last executing test programs: 1h9m48.034483917s ago: executing program 0 (id=19): openat$procfs(0xffffffffffffff9c, &(0x7f0000000440)='/proc/mdstat\x00', 0x1800, 0x0) r0 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0x84c0, 0x0, 0xffffffff, 0x121}, &(0x7f0000000100)=0x0, &(0x7f00000003c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x9048}}) io_uring_enter(r0, 0x47f6, 0x0, 0x0, 0x0, 0x0) 1h9m41.22732418s ago: executing program 0 (id=21): bpf$MAP_CREATE(0x0, 0x0, 0x48) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}}, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000009c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r6, {0x0, 0xd}, {0x6, 0xb}, {0xa, 0xb}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0x8001, 0x4, 0x0, 0x401, 0x0, 0x5, 0xffff, 0x200}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x2001c061}, 0x4008000) sendto$packet(r4, 0x0, 0x0, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r3, 0x1, 0xd8, 0x6, @broadcast}, 0x14) 1h9m13.09370314s ago: executing program 0 (id=23): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x3}, @NFTA_LIMIT_BURST={0x8, 0x3, 0x1, 0x0, 0x81}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x8c}}, 0x0) 1h9m0.804308396s ago: executing program 0 (id=24): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000003040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r2, &(0x7f0000003180)={0x0, 0x0, &(0x7f0000003140)={&(0x7f0000003080)={0x28, r1, 0xe6e964277ae08d57, 0x70bd2c, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @loopback}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x8040000}, 0x90) sendto$inet(r0, &(0x7f00000000c0)="8b", 0x1, 0x0, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000)="1c", 0x1, 0x80, 0x0, 0x0) 1h8m53.851446429s ago: executing program 0 (id=26): mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000300)={&(0x7f0000cdb000/0x4000)=nil, 0x4000}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) 1h8m32.629959581s ago: executing program 0 (id=30): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x0, 0x0, 0x200000, 0x0, 0xb49, 0x9, 0xc, 0x0, 0x1}, 0x0) read$dsp(0xffffffffffffffff, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, 0x0, 0x0) r3 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r3, 0x29, 0x36, &(0x7f0000000600)=ANY=[], 0x8) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4e2a, 0xffffffff, @mcast2, 0x9}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) 1h7m45.912539675s ago: executing program 32 (id=30): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x0, 0x0, 0x200000, 0x0, 0xb49, 0x9, 0xc, 0x0, 0x1}, 0x0) read$dsp(0xffffffffffffffff, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, 0x0, 0x0) r3 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r3, 0x29, 0x36, &(0x7f0000000600)=ANY=[], 0x8) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4e2a, 0xffffffff, @mcast2, 0x9}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) 1m3.515008336s ago: executing program 2 (id=599): syz_usb_connect(0x2, 0x56, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000c9d1c40899040a50b7e70102030109024400020000000009049700010dd5ce0008240201000000000905000000000000000705a3f6d2fb5b09040000014106cf0008240201000000000905c926"], 0x0) syz_open_dev$sndctrl(&(0x7f0000000040), 0x2, 0x2a803) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x0) 53.902307454s ago: executing program 1 (id=601): r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[], 0x1a000}}, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)) close_range(r1, 0xffffffffffffffff, 0x0) 52.948722447s ago: executing program 2 (id=602): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r3, 0x25, &(0x7f00000000c0)) close(r3) 49.098046607s ago: executing program 1 (id=603): socket$kcm(0x10, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000001c0)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000580)='[=', 0x2}], 0x1, 0x0, 0x0, 