last executing test programs: 4.633453847s ago: executing program 2 (id=3): unshare(0x400) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_DAEMON(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r2, 0x301, 0x70bd2a, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000090}, 0x40) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) r3 = eventfd2(0xd, 0x1) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x109042, 0x0) write$P9_RSTATu(r4, &(0x7f0000000080)={0x233, 0x7d, 0x2, {{0x500, 0xf2, 0x0, 0x4, {0x0, 0x1, 0x5}, 0x0, 0x0, 0x0, 0x0, 0x1b, '\x04nodev{evoo~\x059\xc6\x00\x05\x00\x007\xd9:\x8b\x92\x00\x00\x00', 0x38, 'pJ\x86\xce\xc6\x02\x00}\xfag>\xff\xeb\t\xb55\x1f[\xde\x05@\x00\x00\x00\x00\x18{\x82\x00\xb5\x00\x00+Y_\xcb\x14\x03CT\xb9\xfd\x9e\xf1\x96\xa5\x1c\xd5\x15z\xdc\x81\x03\xb4\x94\xe1', 0xf, '\xcf\xc2m\xd7\xc5\xb4\x99\xbf\xb4+\x93\x80~\x8bZ', 0x5d, '\xf8\xf6i\xfbqm\xcf1^\xca\xf3\x85@\x9a\xc6[\x94\bg\x8c,;\xa6\x1dR\xc3l\xde{\a\xdb\xda\xb2\x88K\xaf\x05\x00~\x04\xe6\x9d\xb0\xc3\xca\x00\x00\x00\x00\x00\x00G\xec!\xca\xbf\xf2\x0f\x9c\x1c\xbe6\xf4\xfd\x1aL\xc2\x9e\x95?\xa5\xe0R\x15t\x80\xe8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x81\xff\xff\xff\x00'}, 0x12c, 'odev/n\xb1{#\x00\xf9\xda\xa5\xee#&n\xcf\x85\xfe\xa6^B\xd9y\xa3\xfd\xe5\xf4U\xda\xf0;\x11r\xd9{\xad\xc7\tZ\xfdv\xfeO\x04A\xf7\xf7t\x1e\xac\x03\x00\x00\xec\xff\x00\x00\xdb\xa0\xc2\xf7\xf0\x9f\xf5<~M\x1a\xd6n-\a\x01\x98\x01\x9f0\x11\x84G\xaa\x9at\xf5\x16\x85\xf5\x06\xae\x89H\x06\x87\x82g\xd5\xa1)\x8dy,J7\xf2\xe1\xcb\xbd$\x82\x92\x9a\r\x89r\xb5\xcfs.\xa5\xb0\xd7#\x85\x9d\xba?\x93\xae\xd3\xb4.\xe7\xca\xc0}\xe0\x9d\x1dh\xa6\x033\xa8\x82F}+1\xaa\xcd\xf9\x18\x85I\xb1\x12]lL\x9b\x18\xc2\xfbV\xc5}}\xc6&\xe49\a\x96\xa1\xebH\'Fi\xab\x13\xf8\xb1\x1d\x14`Y\xf3\x10\xe2cMY?\xece\xd5)\xf3\x82\x06fd\xdf$NL\x90W\np\x04\x9f9\x9f\x06\x1fu\xb7y|\xe1\xfe\x11\xea\x91\x96\t\xd5\x1aA\xdd=\xe3\x04\xbd|~\xd0\xa4V\xf0\xae\x12Qa\x05\xc9\xce\x88}\xf5\xa6\xe0\xb6\xa7}Yl\xf8\x8b\xa6\xe5\xc69|}P!\xd7\x98\x95(\xfd\x179\xe1\xc2\xd8\x7f\xff\x00'/300, 0x0, 0xee01}}, 0x233) ioctl$VHOST_SET_VRING_CALL(r0, 0x4008af21, &(0x7f0000000080)={0x0, r3}) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x791201, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000100)=0x3) capset(&(0x7f0000000500)={0x20080522}, &(0x7f0000000200)={0x200002, 0x200003, 0x801, 0x4, 0x7}) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r6, &(0x7f00000003c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r6, 0x4) r7 = socket$netlink(0x10, 0x3, 0x5) writev(r7, &(0x7f0000000080)=[{&(0x7f0000000200)}], 0x1) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x6, 0x80010, r5, 0x7c1a5000) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x94) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f00000004c0), 0x800, 0x0) ioctl$EVIOCGPROP(r8, 0x40047438, &(0x7f0000000180)=""/246) ioctl$PPPIOCSMRU1(r8, 0x80047453, &(0x7f0000000340)=0x5) 4.250263676s ago: executing program 2 (id=5): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=@newtaction={0x14, 0x30, 0x48b}, 0x14}, 0x1, 0x0, 0x0, 0x4048000}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000001c0), 0x0, 0x40012140, &(0x7f0000000a00)={0x0, 0x989680}) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) socket$nl_route(0x10, 0x3, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x0, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x41, 0x0, 0x7, 0x7ffc0001}]}) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x100b300, 0x0, 0x0, 0x0, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x4) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000040)={@my=0x1}) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280), 0xa0203, 0x0) ioctl$SNAPSHOT_AVAIL_SWAP_SIZE(r6, 0x80083313, &(0x7f0000001dc0)) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x50, r8, 0x1, 0x4, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'vcan0\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) 2.904325578s ago: executing program 0 (id=1): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x70bd2e, 0x0, {}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}]}, 0x2c}}, 0x0) 2.797638482s ago: executing program 1 (id=2): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x110) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x802, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) prctl$PR_SET_SECUREBITS(0x1c, 0x25) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$BPF_GET_MAP_INFO(0x3, 0x0, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) socket$key(0xf, 0x3, 0x2) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) openat$ptmx(0xffffff9c, 0x0, 0x200, 0x0) r3 = syz_io_uring_setup(0x49a, &(0x7f0000000400)={0x0, 0x79af, 0x3180, 0x8000, 0x400246}, &(0x7f0000000340)=0x0, &(0x7f00000006c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_MSG_RING={0x28, 0x40, 0x0, r3, 0x0, 0x0, 0x0, 0x2}) io_uring_enter(r3, 0x4c6e, 0xc67a, 0x8, 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r6 = userfaultfd(0x80001) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f00000000c0)) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$UFFDIO_ZEROPAGE(r6, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00004bd000/0x3000)=nil, 0x3000}}) io_uring_enter(r3, 0x627, 0x4c1, 0x43, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000004080)=ANY=[@ANYBLOB="04000000040000000400000022bf000000080007", @ANYRES32, @ANYBLOB='\x00'/18, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000400"/28], 0x48) 2.73574896s ago: executing program 0 (id=6): syz_open_dev$cec(0x0, 0x0, 0x400) r0 = socket(0x1e, 0x4, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x0, 0x0, 0xffffffff}, 0x10) r1 = socket(0x1e, 0x4, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000680)={0x24, r3, 0x201, 0x3ffffd, 0x7ffffe, {{}, {}, {0x8, 0x11, 0x84e}}}, 0x24}, 0x1, 0x0, 0x0, 0x11}, 