000000000004 [ 469.673680][T11291] RBP: 00007fd76d02a090 R08: 0000000000000000 R09: 0000000000000000 [ 469.673690][T11291] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 469.673699][T11291] R13: 0000000000000000 R14: 00007fd76c3b5fa0 R15: 00007fff34911988 [ 469.673723][T11291] [ 470.042226][ T5864] ntrig 0003:1B96:000A.0041: unknown main item tag 0x0 [ 470.054813][ T5864] ntrig 0003:1B96:000A.0041: unknown main item tag 0x0 [ 470.064143][ T5864] ntrig 0003:1B96:000A.0041: hidraw0: USB HID v0.00 Device [HID 1b96:000a] on usb-dummy_hcd.5-1/input0 [ 470.166506][T11294] x_tables: ip_tables: osf match: only valid for protocol 6 [ 470.336081][T11261] dummy0 speed is unknown, defaulting to 1000 [ 470.347073][ T5864] ntrig 0003:1B96:000A.0041: Firmware version: 0.1.27.36.0 (0730 806c) [ 470.418246][ T5926] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 470.570093][T11261] chnl_net:caif_netlink_parms(): no params data found [ 471.017038][ T5864] usb 6-1: USB disconnect, device number 39 [ 471.026463][ T5926] usb 2-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 471.087200][ T5926] usb 2-1: config 0 interface 0 has no altsetting 0 [ 471.120028][ T5926] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 471.132916][ T5926] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 471.142409][ T5926] usb 2-1: Product: syz [ 471.146607][ T5926] usb 2-1: Manufacturer: syz [ 471.151460][ T5926] usb 2-1: SerialNumber: syz [ 471.161044][ T5926] usb 2-1: config 0 descriptor?? [ 471.171655][ T5926] usb 2-1: selecting invalid altsetting 0 [ 471.349123][ T5829] Bluetooth: hci2: command tx timeout [ 471.351500][T11261] bridge0: port 1(bridge_slave_0) entered blocking state [ 471.382451][ T5965] usb 2-1: USB disconnect, device number 58 [ 471.920298][T11261] bridge0: port 1(bridge_slave_0) entered disabled state [ 472.007973][T11261] bridge_slave_0: entered allmulticast mode [ 472.132077][T11261] bridge_slave_0: entered promiscuous mode [ 472.217089][T11261] bridge0: port 2(bridge_slave_1) entered blocking state [ 472.246164][T11261] bridge0: port 2(bridge_slave_1) entered disabled state [ 472.254281][T11261] bridge_slave_1: entered allmulticast mode [ 472.266988][T11261] bridge_slave_1: entered promiscuous mode [ 472.548280][T11261] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 472.710412][T11328] netlink: 'syz.5.1459': attribute type 1 has an invalid length. [ 472.783029][T11261] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 472.872457][ T12] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 473.274424][T11331] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1459'. [ 473.375546][T11329] netdevsim netdevsim5 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 473.385887][T11329] netdevsim netdevsim5 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 473.397101][T11329] netdevsim netdevsim5 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 473.406010][T11329] netdevsim netdevsim5 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 473.420971][T11329] bond1: (slave geneve2): making interface the new active one [ 473.427844][ T5829] Bluetooth: hci2: command tx timeout [ 473.450401][T11329] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 473.467354][T11331] 8021q: adding VLAN 0 to HW filter on device bond1 [ 473.482047][T11261] team0: Port device team_slave_0 added [ 473.491226][T11261] team0: Port device team_slave_1 added [ 473.509772][T10565] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 473.673087][T11261] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 473.680417][T11261] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 473.707418][T11261] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 473.731584][T11261] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 473.738833][T11261] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 473.765651][T11261] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 474.109168][T11261] hsr_slave_0: entered promiscuous mode [ 474.115697][T11261] hsr_slave_1: entered promiscuous mode [ 474.124309][T11261] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 474.136695][T11261] Cannot create hsr debugfs directory [ 474.884508][ T5871] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 475.326266][ T5871] usb 6-1: Using ep0 maxpacket: 32 [ 475.433298][ T5871] usb 6-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 475.507779][ T5829] Bluetooth: hci2: command tx timeout [ 475.614418][ T5871] usb 6-1: New USB device found, idVendor=3344, idProduct=22f0, bcdDevice=ef.4d [ 475.653641][ T5871] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 475.711661][ T5871] usb 6-1: Product: syz [ 475.715864][ T5871] usb 6-1: Manufacturer: syz [ 475.737065][ T5871] usb 6-1: SerialNumber: syz [ 476.302520][T11360] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 476.685659][T11360] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 476.699261][ T5871] usb 6-1: selecting invalid altsetting 1 [ 476.737953][ T5871] LME2510(C): Firmware Status: 00 00 00 00 00 00 [ 476.738045][ T5871] dvb_usb_lmedm04 6-1:2.0: probe with driver dvb_usb_lmedm04 failed with error -22 [ 476.765554][ T5871] usb 6-1: USB disconnect, device number 40 [ 477.305611][T11261] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 477.330386][T11261] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 477.345955][T11261] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 477.363541][T11261] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 477.564855][T11396] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 477.641388][T11261] 8021q: adding VLAN 0 to HW filter on device bond0 [ 477.660183][T11261] 8021q: adding VLAN 0 to HW filter on device team0 [ 477.696182][T11405] xt_hashlimit: size too large, truncated to 1048576 [ 477.758305][T11261] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 477.778044][T11261] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 477.803226][ T1160] bridge0: port 1(bridge_slave_0) entered blocking state [ 477.811555][ T1160] bridge0: port 1(bridge_slave_0) entered forwarding state [ 477.821407][ T1160] bridge0: port 2(bridge_slave_1) entered blocking state [ 477.828562][ T1160] bridge0: port 2(bridge_slave_1) entered forwarding state [ 478.629408][ T36] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 478.667499][T11420] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1483'. [ 478.823376][T11261] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 479.024193][T11420] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1483'. [ 479.607673][ T13] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 479.653300][T11425] dummy0 speed is unknown, defaulting to 1000 [ 479.751984][T11261] veth0_vlan: entered promiscuous mode [ 479.770013][T11261] veth1_vlan: entered promiscuous mode [ 479.888356][ T5950] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 480.163955][T11439] netlink: 168 bytes leftover after parsing attributes in process `syz.5.1486'. [ 480.174630][ T5950] usb 2-1: Using ep0 maxpacket: 16 [ 480.181482][ T5950] usb 2-1: config 0 has no interfaces? [ 480.188180][ T30] kauditd_printk_skb: 25 callbacks suppressed [ 480.188209][ T30] audit: type=1400 audit(1751016499.453:904): avc: denied { setopt } for pid=11428 comm="syz.5.1486" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 480.206492][ T5950] usb 2-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ec.7e [ 480.228258][T11261] veth0_macvtap: entered promiscuous mode [ 480.277253][T11261] veth1_macvtap: entered promiscuous mode [ 480.301193][ T5950] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 480.302115][T11261] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 480.321398][ T5950] usb 2-1: Product: syz [ 480.326626][ T5950] usb 2-1: Manufacturer: syz [ 480.333502][ T5950] usb 2-1: SerialNumber: syz [ 480.433922][ T5950] usb 2-1: config 0 descriptor?? [ 480.445545][T11261] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 480.541598][T11261] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 480.552719][T11261] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 480.568101][T11261] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 480.679944][T11261] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 480.838748][ T5864] usb 2-1: USB disconnect, device number 59 [ 480.927605][T11450] Context (ID=0x0) not attached to queue pair (handle=0x4d9:0x0) [ 481.082427][ T771] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 481.097986][ T5926] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 481.152342][ T771] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 481.205850][ T64] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 481.270155][ T64] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 481.327944][ T5926] usb 5-1: Using ep0 maxpacket: 32 [ 481.348156][ T5926] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 481.365259][ T5926] usb 5-1: New USB device found, idVendor=1b96, idProduct=000a, bcdDevice= 0.00 [ 481.415308][ T5926] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 481.453782][ T5926] usb 5-1: config 0 descriptor?? [ 481.607839][ T5950] usb 6-1: new low-speed USB device number 41 using dummy_hcd [ 481.748123][ T5950] usb 6-1: device descriptor read/64, error -71 [ 481.880074][ T5926] ntrig 0003:1B96:000A.0042: unknown main item tag 0x0 [ 481.887110][ T5926] ntrig 0003:1B96:000A.0042: unknown main item tag 0x0 [ 481.913290][ T5926] ntrig 0003:1B96:000A.0042: hidraw0: USB HID v0.00 Device [HID 1b96:000a] on usb-dummy_hcd.4-1/input0 [ 481.988233][ T5950] usb 6-1: new low-speed USB device number 42 using dummy_hcd [ 482.097364][ T5926] ntrig 0003:1B96:000A.0042: Firmware version: 0.1.27.36.0 (0730 806c) [ 482.149213][ T5950] usb 6-1: device descriptor read/64, error -71 [ 482.243853][ T64] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 482.316898][ T5950] usb usb6-port1: attempt power cycle [ 482.472616][ T64] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 482.490924][T11461] gfs2: gfs2 mount does not exist [ 482.566672][ T64] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 482.653708][ T64] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 482.677891][ T5950] usb 6-1: new low-speed USB device number 43 using dummy_hcd [ 482.699986][ T5950] usb 6-1: device descriptor read/8, error -71 [ 482.802840][ T64] bridge_slave_1: left allmulticast mode [ 482.809486][ T64] bridge_slave_1: left promiscuous mode [ 482.815181][ T64] bridge0: port 2(bridge_slave_1) entered disabled state [ 482.825063][ T64] bridge_slave_0: left allmulticast mode [ 482.831042][ T64] bridge_slave_0: left promiscuous mode [ 482.836687][ T64] bridge0: port 1(bridge_slave_0) entered disabled state [ 482.937867][ T5950] usb 6-1: new low-speed USB device number 44 using dummy_hcd [ 482.958275][ T5950] usb 6-1: device descriptor read/8, error -71 [ 483.079133][ T5950] usb usb6-port1: unable to enumerate USB device [ 483.146976][ T64] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 483.158229][ T64] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 483.168895][ T64] bond0 (unregistering): Released all slaves [ 483.414796][ T64] hsr_slave_0: left promiscuous mode [ 483.429410][ T64] hsr_slave_1: left promiscuous mode [ 484.297201][ T64] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 484.327998][ T64] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 484.379709][ T64] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 484.387146][ T64] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 484.404097][ T36] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 484.410420][ T5830] Bluetooth: hci4: command 0x0406 tx timeout [ 484.465234][ T5941] usb 5-1: USB disconnect, device number 66 [ 484.504260][ T64] veth1_macvtap: left promiscuous mode [ 484.680289][ T64] veth0_macvtap: left promiscuous mode [ 484.685928][ T64] veth1_vlan: left promiscuous mode [ 484.705752][ T64] veth0_vlan: left promiscuous mode [ 484.830050][T11477] fuse: Bad value for 'fd' [ 484.956929][T11482] fuse: Bad value for 'fd' [ 485.032061][ T771] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 485.418070][ T917] usb 6-1: new full-speed USB device number 45 using dummy_hcd [ 485.441722][T11479] trusted_key: encrypted_key: insufficient parameters specified [ 485.463731][ T5830] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 485.474194][ T5830] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 485.482751][ T5830] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 485.493907][ T5830] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 485.505036][ T5830] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 485.580463][ T917] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 485.625796][ T917] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 255, setting to 64 [ 485.693204][ T917] usb 6-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 485.764148][ T917] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 485.801327][ T917] usb 6-1: config 0 descriptor?? [ 485.829392][T11478] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 486.086451][ T917] ath6kl: Failed to submit usb control message: -71 [ 486.097178][ T917] ath6kl: unable to send the bmi data to the device: -71 [ 486.111187][ T917] ath6kl: Unable to send get target info: -71 [ 486.171601][ T917] ath6kl: Failed to init ath6kl core: -71 [ 486.195277][ T917] ath6kl_usb 6-1:0.0: probe with driver ath6kl_usb failed with error -71 [ 486.268546][ T917] usb 6-1: USB disconnect, device number 45 [ 486.429877][ T64] team0 (unregistering): Port device team_slave_1 removed [ 486.489081][ T5926] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 486.526412][ T64] team0 (unregistering): Port device team_slave_0 removed [ 486.693194][ T5926] usb 5-1: Using ep0 maxpacket: 32 [ 486.714015][ T5926] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 486.730394][ T5926] usb 5-1: New USB device found, idVendor=1b96, idProduct=000a, bcdDevice= 0.00 [ 486.739686][ T5926] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 486.750089][ T5926] usb 5-1: config 0 descriptor?? [ 486.991049][T11490] dummy0 speed is unknown, defaulting to 1000 [ 487.019322][ T5833] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 487.043584][T11498] dummy0 speed is unknown, defaulting to 1000 [ 487.095125][ T30] audit: type=1400 audit(1751016506.383:905): avc: denied { mounton } for pid=11502 comm="syz.3.1505" path="/proc/1050/task" dev="proc" ino=36978 