0x40044}}], 0x1, 0x4c095) setsockopt$sock_int(r2, 0x1, 0x10, &(0x7f00000002c0)=0x8001, 0x4) write$binfmt_elf64(r3, &(0x7f0000000600)=ANY=[], 0x78) recvmmsg(r2, &(0x7f00000010c0)=[{{0x0, 0x0, 0x0}, 0x41}], 0x1, 0x382, 0x0) 24.619209729s ago: executing program 1 (id=604): sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x32, 0x0, &(0x7f0000000400)=[@increfs], 0xfffffcb0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000540)={@fd={0x66642a85, 0x0, r3}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1, 0x29}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000600)={0x0, 0x18, 0x40}}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000700)="0a1398f8668babb9862aa1c9ea0380d18dafd06547dd62179ba79df1971b787788d854fbec0fe18f84085926de2d9ab0b6f1512c6dbc8a704453c6de009e89414d8518e3dcdd32ecd952f78f6c58a9fd"}) 21.139490296s ago: executing program 2 (id=605): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) 13.746336953s ago: executing program 1 (id=606): r0 = syz_io_uring_setup(0xb, &(0x7f00000002c0)={0x0, 0x5d09, 0x1, 0x1, 0x100020b}, &(0x7f0000000040)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0xc000000, &(0x7f00000001c0)=[{0x0}, {0x0}], 0x2, 0x12}) io_uring_enter(r0, 0x847ba, 0x0, 0xe, 0x0, 0x0) 11.623169111s ago: executing program 2 (id=607): r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[], 0x1a000}}, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)) close_range(r1, 0xffffffffffffffff, 0x0) 5.997666979s ago: executing program 1 (id=608): setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x12, &(0x7f0000000140)=0x8, 0x4) 4.341661422s ago: executing program 2 (id=609): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000001c0)={0x73622a85, 0x10b, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x32, 0x0, &(0x7f0000000400)=[@increfs], 0xfffffcb0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x2d, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000540)={@fd={0x66642a85, 0x0, r2}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1, 0x29}, @ptr={0x70742a85, 0x5, 0x0, 0x0, 0x1, 0xca}}, &(0x7f0000000600)={0x0, 0x18, 0x40}}, 0x1000}], 0x0, 0x0, 0x0}) 1.896774434s ago: executing program 1 (id=610): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0/file0\x00', 0x1c0) r0 = landlock_create_ruleset(&(0x7f0000000180)={0x104, 0x2}, 0x18, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x200000, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000200)={0x100, r1}, 0x0) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000240)='./file0/file0\x00', 0x200000, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r0, 0x1, &(0x7f0000000280)={0x100, r2}, 0x0) close(r2) close(r1) umount2(&(0x7f00000002c0)='./file0\x00', 0x0) 0s ago: executing program 2 (id=611): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:24148' (ED25519) to the list of known hosts. syzkaller login: [ 552.862236][ T3227] cgroup: Unknown subsys name 'net' [ 553.656496][ T3227] cgroup: Unknown subsys name 'cpuset' [ 553.851314][ T3227] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 627.303684][ T3227] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 736.030063][ T3234] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 736.273411][ T3234] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 740.994157][ T3236] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 741.066388][ T3236] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 752.624836][ T3234] hsr_slave_0: entered promiscuous mode [ 752.720830][ T3234] hsr_slave_1: entered promiscuous mode [ 757.860730][ T3236] hsr_slave_0: entered promiscuous mode [ 757.888526][ T3236] hsr_slave_1: entered promiscuous mode [ 757.903002][ T3236] debugfs: 'hsr0' already exists in 'hsr' [ 757.905189][ T3236] Cannot create hsr debugfs directory [ 764.945850][ T3234] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 765.256242][ T3234] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 