0x2000a004) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) sendmmsg(r0, &(0x7f0000008fc0)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000a00)="ef62c8e9740f077912f4490f2c45a4236bb8899053655b1abf431a1d91853323babab75fc85f110ca85d25db41dfa48da41415dd3c02e70a1067d80be6026a769c085aa6fb54504afae5d18cf5ab178b895b66f49d99934dae16d51c918f0eccbc34c9f42f4116283389dfbd3956f2bc7776638a7069b97e192442ede30de0c4102678988befe13801b4e65a0d400a51f2b0efc63f2257ca4076f94b6f025601b115e46d23c074046a85e5c9712be1b17c1a86a30fff74381d204a05a155f36cf36a13890a311463759810ecdf52a8546c4d811b42d8b4a6fd0df7c57fa35ba815bb62d7468db02cf8593f84ac93e8a5fa5720b88c7d253300f1fb1300b50d51f1027dbdc023b615ce1752eaee9efcbc032cebbb9df3d14c91d99754b5223e34ae4798fbc9c728637d9e93379d1475e980419b4cc27df543c65686eb033b349de2a694f8ed865470cea07768035c832061287221bb116fcc4b9370d86af9b66960f2aef9aea5d117c7a701e754a41f564300b5e20c48dd941482dbe7be80cf472aff1b2fb584a833b3f99f6625f3ec73eb7926102ef9ddaa4e74c5217492426d12cf2a95bdf2b5674af54247560bd45f785ef8083ceb0f68e3004ff9235cadaa68dc5b5717e57707794d5ca95747a2f91166cade480c77e877d32ddd71c5435222788fdd7ddd169e2d0405be2fc0fc6b9ad17a1349066e7c175c05ad26dffa9b765f4ed72c9e31baaeb07a870c532b7eb2ef55d82ed519066262b84f2f6407f0addf21d273c87f5abdefedc38d9e771976abd2aa672c426d374a7c805e30470689bbe1da0996c674f10d794d1931f3747a713eabe752b8b4bfda0c7706ba7273822911e730c28a81c094a39c1e0e1c2222e983015f0abf915ae2c4936d87c8d910fb607d411d5486f13a5e1cc7620e735b3fdd57329d8fb99a8c0585688f69887c461f21657e43d88f2001bacc8c1ecbc978c3c72e503f647d2011d3d664d8919441532849531342f1c2bd885015182421cc67cbc0d164912cbc3b40b6380cb32089fe56cd2a44789c5e2e3a1e7c163602123fce00d4a75715264f74c186c1ae817e3f9ed4be0ad801fd2677d9079076b5fc035dd6a1d74fdbf8b61cddffc01ee8c5785f0943398f9e734f98a1d7b8743d2ffa64aa286e7c68b4b46c67e8468dd5d882183817583bc777cf281446d6425daa746e572fc9c665ed2079032683e476f72fffcf9e6787cb12c5fa160276759f6ee5afda010f1c5b58e958bf5c42cb69bae54dc9886d3d2fee1962a7e271481aab4723fb37601bdc78266158fc00f01af038cbde860d5e5a12f408e2ecb0cbb0ef67da33d44a8f6cfff96cb483f67fbe7772716d0067070b7e076578f5ba1c914924607027e728c5cdaa7c091f5d42243cfb1d506804188bcb226033a2acf72c469a2d4fabd493ed617fa2cd61e928052ca7fcc1b63bf24d576ea67f96e53a0d79877c89e326edd850f749d486b1f85311531b434ea8509c38a20e6480f9d185b2a4c16c802bb162cc51c05de429dbeccd0c7741c1c69c816d73e32d6454e15e50eccc1fa6947097cd25f5070fe24ca2ab81a10d89ea7777e0752ccd2ea436d4cbcf5ed5e8a4cae98362f45e1df32454c14059775a5ccc0c481b76f63776b9763c654d790bf6a587ac6f7892efe9fb04fb8651b9c1ab522856c63f934b707a61599c201d973acd38668afac2555f32f5c2d6989dbd560b230f9c177ad0a618684279d17b2c91c1e9d01175ed40cfcb17f1c7657dc4add96323e971de1793b98202942dbadf229fa490518bf09d2b283d4c6800ab938464b3ef1c4c2eec2db3a0c9f4d64c001ab8125f2a440b57277a7c61a1d1cf9d2618b096d8475fedabd3c4bbdd14eca8dfd40cd778594670331a5b840872ebb1f9c80f9007703d731a2cee2c9c0c4be919dcc2d1e23569ef12d55f9deec18b297e956dbe45fffc97869849a5095842e4d8c5702dfc522c8d4d8dfb4d2bd9a10e77433e381b03cc179130534f25ea81e6d6c581c0b5835f3dc44b92f9559d65d247bd1d57d483bf683147a57869de808287103f49d0c9661630e67191586bbe851e06dffd60a0fd39cbffa0da72b09aacdab1630d685c73bd9b0fd24e8f435ae96ac1b00333b9575e88e9765f14c29cdee08a528985416ede07ada9bacd73b4c73e7cb199993477a068dc18a5269bd4f622f164ac5bd1cf256beb2b133a61d6b30826371ac4a33ac674b8c3a0c111f8b7c6ece55a12e267bc2fd010c0d82d7cf1c06aa02e37acfcf2685f61f5b1581ec044e62a8e33d5d1269b205995285dc287db6633317861cb4f291f4ee71978a4b21757e664071985ae90d9a99cc14da6ea3474fe123b60d3265fd340a00f985acdc0da0f8ff979e8f6f27efe60c667ab48825832f4a4e2e7b31e229b7ec67443f942de8b424cdc92a2b5d4f3271976676bfafef0b5769df80a4c05b241ef2e54624f078a41f2bfbef05e20c0e133e90af679e6fa7f835e93ea76124c389b094e508ef26d1f7cc5a941598ce5fdb1cd84483109e018c9188dde58690745daeb0aee9476e33b935c8ad7d35d9eee3dc3592b02460000c3d5a1763dd42ea4e5b68e6875f1f6498fb2e30a918baa8b063ed6a6902910cfccf1f9fa75b2d2a4ed920d9f9065fbf2b92749271ba6abc9f55deba224f7d547db62c1feda3ce94e6c755edd40eec55e7683b9f2c9a680f0b8e915cbcbc7edbfac66063181559487b0adf586be414b766c82d10641ba574812fa495396cf6b17ff36ec0322e1aa9a6c1250c424452a15290ed1f9887ec08a40519dc28faf9dd1414874193afe7afd7f5b5b3f306b2ced07a32b45984852dd1b913ccca58e40a545bed64f21b16fe5cbb5d0e1bbfaa7af02e29c5736080ba1d501db950eac4942a33b2edb88ff054fdb32500b587152b1e12f2ebec4cafa5fb1997128f5747443dc919655d67438119fd77033dd6553685c37923d851023bde73f9ff82925f52a03e7106bf408ebbe4ea31db631e3b395113bcf00a81e6da018a1594b1b41fe942731c8b203334bd264ca540e9389a33018ab872dea055024af4328660377098a01b14a2daa8d464201b1a0dbb7b02200a11323360191166db42d9fb6f15f70832268743966a2b009a130bb8d3ac15e9eecd15d88237c76d3f72f9a2c2b5876a276f45efb19d766da02e404b5197514a4eac7f705f2e49b3b4a264690b32e7e674ddaca8a18d8e86175755ffca6b51d391f2db4c9ce1f11364d77fd523aeeee4b91e996ba79d187d11519fa1e749aef951f36dde4af7b261fc5439d4a0a4926c94ed93a7bc3760be98d05fbc1307fb667029a82f47597556bfbaacee91ad7e4d6c7ef210950d248bec736902eeb974571f0ac286af8d9059c8cd2eb4ec012fb7cad9f19286aaf64488c2390edc2fe7d92f1b1099b0fa2228896bef6565494896606ba21c40118aa35db3eab9e58fac1983ce5bbdcb955194d81d8583105c780eff19a0d98e8d43603ffc2cc2f1ced512aaa6c8f90e0126ca5678cd3e0850f093900aecf37c50dcae348550dda1bf1b7ed2630e627a19ac71fc418afcf7c0634c00bf1f9785a876b4be940ad05d1ffa5eae91fe10b447021fb5cbec9f5cc11cc1d700b30d7aa79ba7e499e3c22976503185a63e31e393a5cc723b3db89cd126b30de934f18e22978a67b2182cdb636362d6d7a1fd2c41654267bcad2a14f7025fb25d9eaa3a5e47d2120cb8b8ae4c186e7b9644757115b731ebfa3cc9eda34dae8ad1e87b069fe29e1cedcde44bf13c3ddacdc5ddef2640f15e1fd4c856237425a238706df0f47b3c16006f1d3bca7fde69e99f8a6d524d691757a37d5c44d24c47f4d51afe4a51368f09e8f8914b85d912ac19bb5b756754fa5590de8711a82785b731e93c32be4d070bb9a6769284021e487dbb93c1532792671bb1052247bb99e715e91b5e8dcc9d064f467809f07d5d32f28fb0a70f5207988f79f644182c8525e5947adf479c22c184c03b72ab0b8eecd945453214db1aee3ca687b0e087a0db85efcf69f155eac2768f4fee2b655f8d59842fc7d64c3cdc1b136fc349e8408370438aaad77ca9cdac779566caa4429daa2b8c3b71bca981e1dc679d30d18d04f1fc129982d8937bac14138c9c9fa1f8a02362b901def246c27e98de5dc12b7e7572155fe4e9d1bdcbe7c04189e45f4a57b7b7764b3ae6b2ef00caaa07ec5d6bfa248791de39dc805a8226d09bf1470a7b84a89ea41a03adbec4f9c10350a3043e906641b9e02723647d0e7efac7329640e2d36e5b47b8e6712effcf38f46dc054cddd2e64b0db8d10f140b14bcb89e594d18e6cf355da12996f92f008ef870e0c710cf4174f4e246b8138cb66c2d34e1ee395a199ae04f00f8d113c063b067bd0459621d049507bbbee65932fb2eabf4e00096bdbed9775cf7e5fb33a2c247f14ef3ca68c94d037ac68235a21e88a3ea4248a8cba8d48965d0948b23891a5059b14c327d366468d540b52b7ceb677cb46e58fb8560513d12438f53a3faa78e6ea3e55fa4369810a73add20c313498cd6ba1c37a924c968ed7e0ded2913c31ede492160f485d37af7b9d5cd318838291d16b3a4ec3ba34095a4835647f26c33f7582148b2cb107c191fac625fede2e68e21dc6a74307f00bebca9072a49d0fa30441d75eaa71482803ace96fada2de0d4ac2102a878c088efa7d36130d83c05ef0931bdfa3725fc30b3aab28c92b8ba0b967e6745911a4ef02f292e0e2ec7a05275b2643eea0b9cea6862fa54e247384277416e94972a07c3cc100ad4ec99a00a8596e873878f3e6bc37784020875f16fec5964bf8843d6fb192bc4b76a70e7fc31f03d218ed5ecd56987be3bdc77e8e4ae056d7f2fe547333dbbc433f7f81fdbb064f811e40c78a60742710af9f37d26b19f62c467045ac1dd3612bf471c81900e64c9af73c1a42f67d47a986e3c9ec0970cd97bbf1ef298bd32a8db4a598848de404cd175735d02d7dd4c204211f7362e84b265a1f07ca402ad923e72a4c93eaf76dab9114c5bbe3bc1c1a66f3d7576abbb8229991243728de56f15bfb0ec821c253fe64641c6311214dd204549e4bd39921cff9a7201e87f4fbae796c3fca311fb9a0547045195c11718da81582cae80ab9819ba7972aed96455899bbe4d851f4928b9a250fc16d7d824c78d8af3ed226c651dd028b9d465f27713fb7956b980bc9bd9b46a898e0ea6e130e49f52d6358c0ad802ddd5e5a77d4721ec4335ec3d1023721436a0051996eebf62a3edffdb", 