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 487.281069][ T5926] ntrig 0003:1B96:000A.0043: unknown main item tag 0x0 [ 487.295446][ T5926] ntrig 0003:1B96:000A.0043: unknown main item tag 0x0 [ 487.305807][ T5926] ntrig 0003:1B96:000A.0043: hidraw0: USB HID v0.00 Device [HID 1b96:000a] on usb-dummy_hcd.4-1/input0 [ 487.331016][ T30] audit: type=1400 audit(1751016506.623:906): avc: denied { accept } for pid=11504 comm="syz.1.1506" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 487.351036][ T917] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 487.359891][ T5833] usb 6-1: Using ep0 maxpacket: 16 [ 487.362074][T11490] chnl_net:caif_netlink_parms(): no params data found [ 487.452176][T11512] fuse: Bad value for 'fd' [ 487.504405][ T5833] usb 6-1: config 0 has no interfaces? [ 487.559018][ T5833] usb 6-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ec.7e [ 487.569356][ T5926] ntrig 0003:1B96:000A.0043: Firmware version: 0.1.27.36.0 (0730 806c) [ 487.588226][ T5833] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 487.600286][ T5830] Bluetooth: hci2: command tx timeout [ 487.648565][ T5833] usb 6-1: Product: syz [ 487.668944][ T5833] usb 6-1: Manufacturer: syz [ 487.691788][ T5833] usb 6-1: SerialNumber: syz [ 487.833917][ T5833] usb 6-1: config 0 descriptor?? [ 487.878176][ T917] usb 4-1: device descriptor read/64, error -71 [ 488.175795][ T917] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 488.271850][ T5941] usb 5-1: USB disconnect, device number 67 [ 488.304891][T11498] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 488.314692][T11498] netdevsim netdevsim5 netdevsim0: unset [1, 1] type 2 family 0 port 20000 - 0 [ 488.388095][ T917] usb 4-1: device descriptor read/64, error -71 [ 488.398534][ T5833] usb 6-1: USB disconnect, device number 46 [ 488.411506][T11490] bridge0: port 1(bridge_slave_0) entered blocking state [ 488.419143][T11490] bridge0: port 1(bridge_slave_0) entered disabled state [ 488.426300][T11490] bridge_slave_0: entered allmulticast mode [ 488.433111][T11490] bridge_slave_0: entered promiscuous mode [ 488.535179][ T917] usb usb4-port1: attempt power cycle [ 488.950493][T11490] bridge0: port 2(bridge_slave_1) entered blocking state [ 488.961812][T11490] bridge0: port 2(bridge_slave_1) entered disabled state [ 488.977323][T11490] bridge_slave_1: entered allmulticast mode [ 488.984763][T11490] bridge_slave_1: entered promiscuous mode [ 489.058053][T11490] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 489.083326][T11490] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 489.301138][T11490] team0: Port device team_slave_0 added [ 489.307814][ T917] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 489.315650][T11490] team0: Port device team_slave_1 added [ 489.339214][ T917] usb 4-1: device descriptor read/8, error -71 [ 489.370748][T11490] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 489.386998][T11490] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 489.414251][T11490] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 489.457144][T11490] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 489.467810][ T5941] usb 2-1: new high-speed USB device number 60 using dummy_hcd [ 489.482048][T11490] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 489.564804][T11490] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 489.579975][ T917] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 489.625123][ T917] usb 4-1: device descriptor read/8, error -71 [ 489.645777][ T5941] usb 2-1: config 4 has an invalid interface number: 95 but max is 0 [ 489.667891][ T5830] Bluetooth: hci2: command tx timeout [ 489.694522][ T5941] usb 2-1: config 4 has no interface number 0 [ 489.742679][ T5941] usb 2-1: config 4 interface 95 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 8 [ 489.789660][ T917] usb usb4-port1: unable to enumerate USB device [ 489.814302][ T5941] usb 2-1: New USB device found, idVendor=7725, idProduct=b0a8, bcdDevice= 7.46 [ 489.861511][ T5941] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 489.906698][ T5941] usb 2-1: Product: syz [ 489.945978][ T5941] usb 2-1: Manufacturer: syz [ 489.994919][ T5941] usb 2-1: SerialNumber: syz [ 490.143430][T11526] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 490.155177][ T771] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 490.379731][T11490] hsr_slave_0: entered promiscuous mode [ 490.386435][T11490] hsr_slave_1: entered promiscuous mode [ 490.418772][T11490] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 490.426376][T11490] Cannot create hsr debugfs directory [ 490.529038][ T5941] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 490.538202][ T30] audit: type=1400 audit(1751016509.793:907): avc: denied { create } for pid=11534 comm="syz.4.1511" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 490.571169][ T5941] usb 2-1: MIDIStreaming interface descriptor not found [ 490.594580][ T30] audit: type=1400 audit(1751016509.883:908): avc: denied { sys_admin } for pid=11534 comm="syz.4.1511" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 490.668029][T11539] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 490.713015][ T5941] usb 2-1: USB disconnect, device number 60 [ 490.715430][T11544] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1514'. [ 490.798321][ T1160] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 492.319592][ T5830] Bluetooth: hci2: command tx timeout [ 492.528230][T11562] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1517'. [ 492.713211][ T5830] Bluetooth: hci3: unexpected cc 0x203e length: 2 > 1 [ 492.722595][ T5830] Bluetooth: hci3: unexpected event for opcode 0x203e [ 492.973476][T11490] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 492.982293][T11569] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1520'. [ 493.000018][T11490] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 493.018895][T11490] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 493.037202][T11490] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 493.130699][T11490] 8021q: adding VLAN 0 to HW filter on device bond0 [ 493.214199][T11490] 8021q: adding VLAN 0 to HW filter on device team0 [ 493.268332][ T5926] usb 6-1: new low-speed USB device number 47 using dummy_hcd [ 493.463864][ T5926] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 493.825426][ T5926] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 494.115047][ T771] bridge0: port 1(bridge_slave_0) entered blocking state [ 494.122211][ T771] bridge0: port 1(bridge_slave_0) entered forwarding state [ 494.151672][ T771] bridge0: port 2(bridge_slave_1) entered blocking state [ 494.158853][ T771] bridge0: port 2(bridge_slave_1) entered forwarding state [ 494.176784][ T5926] usb 6-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 494.204045][T11490] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 494.219646][ T5926] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 494.236701][T11490] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 494.389262][ T5830] Bluetooth: hci2: command tx timeout [ 494.458506][ T5926] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 494.549373][T11584] netlink: 468 bytes leftover after parsing attributes in process `syz.3.1522'. [ 