last executing test programs: 6m9.084816909s ago: executing program 1 (id=3173): openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x20000000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r0, 0x0, 0x94, 0x0, 0x0, 0x0, 0x11, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0}, 0x48) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102400, 0x19000) gettid() setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x4c, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0xa0, 0x30, 0x9, 0x0, 0x0, {}, [{0x8c, 0x1, [@m_bpf={0x88, 0x1, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{0x60}, {}, {0x3}, {}, {}, {}, {0x6}]}, @TCA_ACT_BPF_PARMS={0x18}]}, {}, {0xc}, {0xc}}}]}]}, 0xa0}}, 0x0) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0xfffffe0b) ioprio_set$pid(0x1, 0x0, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/asound/seq/clients\x00', 0x0, 0x0) readv(r3, &(0x7f00000038c0)=[{&(0x7f0000004980)=""/4096, 0x1000}], 0x1) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x22, 0x5, {[@global=@item_4={0x3, 0x1, 0xb, "eb167781"}]}}, 0x0}, 0x0) 6m4.842023585s ago: executing program 1 (id=3189): r0 = syz_open_procfs(0x0, &(0x7f00000190c0)='net/ip_tables_matches\x00') pread64(r0, &(0x7f0000000080)=""/102355, 0x1bbc, 0x6) write$UHID_INPUT2(r0, 0x0, 0x8f) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r2, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') syz_open_procfs(r1, &(0x7f00000001c0)='net/kcm\x00') r3 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt$sock_buf(r3, 0x1, 0x1c, 0x0, &(0x7f00000002c0)) 6m3.866369897s ago: executing program 1 (id=3192): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$kcm(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x9, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x44, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, 0x0, {0x0, 0xffe0}, {0xffff, 0xffff}, {0x0, 0xfff2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_SPLIT_GSO={0x8, 0x11, 0x1}, @TCA_CAKE_AUTORATE={0x8}]}}]}, 0x44}}, 0x0) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad44afac11d875397bdb22d0000b420a1a93c5240f45f819ef6167d3d458dd4992861ac00", "f4bd00ac6700000000000000000000c2888e7d52164ec480e79200000100", [0x0, 0x2000000000001]}}) ioctl$XFS_IOC_SCRUBV_METADATA(r0, 0xc0285840, &(0x7f0000000000)={0xd22, 0x200, 0x5, 0x0, 0x3, 0x0, 0x0, 0xffffffffffffffff}) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x4, 0xf, 0x80000006}, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 6m2.740804087s ago: executing program 1 (id=3198): openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x20000000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r0, 0x0, 0x94, 0x0, 0x0, 0x0, 0x11, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0}, 0x48) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102400, 0x19000) gettid() setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x4c, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0xa0, 0x30, 0x9, 0x0, 0x0, {}, [{0x8c, 0x1, [@m_bpf={0x88, 0x1, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{0x60}, {}, {0x3}, {}, {}, {}, {0x6}]}, @TCA_ACT_BPF_PARMS={0x18}]}, {}, {0xc}, {0xc}}}]}]}, 0xa0}}, 0x0) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0xfffffe0b) ioprio_set$pid(0x1, 0x0, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/asound/seq/clients\x00', 0x0, 0x0) readv(r3, &(0x7f00000038c0)=[{&(0x7f0000004980)=""/4096, 0x1000}], 0x1) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x22, 0x5, {[@global=@item_4={0x3, 0x1, 0xb, "eb167781"}]}}, 0x0}, 0x0) 5m57.333839195s ago: executing program 1 (id=3212): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x40, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xe, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x5, 0x7, 0xb3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r7, &(0x7f0000000140)="bad330fbc9b5544972e7a5ea0756", 0x36, 0x40, &(0x7f00000001c0)={0x11, 0x1a, r6, 0x1, 0xd8, 0x6, @random="98c8ca7122df"}, 0x14) sendto$packet(r7, &(0x7f0000000480)="c1858aec1d0a21756f66b4805f3a", 0xe, 0x40000, &(0x7f0000000240)={0x11, 0xf8, r6, 0x1, 0x5, 0x6, @random="24f51e8e0a5a"}, 0x14) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000980)=@newqdisc={0x24, 0x29, 0x4ee4e6a52ff56541, 0x4001, 0xffffbddc, {0x0, 0x0, 0x0, r10, {0x10}, {}, {0xe, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000) 5m55.057885527s ago: executing program 1 (id=3219): openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x20000000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r0, 0x0, 0x94, 0x0, 0x0, 0x0, 0x11, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0}, 0x48) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102400, 0x19000) gettid() setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x4c, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0xa0, 0x30, 0x9, 0x0, 0x0, {}, [{0x8c, 0x1, [@m_bpf={0x88, 0x1, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{0x60}, {}, {0x3}, {}, {}, {}, {0x6}]}, @TCA_ACT_BPF_PARMS={0x18}]}, {}, {0xc}, {0xc}}}]}]}, 0xa0}}, 0x0) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0xfffffe0b) ioprio_set$pid(0x1, 0x0, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/asound/seq/clients\x00', 0x0, 0x0) readv(r3, &(0x7f00000038c0)=[{&(0x7f0000004980)=""/4096, 0x1000}], 0x1) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x22, 0x5, {[@global=@item_4={0x3, 0x1, 0xb, "eb167781"}]}}, 0x0}, 0x0) 5m43.299290943s ago: executing program 32 (id=3209): openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x20000000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r0, 0x0, 0x94, 0x0, 0x0, 0x0, 0x11, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0}, 0x48) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102400, 0x19000) gettid() setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x4c, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0xa0, 0x30, 0x9, 0x0, 0x0, {}, [{0x8c, 0x1, [@m_bpf={0x88, 0x1, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{0x60}, {}, {0x3}, {}, {}, {}, {0x6}]}, @TCA_ACT_BPF_PARMS={0x18}]}, {}, {0xc}, {0xc}}}]}]}, 0xa0}}, 