0xe9d}], 0x1, &(0x7f0000006640)=ANY=[@ANYBLOB="9800000000000000de0000001b8e00009287eee789ae4701889ee283b06fc191e8e6d88cbb8ece2720204d93bc01955b368117df06fecfff6fb09f21f3342d4f1f2f5271af8791ec851ee0a4fdaf1fe60838e2405b51b8c8594e46e850b48e3bdf020f45b5d9bb39ff15ccc85997e8d2ec4a3045971cd0d01736692533737322b3856e564da0a29e2b6ce8b7aaa5f656654700000000000070000000000000001801000007000000f0d0dffbe28ad2ffbf58effbf976743e2e39aee2f4051cc5beefdb9c1d56790d43a41a17b187e05578ed5df0952c74c8dcd27f4a79627d047c50d604220be58f5a1609"], 0x108}}], 0x1, 0x0) 2.646945941s ago: executing program 3 (id=4): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0x2}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x52) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000700)='signal_generate\x00', r1}, 0x10) syz_open_procfs$namespace(0x0, 0xfffffffffffffffe) 1.25481901s ago: executing program 3 (id=7): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x20000800) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)={0x7c, r1, 0x5, 0x4, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x3f, 0xe, {{{}, {}, @device_b, @broadcast}, 0x1fffffffffffffe, @random=0x4, 0x0, @val={0x0, 0x6, @default_ibss_ssid}, @void, @void, @void, @void, @void, @void, @void, @val={0x3c, 0x4, {0x1, 0x7, 0x3c, 0x2}}, @void, @void, @val={0x71, 0x7, {0x1, 0x1, 0x0, 0x1, 0x1, 0xf0, 0x8}}, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x6}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x4}]}, 0x7c}}, 0x0) 741.301215ms ago: executing program 0 (id=8): recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r1, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x1, 0x5}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000240)={0x42, 0x1}, 0x10) bind$tipc(r0, 0x0, 0x0) 256.695308ms ago: executing program 2 (id=9): r0 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x9}, 0x1c) sendmmsg$inet(r0, &(0x7f0000001040)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000800)="3aae1baf930b4569b9ddef9797ffd935c7d80e6466b3e4e62dc9603583f5d4b61fbc65b6ac744d7319535e75bf552062e4cfde1ba7ce29263322e18ea9740aa82ca692f123993e57cda00d2b1f4e799bd41e3f76258180fa91a42aaa8b1ebc4e0ea8fb12f2c71e6e5bc57a8e91f254005514721d93c13c5606ae1fea7f31f558d562bd5a8dfb0b9fed873efa221fccffa847cd374c92e6cbb03e6a9de890ce323f000000abcc6c01326d588495b7c1a7db31ec4129e6336f26bb9e0b7552af3cd2d5dda1632799bbc98425c433384d8a8e4071ff39a36dfdfdf05af35a4ddd340cfecd7ec935f4ce7d3e851583ba1cf53a90a7f7bce5703de57ce93ddef7849b30a01de0637e6d5e507b801d32e582e0c2d564539ebfc84c098a23e765552767b122885fb1629e9c180be47da7931bd125b80de15aab0c56a2edf2e0483b87f5ab299dc046076203dea10ccbfc631d5bf4a87ce67004519f248f086346ce6a8a9d181789a59f81d9b7f6781daac3e229914b8b8998c15c3b6302a519331cb05995bc60b7cb872dd3b5b43331c77c5d72e21f7bd2b1a915ff3204e3f20d3a20b22d6a58155b5a4ebf6d1d1cd90c656ecada531c07ff91deb3efa91762cdecfbcc43553750f22ac5c18cc5e8b6f790c2f4e6373af9f98d10e6df49ff8e5cbcbd68e11ed0b967add11410dc2e34f08dea658eb95d4d1153b4c6093192a340eb30fcc71619888c6486746a049585d249efb96b9cace83320b8f96b40ebe3a9a788d05a053380d1026b9434df87a3a387549bcabe88684c4dbf0da9a5212f3dbc8d1dff240856691243b203d7edd4d3cc89a38a6c80fdb1229a01044af7aaecb20d5570ebf24b30bbc6dfc3f70d85cd9f0d60ebd8fedd161d199d9997a0e2d18d1c99bc7158564e0ddb4673055de196535d706d142e1dc7d404583923cb1b286cfc5418884ac7e605d93652dc48ff690894405a0b6abc3c4d0f6a16c0a95c0508bd7eeffcd1da0b17f7701448658864b429e9472e", 0x2d2}, {&(0x7f0000001200)="ab29d92826349952eb8f7a2a74f535bc9739c1df57144c51a3391625b8b5354134b06ef1355506aeae96e3f097503998f375a054cf3d7de4fe53ea51518955349cdbadca60e1c65cc18dbe99369be03e492fb55fc9067bb6f7f7c3ee1720000000054a63ac58225ed0502f5ac8999e0c74a5dbb320bd54ec813e8bee6bfa5cbfb0726ac1b6ad97d802d5fae186f0768021fb965c7396854e2a3ac844a3769f8449901ba5e2b2da1ff6119aeb26ac204cfc6b54be73b6f195491ae2c0cb26b0cba61dae7a17740e8112ff188919c6e2e31a2a074863edba4a0e58b61f48eccfcc29d7f9e48a43b8cb7d3c5a1e5aa67f87538140f8d633a54bceb8b1dda2397ea147d3b26e903f608b6ab1844ea7cf630d828118bba0f0f85e2e6316ae1ed9a2a7d08a05c170cb76bf111930df0cf760f7768571afdefe82a95296cee7c010f748a97046efcc774e7d85edbd5058104fef4942fb4430da89f67d1fea33bf2acfb793a6e453a8a28cd5c4b733fc8e8f630932206960e9076c7d7fc99fce018701c50d39b811a7427a7a9fcb340c2755541f228462010ec40ba945a0febd460dad5d548f1be090f5dbaa8ae8835dc47ed2537681827f6129759272574cf58f2f33c0bb3c24fa67c327cde47a0e416573cfdcfb44ed9dd4ce41af4de9c471c49f120790934c3b32f2f4777c65b15748267223cbde856fa5a33f12cb1ea51da9ce96881d1aa6d096ed6b23190800000081803a2119d9efd47b1abba3c1e6c563c1ec692da80ef66b19495b8e801d", 0x22b}, {&(0x7f0000000140)="5be081cd2e5383c893e2c864f68d8573838b7c45b1b91b502672fbed5f011c8997b7ab38d99b9455046f57b5fc090014b5e2bb01000000000000001a7838d85997aa2fa46ff7203067c30aa7352abbdf98e9bf033a3184a11e84639d3b91f8cb16eeb4eff27492712fcf94d28549f37bd93c88ead64493602291b385aa18601c787fc7", 0x83}], 0x3, 0x0, 0x0, 0x900}}], 0x1, 0x0) 218.758723ms ago: executing program 1 (id=10): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) pipe(0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b6db714e4b94bdae214fa68a0557eb3c5ca683a4b6fc89398f2b9000f224891060017c4700de60beac671e8e8fdecb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c5553d2ccb5fc5b51fe6b174ebd9907dcff414ed55b0d18a93ee341ab59016f81860324b800300000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4a801efdf008499"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x34, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSETELEM={0x2c, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x4}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xa8}}, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x12, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000040)={@map=r6, r4, 0x26}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000a80)={r6, 0x0, &(0x7f0000000a40)=@tcp6}, 