494.591683][T11580] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1523'. [ 494.599179][ T5926] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 494.611377][ T5926] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 494.627973][T11580] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1523'. [ 494.639572][ T5926] usb 6-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 494.704536][ T5926] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 494.716011][ T5926] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 494.766687][ T5926] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 494.775786][T11592] vcan0: tx drop: invalid sa for name 0x0000000200000000 [ 494.777414][ T5926] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 494.800162][ T5926] usb 6-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 494.812634][T11490] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 494.821088][ T5926] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 494.834104][ T5926] usb 6-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 494.854301][ T5926] usb 6-1: string descriptor 0 read error: -22 [ 494.861304][ T5926] usb 6-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 494.873869][ T5926] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 494.892468][ T5926] adutux 6-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 494.917325][T11490] veth0_vlan: entered promiscuous mode [ 494.973953][T11490] veth1_vlan: entered promiscuous mode [ 495.014851][T11490] veth0_macvtap: entered promiscuous mode [ 495.025205][T11490] veth1_macvtap: entered promiscuous mode [ 495.072663][T11490] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 495.082567][T11594] netlink: 'syz.1.1525': attribute type 4 has an invalid length. [ 495.090390][T11594] netlink: 17 bytes leftover after parsing attributes in process `syz.1.1525'. [ 495.115407][T11490] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 495.125460][T11569] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1520'. [ 495.181562][T11490] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 495.191140][ T5926] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 495.209352][ T5965] usb 6-1: USB disconnect, device number 47 [ 495.223878][T11490] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 495.243799][T11490] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 495.252721][T11490] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 495.378326][ T5926] usb 4-1: Using ep0 maxpacket: 32 [ 495.433746][ T12] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 495.777864][ T5950] usb 2-1: new high-speed USB device number 61 using dummy_hcd [ 495.828025][ T5926] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 495.850933][ T5926] usb 4-1: New USB device found, idVendor=1b96, idProduct=000a, bcdDevice= 0.00 [ 495.860206][ T5926] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 495.873657][ T5926] usb 4-1: config 0 descriptor?? [ 495.875730][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 495.893800][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 495.933531][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 495.943267][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 496.037372][ T5950] usb 2-1: config index 0 descriptor too short (expected 45, got 36) [ 496.046367][ T5950] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 496.058047][ T5950] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 496.069073][ T5950] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 496.081464][ T5950] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 496.094529][ T5950] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 496.105245][ T5950] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 496.148530][ T5950] usb 2-1: config 0 descriptor?? [ 496.172173][T11603] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 496.390937][ T5926] ntrig 0003:1B96:000A.0044: unknown main item tag 0x0 [ 496.403374][ T5926] ntrig 0003:1B96:000A.0044: unknown main item tag 0x0 [ 496.470890][ T5926] ntrig 0003:1B96:000A.0044: hidraw0: USB HID v0.00 Device [HID 1b96:000a] on usb-dummy_hcd.3-1/input0 [ 497.270094][ T5926] ntrig 0003:1B96:000A.0044: Firmware version: 0.1.27.36.0 (0730 806c) [ 497.524517][ T5965] usb 4-1: USB disconnect, device number 53 [ 497.600909][ T5950] usbhid 2-1:0.0: can't add hid device: -71 [ 497.615049][ T5950] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 497.625300][ T5950] usb 2-1: USB disconnect, device number 61 [ 497.651582][T11627] block device autoloading is deprecated and will be removed. [ 497.841681][ T13] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 498.069145][T11642] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1537'. [ 499.410306][ T5965] usb 6-1: new high-speed USB device number 48 using dummy_hcd [ 499.499767][ T3521] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 499.619452][ T5965] usb 6-1: Using ep0 maxpacket: 8 [ 499.631292][ T5965] usb 6-1: New USB device found, idVendor=0711, idProduct=0200, bcdDevice=69.34 [ 499.641056][ T5965] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 499.649197][ T5965] usb 6-1: Product: syz [ 499.653570][ T5965] usb 6-1: Manufacturer: syz [ 499.664833][ T5965] usb 6-1: SerialNumber: syz [ 499.671190][ T5965] usb 6-1: config 0 descriptor?? [ 499.678475][ T5965] mct_u232 6-1:0.0: MCT U232 converter detected [ 499.685339][ T5965] mct_u232 ttyUSB0: expected endpoint missing [ 499.861020][ T3521] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 499.915159][ T5833] usb 6-1: USB disconnect, device number 48 [ 499.921784][ T5833] mct_u232 6-1:0.0: device disconnected [ 499.947180][ T3521] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 500.012493][ T3521] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 500.107354][ T3521] bridge_slave_1: left allmulticast mode [ 500.113199][ T3521] bridge_slave_1: left promiscuous mode [ 500.122456][ T3521] bridge0: port 2(bridge_slave_1) entered disabled state [ 500.133565][ T3521] bridge_slave_0: left allmulticast mode [ 500.142106][ T3521] bridge_slave_0: left promiscuous mode [ 500.148537][ T3521] bridge0: port 1(bridge_slave_0) entered disabled state [ 500.503059][ T3521] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 500.516652][ T3521] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 500.526646][ T3521] bond0 (unregistering): Released all slaves [ 501.028571][ T1105] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 501.030935][ T1298] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.045565][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.251748][ T5833] usb 6-1: new high-speed USB device number 49 using dummy_hcd [ 501.291536][ T3521] hsr_slave_0: left promiscuous mode [ 501.294412][ T5829] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 501.308438][ T5829] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 501.312800][T11671] FAULT_INJECTION: forcing a failure. [ 501.312800][T11671] name failslab, interval 1, probability 0, space 0, times 0 [ 501.317667][ T5829] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 501.339282][ T3521] hsr_slave_1: left promiscuous mode [ 501.345282][ T3521] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 