0x0) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0xfffffe0b) ioprio_set$pid(0x1, 0x0, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/asound/seq/clients\x00', 0x0, 0x0) r3 = syz_usb_connect$hid(0x5, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000010d80402f000000000000109022d00010000001009040000010300000009211000fd0122050009058103"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x22, 0x5, {[@global=@item_4={0x3, 0x1, 0xb, "eb167781"}]}}, 0x0}, 0x0) 5m40.021603408s ago: executing program 33 (id=3219): openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x20000000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r0, 0x0, 0x94, 0x0, 0x0, 0x0, 0x11, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0}, 0x48) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102400, 0x19000) gettid() setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x4c, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0xa0, 0x30, 0x9, 0x0, 0x0, {}, [{0x8c, 0x1, [@m_bpf={0x88, 0x1, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0x3c, 0x4, [{0x60}, {}, {0x3}, {}, {}, {}, {0x6}]}, @TCA_ACT_BPF_PARMS={0x18}]}, {}, {0xc}, {0xc}}}]}]}, 0xa0}}, 0x0) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0xfffffe0b) ioprio_set$pid(0x1, 0x0, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/asound/seq/clients\x00', 0x0, 0x0) readv(r3, &(0x7f00000038c0)=[{&(0x7f0000004980)=""/4096, 0x1000}], 0x1) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x22, 0x5, {[@global=@item_4={0x3, 0x1, 0xb, "eb167781"}]}}, 0x0}, 0x0) 4m55.413280804s ago: executing program 0 (id=3338): sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{&(0x7f0000000240)=@generic={0x21, "1aee2c4f6843c6782466293e62d4f664c2efa8906f0d97822ac0d88ecdd9d47e182b3b523c6243022c1be9fd662325c023ac48a28ae996c41561bb7e9903c408613b4d29da0b9d5af499caa7759c17c667af8acea6dc52148f1233494efd8f08aaab6382d5e33471a107ec47df5b5312764e134c68842fd1a2078151812e"}, 0x80, &(0x7f00000009c0)=[{&(0x7f00000002c0)="f973085a6ea39ea1b25a1c6b351e11245900557d1c8e9f86bae5e5c64e50ef25afb0295d0c303850b4bff4d088bf9df67e013836e2882dad3f7698b52997f7efa9eb96f09be1c3019445927c6b2fe32d38ae2bcad2ac0d85ebd42914fb18b7d0670f8b3be16755ead6a6fb713fa618ce2cf424ea7cc84b04016b9a2afbfaf68803f1c1acb74f", 0x86}, {&(0x7f0000000380)="82f294054d05973abfac6a6f31050418457d017c5fd68b034cf51b9f6a6d71daa5c776bca90037bc7c3d88b151fbf856f69ebd05e750f13f02af646b284953b6640a08c827c6f2ff4ad8e84077f9f03f94792aa17c4743cba3f355bb9c5b04b91ed70d253db68e17cdd561fab504479f723388dda974e2a9fb1bcda474c08d6222179b19e902009ea3cb3e42408bab6c1f29cb62d05805063967de38", 0x9c}, {&(0x7f0000000480)}, {&(0x7f0000000780)="8ff2f15bd0017ce4b36b6bc4335634254cffcc40c0312f5ff35991272b79d76712dc0c3cfdc0d70ce8004884e6917bed9ffee1584df7f06c7bccac71daf78bf3c68b8d5e56357654784bdbc700bceb1049c6a47d53c5ac29f83aed3ae9968fe8", 0x60}, {0x0}, {&(0x7f0000000900)="a9be9b2ff3a19d5a1226e5243d37d1fd2894c1ae880dc2316aa2d5ad08944c7135eb837eff354282dd5863c051eb7b9b17be0e4fdd6560f3f2c2c04af73a6cb75b5d05d6037f91e8f4f08e90d5313fb91fbdc5acd212f7d8c800a837a0236309d25e82d5767d8df7512b2beb324c2a2fd6f4ed3a3eb7396f02d515396a3be574d721df257dbf0bc39c617c69458d721eb85d0e", 0x93}, {&(0x7f00000000c0)}], 0x7}}, {{&(0x7f0000000a40)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x80, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000ac0)="3eb85e3024a2953147f5444738e1388e15fef01893884c2eeb5c559f4a030ee6b08fca1e38ee56dac9cbbea3d6d43e34d9daf81d45289d2bc841e2c4c7072582b15ce7ff3e22b0f19d8a2643280daeb9791b2d0f9b216a0fda4f30804b739da3cce1691d6d88ff52d3e43b26d935d69e99673e98e92fe2fd18e63d4d5699814d9843367774e155678592d0eec07073e851f50827bde418748aa0741684fe603e34dcc960678c7b3e71e48befa166d4a5247325fa881fc7857a8caadde6a2ac9cdc", 0xc1}, {&(0x7f0000000bc0)}], 0x3, &(0x7f0000000cc0)=[@mark={{0x14, 0x1, 0x24, 0x9a9}}, @mark={{0x14, 0x1, 0x24, 0x4}}, @timestamping={{0x14, 0x1, 0x25, 0x101}}, @txtime={{0x18, 0x1, 0x3d, 0x2}}, @txtime={{0x18, 0x1, 0x3d, 0x9d}}], 0x78}}, {{0x0, 0x0, &(0x7f0000003a40)=[{&(0x7f0000000640)="f3f4c60f4caeeeb0b0c17aa4", 0xc}], 0x1}}], 0x3, 0x20000044) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'vlan1\x00'}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 4m54.35028747s ago: executing program 0 (id=3341): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000380)={'wlan1\x00'}) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$SEG6_CMD_SETHMAC(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x2c, r2, 0x1, 0x0, 0x0, {}, [@SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x1}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x1}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}]}, 0x2c}}, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000040)="d8000000100081044e81f782db44b904021d006a0f000000e8fe55a1290015000600142603600e120900040044000000a80016000a0003402e60000000000000b94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a985162f7ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d3220a7c9f8775730d16a4683f1aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x60044084) r4 = syz_open_dev$sndpcmc(&(0x7f0000000300), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) mmap$snddsp_control(&(0x7f0000000000/0x3000)=nil, 0x1000, 0x1, 0x11, r4, 0x82000000) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(0xffffffffffffffff, 0x84, 0x74, 0x0, &(0x7f00000002c0)) newfstatat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', &(0x7f00000002c0), 0x6800) 4m51.102845384s ago: executing program 0 (id=3347): syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x0, 0x0, 0x5}, 0x10) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) dup(r1) r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r2, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000240)={0x1, 0x1, 0x0, &(0x7f0000000200)=""/51, 0x0}) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000340)) r4 = dup(r3) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000000)={0x1, r4}) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x9200000000000000) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) recvmmsg$unix(r0, &(0x7f00000043c0)=[{{0x0, 