0x1c) socketpair$unix(0x1, 0x1, 0x0, 0x0) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nbd(&(0x7f0000000a00), 0xffffffffffffffff) sendmsg$NBD_CMD_STATUS(r7, &(0x7f0000000dc0)={0x0, 0x0, &(0x7f0000000d80)={&(0x7f0000000c80)={0x1c, r8, 0x411, 0x70bd2d, 0x25dfdbff, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000502000002"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b7080000000010007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x305200, 0x0) close(r10) r11 = socket$unix(0x1, 0x1, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r13, {0x0, 0xb}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xa, 0x7f61, 0x1, 0xc5, 0xe23, 0x1, 0x1, 0x7fff, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008001}, 0x8080) sendmsg$nl_route_sched(r12, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000880)=@newqdisc={0x64, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x80000, {0x0, 0x0, 0x0, r13, {0x0, 0x9}, {0xffe6, 0xb}, {0xffe0, 0x14}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x38, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xf, 0x2, 0xe, 0x0, 0x7fff, 0x38f7}, {0x9, 0x1, 0x0, 0xfffe, 0x8, 0x401}, 0xf5, 0x80000001, 0x210e}}, @TCA_TBF_PRATE64={0xc, 0x5, 0xee3ce641f2ef5769}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x20004064}, 0x4008000) sendmsg$MPTCP_PM_CMD_REMOVE(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x24, 0x0, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x2}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0xc0}, 0x50) 62.316113ms ago: executing program 2 (id=11): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000840)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000071000000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) r3 = socket$key(0xf, 0x3, 0x2) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000100)) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r6 = dup3(r5, r4, 0x0) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000004a40)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) sendmsg$key(r3, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000100)={0x2, 0x3, 0x0, 0x3, 0xe, 0x0, 0x700, 0x0, [@sadb_key={0x4, 0x9, 0xa0, 0x0, "01d78771b90bd8a3b4914783c58777003d5b9538"}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @private}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x2, 0xd}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @dev}}]}, 0x70}, 0x1, 0x7}, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) r9 = syz_open_dev$vim2m(&(0x7f0000000280), 0x4, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r9, 0xc0405602, 0x0) sendmsg$OSF_MSG_ADD(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)={0x268, 0x0, 0x5, 0x401, 0x0, 0x0, {0xa, 0x0, 0xa}, [{{0x254, 0x1, {{0x0, 0x7}, 0x7, 0x1, 0x4, 0x0, 0x2, 'syz1\x00', "523ca936f8f61abb3d7b1d6e25ad96acfe31ce82f2f500eb00d82e396194db04", "0b6bf1b1639cd090c61155070ae569ac4a65ef2100", [{0x8, 0x9, {0x1, 0xf}}, {0x800, 0x7, {0x1, 0xb}}, {0x9, 0x18, {0x0, 0x56c}}, {0x8, 0x1, {0x3, 0x2d}}, {0x0, 0x42, {0x0, 0x401}}, {0xffa8, 0x1, {0x3}}, {0xfff8, 0x7, {0x1, 0x2}}, {0x4, 0x1, {0x0, 0x1000000}}, {0x0, 0xfff7, {0x1, 0xa}}, {0xc, 0xff, {0x1, 0x7}}, {0x1000, 0x9, {0x1, 0xd3f}}, {0x16, 0x9, {0x0, 0x99}}, {0xe45a, 0x4fd, {0x2, 0xe3c7305}}, {0x6, 0x8, {0x1, 0x4}}, {0x2, 0xc, {0x1, 0x9}}, {0x9, 0x5, {0x2, 0x7f}}, {0x1, 0x1000, {0x2, 0x3}}, {0x0, 0xfff, {0x1, 0x2}}, {0x9, 0x7, {0x0, 0x3fd}}, {0x1, 0x10, {0x0, 0x7fff}}, {0x200e, 0x40, {0x3, 0x90a}}, {0x5, 0x2, {0x2, 0x3}}, {0x9, 0x6, {0x2, 0x6}}, {0xefe7, 0x6, {0x1, 0x5}}, {0x9, 0x6, {0x3, 0x2}}, {0x40, 0x6ba5, {0x2, 0x8}}, {0xd9, 0xcf83, {0x1, 0xc}}, {0x2, 0xff7b, {0x2, 0x9953}}, {0x8000, 0xb, {0x1, 0xfd}}, {0xc, 0x2, {0x2, 0xb}}, {0x8003, 0x5, {0x1, 0x7}}, {0x1, 0x4, {0x2, 0xe141}}, {0x1000, 0x40, {0x0, 0x5}}, {0x2, 0x5, {0x0, 0x4}}, {0xb, 0x1, {0x3, 0x4}}, {0x4, 0x58, {0x1, 0x7}}, {0x6, 0xe, {0x3, 0x10001}}, {0x8, 0x6e, {0x2, 0x7fffffff}}, {0x3, 0xff, {0x2, 0x7}}, {0x400, 0x8, {0x0, 0x8}}]}}}]}, 0x268}, 0x1, 0x0, 0x0, 0x854}, 0x4004000) 0s ago: executing program 0 (id=12): add_key(&(0x7f0000000000)='keyring\x00', 0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2255, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) syz_open_dev$video(&(0x7f0000000880), 0x7ff, 0x60b00) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) msgrcv(0x0, 0x0, 0x0, 0x0, 0xa1e3a9fe3eb9c551) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[], 0x48) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x23) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r2, 0x7a7, &(0x7f0000000000)=0x10000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r2, 0x7a0, &(0x7f0000000100)={@local}) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(r2, 0x7b2, &(0x7f0000001680)={&(0x7f0000000680)=[0x20000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x10, 0xe3, 0x0, 0x0, 0x0, 0x3, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcb776f6, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x8001, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7357c35c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x9, 0x0, 0x0, 0x5, 0x4, 0x40000, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xba000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1cd5a44b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd4, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x4], 0x1, 0x400}) ioctl$IOCTL_VMCI_CTX_REMOVE_NOTIFICATION(r2, 0x7b0, &(0x7f00000000c0)={@hyper, 0x1}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x1fd, 0x0, 0xdddd1000, 0x1000, &(0x7f0000394000/0x1000)=nil}) userfaultfd(0x80001) socket$netlink(0x10, 0x3, 0x1) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0301, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r3, 0xc004500a, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r3, 0xc0045006, &(0x7f0000000180)=0x6f) openat$dsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.30' (ED25519) to the list of known hosts. [ 82.384175][ T5757] cgroup: Unknown subsys name 'net' [ 82.551137][ T5757] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 84.286756][ T5757] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 86.532749][ T5773] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 86.543021][ T5785] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 86.551107][ T5785] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 86.559132][ T5785] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 