765.460884][ T3234] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 765.652073][ T3234] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 768.813869][ T3236] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 769.117061][ T3236] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 769.296633][ T3236] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 769.625395][ T3236] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 789.043202][ T3234] 8021q: adding VLAN 0 to HW filter on device bond0 [ 791.943667][ T3236] 8021q: adding VLAN 0 to HW filter on device bond0 [ 848.275825][ T3236] veth0_vlan: entered promiscuous mode [ 849.568207][ T3236] veth1_vlan: entered promiscuous mode [ 850.954937][ T3234] veth0_vlan: entered promiscuous mode [ 852.547064][ T3234] veth1_vlan: entered promiscuous mode [ 853.392171][ T3236] veth0_macvtap: entered promiscuous mode [ 853.788732][ T3236] veth1_macvtap: entered promiscuous mode [ 857.094720][ T3234] veth0_macvtap: entered promiscuous mode [ 857.781146][ T3234] veth1_macvtap: entered promiscuous mode [ 858.447019][ T105] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 858.474300][ T105] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 858.498775][ T105] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 858.508884][ T105] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 862.845785][ T57] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 862.870113][ T57] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 862.935145][ T57] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 862.946252][ T57] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 864.556757][ T3236] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 892.091027][ T3869] netlink: 'syz.0.6': attribute type 30 has an invalid length. [ 987.413364][ T3229] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 989.082671][ T3229] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 989.085293][ T3229] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 989.099259][ T3229] usb 1-1: Product: syz [ 989.101139][ T3229] usb 1-1: Manufacturer: syz [ 989.102548][ T3229] usb 1-1: SerialNumber: syz [ 991.706360][ T3229] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 991.725498][ T3229] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 994.329677][ T3229] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 994.694754][ C0] raw-gadget.0 gadget.0: ignoring, device is not running [ 994.732955][ T3229] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x00001004. ret = -EPIPE [ 994.752374][ C0] raw-gadget.0 gadget.0: ignoring, device is not running [ 994.779949][ T3229] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x0000011c. ret = -EPIPE [ 994.783207][ T3229] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 994.921585][ T3229] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 995.260187][ T3229] lan78xx 1-1:1.0: probe with driver lan78xx failed with error -32 [ 995.991914][ T3229] usb 1-1: USB disconnect, device number 2 [ 1060.602427][ T3966] netlink: 24 bytes leftover after parsing attributes in process `syz.1.27'. [ 1068.804363][ T3970] syzkaller0: entered promiscuous mode [ 1068.805908][ T3970] syzkaller0: entered allmulticast mode [ 1096.672069][ T3994] syzkaller0: entered promiscuous mode [ 1096.673306][ T3994] syzkaller0: entered allmulticast mode [ 1170.129746][ T4020] A link change request failed with some changes committed already. Interface wg0 may have been left with an inconsistent configuration, please check. [ 1183.125057][ T3411] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1184.310828][ T3411] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1185.970965][ T3411] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1188.042983][ T3411] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1210.471329][ T3411] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1210.722259][ T3411] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1210.855706][ T3411] bond0 (unregistering): Released all slaves [ 1213.801298][ T3411] hsr_slave_0: left promiscuous mode [ 1214.019769][ T3411] hsr_slave_1: left promiscuous mode [ 1215.050664][ T3411] veth1_macvtap: left promiscuous mode [ 1215.055419][ T3411] veth0_macvtap: left promiscuous mode [ 1215.084133][ T3411] veth1_vlan: left promiscuous mode [ 1215.122179][ T3411] veth0_vlan: left promiscuous mode [ 1297.262112][ T4013] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1297.556734][ T4013] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1331.992554][ T4013] hsr_slave_0: entered promiscuous mode [ 1332.070780][ T4013] hsr_slave_1: entered promiscuous mode [ 1349.084169][ T4013] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1349.615521][ T4013] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1349.975931][ T4013] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1350.330445][ T4013] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1393.113231][ T4013] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1548.633134][ T4013] veth0_vlan: entered promiscuous mode [ 1549.404827][ T4013] veth1_vlan: entered promiscuous mode [ 1554.045269][ T4013] veth0_macvtap: entered promiscuous mode [ 1554.535369][ T4013] veth1_macvtap: entered promiscuous mode [ 1559.372753][ T3805] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1559.374874][ T3805] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1559.376510][ T3805] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1559.404868][ T3805] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1838.086027][ T4589] netlink: 12 bytes leftover after parsing attributes in process `syz.2.95'. [ 1888.402483][ T4616] netlink: 8 bytes leftover after parsing attributes in process `syz.1.100'. [ 1979.822693][ T4664] Zero length message leads to an empty skb [ 2024.482125][ T4695] netlink: 68 bytes leftover after parsing attributes in process `syz.1.125'. [ 2064.145325][ T4711] netlink: 68 bytes leftover after parsing attributes in process `syz.1.130'. [ 2085.049550][ T4721] binder: 4720:4721 unknown command 0 [ 2085.052019][ T4721] binder: 4720:4721 ioctl c0306201 200000000080 returned -22 [ 2085.655845][ T4721] binder: 4720:4721 ioctl c0306201 2000000003c0 returned -14 [ 2087.522039][ T4723] netlink: 68 bytes leftover after parsing attributes in process `syz.1.135'. [ 2099.626030][ T4734] netlink: 72 bytes leftover after parsing attributes in process `syz.2.138'. [ 2118.656564][ T4743] netlink: 68 bytes leftover after parsing attributes in process `syz.1.141'. [ 2132.326100][ T4745] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 2142.024142][ T4754] netlink: 52 bytes leftover after parsing attributes in process `syz.1.144'. [ 2149.581802][ T4760] netlink: 68 bytes leftover after parsing attributes in process `syz.1.146'. [ 2184.725072][ T4776] netlink: 8 bytes leftover after parsing attributes in process `syz.2.150'. [ 2397.416301][ T4854] netlink: 68 bytes leftover after parsing attributes in process `syz.1.177'. [ 2464.745673][ T4872] netlink: 68 bytes leftover after parsing attributes in process `syz.1.183'. [ 2604.071481][ T4949] netlink: 68 bytes leftover after parsing attributes in process `syz.2.206'. [ 2629.170832][ T4971] netlink: 68 bytes leftover after parsing attributes in process `syz.1.212'. [ 2629.426354][ T4970] netlink: 40 bytes leftover after parsing attributes in process `syz.2.213'. [ 3288.182599][ T5261] usb usb1: usbfs: process 5261 (syz.1.283) did not claim interface 0 before use [ 3514.243361][ T5352] comedi comedi0: Minor 3 could not be opened [ 3639.350325][ T5388] binder: 5387:5388 unknown command 0 [ 3639.353688][ T5388] binder: 5387:5388 ioctl c0306201 200000000080 returned -22 [ 3657.633754][ T5402] futex_wake_op: syz.1.325 tries to shift op by 144; fix this program [ 3663.675150][ T5405] binder: 5404:5405 unknown