0x0, &(0x7f0000002d00)=[{&(0x7f0000000900)=""/174, 0xae}], 0x1}}], 0x1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000580)=ANY=[@ANYBLOB="2c0000001300050026bd", @ANYRES32=r6, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\f\x00'], 0x2c}, 0x1, 0x0, 0x0, 0x800c000}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r7 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r7, &(0x7f0000009b80)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0x0, 0x0) mremap(&(0x7f000007e000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f000007f000/0x1000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 4m44.370808703s ago: executing program 0 (id=3357): bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0xe, 0x4, 0x4, 0x1, 0x0, 0x1, 0xfffffffc}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bca2000000000000a6020000f8ffffffb703000018000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r0, 0x90004) accept4(r0, &(0x7f0000000040)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @private1}}, 0x0, 0x800) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) 4m43.780283704s ago: executing program 0 (id=3359): r0 = openat$kvm(0x0, 0x0, 0x200, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x0, 0x40, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) io_uring_setup(0x2dfd, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x19, 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x20008000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x14) 4m40.408781823s ago: executing program 0 (id=3367): r0 = syz_open_procfs(0x0, &(0x7f00000190c0)='net/ip_tables_matches\x00') pread64(r0, &(0x7f0000000080)=""/102355, 0x1bbc, 0x6) write$UHID_INPUT2(r0, 0x0, 0x8f) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') r3 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt$sock_buf(r3, 0x1, 0x1c, 0x0, &(0x7f00000002c0)) 4m25.189079614s ago: executing program 34 (id=3367): r0 = syz_open_procfs(0x0, &(0x7f00000190c0)='net/ip_tables_matches\x00') pread64(r0, &(0x7f0000000080)=""/102355, 0x1bbc, 0x6) write$UHID_INPUT2(r0, 0x0, 0x8f) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') syz_open_procfs(0x0, &(0x7f00000001c0)='net/kcm\x00') r3 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt$sock_buf(r3, 0x1, 0x1c, 0x0, &(0x7f00000002c0)) 2m30.390318479s ago: executing program 5 (id=3758): r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000040)={0x2, 0x4e22, @loopback}, 0x10) sendmsg$rds(r0, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000780)=[@rdma_args={0x48, 0x114, 0x1, {{}, {0x0, 0x2c}, &(0x7f00000006c0)=[{&(0x7f0000000100)=""/44, 0x410200}], 0x1}}], 0x48}, 0x0) 2m30.060570756s ago: executing program 5 (id=3761): socket$netlink(0x10, 0x3, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x4) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000340)={0xa, @sliced={0xfffb, [0x100, 0x101, 0x3, 0x2, 0x400, 0x374, 0x10, 0xffff, 0x8, 0x10, 0xe, 0x8, 0x6, 0xd, 0x4, 0x6, 0x5, 0x1, 0x7, 0x8, 0x40, 0x7, 0xcac, 0xac, 0x800, 0x4, 0x3, 0x401, 0xfff, 0x100, 0xcd, 0x6, 0x3ff, 0xfe00, 0xb484, 0x7, 0x6, 0x2, 0x9, 0x25, 0xfffc, 0x400, 0xa, 0x8, 0x0, 0x4, 0x5ce2, 0x4], 0x5}}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) shutdown(0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x79fe, &(0x7f0000000240)={0x0, 0xc8a1, 0x20000, 0x2, 0x20002f9}) sendmsg$TIPC_NL_MON_PEER_GET(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8010}, 0x10) r4 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000200), 0x20a00, 0x18) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000480)=0x1) 2m25.802076247s ago: executing program 5 (id=3769): rt_sigprocmask(0x0, 0x0, 0x0, 0x0) gettid() timer_create(0x2, 0x0, &(0x7f00000000c0)=0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1000000, 0x5d032, 0xffffffffffffffff, 0x0) syz_usb_connect(0x0, 0x51, &(0x7f0000000640)={{0x12, 0x1, 0x110, 0x73, 0xd6, 0x1e, 0x8, 0x1199, 0x218, 0x9a82, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3f, 0x1, 0xff, 0x5, 0x20, 0x3c, "", [{{0x9, 0x4, 0x6a, 0xf, 0x5, 0xef, 0x9b, 0xe4, 0x7f, [], [{{0x9, 0x5, 0xd, 0x3, 0x3ff, 0x5, 0x6, 0x9}}, {{0x9, 0x5, 0xe, 0x4, 0x400, 0x7f, 0x3, 0x1}}, {{0x9, 0x5, 0x6, 0x10, 0x200, 0x2, 0x8, 0x4}}, {{0x9, 0x5, 0x3, 0x10, 0x20, 0x9, 0x1, 0x1}}, {{0x9, 0x5, 0x7, 0xc, 0x400, 0x49, 0x84, 0xff}}]}}]}}]}}, 0x0) timer_settime(r0, 0x1, &(0x7f00000002c0)={{0x77359400}, {0x0, 0x9}}, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000003c0)='/proc/meminfo\x00', 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$NL80211_CMD_SET_CQM(0xffffffffffffffff, 0x0, 0x8d0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) 2m22.97052739s ago: executing program 5 (id=3778): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) shmctl$SHM_INFO(0x0, 0xe, 0x0) 2m21.928738886s ago: executing program 5 (id=3779): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r0, 0x90004) accept4(r0, &(0x7f0000000040)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @private1}}, 0x0, 0x800) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c900"], 0x16) 2m21.515627929s ago: executing program 5 (id=3781): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) socket$can_bcm(0x1d, 0x2, 0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000500)=ANY=[], 0x0) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)={0x1c, 0x4, 0x6, 0x201, 0x0, 0x0, {0xa, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x11}, 0x28000080) mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='exfat\x00', 0x0, 0x0) 2m5.783327619s ago: executing program 35 (id=3781): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) socket$can_bcm(0x1d, 0x2, 0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000500)=ANY=[], 0x0) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)={0x1c, 0x4, 0x6, 0x201, 0x0, 0x0, {0xa, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x11}, 0x28000080) mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='exfat\x00', 0x0, 0x0) 1m41.600604017s ago: executing program 2 (id=3873): r0 