86.568010][ T5785] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 86.575944][ T5785] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 86.583471][ T5785] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 86.619952][ T5778] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 86.644546][ T5786] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 86.652825][ T5778] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 86.653777][ T5786] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 86.665133][ T5783] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 86.672756][ T5786] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 86.678516][ T5783] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 86.685062][ T5786] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 86.696002][ T5783] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 86.704504][ T5778] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 86.713324][ T5783] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 86.721054][ T5783] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 86.729221][ T5778] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 86.736535][ T5786] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 86.737021][ T5778] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 86.750604][ T5786] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 86.758863][ T5786] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 87.294727][ T5770] chnl_net:caif_netlink_parms(): no params data found [ 87.306679][ T5769] chnl_net:caif_netlink_parms(): no params data found [ 87.463469][ T5767] chnl_net:caif_netlink_parms(): no params data found [ 87.565452][ T5768] chnl_net:caif_netlink_parms(): no params data found [ 87.624139][ T5769] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.633039][ T5769] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.640878][ T5769] bridge_slave_0: entered allmulticast mode [ 87.648518][ T5769] bridge_slave_0: entered promiscuous mode [ 87.659908][ T5769] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.667596][ T5769] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.675136][ T5769] bridge_slave_1: entered allmulticast mode [ 87.683196][ T5769] bridge_slave_1: entered promiscuous mode [ 87.695309][ T5770] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.703267][ T5770] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.711157][ T5770] bridge_slave_0: entered allmulticast mode [ 87.718677][ T5770] bridge_slave_0: entered promiscuous mode [ 87.776436][ T5770] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.784088][ T5770] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.793024][ T5770] bridge_slave_1: entered allmulticast mode [ 87.801043][ T5770] bridge_slave_1: entered promiscuous mode [ 87.880944][ T5769] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.972809][ T5769] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.992417][ T5770] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.010288][ T5770] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.022114][ T5767] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.029335][ T5767] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.042101][ T5767] bridge_slave_0: entered allmulticast mode [ 88.049598][ T5767] bridge_slave_0: entered promiscuous mode [ 88.136696][ T5767] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.145469][ T5767] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.155332][ T5767] bridge_slave_1: entered allmulticast mode [ 88.163102][ T5767] bridge_slave_1: entered promiscuous mode [ 88.191838][ T5769] team0: Port device team_slave_0 added [ 88.201997][ T5769] team0: Port device team_slave_1 added [ 88.211645][ T5770] team0: Port device team_slave_0 added [ 88.221795][ T5770] team0: Port device team_slave_1 added [ 88.245365][ T5767] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.368384][ T5767] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.378142][ T5768] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.386273][ T5768] bridge0: port 1(bridge_slave_0) entered disabled state [ 88.394764][ T5768] bridge_slave_0: entered allmulticast mode [ 88.402085][ T5768] bridge_slave_0: entered promiscuous mode [ 88.410382][ T5769] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.418263][ T5769] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.445389][ T5769] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.489952][ T5768] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.498179][ T5768] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.508461][ T5768] bridge_slave_1: entered allmulticast mode [ 88.516125][ T5768] bridge_slave_1: entered promiscuous mode [ 88.537051][ T5769] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.544483][ T5769] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.572103][ T5769] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.585148][ T5770] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.592509][ T5770] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.618806][ T5770] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.678574][ T5770] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.687231][ T5770] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.713901][ T5770] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.734427][ T5767] team0: Port device team_slave_0 added [ 88.746643][ T5768] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.759477][ T5768] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.781743][ T5778] Bluetooth: hci1: command tx timeout [ 88.781760][ T5777] Bluetooth: hci0: command tx timeout [ 88.797067][ T5767] team0: Port device team_slave_1 added [ 88.861084][ T5778] Bluetooth: hci2: command tx timeout [ 88.861123][ T5777] Bluetooth: hci3: command tx timeout [ 88.886797][ T5769] hsr_slave_0: entered promiscuous mode [ 88.893961][ T5769] hsr_slave_1: entered promiscuous mode [ 88.904384][ T5767] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.911975][ T5767] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.939616][ T5767] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.954873][ T5767] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.961972][ T5767] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.988392][ T5767] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.005218][ T5768] team0: Port device team_slave_0 added [ 89.014840][ T5768] team0: Port device team_slave_1 added [ 89.037809][ T5770] hsr_slave_0: entered promiscuous mode [ 89.045030][ T5770] hsr_slave_1: entered promiscuous mode [ 89.052339][ T5770] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 89.060301][ T5770] Cannot create hsr debugfs directory [ 89.184609][ T5767] hsr_slave_0: entered promiscuous mode [ 89.192023][ T5767] hsr_slave_1: entered promiscuous mode [ 89.198513][ T5767] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 89.206303][ T5767] Cannot create hsr debugfs directory [ 89.228014][ T5768] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 89.236719][ T5768] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.267472][ T5768] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 89.325698][ T5768] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 89.333422][ T5768] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 89.360817][ T5768] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 89.534825][ T5768] hsr_slave_0: entered promiscuous mode [ 89.542354][ T5768] hsr_slave_1: entered promiscuous mode [ 89.548993][ T5768] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 89.558122][ T5768] Cannot create hsr debugfs directory [ 89.818938][ T5770] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 89.835873][ T5770] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 89.865039][ T5770] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 89.901853][ T5770] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 89.954551][ T5769] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 89.965932][ T5769] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 89.976763][ T5769] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 89.988541][ T5769] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 90.064333][ T5767] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 90.096508][ T5767] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 90.107369][ T5767] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 90.118991][ T5767] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 90.226886][ T5768] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 90.256075][ T5768] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 90.268912][ T5768] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 90.279499][ T5768] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 90.404190][ T5770] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.475040][ T5770] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.494139][ T5767] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.522703][ T2879] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.530165][ T2879] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.548720][ T2879] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.556044][ T2879] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.609517][ T5769] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.638044][ T5767] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.694457][ T169] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.701884][ T169] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.719838][ T169] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.727179][ T169] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.745781][ T5768] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.763879][ T5769] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.812459][ T2952] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.819830][ T2952] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.847480][ T2952] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.854737][ T2952] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.862721][ T5777] Bluetooth: hci1: command tx timeout [ 90.868352][ T5778] Bluetooth: hci0: command tx timeout [ 90.923714][ T5768] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.941417][ T5777] Bluetooth: hci3: command tx timeout [ 90.947215][ T5778] Bluetooth: hci2: command tx timeout [ 90.983357][ T4307] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.990682][ T4307] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.033302][ T2958] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.040576][ T2958] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.267411][ T5770] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.409663][ T5770] veth0_vlan: entered promiscuous mode [ 91.447284][ T5770] veth1_vlan: entered promiscuous mode [ 91.565937][ T5770] veth0_macvtap: entered promiscuous mode [ 91.615104][ T5770] veth1_macvtap: entered promiscuous mode [ 91.698778][ T5770] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.726803][ T5770] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.746635][ T5770] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.755885][ T5770] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.766450][ T5770] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.775745][ T5770] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.803067][ T5767] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.898563][ T5769] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.909140][ T5768] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.024336][ T5767] veth0_vlan: entered promiscuous mode [ 92.031580][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.048704][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.088260][ T5767] veth1_vlan: entered promiscuous mode [ 92.145490][ T5769] veth0_vlan: entered promiscuous mode [ 92.155731][ T2879] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.175425][ T5769] veth1_vlan: entered promiscuous mode [ 92.189517][ T2879] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.214132][ T5767] veth0_macvtap: entered promiscuous mode [ 92.236759][ T5767] veth1_macvtap: entered promiscuous mode [ 92.253280][ T5768] veth0_vlan: entered promiscuous mode [ 92.343921][ T5768] veth1_vlan: entered promiscuous mode [ 92.355731][ T5767] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.368578][ T5767] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.382046][ T5767] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.390180][ T5769] veth0_macvtap: entered promiscuous mode [ 92.426106][ T5767] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 92.446738][ T5767] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.459143][ T5767] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.472393][ T5769] veth1_macvtap: entered promiscuous mode [ 92.540026][ T5768] veth0_macvtap: entered promiscuous mode [ 92.553980][ T5767] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.566150][ T5767] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.576686][ T5767] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.585888][ T5767] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.614038][ T5769] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.626019][ T5769] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.643473][ T5769] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.657181][ T5769] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.675524][ T5769] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.696347][ T5768] veth1_macvtap: entered promiscuous mode [ 92.712461][ T27] cfg80211: failed to load regulatory.db [ 92.774050][ T5769] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 92.788011][ T5769] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.807231][ T5769] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 92.820319][ T5769] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.836236][ T5769] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.908109][ T5768] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.921079][ T5768] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.932633][ T5768] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.941360][ T5777] Bluetooth: hci1: command tx timeout [ 92.948531][ T5768] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.948617][ T5768] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 92.970435][ T5778] Bluetooth: hci0: command tx timeout [ 92.979550][ T5768] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 92.992049][ T5768] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.002730][ T5769] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.011679][ T5769] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.021004][ T5778] Bluetooth: hci2: command tx timeout [ 93.026592][ T5778] Bluetooth: hci3: command tx timeout [ 93.033208][ T5769] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.049598][ T5769] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.158543][ T5768] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 93.176238][ T5768] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.188425][ T5768] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 93.208625][ T5768] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.220258][ T5768] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 93.237769][ T5768] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 93.250907][ T5768] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.325970][ T5768] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.345523][ T5768] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.355481][ T5768] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.369264][ T5768] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.442655][ T2952] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.473002][ T2952] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.646621][ T2952] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.692302][ T2952] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.813365][ T2958] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.846565][ T2958] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.894048][ T5869] random: crng reseeded on system resumption [ 93.935225][ T2952] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.979751][ T2952] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.080055][ T169] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.116301][ T169] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.245225][ T2879] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.259943][ T2879] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.844385][ T5878] tipc: Started in network mode [ 94.879815][ T5878] tipc: Node identity 84e, cluster identity 4711 [ 94.961842][ T5878] tipc: Node number set to 2126 [ 94.968700][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 95.067456][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 95.223197][ T5777] Bluetooth: hci1: command tx timeout [ 95.229160][ T5777] Bluetooth: hci0: command tx timeout [ 95.239689][ T5777] Bluetooth: hci3: command tx timeout [ 95.248789][ T5777] Bluetooth: hci2: command tx timeout [ 95.421055][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 95.476904][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 95.591242][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 95.681444][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 95.712121][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 95.741020][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 95.749279][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 95.783931][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 96.965627][ T5889] tipc: Failed to remove unknown binding: 66,1,1/2126:1013193007/1013193009 [ 97.050135][ T5893] tipc: Enabling of bearer rejected, failed to enable media [ 97.115435][ C0] ------------[ cut here ]------------ [ 97.121377][ C0] no supported rates for sta (null) (0xffffffff, band 0) in rate_mask 0xfff with flags 0x20 [ 97.132487][ C0] WARNING: CPU: 0 PID: 16 at net/mac80211/rate.c:385 __rate_control_send_low+0x635/0x880 [ 97.142726][ C0] Modules linked in: [ 97.146966][ C0] CPU: 0 PID: 16 Comm: ksoftirqd/0 Not tainted syzkaller #0 [ 97.154392][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 97.164562][ C0] RIP: 0010:__rate_control_send_low+0x635/0x880 [ 97.170961][ C0] Code: 30 42 0f b6 04 28 84 c0 0f 85 e6 01 00 00 41 8b 0e 48 c7 c7 00 68 be 8b 48 8b 74 24 10 44 8b 44 24 1c 45 89 e1 e8 2b 16 70 f7 <0f> 0b e9 78 fe ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 03 fa ff [ 97.191027][ C0] RSP: 0018:ffffc900001573c0 EFLAGS: 00010246 [ 97.197258][ C0] RAX: 172c915a105e1400 RBX: 000000000000000c RCX: ffff88801b265a00 [ 97.205450][ C0] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002 [ 97.213529][ C0] RBP: 0000000000000084 R08: ffffc90000156fc7 R09: 1ffff9200002adf8 [ 97.221684][ C0] R10: dffffc0000000000 R11: fffff5200002adf9 R12: 0000000000000020 [ 97.229756][ C0] R13: dffffc0000000000 R14: ffff88807cb03358 R15: ffff8880214557a8 [ 97.237889][ C0] FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 97.247052][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 97.253866][ C0] CR2: 