501.353934][ T5829] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 501.363064][ T5829] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 501.370938][T11671] CPU: 1 UID: 0 PID: 11671 Comm: syz.4.1546 Not tainted 6.16.0-rc3-syzkaller-00116-ge34a79b96ab9 #0 PREEMPT(full) [ 501.370962][T11671] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 501.370973][T11671] Call Trace: [ 501.370979][T11671] [ 501.370985][T11671] dump_stack_lvl+0x16c/0x1f0 [ 501.371014][T11671] should_fail_ex+0x512/0x640 [ 501.371035][T11671] ? fs_reclaim_acquire+0xae/0x150 [ 501.371054][T11671] ? tomoyo_encode2+0x100/0x3e0 [ 501.371075][T11671] should_failslab+0xc2/0x120 [ 501.371098][T11671] __kmalloc_noprof+0xd2/0x510 [ 501.371119][T11671] ? d_absolute_path+0x136/0x1a0 [ 501.371140][T11671] tomoyo_encode2+0x100/0x3e0 [ 501.371164][T11671] tomoyo_encode+0x29/0x50 [ 501.371184][T11671] tomoyo_realpath_from_path+0x18f/0x6e0 [ 501.371214][T11671] tomoyo_path_number_perm+0x245/0x580 [ 501.371231][T11671] ? tomoyo_path_number_perm+0x237/0x580 [ 501.371250][T11671] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 501.371269][T11671] ? find_held_lock+0x2b/0x80 [ 501.371312][T11671] ? find_held_lock+0x2b/0x80 [ 501.371329][T11671] ? hook_file_ioctl_common+0x145/0x410 [ 501.371357][T11671] ? __fget_files+0x20e/0x3c0 [ 501.371380][T11671] security_file_ioctl+0x9b/0x240 [ 501.371402][T11671] __x64_sys_ioctl+0xb7/0x210 [ 501.371422][T11671] do_syscall_64+0xcd/0x4c0 [ 501.371447][T11671] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 501.371465][T11671] RIP: 0033:0x7fd76c18e929 [ 501.371481][T11671] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 501.371498][T11671] RSP: 002b:00007fd76d02a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 501.371515][T11671] RAX: ffffffffffffffda RBX: 00007fd76c3b5fa0 RCX: 00007fd76c18e929 [ 501.371526][T11671] RDX: 0000200000000040 RSI: 00000000c040565f RDI: 0000000000000003 [ 501.371536][T11671] RBP: 00007fd76d02a090 R08: 0000000000000000 R09: 0000000000000000 [ 501.371546][T11671] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 501.371555][T11671] R13: 0000000000000000 R14: 00007fd76c3b5fa0 R15: 00007fff34911988 [ 501.371576][T11671] [ 501.371723][T11673] hpfs: Bad magic ... probably not HPFS [ 501.372518][T11671] ERROR: Out of memory at tomoyo_realpath_from_path. [ 501.397657][ T3521] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 501.605886][ T5833] usb 6-1: device descriptor read/64, error -71 [ 501.623045][ T3521] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 501.663618][ T3521] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 501.962180][ T3521] veth1_macvtap: left promiscuous mode [ 501.967813][ T5833] usb 6-1: new high-speed USB device number 50 using dummy_hcd [ 501.979551][ T3521] veth0_macvtap: left promiscuous mode [ 501.985679][ T3521] veth1_vlan: left promiscuous mode [ 501.991559][ T3521] veth0_vlan: left promiscuous mode [ 502.119080][ T5833] usb 6-1: device descriptor read/64, error -71 [ 502.307013][ T5833] usb usb6-port1: attempt power cycle [ 502.868507][ T64] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 502.941841][ T3521] team0 (unregistering): Port device team_slave_1 removed [ 502.979812][ T3521] team0 (unregistering): Port device team_slave_0 removed [ 503.147834][ T5833] usb 6-1: new high-speed USB device number 51 using dummy_hcd [ 503.178895][ T5833] usb 6-1: device descriptor read/8, error -71 [ 503.437848][ T5830] Bluetooth: hci2: command tx timeout [ 503.448213][ T5833] usb 6-1: new high-speed USB device number 52 using dummy_hcd [ 503.468846][ T5833] usb 6-1: device descriptor read/8, error -71 [ 503.578383][ T5833] usb usb6-port1: unable to enumerate USB device [ 504.271680][T11693] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1553'. [ 505.049360][T11668] dummy0 speed is unknown, defaulting to 1000 [ 505.343902][T11711] FAULT_INJECTION: forcing a failure. [ 505.343902][T11711] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 505.357536][T11711] CPU: 1 UID: 0 PID: 11711 Comm: syz.4.1557 Not tainted 6.16.0-rc3-syzkaller-00116-ge34a79b96ab9 #0 PREEMPT(full) [ 505.357562][T11711] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 505.357573][T11711] Call Trace: [ 505.357580][T11711] [ 505.357587][T11711] dump_stack_lvl+0x16c/0x1f0 [ 505.357618][T11711] should_fail_ex+0x512/0x640 [ 505.357644][T11711] _copy_from_user+0x2e/0xd0 [ 505.357671][T11711] copy_from_sockptr_offset.constprop.0+0x136/0x170 [ 505.357692][T11711] ? __pfx_copy_from_sockptr_offset.constprop.0+0x10/0x10 [ 505.357721][T11711] copy_bpf_fprog_from_user+0x15d/0x2d0 [ 505.357741][T11711] ? __pfx_copy_bpf_fprog_from_user+0x10/0x10 [ 505.357761][T11711] ? sk_setsockopt+0xacb/0x3e40 [ 505.357791][T11711] sk_setsockopt+0x10d4/0x3e40 [ 505.357822][T11711] ? __pfx_sk_setsockopt+0x10/0x10 [ 505.357847][T11711] ? selinux_netlbl_socket_setsockopt+0x183/0x470 [ 505.357873][T11711] ? __pfx_selinux_netlbl_socket_setsockopt+0x10/0x10 [ 505.357910][T11711] ? selinux_socket_setsockopt+0x6a/0x80 [ 505.357936][T11711] do_sock_setsockopt+0x3f2/0x470 [ 505.357963][T11711] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 505.358011][T11711] __sys_setsockopt+0x1a0/0x230 [ 505.358039][T11711] __x64_sys_setsockopt+0xbd/0x160 [ 505.358060][T11711] ? do_syscall_64+0x91/0x4c0 [ 505.358084][T11711] ? lockdep_hardirqs_on+0x7c/0x110 [ 505.358108][T11711] do_syscall_64+0xcd/0x4c0 [ 505.358134][T11711] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 505.358153][T11711] RIP: 0033:0x7fd76c18e929 [ 505.358169][T11711] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 505.358186][T11711] RSP: 002b:00007fd76cfe8038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 505.358204][T11711] RAX: ffffffffffffffda RBX: 00007fd76c3b6160 RCX: 00007fd76c18e929 [ 505.358216][T11711] RDX: 000000000000001a RSI: 0000000000000001 RDI: 0000000000000008 [ 505.358226][T11711] RBP: 00007fd76cfe8090 R08: 0000000000000010 R09: 0000000000000000 [ 505.358237][T11711] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000001 [ 505.358248][T11711] R13: 0000000000000000 R14: 00007fd76c3b6160 R15: 00007fff34911988 [ 505.358272][T11711] [ 505.575906][ T5830] Bluetooth: hci2: command tx timeout [ 505.646262][T11713] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1560'. [ 505.656022][T11713] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1560'. [ 505.735792][T11717] wg1: entered promiscuous mode [ 505.746134][T11717] wg1: entered allmulticast mode [ 505.787514][T11713] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 505.796876][T11713] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 505.806475][T11713] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 505.957853][ T5965] usb 4-1: new low-speed USB device number 54 using dummy_hcd [ 506.126220][T11668] chnl_net:caif_netlink_parms(): no params data found [ 506.252302][ T5965] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 506.318598][ T5965] usb 4-1: config 0 has no interface number 0 [ 506.413604][ T5965] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 506.560057][ T5965] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 506.791169][ T5965] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 506.878133][ T36] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 507.533100][ T5965] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 507.554674][ T5965] usb 4-1: config 0 descriptor?? [ 507.562722][T11719] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 507.588178][ T5830] Bluetooth: hci2: command tx timeout [ 507.741357][ T5965] iowarrior 4-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 508.088377][ T13] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 508.218605][ T5950] usb 4-1: USB disconnect, device number 54 [ 508.228652][T11668] bridge0: port 1(bridge_slave_0) entered blocking state [ 508.235823][T11668] bridge0: port 1(bridge_slave_0) entered disabled state [ 508.251609][T11668] bridge_slave_0: entered allmulticast mode [ 508.262496][T11668] bridge_slave_0: entered promiscuous mode [ 508.274372][T11668] bridge0: port 2(bridge_slave_1) entered blocking state [ 508.281683][T11668] bridge0: port 2(bridge_slave_1) entered disabled state [ 508.288981][T11668] bridge_slave_1: entered allmulticast mode [ 508.296279][T11668] bridge_slave_1: entered promiscuous mode [ 508.547566][T11750] FAULT_INJECTION: forcing a failure. [ 508.547566][T11750] name failslab, interval 1, probability 0, space 0, times 0 [ 508.560437][T11750] CPU: 1 UID: 0 PID: 11750 Comm: syz.4.1569 Not tainted 6.16.0-rc3-syzkaller-00116-ge34a79b96ab9 #0 PREEMPT(full) [ 508.560464][T11750] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 508.560475][T11750] Call Trace: [ 508.560483][T11750] [ 508.560490][T11750] dump_stack_lvl+0x16c/0x1f0 [ 508.560521][T11750] should_fail_ex+0x512/0x640 [ 508.560543][T11750] ? kmem_cache_alloc_lru_noprof+0x5f/0x3b0 [ 508.560571][T11750] should_failslab+0xc2/0x120 [ 508.560596][T11750] kmem_cache_alloc_lru_noprof+0x72/0x3b0 [ 508.560620][T11750] ? __d_alloc+0x31/0xaa0 [ 508.560650][T11750] __d_alloc+0x31/0xaa0 [ 508.560678][T11750] d_alloc_pseudo+0x1c/0xc0 [ 508.560698][T11750] alloc_file_pseudo+0xcf/0x230 [ 508.560718][T11750] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 508.560736][T11750] ? do_raw_spin_unlock+0x172/0x230 [ 508.560762][T11750] __anon_inode_getfile+0xf7/0x3a0 [ 508.560792][T11750] anon_inode_getfd+0x52/0xb0 [ 508.560818][T11750] __x64_sys_fsopen+0x18b/0x240 [ 508.560837][T11750] do_syscall_64+0xcd/0x4c0 [ 508.560865][T11750] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 508.560883][T11750] RIP: 0033:0x7fd76c18e929 [ 508.560898][T11750] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 508.560916][T11750] RSP: 002b:00007fd76cf88038 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 508.560934][T11750] RAX: ffffffffffffffda RBX: 00007fd76c3b6080 RCX: 00007fd76c18e929 [ 508.560946][T11750] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000240 [ 508.560957][T11750] RBP: 00007fd76cf88090 R08: 0000000000000000 R09: 0000000000000000 [ 508.560969][T11750] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 508.560980][T11750] R13: 0000000000000000 R14: 00007fd76c3b6080 R15: 00007fff34911988 [ 508.561009][T11750] [ 508.750024][ C1] vkms_vblank_simulate: vblank timer overrun [ 509.315109][T11668] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 509.349001][T11668] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 509.671170][ T5830] Bluetooth: hci2: command tx timeout [ 510.010607][T11668] team0: Port device team_slave_0 added [ 510.034854][T11668] team0: Port device team_slave_1 added [ 510.082883][T11668] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 510.095422][T11668] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 510.177677][T11668] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 510.213407][T11668] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 510.228296][T11668] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 510.254207][ C1] vkms_vblank_simulate: vblank timer overrun [ 511.113202][T11668] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 511.251649][T11778] netlink: 'syz.1.1579': attribute type 11 has an invalid length. [ 511.360981][ T30] audit: type=1400 audit(1751016530.653:909): avc: denied { write } for pid=11779 comm="syz.3.1580" name="file0" dev="tmpfs" ino=1728 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 511.991368][T11668] hsr_slave_0: entered promiscuous mode [ 511.997800][ T30] audit: type=1400 audit(1751016530.653:910): avc: denied { open } for pid=11779 comm="syz.3.1580" path="/325/file0" dev="tmpfs" ino=1728 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 512.020559][ C1] vkms_vblank_simulate: vblank timer overrun [ 512.022175][T11668] hsr_slave_1: entered promiscuous mode [ 512.037083][T11668] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 512.062735][T11668] Cannot create hsr debugfs directory [ 512.399817][T11787] option changes via remount are deprecated (pid=11786 comm=syz.4.1582) [ 512.899187][T11798] netlink: 44 bytes leftover after parsing attributes in process `syz.5.1585'. [ 513.935044][ T1160] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 513.950267][ T13] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 514.124584][T11809] tipc: Started in network mode [ 514.138902][T11809] tipc: Node identity aaaaaaaaaa32, cluster identity 4711 [ 514.150069][T11809] tipc: Enabled bearer , priority 10 [ 514.203565][T11813] netlink: 10 bytes leftover after parsing attributes in process `syz.1.1591'. [ 514.453651][ T5833] libceph: connect (1)[c::]:6789 error -101 [ 514.483200][ T5833] libceph: mon0 (1)[c::]:6789 connect error [ 514.692418][T11668] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 514.727769][T11668] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 514.753710][T11668] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 514.769838][ T5833] libceph: connect (1)[c::]:6789 error -101 [ 514.815331][ T5833] libceph: mon0 (1)[c::]:6789 connect error [ 514.818211][T11668] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 514.974875][T11815] ceph: No mds server is up or the cluster is laggy [ 515.061763][ T30] audit: type=1400 audit(1751016534.353:911): avc: denied { bind } for pid=11831 comm="syz.1.1593" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 515.209676][T11832] [ 515.212014][T11832] ====================================================== [ 515.219010][T11832] WARNING: possible circular locking dependency detected [ 515.226011][T11832] 6.16.0-rc3-syzkaller-00116-ge34a79b96ab9 #0 Not tainted [ 515.233097][T11832] ------------------------------------------------------ [ 515.240093][T11832] syz.1.1593/11832 is trying to acquire lock: [ 515.246132][T11832] ffffffff905a2618 (nr_node_list_lock){+...}-{3:3}, at: nr_rt_device_down+0xd3/0x810 [ 515.255608][T11832] [ 515.255608][T11832] but task is already holding lock: [ 515.262957][T11832] ffffffff905a25b8 (nr_neigh_list_lock){+...}-{3:3}, at: nr_rt_device_down+0x2c/0x810 [ 515.272514][T11832] [ 515.272514][T11832] which lock already depends on the new lock. [ 515.272514][T11832] [ 515.282916][T11832] [ 515.282916][T11832] the existing dependency chain (in reverse order) is: [ 515.291909][T11832] [ 515.291909][T11832] -> #2 (nr_neigh_list_lock){+...