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="0100000000000000ea01020000000900010073797a3200000000090001008a797ab0000000000900030073797a32000000000900010073797a32000000000900030073797a3200000000140002"], 0x70}}, 0x20000800) 1m41.317776362s ago: executing program 2 (id=3875): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x608801, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() getrlimit(0x2, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000000)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@ipv6_newnexthop={0x20, 0x68, 0x5fb9a818fb7378e9, 0x0, 0x25dfdbfc, {}, [@NHA_OIF={0x8, 0x5, r4}]}, 0x20}}, 0x24008000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=@newnexthop={0x38, 0x68, 0x1, 0x100003, 0x7ffffffd, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x15}]}, @NHA_RES_GROUP={0xc, 0xc, 0x0, 0x1, [@NHA_RES_GROUP_BUCKETS={0x6, 0x1, 0x3fd4}]}, @NHA_GROUP_TYPE={0x6, 0x3, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008018}, 0x4000080) 1m39.916451838s ago: executing program 2 (id=3877): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) ioctl$KDMKTONE(0xffffffffffffffff, 0x4b30, 0x200010) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) shmat(0x0, &(0x7f0000ffc000/0x3000)=nil, 0x4000) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r3, 0x400448e7, &(0x7f0000000080)) 1m37.713017767s ago: executing program 2 (id=3882): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in={0x2, 0x4e22, @rand_addr=0x64010100}, @in={0x2, 0x4e24, @loopback}], 0x20) r1 = syz_usb_connect(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000751c0110e60f00989ad1010203010902240001000000000904290202b48cbb000905"], 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000140)=@o_path={&(0x7f0000000080)='./file0\x00', 0x0, 0x8, r0}, 0x18) sendto$inet6(r0, &(0x7f00000000c0)='\x00', 0x1, 0x0, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x9, @local, 0x4}, 0x1c) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) fcntl$getownex(r0, 0x10, &(0x7f0000000180)={0x0, 0x0}) process_vm_readv(r2, &(0x7f0000000740)=[{&(0x7f0000000240)=""/31, 0x1f}, {&(0x7f00000003c0)=""/183, 0xb7}, {&(0x7f00000005c0)=""/225, 0xe1}, {&(0x7f00000006c0)=""/100, 0x64}], 0x4, &(0x7f00000008c0)=[{&(0x7f0000000800)=""/139, 0x8b}], 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='cpuset.effective_mems\x00', 0x275a, 0x0) fcntl$lock(r3, 0x6, &(0x7f00000001c0)={0x2, 0x1, 0x7, 0x6}) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r5) read$msr(r4, &(0x7f0000002000)=""/102400, 0x19000) socket(0x10, 0x3, 0x0) r6 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r6, 0xaf01, 0x0) r7 = eventfd2(0x0, 0x1) read$eventfd(r7, &(0x7f0000000200), 0x8) ioctl$VHOST_SET_VRING_KICK(r6, 0x4008af20, &(0x7f0000000040)={0x0, r7}) pselect6(0x40, &(0x7f0000000100)={0x5, 0x0, 0xfffffffffffffff8, 0x10000000000000, 0x1, 0xffffffffffffffff, 0xa4, 0x2}, 0x0, &(0x7f0000000000)={0x1f, 0x4, 0x1000, 0x8000000000000000, 0x0, 0x80000000000000, 0x800, 0x20000}, 0x0, 0x0) writev(r7, &(0x7f0000000340)=[{&(0x7f0000000100)="569534ab1bbe0e03", 0x8}], 0x1) r8 = add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f0000000080)={'fscrypt:', @desc2}, &(0x7f00000000c0)={0x0, "f1a1173fb9462d3589e67197f90be6e423ceb0ab4912f9f6a31854ec98e950cfed21fcad7ff0fbcb566a0982f8938caa52dd8d39af14c31ed56ad59300"}, 0x52ba, 0xffffffffffffffff) keyctl$KEYCTL_MOVE(0x4, r8, r8, r8, 0x1) r9 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00'}) 1m34.606885275s ago: executing program 2 (id=3891): sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{&(0x7f0000000240)=@generic={0x21, "1aee2c4f6843c6782466293e62d4f664c2efa8906f0d97822ac0d88ecdd9d47e182b3b523c6243022c1be9fd662325c023ac48a28ae996c41561bb7e9903c408613b4d29da0b9d5af499caa7759c17c667af8acea6dc52148f1233494efd8f08aaab6382d5e33471a107ec47df5b5312764e134c68842fd1a2078151812e"}, 0x80, &(0x7f00000009c0)=[{&(0x7f00000002c0)="f973085a6ea39ea1b25a1c6b351e11245900557d1c8e9f86bae5e5c64e50ef25afb0295d0c303850b4bff4d088bf9df67e013836e2882dad3f7698b52997f7efa9eb96f09be1c3019445927c6b2fe32d38ae2bcad2ac0d85ebd42914fb18b7d0670f8b3be16755ead6a6fb713fa618ce2cf424ea7cc84b04016b9a2afbfaf68803f1c1acb74fef", 0x87}, {&(0x7f0000000380)="82f294054d05973abfac6a6f31050418457d017c5fd68b034cf51b9f6a6d71daa5c776bca90037bc7c3d88b151fbf856f69ebd05e750f13f02af646b284953b6640a08c827c6f2ff4ad8e84077f9f03f94792aa17c4743cba3f355bb9c5b04b91ed70d253db68e17cdd561fab504479f723388dda974e2a9fb1bcda474c08d6222179b19e902009ea3cb3e42408bab6c1f29cb62d05805063967de38327e", 0x9e}, {&(0x7f0000000480)}, {&(0x7f0000000780)="8ff2f15bd0017ce4b36b6bc4335634254cffcc40c0312f5ff35991272b79d76712dc0c3cfdc0d70ce8004884e6917bed9ffee1584df7f06c7bccac71daf78bf3c68b8d5e56357654784bdbc700bceb1049c6a47d53c5ac29f83aed3ae9968fe8", 0x60}, {&(0x7f0000000800)="5193f0b40db29d9ce06f429ed3c2c6405967f1e559f08c35f5e63ad64c2746967cca1bbeaf6206a79c42badb4fb453f294c2932cb5552a5f9c1d633207a53c2f54d98c2f9e4323eac6c20c56e7607d212b210a0325f7c289d1a2552d7a3f2176a47e95bc46471fae9167768d58f22ff10ba3cc2050b1ee838ce9e4ac5a1544fec3e291272cfaaa4817539972fb8bb2ed", 0x90}, {&(0x7f00000000c0)}], 0x6}}, {{&(0x7f0000000a40)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x80, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000bc0)="61275006ed747229311198ab94c7e6699587b0d033c2f17d1ccbd45cba520b6888fbad95d4d6ae3cc7172b392f90693e992e52408ba7f1874d1767303d6acb170f216f71908f53a3be1833a25eb1fb2ba3913dcc1de30c5c7e914b13514dea44fb2b964aaa280d5a85512fede48830ca6ea5cd18ff95c871d91454240f370e0c8e2629e58605c4b29017a160709ec76547c92a21d0ec5589e228922b105d0b8b29256620c44d2118334025dedd46db5194f22b34", 0xb4}], 0x2, &(0x7f0000000cc0)=[@mark={{0x14, 0x1, 0x24, 0x9a9}}, @mark={{0x14, 0x1, 0x24, 0x4}}, @timestamping={{0x14, 0x1, 0x25, 0x101}}, @txtime={{0x18, 0x1, 0x3d, 0x2}}, @txtime={{0x18, 0x1, 0x3d, 0x9d}}], 0x78}}], 0x2, 0x20000044) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'vlan1\x00'}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 1m34.129279061s ago: executing program 2 (id=3893): ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(0xffffffffffffffff, 0x4048587b, &(0x7f0000000540)={{0xffffffffffffffff, 