command 0 [ 3663.682752][ T5405] binder: 5404:5405 ioctl c0306201 200000000080 returned -22 [ 3684.716453][ T5417] binder: 5416:5417 ioctl 4018620d 0 returned -22 [ 3684.805666][ T5417] binder: 5416:5417 unknown command 0 [ 3684.866915][ T5417] binder: 5416:5417 ioctl c0306201 200000000080 returned -22 [ 3685.592519][ T5417] binder: 5416:5417 ioctl c0306201 2000000003c0 returned -14 [ 4007.031584][ T5609] netlink: 52 bytes leftover after parsing attributes in process `syz.2.405'. [ 4101.711208][ T5664] netlink: 52 bytes leftover after parsing attributes in process `syz.2.417'. [ 4123.986082][ T5681] binder: 5680:5681 ioctl c0306201 2000000003c0 returned -14 [ 4127.732223][ T5685] netlink: 52 bytes leftover after parsing attributes in process `syz.1.423'. [ 4141.782679][ T5700] binder: 5699:5700 ioctl c0306201 2000000003c0 returned -14 [ 4148.132139][ T5704] netlink: 52 bytes leftover after parsing attributes in process `syz.2.429'. [ 4182.132131][ T5727] netlink: 16 bytes leftover after parsing attributes in process `syz.1.435'. [ 4182.144965][ T5727] netlink: 20 bytes leftover after parsing attributes in process `syz.1.435'. [ 4229.203405][ T5748] netlink: 16 bytes leftover after parsing attributes in process `syz.2.443'. [ 4229.205693][ T5748] netlink: 20 bytes leftover after parsing attributes in process `syz.2.443'. [ 4411.200244][ T5858] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 4411.404220][ T5858] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 4437.435349][ T5878] netlink: 104 bytes leftover after parsing attributes in process `syz.2.479'. [ 4559.876240][ T4709] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 4560.190127][ T4709] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 4560.191925][ T4709] usb 2-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 4560.193123][ T4709] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 4560.376720][ T4709] usb 2-1: config 0 descriptor?? [ 4560.460188][ T5947] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 4562.845338][ T4709] elan 0003:04F3:0755.0001: hidraw0: USB HID v1.01 Device [HID 04f3:0755] on usb-dummy_hcd.1-1/input0 [ 4563.900725][ T4709] usb 2-1: reset full-speed USB device number 2 using dummy_hcd [ 4566.770249][ T5852] usb 2-1: USB disconnect, device number 2 [ 4581.610564][ T5979] binder: 5977:5979 unknown command 0 [ 4581.611672][ T5979] binder: 5977:5979 ioctl c0306201 200000000080 returned -22 [ 4607.923139][ T5992] binder: 5991:5992 unknown command 0 [ 4607.924411][ T5992] binder: 5991:5992 ioctl c0306201 200000000080 returned -22 [ 4675.576416][ T6011] binder: 6010:6011 unknown command 0 [ 4675.592134][ T6011] binder: 6010:6011 ioctl c0306201 200000000080 returned -22 [ 4729.306225][ T6038] binder: 6037:6038 unknown command 0 [ 4729.320554][ T6038] binder: 6037:6038 ioctl c0306201 200000000080 returned -22 [ 4778.781974][ T6060] binder: 6059:6060 unknown command 0 [ 4778.784653][ T6060] binder: 6059:6060 ioctl c0306201 200000000080 returned -22 [ 4779.368186][ T6060] binder: 6059:6060 ioctl c0306201 2000000003c0 returned -14 [ 4779.463782][ T6060] binder: 6059:6060 ioctl c0306201 0 returned -14 [ 4790.983007][ T6074] binder: 6073:6074 ioctl c0306201 0 returned -14 [ 4800.234407][ T6081] binder: 6080:6081 unknown command 0 [ 4800.235572][ T6081] binder: 6080:6081 ioctl c0306201 200000000080 returned -22 [ 4801.161705][ T6081] binder: 6080:6081 ioctl c0306201 2000000003c0 returned -14 [ 4801.234965][ T6081] binder: 6080:6081 ioctl c0306201 0 returned -14 [ 4818.626539][ T6089] binder: 6088:6089 ioctl c0306201 0 returned -14 [ 4835.990475][ T6104] binder: 6103:6104 ioctl c0306201 0 returned -14 [ 4867.821769][ T6121] binder: 6120:6121 ioctl c0306201 0 returned -14 [ 4896.451413][ T6129] syz.2.550 uses obsolete (PF_INET,SOCK_PACKET) [ 4954.602089][ T6152] binder: 6151:6152 unknown command 0 [ 4954.605419][ T6152] binder: 6151:6152 ioctl c0306201 200000000080 