}-{3:3}: [ 515.299791][T11832] _raw_spin_lock_bh+0x33/0x40 [ 515.305070][T11832] nr_rt_ioctl+0xc66/0x29b0 [ 515.310088][T11832] nr_ioctl+0x19a/0x2e0 [ 515.314742][T11832] sock_do_ioctl+0x118/0x280 [ 515.319843][T11832] sock_ioctl+0x227/0x6b0 [ 515.324694][T11832] __x64_sys_ioctl+0x18b/0x210 [ 515.329967][T11832] do_syscall_64+0xcd/0x4c0 [ 515.334985][T11832] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 515.341376][T11832] [ 515.341376][T11832] -> #1 (&nr_node->node_lock){+...}-{3:3}: [ 515.349341][T11832] _raw_spin_lock_bh+0x33/0x40 [ 515.354613][T11832] nr_rt_ioctl+0x816/0x29b0 [ 515.359615][T11832] nr_ioctl+0x19a/0x2e0 [ 515.364263][T11832] sock_do_ioctl+0x118/0x280 [ 515.369355][T11832] sock_ioctl+0x227/0x6b0 [ 515.374198][T11832] __x64_sys_ioctl+0x18b/0x210 [ 515.379463][T11832] do_syscall_64+0xcd/0x4c0 [ 515.384473][T11832] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 515.390865][T11832] [ 515.390865][T11832] -> #0 (nr_node_list_lock){+...}-{3:3}: [ 515.398655][T11832] __lock_acquire+0x126f/0x1c90 [ 515.404006][T11832] lock_acquire+0x179/0x350 [ 515.409009][T11832] _raw_spin_lock_bh+0x33/0x40 [ 515.414268][T11832] nr_rt_device_down+0xd3/0x810 [ 515.419618][T11832] nr_device_event+0x126/0x170 [ 515.424878][T11832] notifier_call_chain+0xb9/0x410 [ 515.430402][T11832] call_netdevice_notifiers_info+0xbe/0x140 [ 515.436790][T11832] dev_close_many+0x319/0x630 [ 515.441962][T11832] netif_close+0x17f/0x230 [ 515.446869][T11832] dev_close+0xaa/0x240 [ 515.451525][T11832] bpq_device_event+0x601/0x840 [ 515.456876][T11832] notifier_call_chain+0xb9/0x410 [ 515.462400][T11832] call_netdevice_notifiers_info+0xbe/0x140 [ 515.468789][T11832] __dev_notify_flags+0x1f7/0x2e0 [ 515.474313][T11832] netif_change_flags+0x108/0x160 [ 515.479835][T11832] dev_change_flags+0xba/0x250 [ 515.485091][T11832] dev_ifsioc+0x1498/0x1f70 [ 515.490091][T11832] dev_ioctl+0x223/0x10e0 [ 515.494926][T11832] sock_do_ioctl+0x19d/0x280 [ 515.500012][T11832] sock_ioctl+0x227/0x6b0 [ 515.504836][T11832] __x64_sys_ioctl+0x18b/0x210 [ 515.510096][T11832] do_syscall_64+0xcd/0x4c0 [ 515.515099][T11832] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 515.521487][T11832] [ 515.521487][T11832] other info that might help us debug this: [ 515.521487][T11832] [ 515.531687][T11832] Chain exists of: [ 515.531687][T11832] nr_node_list_lock --> &nr_node->node_lock --> nr_neigh_list_lock [ 515.531687][T11832] [ 515.545474][T11832] Possible unsafe locking scenario: [ 515.545474][T11832] [ 515.552895][T11832] CPU0 CPU1 [ 515.558234][T11832] ---- ---- [ 515.563569][T11832] lock(nr_neigh_list_lock); [ 515.568237][T11832] lock(&nr_node->node_lock); [ 515.575492][T11832] lock(nr_neigh_list_lock); [ 515.582660][T11832] lock(nr_node_list_lock); [ 515.587234][T11832] [ 515.587234][T11832] *** DEADLOCK *** [ 515.587234][T11832] [ 515.595354][T11832] 2 locks held by syz.1.1593/11832: [ 515.600529][T11832] #0: ffffffff9034cbe8 (rtnl_mutex){+.+.}-{4:4}, at: dev_ioctl+0x212/0x10e0 [ 515.609290][T11832] #1: ffffffff905a25b8 (nr_neigh_list_lock){+...}-{3:3}, at: nr_rt_device_down+0x2c/0x810 [ 515.619274][T11832] [ 515.619274][T11832] stack backtrace: [ 515.625136][T11832] CPU: 1 UID: 0 PID: 11832 Comm: syz.1.1593 Not tainted 6.16.0-rc3-syzkaller-00116-ge34a79b96ab9 #0 PREEMPT(full) [ 515.625156][T11832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 515.625163][T11832] Call Trace: [ 515.625168][T11832] [ 515.625173][T11832] dump_stack_lvl+0x116/0x1f0 [ 515.625190][T11832] print_circular_bug+0x275/0x350 [ 515.625208][T11832] check_noncircular+0x14c/0x170 [ 515.625226][T11832] __lock_acquire+0x126f/0x1c90 [ 515.625245][T11832] lock_acquire+0x179/0x350 [ 515.625262][T11832] ? nr_rt_device_down+0xd3/0x810 [ 515.625277][T11832] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 515.625290][T11832] _raw_spin_lock_bh+0x33/0x40 [ 515.625304][T11832] ? nr_rt_device_down+0xd3/0x810 [ 515.625319][T11832] nr_rt_device_down+0xd3/0x810 [ 515.625334][T11832] ? __local_bh_enable_ip+0xa4/0x120 [ 515.625349][T11832] nr_device_event+0x126/0x170 [ 515.625361][T11832] notifier_call_chain+0xb9/0x410 [ 515.625376][T11832] ? __pfx_nr_device_event+0x10/0x10 [ 515.625389][T11832] call_netdevice_notifiers_info+0xbe/0x140 [ 515.625401][T11832] dev_close_many+0x319/0x630 [ 515.625412][T11832] ? __lock_acquire+0xb8a/0x1c90 [ 515.625429][T11832] ? __pfx_dev_close_many+0x10/0x10 [ 515.625442][T11832] netif_close+0x17f/0x230 [ 515.625452][T11832] ? __pfx_netif_close+0x10/0x10 [ 515.625465][T11832] dev_close+0xaa/0x240 [ 515.625482][T11832] bpq_device_event+0x601/0x840 [ 515.625499][T11832] notifier_call_chain+0xb9/0x410 [ 515.625513][T11832] ? __pfx_bpq_device_event+0x10/0x10 [ 515.625530][T11832] call_netdevice_notifiers_info+0xbe/0x140 [ 515.625542][T11832] __dev_notify_flags+0x1f7/0x2e0 [ 515.625557][T11832] ? __pfx___dev_notify_flags+0x10/0x10 [ 515.625572][T11832] ? __pfx___dev_change_flags+0x10/0x10 [ 515.625588][T11832] ? do_raw_spin_lock+0x12c/0x2b0 [ 515.625600][T11832] netif_change_flags+0x108/0x160 [ 515.625616][T11832] dev_change_flags+0xba/0x250 [ 515.625627][T11832] dev_ifsioc+0x1498/0x1f70 [ 515.625641][T11832] ? __pfx_dev_ifsioc+0x10/0x10 [ 515.625655][T11832] ? __pfx___mutex_lock+0x10/0x10 [ 515.625673][T11832] ? dev_load+0x8e/0x240 [ 515.625687][T11832] dev_ioctl+0x223/0x10e0 [ 515.625701][T11832] sock_do_ioctl+0x19d/0x280 [ 515.625712][T11832] ? __pfx_sock_do_ioctl+0x10/0x10 [ 515.625724][T11832] ? ioctl_has_perm.constprop.0.isra.0+0x379/0x540 [ 515.625741][T11832] ? ioctl_has_perm.constprop.0.isra.0+0x383/0x540 [ 515.625757][T11832] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 515.625774][T11832] sock_ioctl+0x227/0x6b0 [ 515.625785][T11832] ? __pfx_sock_ioctl+0x10/0x10 [ 515.625795][T11832] ? hook_file_ioctl_common+0x145/0x410 [ 515.625814][T11832] ? selinux_file_ioctl+0x180/0x270 [ 515.625828][T11832] ? selinux_file_ioctl+0xb4/0x270 [ 515.625843][T11832] ? __pfx_sock_ioctl+0x10/0x10 [ 515.625854][T11832] __x64_sys_ioctl+0x18b/0x210 [ 515.625868][T11832] do_syscall_64+0xcd/0x4c0 [ 515.625885][T11832] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 515.625898][T11832] RIP: 0033:0x7fb59198e929 [ 515.625907][T11832] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 515.625918][T11832] RSP: 002b:00007fb592876038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 515.625929][T11832] RAX: ffffffffffffffda RBX: 00007fb591bb5fa0 RCX: 00007fb59198e929 [ 515.625936][T11832] RDX: 0000200000000700 RSI: 0000000000008914 RDI: 000000000000000e [ 515.625943][T11832] RBP: 00007fb591a10b39 R08: 0000000000000000 R09: 0000000000000000 [ 515.625950][T11832] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 515.625956][T11832] R13: 0000000000000000 R14: 00007fb591bb5fa0 R15: 00007ffc0b99f908 [ 515.625966][T11832] [ 515.982180][ T917] tipc: Node number set to 10005162 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 517.198145][ T13] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 517.208567][ T13] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 517.290119][ T13] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 517.300541][ T13] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 517.351803][ T13] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 517.362153][ T13] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 517.879309][ T13] bridge_slave_1: left