0x0, 0x64f280, &(0x7f0000000080)={@align=0x5, {0x6, 0x0, 0x6, 0xffffffffffffffff}}, 0x83d6, 0x0, 0x0}, 0x0, 0x0}) r0 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4ea3, 0x0, @loopback, 0x3}, 0x1c) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000019200)=@raw={'raw\x00', 0x8, 0x3, 0x4d8, 0x180, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x408, 0xffffffff, 0xffffffff, 0x408, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@loopback, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x158, 0x180, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@iprange={{0x68}, {@ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @ipv4=@multicast2, @ipv6=@loopback, @ipv6=@empty}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x538) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x953a, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0xff8a}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 1m22.036437564s ago: executing program 8 (id=3916): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x10, 0xc, &(0x7f0000000c00)=ANY=[], 0x0, 0x8, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x102}, 0x94) getsockopt(0xffffffffffffffff, 0x0, 0x15, 0xffffffffffffffff, &(0x7f0000000040)=0x2) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$XFS_IOC_GETBMAP(r0, 0xc0205826, 0x0) setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, 0x0) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) 1m21.816341666s ago: executing program 8 (id=3918): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$kcm(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x9, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x44, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, 0x0, {0x0, 0xffe0}, {0xffff, 0xffff}, {0x0, 0xfff2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_SPLIT_GSO={0x8, 0x11, 0x1}, @TCA_CAKE_AUTORATE={0x8}]}}]}, 0x44}}, 0x0) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad44afac11d875397bdb22d0000b420a1a93c5240f45f819ef6167d3d458dd4992861ac00", "f4bd00ac6700000000000000000000c2888e7d52164ec480e79200000100", [0x0, 0x2000000000001]}}) ioctl$XFS_IOC_SCRUBV_METADATA(r0, 0xc0285840, &(0x7f0000000000)={0xd22, 0x200, 0x5, 0x0, 0x3, 0x0, 0x0, 0xffffffffffffffff}) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x4, 0xf, 0x80000006}, 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r2, 0xffffffffffffffff, 0x0) 1m21.131311583s ago: executing program 8 (id=3919): r0 = syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x2242) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, 0x0) 1m21.00955654s ago: executing program 8 (id=3920): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_DEST(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000580)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="6fa926bd7000fbdbdf25060000001400018008000500030000000600"], 0x28}, 0x1, 0x0, 0x0, 0x4004840}, 0x4008000) 1m20.840468429s ago: executing program 8 (id=3922): socket$netlink(0x10, 0x3, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x4) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000340)={0xa, @sliced={0xfffb, [0x100, 0x101, 0x3, 0x2, 0x400, 0x374, 0x10, 0xffff, 0x8, 0x10, 0xe, 0x8, 0x6, 0xd, 0x4, 0x6, 0x5, 0x1, 0x7, 0x8, 0x40, 0x7, 0xcac, 0xac, 0x800, 0x4, 0x3, 0x401, 0xfff, 0x100, 0xcd, 0x6, 0x3ff, 0xfe00, 0xb484, 0x7, 0x6, 0x2, 0x9, 0x25, 0xfffc, 0x400, 0xa, 0x8, 0x0, 0x4, 0x5ce2, 0x4], 0x5}}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) shutdown(0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x79fe, &(0x7f0000000240)={0x0, 0xc8a1, 0x20000, 0x2, 0x20002f9}) sendmsg$TIPC_NL_MON_PEER_GET(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8010}, 0x10) r4 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000200), 0x20a00, 0x18) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000480)=0x1) ioctl$TCSETSF2(r4, 0x89f2, &(0x7f0000000040)={0x0, 0x10, 0x4, 0x0, 0xc, "a500000500", 0xe7, 0x2}) socket$inet_sctp(0x2, 0x5, 0x84) 1m19.238708496s ago: executing program 8 (id=3924): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000880), 0x0, 0x0) ioctl$TCSETS2(r0, 0x402c542b, &(0x7f0000000040)={0x6, 0x7, 0x10021da0, 0x10000, 0xff, "42f407000000195a14c84953dc7e8e5aec7776", 0xfffffffe, 0x9}) r1 = syz_usb_connect$midi(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0xd8c, 0x102, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x1, 0x5, 0x60, 0x1, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x3, 0x20, 0x2}}}}}]}}, 0x0) syz_usb_connect$uac2(0x0, 0xaa, &(0x7f0000000080)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x10, 0x41e, 0x3000, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x98, 0x3, 0x1, 0xfc, 0x20, 0x3, {0x8, 0xb, 0x0, 0x1, 0x1, 0x9, 0x20, 0x80}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x1, 0x5, 0x1c, 0x3}, [@output_terminal={0xc, 0x24, 0x3, 0x1, 0x706, 0x1, 0x2, 0x2, 0x0, 0x22}, @feature_unit={0x7, 0x24, 0x6, 0x6, 0x4, [0x7]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x1, 0x3, 0x1, 0x4}, @format_type_ii_discrete={0xc, 0x24, 0x2, 0x2, 0x58e6, 0x6, 0x0, "9a415f"}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x7, 0x3, 0xcf, 0x20}]}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x7, 0x80, 0x6, {0x8, 0x25, 0x1, 0x1, 0x33, 0x40}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0xc, 0xd, 0x9, {0x8, 0x25, 0x1, 0x1, 0xc, 0x1, 0xb}}}}}}}}]}}, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, &(0x7f0000000940)={0x2c, 0x0, &(0x7f0000000840)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x81d}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac2(r1, &(0x7f0000000140)={0x14, 0x0, 0x0}, 0x0) syz_clone(0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x4, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0}, 0x94) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000580)={'veth0_to_team\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000004c0)={r2, r4, 0x25, 0x0, @void}, 0x10) r5 = socket(0x10, 0x803, 0x0) r6 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000140), 0x1a1100, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) ioctl$FBIOGET_CON2FBMAP(r6, 