returned -22 [ 4954.940004][ T6152] binder: 6151:6152 ioctl c0306201 2000000003c0 returned -14 [ 5020.710147][ T6194] binder: 6192:6194 unknown command 0 [ 5020.711220][ T6194] binder: 6192:6194 ioctl c0306201 200000000080 returned -22 [ 5020.900488][ T6194] binder: 6192:6194 ioctl c0306201 2000000003c0 returned -14 [ 5048.332044][ T6215] binder: 6214:6215 unknown command 0 [ 5048.333270][ T6215] binder: 6214:6215 ioctl c0306201 200000000080 returned -22 [ 5048.631464][ T6215] binder: BINDER_SET_CONTEXT_MGR already set [ 5048.634678][ T6215] binder: 6214:6215 ioctl 4018620d 200000000040 returned -16 [ 5048.702788][ T6215] binder: 6214:6215 ioctl c0306201 2000000003c0 returned -14 [ 5062.421295][ T6235] binder: 6234:6235 unknown command 0 [ 5062.423344][ T6235] binder: 6234:6235 ioctl c0306201 200000000080 returned -22 [ 5062.646064][ T6235] binder: 6234:6235 ioctl c0306201 2000000003c0 returned -14 [ 5067.156665][ T6239] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 5067.243146][ T6239] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 5092.306045][ T6257] netlink: 176 bytes leftover after parsing attributes in process `syz.2.592'. [ 5092.619338][ T6257] netlink: 120 bytes leftover after parsing attributes in process `syz.2.592'. [ 5128.019636][ T6274] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 5128.089938][ T6274] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 5170.160683][ T6294] binder: 6293:6294 unknown command 0 [ 5170.162804][ T6294] binder: 6293:6294 ioctl c0306201 200000000080 returned -22 [ 5187.961160][ T6307] binder: 6306:6307 unknown command 0 [ 5187.962292][ T6307] binder: 6306:6307 ioctl c0306201 200000000080 returned -22 [ 5188.071574][ T6307] binder: 6306:6307 ioctl c0306201 2000000003c0 returned -14 [ 5189.665895][ T6309] BUG: sleeping function called from invalid context at fs/inode.c:1928 [ 5189.670810][ T6309] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6309, name: syz.1.610 [ 5189.672703][ T6309] preempt_count: 1, expected: 0 [ 5189.673523][ T6309] RCU nest depth: 0, expected: 0 [ 5189.674449][ T6309] 2 locks held by syz.1.610/6309: [ 5189.675336][ T6309] #0: ffffaf80190f00e0 (&type->s_umount_key#49){+.+.}-{4:4}, at: deactivate_super+0x7e/0x98 [ 5189.682815][ T6309] #1: ffffaf80190f0998 (&s->s_inode_list_lock){+.+.}-{3:3}, at: hook_sb_delete+0x12e/0xbde [ 5189.692135][ T6309] Preemption disabled at: [ 5189.692805][ T6309] [] hook_sb_delete+0x12e/0xbde [ 5189.696826][ T6309] CPU: 1 UID: 0 PID: 6309 Comm: syz.1.610 Not tainted syzkaller #0 PREEMPT [ 5189.697896][ T6309] Hardware name: riscv-virtio,qemu (DT) [ 5189.698556][ T6309] Call Trace: [ 5189.699068][ T6309] [] dump_backtrace+0x2e/0x3c [ 5189.699771][ T6309] [] show_stack+0x30/0x3c [ 5189.700272][ T6309] [] dump_stack_lvl+0x12a/0x1a2 [ 5189.701017][ T6309] [] dump_stack+0x1c/0x24 [ 5189.701726][ T6309] [] __might_resched+0x59c/0x5f8 [ 5189.702364][ T6309] [] __might_sleep+0x86/0xca [ 5189.702977][ T6309] [] iput+0x3c/0xb22 [ 5189.703680][ T6309] [] hook_sb_delete+0x86e/0xbde [ 5189.704341][ T6309] [] security_sb_delete+0xac/0x184 [ 5189.704876][ T6309] [] generic_shutdown_super+0xba/0x37c [ 5189.705410][ T6309] [] kill_litter_super+0x74/0xb0 [ 5189.705823][ T6309] [] deactivate_locked_super+0xd8/0x19c [ 5189.706594][ T6309] [] deactivate_super+0x84/0x98 [ 5189.707169][ T6309] [] cleanup_mnt+0x1dc/0x3e6 [ 5189.707523][ T6309] [] __cleanup_mnt+0x1c/0x26 [ 5189.707875][ T6309] [] task_work_run+0x16a/0x25e [ 5189.708168][ T6309] [] exit_to_user_mode_loop+0x110/0x142 [ 5189.708623][ T6309] [] do_trap_ecall_u+0x3f8/0x53a [ 5189.709349][ T6309] [] handle_exception+0x15e/0x16a SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 5214.305691][ T3805] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 5217.154595][ T3805] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 5218.869418][ T3805] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0