allmulticast mode [ 517.884972][ T13] bridge_slave_1: left promiscuous mode [ 517.890955][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 517.899167][ T13] bridge_slave_0: left allmulticast mode [ 517.904874][ T13] bridge_slave_0: left promiscuous mode [ 517.910577][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 517.920258][ T13] bridge_slave_1: left allmulticast mode [ 517.925960][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 517.933549][ T13] bridge_slave_0: left allmulticast mode [ 517.939393][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 517.947323][ T13] bridge_slave_1: left allmulticast mode [ 517.952963][ T13] bridge_slave_1: left promiscuous mode [ 517.958642][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 517.966246][ T13] bridge_slave_0: left allmulticast mode [ 517.971944][ T13] bridge_slave_0: left promiscuous mode [ 517.977564][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 518.062102][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 518.071586][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 518.080856][ T13] bond0 (unregistering): Released all slaves [ 518.161600][ T13] bond1 (unregistering): Released all slaves [ 518.382450][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 518.391867][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 518.401543][ T13] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 518.410032][ T13] bond0 (unregistering): Released all slaves [ 518.453871][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 518.463285][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 518.473148][ T13] bond0 (unregistering): Released all slaves [ 518.545220][ T13] tipc: Disabling bearer [ 518.550352][ T13] tipc: Left network mode [ 518.778272][ T13] hsr_slave_0: left promiscuous mode [ 518.783836][ T13] hsr_slave_1: left promiscuous mode [ 518.789539][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 518.796933][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 518.804587][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 518.812354][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 518.821556][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 518.829046][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 518.837829][ T13] hsr_slave_0: left promiscuous mode [ 518.843380][ T13] hsr_slave_1: left promiscuous mode [ 518.848985][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 518.856334][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 518.865599][ T13] veth1_macvtap: left promiscuous mode [ 518.871256][ T13] veth0_macvtap: left promiscuous mode [ 518.876749][ T13] veth1_vlan: left promiscuous mode [ 518.882007][ T13] veth0_vlan: left promiscuous mode [ 519.118726][ T13] team0 (unregistering): Port device vlan0 removed [ 519.262174][ T13] team0 (unregistering): Port device team_slave_1 removed [ 519.292948][ T13] team0 (unregistering): Port device team_slave_0 removed [ 519.577658][ T13] team0 (unregistering): Port device team_slave_1 removed [ 519.597123][ T13] team0 (unregistering): Port device team_slave_0 removed [ 519.598061][ T1160] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 519.615202][ T3521] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 520.392133][ T13] netdevsim netdevsim5 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 520.402505][ T13] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 520.412796][ T13] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 520.459912][ T13] netdevsim netdevsim5 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 520.470379][ T13] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 520.480643][ T13] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 520.530327][ T13] netdevsim netdevsim5 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 520.540652][ T13] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 520.551254][ T13] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 520.662414][ T13] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 520.690633][ T13] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 520.730288][ T13] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 520.790090][ T13] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 520.859557][ T13] bridge_slave_1: left allmulticast mode [ 520.865197][ T13] bridge_slave_1: left promiscuous mode [ 520.870896][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 520.878739][ T13] bridge_slave_0: left allmulticast mode [ 520.884370][ T13] bridge_slave_0: left promiscuous mode [ 520.890458][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 520.899674][ T13] bridge_slave_1: left allmulticast mode [ 520.905294][ T13] bridge_slave_1: left promiscuous mode [ 520.911132][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 520.920510][ T13] bridge_slave_0: left allmulticast mode [ 520.926145][ T13] bridge_slave_0: left promiscuous mode [ 520.931879][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 520.981959][ T13] bond1 (unregistering): (slave geneve2): Releasing active interface [ 521.221308][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 521.230853][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 521.240452][ T13] bond0 (unregistering): Released all slaves [ 521.249752][ T13] bond1 (unregistering): Released all slaves [ 521.268726][ T13] bond1 (unregistering): (slave gretap1): Releasing active interface [ 521.361297][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 521.370882][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 521.379958][ T13] bond0 (unregistering): Released all slaves [ 521.389669][ T13] bond1 (unregistering): Released all slaves [ 521.457181][ T13] tipc: Disabling bearer [ 521.467809][ T13] tipc: Left network mode [ 521.711012][ T13] hsr_slave_0: left promiscuous mode [ 521.716521][ T13] hsr_slave_1: left promiscuous mode [ 521.722154][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 521.729530][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 521.736923][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 521.744314][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 521.753204][ T13] hsr_slave_0: left promiscuous mode [ 521.760351][ T13] hsr_slave_1: left promiscuous mode [ 521.765825][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 521.773249][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 521.780638][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 521.788187][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 521.798602][ T13] veth1_macvtap: left promiscuous mode [ 521.804095][ T13] veth1_vlan: left promiscuous mode [ 521.809404][ T13] veth0_vlan: left promiscuous mode [ 521.815031][ T13] veth1_macvtap: left promiscuous mode [ 521.820516][ T13] veth0_macvtap: left promiscuous mode [ 521.825994][ T13] veth1_vlan: left promiscuous mode [ 521.831366][ T13] veth0_vlan: left promiscuous mode [ 521.940465][ T13] team0 (unregistering): Port device team_slave_1 removed [ 521.950732][ T13] team0 (unregistering): Port device team_slave_0 removed [ 522.130031][ T13] team0 (unregistering): Port device team_slave_1 removed [ 522.152397][ T13] team0 (unregistering): Port device team_slave_0 removed [ 522.862808][ T13] IPVS: stop unused estimator thread 0...