0x460f, &(0x7f0000000000)={0x38, 0x2}) socket(0x2, 0xa, 0x300) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000140)={'veth0_to_team\x00', &(0x7f0000000280)=@ethtool_channels={0x3d, 0x0, 0x0, 0x0, 0x4, 0x2, 0x1}}) unshare(0x62040200) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000040)={'veth0_to_team\x00', 0x800}) 1m18.939257682s ago: executing program 36 (id=3893): ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(0xffffffffffffffff, 0x4048587b, &(0x7f0000000540)={{0xffffffffffffffff, 0x0, 0x64f280, &(0x7f0000000080)={@align=0x5, {0x6, 0x0, 0x6, 0xffffffffffffffff}}, 0x83d6, 0x0, 0x0}, 0x0, 0x0}) r0 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4ea3, 0x0, @loopback, 0x3}, 0x1c) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000019200)=@raw={'raw\x00', 0x8, 0x3, 0x4d8, 0x180, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x408, 0xffffffff, 0xffffffff, 0x408, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@loopback, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x158, 0x180, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@iprange={{0x68}, {@ipv6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @ipv4=@multicast2, @ipv6=@loopback, @ipv6=@empty}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x538) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x953a, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0xff8a}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 1m4.146364162s ago: executing program 37 (id=3924): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000880), 0x0, 0x0) ioctl$TCSETS2(r0, 0x402c542b, &(0x7f0000000040)={0x6, 0x7, 0x10021da0, 0x10000, 0xff, "42f407000000195a14c84953dc7e8e5aec7776", 0xfffffffe, 0x9}) r1 = syz_usb_connect$midi(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x10, 0xd8c, 0x102, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x1, 0x5, 0x60, 0x1, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x3, 0x20, 0x2}}}}}]}}, 0x0) syz_usb_connect$uac2(0x0, 0xaa, &(0x7f0000000080)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x10, 0x41e, 0x3000, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x98, 0x3, 0x1, 0xfc, 0x20, 0x3, {0x8, 0xb, 0x0, 0x1, 0x1, 0x9, 0x20, 0x80}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x20, 0x0, {{0x9, 0x24, 0x1, 0x1, 0x5, 0x1c, 0x3}, [@output_terminal={0xc, 0x24, 0x3, 0x1, 0x706, 0x1, 0x2, 0x2, 0x0, 0x22}, @feature_unit={0x7, 0x24, 0x6, 0x6, 0x4, [0x7]}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {[@format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x1, 0x3, 0x1, 0x4}, @format_type_ii_discrete={0xc, 0x24, 0x2, 0x2, 0x58e6, 0x6, 0x0, "9a415f"}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x7, 0x3, 0xcf, 0x20}]}, {{0x9, 0x5, 0x1, 0x9, 0x10, 0x7, 0x80, 0x6, {0x8, 0x25, 0x1, 0x1, 0x33, 0x40}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x20, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0xc, 0xd, 0x9, {0x8, 0x25, 0x1, 0x1, 0xc, 0x1, 0xb}}}}}}}}]}}, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, &(0x7f0000000940)={0x2c, 0x0, &(0x7f0000000840)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x81d}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac2(r1, &(0x7f0000000140)={0x14, 0x0, 0x0}, 0x0) syz_clone(0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x4, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0}, 0x94) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000580)={'veth0_to_team\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000004c0)={r2, r4, 0x25, 0x0, @void}, 0x10) r5 = socket(0x10, 0x803, 0x0) r6 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000140), 0x1a1100, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) ioctl$FBIOGET_CON2FBMAP(r6, 0x460f, &(0x7f0000000000)={0x38, 0x2}) socket(0x2, 0xa, 0x300) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000140)={'veth0_to_team\x00', &(0x7f0000000280)=@ethtool_channels={0x3d, 0x0, 0x0, 0x0, 0x4, 0x2, 0x1}}) unshare(0x62040200) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000040)={'veth0_to_team\x00', 0x800}) 17.092548126s ago: executing program 6 (id=4089): socket$kcm(0xa, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, 0x0) ptrace$peekuser(0x3, r0, 0x1) mount(0x0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='xfs\x00', 0x2208004, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000003480)={0x2020}, 0x2020) r4 = socket(0x2, 0x80805, 0x0) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x64010101, 0x4e22, 0x3, 'dh\x00', 0x1, 0x80005, 0x6f}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e21, 0x3, 'sh\x00', 0x5, 0x9, 0x77}, {@remote, 0x4e20, 0x2000, 0xcd}}, 0x44) 16.876546818s ago: executing program 4 (id=4092): openat(0xffffffffffffffff, 0x0, 0x600, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f0000000040), &(0x7f0000000340)=@v3={0x3000000, [{0xdb7, 0x5}, {0x6, 0x5}]}, 0x18, 0x1) socket$nl_route(0x10, 0x3, 0x0) socket$inet6(0xa, 0x3, 0x5) socket$nl_sock_diag(0x10, 0x3, 0x4) socket$inet_sctp(0x2, 0x1, 0x84) syz_usb_connect$uac1(0x2, 0xa5, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000106b1d0101400001020301090293000301000000090400000001"], 0x0) socket$inet6(0xa, 0x3, 0x87) socket$inet6_udp(0xa, 0x2, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0x77, 0x101301) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)) socket$inet_sctp(0x2, 0x1, 0x84) socket$packet(0x11, 0x2, 0x300) socket(0x10, 0x803, 0x0) socket(0x10, 0x803, 0x0) socket(0x400000000010, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001c00010429bd7000ffdbdf250700", @ANYRES32=r1, @ANYBLOB="e0ff8b0a0a0002"], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x24040040) 13.038293875s ago: executing program 4 (id=4097): openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) close(0x3) openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x56, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7ff}, 0x94) r0 = socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x5e, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) openat$fb0(0xffffffffffffff9c, 0x0, 