00007f0356a5bf98 CR3: 0000000062f25000 CR4: 00000000003506f0 [ 97.262129][ C0] Call Trace: [ 97.265474][ C0] [ 97.268481][ C0] rate_control_send_low+0x194/0x790 [ 97.273914][ C0] rate_control_get_rate+0x20b/0x5c0 [ 97.279422][ C0] ieee80211_beacon_get_finish+0x38d/0x6b0 [ 97.285397][ C0] ? ieee80211_set_beacon_cntdwn+0x660/0x660 [ 97.291600][ C0] ? __local_bh_enable_ip+0x12e/0x1c0 [ 97.297306][ C0] ? _local_bh_enable+0xa0/0xa0 [ 97.302309][ C0] ieee80211_beacon_get_ap+0x1429/0x1970 [ 97.308227][ C0] ? ieee80211_tx_8023+0x3c0/0x3c0 [ 97.313687][ C0] ? read_lock_is_recursive+0x20/0x20 [ 97.319329][ C0] ? __ieee80211_beacon_get+0x36/0x1600 [ 97.325230][ C0] __ieee80211_beacon_get+0x10eb/0x1600 [ 97.331259][ C0] ? __ieee80211_beacon_get+0x36/0x1600 [ 97.336992][ C0] ieee80211_beacon_get_tim+0xb8/0x560 [ 97.342571][ C0] ? ieee80211_beacon_get_template_ema_list+0x90/0x90 [ 97.349615][ C0] mac80211_hwsim_beacon_tx+0x3c7/0x780 [ 97.355317][ C0] __iterate_interfaces+0x243/0x500 [ 97.360737][ C0] ? mac80211_hwsim_vendor_cmd_test+0x2b0/0x2b0 [ 97.367055][ C0] ? ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 [ 97.374383][ C0] ? mac80211_hwsim_vendor_cmd_test+0x2b0/0x2b0 [ 97.380730][ C0] ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 [ 97.387930][ C0] mac80211_hwsim_beacon+0xbb/0x1b0 [ 97.393253][ C0] __hrtimer_run_queues+0x51e/0xc40 [ 97.398523][ C0] ? hw_scan_work+0xf40/0xf40 [ 97.403316][ C0] ? hrtimer_interrupt+0x9c0/0x9c0 [ 97.408756][ C0] ? ktime_get_update_offsets_now+0x3d2/0x3f0 [ 97.414939][ C0] hrtimer_run_softirq+0x187/0x2b0 [ 97.420203][ C0] handle_softirqs+0x280/0x820 [ 97.425261][ C0] ? run_ksoftirqd+0x9c/0xf0 [ 97.429934][ C0] ? do_softirq+0x180/0x180 [ 97.434605][ C0] run_ksoftirqd+0x9c/0xf0 [ 97.439054][ C0] ? ksoftirqd_should_run+0x20/0x20 [ 97.444376][ C0] ? takeover_tasklets+0x810/0x810 [ 97.449608][ C0] ? takeover_tasklets+0x810/0x810 [ 97.454866][ C0] ? ksoftirqd_should_run+0x20/0x20 [ 97.460096][ C0] smpboot_thread_fn+0x635/0xa00 [ 97.465287][ C0] ? smpboot_thread_fn+0x50/0xa00 [ 97.470542][ C0] kthread+0x2fa/0x390 [ 97.474685][ C0] ? smpboot_unregister_percpu_thread+0x2a0/0x2a0 [ 97.481185][ C0] ? kthread_blkcg+0xd0/0xd0 [ 97.485803][ C0] ret_from_fork+0x48/0x80 [ 97.490375][ C0] ? kthread_blkcg+0xd0/0xd0 [ 97.495019][ C0] ret_from_fork_asm+0x11/0x20 [ 97.499986][ C0] [ 97.503229][ C0] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 97.510587][ C0] CPU: 0 PID: 16 Comm: ksoftirqd/0 Not tainted syzkaller #0 [ 97.518318][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 97.528744][ C0] Call Trace: [ 97.532059][ C0] [ 97.535201][ C0] dump_stack_lvl+0x16c/0x230 [ 97.540170][ C0] ? show_regs_print_info+0x20/0x20 [ 97.545640][ C0] ? load_image+0x3b0/0x3b0 [ 97.550285][ C0] panic+0x2c0/0x710 [ 97.554717][ C0] ? bpf_jit_dump+0xd0/0xd0 [ 97.559617][ C0] ? ret_from_fork_asm+0x11/0x20 [ 97.564680][ C0] __warn+0x2e0/0x470 [ 97.568776][ C0] ? __rate_control_send_low+0x635/0x880 [ 97.574430][ C0] ? __rate_control_send_low+0x635/0x880 [ 97.580084][ C0] report_bug+0x2be/0x4f0 [ 97.584434][ C0] ? __rate_control_send_low+0x635/0x880 [ 97.590363][ C0] ? __rate_control_send_low+0x635/0x880 [ 97.596010][ C0] ? __rate_control_send_low+0x637/0x880 [ 97.601666][ C0] handle_bug+0xcf/0x120 [ 97.605945][ C0] exc_invalid_op+0x1a/0x50 [ 97.610535][ C0] asm_exc_invalid_op+0x1a/0x20 [ 97.615474][ C0] RIP: 0010:__rate_control_send_low+0x635/0x880 [ 97.621751][ C0] Code: 30 42 0f b6 04 28 84 c0 0f 85 e6 01 00 00 41 8b 0e 48 c7 c7 00 68 be 8b 48 8b 74 24 10 44 8b 44 24 1c 45 89 e1 e8 2b 16 70 f7 <0f> 0b e9 78 fe ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 03 fa ff [ 97.641415][ C0] RSP: 0018:ffffc900001573c0 EFLAGS: 00010246 [ 97.647602][ C0] RAX: 172c915a105e1400 RBX: 000000000000000c RCX: ffff88801b265a00 [ 97.655678][ C0] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002 [ 97.663752][ C0] RBP: 0000000000000084 R08: ffffc90000156fc7 R09: 1ffff9200002adf8 [ 97.671736][ C0] R10: dffffc0000000000 R11: fffff5200002adf9 R12: 0000000000000020 [ 97.679805][ C0] R13: dffffc0000000000 R14: ffff88807cb03358 R15: ffff8880214557a8 [ 97.688001][ C0] rate_control_send_low+0x194/0x790 [ 97.693367][ C0] rate_control_get_rate+0x20b/0x5c0 [ 97.698672][ C0] ieee80211_beacon_get_finish+0x38d/0x6b0 [ 97.704527][ C0] ? ieee80211_set_beacon_cntdwn+0x660/0x660 [ 97.710576][ C0] ? __local_bh_enable_ip+0x12e/0x1c0 [ 97.716124][ C0] ? _local_bh_enable+0xa0/0xa0 [ 97.721016][ C0] ieee80211_beacon_get_ap+0x1429/0x1970 [ 97.726683][ C0] ? ieee80211_tx_8023+0x3c0/0x3c0 [ 97.731831][ C0] ? read_lock_is_recursive+0x20/0x20 [ 97.737419][ C0] ? __ieee80211_beacon_get+0x36/0x1600 [ 97.743132][ C0] __ieee80211_beacon_get+0x10eb/0x1600 [ 97.748752][ C0] ? __ieee80211_beacon_get+0x36/0x1600 [ 97.754460][ C0] ieee80211_beacon_get_tim+0xb8/0x560 [ 97.760076][ C0] ? ieee80211_beacon_get_template_ema_list+0x90/0x90 [ 97.766908][ C0] mac80211_hwsim_beacon_tx+0x3c7/0x780 [ 97.772518][ C0] __iterate_interfaces+0x243/0x500 [ 97.777775][ C0] ? mac80211_hwsim_vendor_cmd_test+0x2b0/0x2b0 [ 97.784235][ C0] ? ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 [ 97.791467][ C0] ? mac80211_hwsim_vendor_cmd_test+0x2b0/0x2b0 [ 97.797735][ C0] ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 [ 97.804872][ C0] mac80211_hwsim_beacon+0xbb/0x1b0 [ 97.810791][ C0] __hrtimer_run_queues+0x51e/0xc40 [ 97.816025][ C0] ? hw_scan_work+0xf40/0xf40 [ 97.820744][ C0] ? hrtimer_interrupt+0x9c0/0x9c0 [ 97.825915][ C0] ? ktime_get_update_offsets_now+0x3d2/0x3f0 [ 97.832139][ C0] hrtimer_run_softirq+0x187/0x2b0 [ 97.837301][ C0] handle_softirqs+0x280/0x820 [ 97.842116][ C0] ? run_ksoftirqd+0x9c/0xf0 [ 97.846724][ C0] ? do_softirq+0x180/0x180 [ 97.851337][ C0] run_ksoftirqd+0x9c/0xf0 [ 97.855936][ C0] ? ksoftirqd_should_run+0x20/0x20 [ 97.861179][ C0] ? takeover_tasklets+0x810/0x810 [ 97.866366][ C0] ? takeover_tasklets+0x810/0x810 [ 97.871528][ C0] ? ksoftirqd_should_run+0x20/0x20 [ 97.876745][ C0] smpboot_thread_fn+0x635/0xa00 [ 97.881714][ C0] ? smpboot_thread_fn+0x50/0xa00 [ 97.886774][ C0] kthread+0x2fa/0x390 [ 97.890860][ C0] ? smpboot_unregister_percpu_thread+0x2a0/0x2a0 [ 97.897444][ C0] ? kthread_blkcg+0xd0/0xd0 [ 97.902056][ C0] ret_from_fork+0x48/0x80 [ 97.906673][ C0] ? kthread_blkcg+0xd0/0xd0 [ 97.911322][ C0] ret_from_fork_asm+0x11/0x20 [ 97.916207][ C0] [ 97.919934][ C0] Kernel Offset: disabled [ 97.924312][ C0] Rebooting in 86400 seconds..