0x20000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r1 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000380)=@req={0xfffff741, 0x10, 0xa96, 0x2}, 0x10) fsync(0xffffffffffffffff) r2 = fsopen(&(0x7f0000000180)='hugetlbfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x6) fchdir(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x108) mkdirat(r3, &(0x7f0000000100)='./file2\x00', 0x181) 12.105420185s ago: executing program 4 (id=4103): ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(0xffffffffffffffff, 0x4048587b, &(0x7f0000000d40)={{0xffffffffffffffff, &(0x7f0000000300)='skcipher\x00', 0x0, 0x0, 0x3, 0x0, 0x0}, 0x0, 0x0}) socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$fb0(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wlan0\x00'}) sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) setreuid(0x0, 0x0) r4 = socket(0x1, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f00000008c0)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f670600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b52710aeee835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5bc6d3fd0500000022eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe326c2ed0a432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1b172191d359645fae2d074ea5724ab77ea04fe507938b1213cdd4a92860e59808689382734d24b3123dd40c6d612c8a19948cd257748b1e7324adddbe61d51013f7d6b313c6df7b7b29678d70fc94dcc3e99e2472e78968ed94e7a54988656e8fff6b1d9b9993c71edd5cc10a2bea8d94d751b77fa7c48c712af35a9ffe670e8fa451942f48741119496bc30137e1202aed6bb5cd5c2d0256d049e4a335e2ea5545e5624be2391c37c0a2ae3bbb5b58778b85424bcdb84358359b2cb2782fc0e82f17b12d641ce6a72ab0ac794f878140897703bebe4420115d26675f27598841965fa91088252"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) bind$unix(r4, &(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000001680)=[{{&(0x7f0000000380)=@file={0x1, './file0\x00'}, 0x6e, 0x0}}], 0x1, 0x0) 10.330855361s ago: executing program 4 (id=4107): openat(0xffffffffffffffff, 0x0, 0x600, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f0000000040), &(0x7f0000000340)=@v3={0x3000000, [{0xdb7, 0x5}, {0x6, 0x5}]}, 0x18, 0x1) socket$nl_route(0x10, 0x3, 0x0) socket$inet6(0xa, 0x3, 0x5) socket$nl_sock_diag(0x10, 0x3, 0x4) socket$inet_sctp(0x2, 0x1, 0x84) syz_usb_connect$uac1(0x2, 0xa5, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000106b1d0101400001020301090293000301000000090400000001"], 0x0) socket$inet6(0xa, 0x3, 0x87) socket$inet6_udp(0xa, 0x2, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0x77, 0x101301) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)) socket$inet_sctp(0x2, 0x1, 0x84) socket$packet(0x11, 0x2, 0x300) socket(0x10, 0x803, 0x0) socket(0x10, 0x803, 0x0) socket(0x400000000010, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001c00010429bd7000ffdbdf25070000", @ANYRES32=r1, @ANYBLOB="e0ff8b0a0a0002"], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x24040040) 10.218455417s ago: executing program 6 (id=4108): writev(0xffffffffffffffff, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = socket$kcm(0x29, 0x2, 0x0) setsockopt$kcm_KCM_RECV_DISABLE(r0, 0x119, 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) set_mempolicy(0x3, &(0x7f0000000080)=0x7, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x7b, 0x11, 0x98}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x5}, @exit={0x95, 0x0, 0x33}], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xb8000000}, 0x70) mount$tmpfs(0x0, &(0x7f0000000540)='./cgroup\x00', &(0x7f0000000580), 0x0, &(0x7f00000002c0)={[{@mpol={'mpol', 0x3d, {'local', '=relative', @void}}}]}) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='rdma.current\x00', 0x26e1, 0x0) ioctl$FIOCLEX(r4, 0x5451) sendmsg$kcm(r4, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000000)=[{0x0}, {0x0}], 0x2}, 0x0) close(r4) socket$kcm(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r4, 0x8b19, &(0x7f0000000000)={'wlan0\x00', @local}) 10.082262495s ago: executing program 9 (id=4109): ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(0xffffffffffffffff, 0x4048587b, &(0x7f0000000d40)={{0xffffffffffffffff, &(0x7f0000000300)='skcipher\x00', 0x0, 0x0, 0x3, 0x0, 0x0}, 0x0, 0x0}) socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$fb0(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wlan0\x00'}) sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) r3 = socket$rds(0x15, 0x5, 0x0) bind$rds(r3, &(0x7f0000000040)={0x2, 0x4e22, @loopback}, 0x10) sendmsg$rds(r3, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000780)=[@rdma_args={0x48, 0x114, 0x1, {{}, {0x0, 0x2c}, &(0x7f00000006c0)=[{&(0x7f0000000100)=""/44, 0x410200}], 0x1}}], 0x48}, 0x0) 9.222136552s ago: executing program 6 (id=4111): socket$nl_netfilter(0x10, 0x3, 0xc) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) prlimit64(0x0, 0x1, &(0x7f0000000180)={0xe98, 0x3e}, &(0x7f0000000140)) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a54000000060a010400000000000000000a0000040900010073797a310000000028000480240001800b000100657874686472000014000280080006400000000108000440000000f1090002045c8d44bafb364b00140000001100010000000000000000000100000a"], 0x7c}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) ioctl$FS_IOC_READ_VERITY_METADATA(r0, 0xc0286687, &(0x7f0000000580)={0x3, 0x8000, 0xb0, &(0x7f00000004c0)=""/176}) syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') syz_usb_connect(0x2, 0x36, &(0x7f00000008c0)=ANY=[@ANYBLOB="120100001b767f2051045251b9c0010203030902240001000000000904000002526f590009050d00000000000009050a02"], 0x0) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f0000000140)={0x0, 0x0, 0x0}) socket$inet6_tcp(0xa, 0x1, 0x0) 9.043437091s ago: executing program 3 (id=4112): syz_open_dev$swradio(&(0x7f0000000380), 0x0, 0x2) r0 = syz_open_dev$swradio(&(0x7f0000000040), 0x1, 0x2) socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r1 = getpid() syz_open_dev$amidi(0x0, 0x2, 0x181) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f0000000580)={{{@in6=@ipv4={""/10, ""/2, @broadcast}, @in=@local}}, {{@in=@remote}, 0x0, @in6=@empty}}, &(0x7f0000000680)=0xe8) sendmmsg$inet6(r4, &(0x7f00000016c0)=[{{&(0x7f00000004c0)={0xa, 0x4e23, 0x0, @loopback, 0x9}, 0x1c, 0x0, 0x0, &(0x7f0000000a00)=[@rthdr_2292={{0x28, 0x29, 0x39, {0xff, 0x2, 0x2, 0xfe, 0x0, [@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01']}}}], 0x28}}], 0x1, 0x4040084) bpf$PROG_LOAD(0x5, 0x0, 0x0) io_setup(0x3fe, &(0x7f00000001c0)=0x0) io_submit(r5, 0x2, &(0x7f0000000400)=[0x0, 0x0]) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, 0x0) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f00000002c0)={0x1, 0x4, 0x10, 0x0, @vifc_lcl_ifindex, @remote}, 0x10) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205648, &(0x7f00000000c0)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000500)={0x98f905, 0xffffbeff, '\x00', @string=&(0x7f0000000300)=0xa3}}) 7.58502705s ago: executing program 3 (id=4114): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000200), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r1, 0xc1205531, &(0x7f0000000540)={0x1, 0x6, 0x0, 0x0, '\x00', '\x00', '\x00', 0x0, 0x0, 0x0, 0x0, "b6855a32474ffa64f778ddcf29c94337"}) sched_setscheduler(0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000400)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c0) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r7, 0xc0a85320, &(0x7f0000000340)={{0x80, 0xfc}, 'port0\x00', 0x0, 0x60000, 0x0, 0xfffffffb, 0x6, 0xfffffffc, 0x10000000, 0x0, 0x1}) socket$inet6_udp(0xa, 0x2, 0x0) r8 = dup(r6) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x42800) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000e40), 0x0, &(0x7f0000000e80)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r8}}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, 0x0, 0x0) syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=ANY=[], 0x1e) nanosleep(0x0, &(0x7f0000000480)) 7.197208431s ago: executing program 7 (id=4115): r0 = inotify_init() socket$inet_tcp(0x2, 0x1, 0x0) ioctl$KVM_HYPERV_EVENTFD(0xffffffffffffffff, 0x4018aebd, &(0x7f0000000080)={0x4000}) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) dup(0xffffffffffffffff) ioctl$KVM_PRE_FAULT_MEMORY(r4, 0xc040aed5, &(0x7f00000000c0)={0xf000, 0x118000}) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000000), 0x1000000, 0x0) syz_usb_connect$uac1(0x4, 0x71, &(0x7f0000000600)=ANY=[], 0x0) socket$tipc(0x1e, 0x2, 0x0) r5 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$VIDIOC_S_FMT(r5, 0xc0d05605, &(0x7f0000000340)={0xd, @meta={0x4b31434d, 0xd7dbb51, 0x922c, 0x6914, 0x92a154b}}) close_range(r0, 0xffffffffffffffff, 0x0) 5.686692773s ago: executing program 4 (id=4116): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000d00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWRULE={0x190, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x164, 0x4, 0x0, 0x1, [{0x160, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x150, 0x2, 0x0, 0x1, [@NFTA_MATCH_REV={0x8}, @NFTA_MATCH_NAME={0xb, 0x1, 'policy\x00'}, @NFTA_MATCH_INFO={0x138, 0x3, "ebae551382395afa4d23edfcbe6d55b57cb15e63c15c46395916e2b388abc3d6ce2316334e8278ad51f6d123a616cf3eb44b275fe6bc6bf402a3f9335458bb7a92f23fc0aa88f2495ff70157ea6b29f7fab11ec362920cab3350208c749f342b38e0df9334cea6fe1e331d76beb7094102d5d409992dcd236e3fd7a8785f97ae9d01b0822c161a491bef0501f8e81ddd66d1b676e8c9f0b2159c2cc0b069669b5af546f644c39bedd627181d27d9c185aae5d910550f08822c6fec60302779b9e812403a2ff826781b4c761bd14eb7515ae224260c9534891afdd05d18b2ffe91f4052766a0b9fe3955bfb1866142e7c1caceb88de7d6e8a5c08ce052bb461f0c7ee914ca5c98c19442d0262a6d04a8e3e29360a9b5871812e08542d54775f5843d70b15871bc247e30d66b83560c014f5000000"}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x20, 0x0, 0x0, {0x7}}}, 0x1b8}, 0x1, 0x0, 0x0, 0x8010}, 0x4000800) 5.430854426s ago: executing program 6 (id=4117): sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{&(0x7f0000000240)=@generic={0x21, "1aee2c4f6843c6782466293e62d4f664c2efa8906f0d97822ac0d88ecdd9d47e182b3b523c6243022c1be9fd662325c023ac48a28ae996c41561bb7e9903c408613b4d29da0b9d5af499caa7759c17c667af8acea6dc52148f1233494efd8f08aaab6382d5e33471a107ec47df5b5312764e134c68842fd1a2078151812e"}, 0x80, &(0x7f00000009c0)=[{&(0x7f00000002c0)="f973085a6ea39ea1b25a1c6b351e11245900557d1c8e9f86bae5e5c64e50ef25afb0295d0c303850b4bff4d088bf9df67e013836e2882dad3f7698b52997f7efa9eb96f0", 0x44}, {&(0x7f0000000380)="82f294054d05973abfac6a6f31050418457d017c5fd68b034cf51b9f6a6d71daa5c776bca90037bc7c3d88b151fbf856f69ebd05e750f13f02af646b284953b6640a08c827c6f2ff4ad8e84077f9f03f94792aa17c4743cba3f355bb9c5b04b91ed70d253db68e17cdd561fab504479f723388dda974e2a9fb1bcda474c08d6222179b19e902009ea3cb3e42408bab6c1f29cb62d05805063967de38327e", 0x9e}, {&(0x7f0000000480)}, {&(0x7f0000000780)="8ff2f15bd0017ce4b36b6bc4335634254cffcc40c0312f5ff35991272b79d76712dc0c3cfdc0d70ce8004884e6917bed9ffee1584df7f06c7bccac71daf78bf3c68b8d5e56357654784bdbc700bceb1049c6a47d53c5ac29f83aed3ae9968fe8", 0x60}, {0x0}, {&(0x7f0000000900)="a9be9b2ff3a19d5a1226e5243d37d1fd2894c1ae880dc2316aa2d5ad08944c7135eb837eff354282dd5863c051eb7b9b17be0e4fdd6560f3f2c2c04af73a6cb75b5d05d6037f91e8f4f08e90d5313fb91fbdc5acd212f7d8c800a837a0236309d25e82d5767d8df7512b2beb324c2a2fd6f4ed3a3eb7396f02d515396a3be574d721df257dbf0bc39c617c69458d721eb85d0e", 0x93}, {&(0x7f00000000c0)}], 0x7}}, {{&(0x7f0000000a40)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x80, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000ac0)="3eb85e3024a2953147f5444738e1388e15fef01893884c2eeb5c559f4a030ee6b08fca1e38ee56dac9cbbea3d6d43e34d9daf81d45289d2bc841e2c4c7072582b15ce7ff3e22b0f19d8a2643280daeb9791b2d0f9b216a0fda4f30804b739da3cce1691d6d88ff52d3e43b26d935d69e99673e98e92fe2fd18e63d4d5699814d9843367774e155678592d0eec07073e851f50827bde418748aa0741684fe603e34dcc960678c7b3e71e48befa166d4a5247325fa881fc7857a8caadde6a2ac9cdc", 0xc1}, {&(0x7f0000000bc0)="61275006ed747229311198ab94c7e6699587b0d033c2f17d1ccbd45cba520b6888fbad95d4d6ae3cc7172b392f90693e992e52408ba7f1874d1767303d6acb170f216f71908f53a3be1833a25eb1fb2ba3913dcc1de30c5c7e914b13514dea44fb2b964aaa280d5a85512fede48830ca6ea5cd18ff95c871d91454240f370e0c8e2629e58605c4b29017a160709ec76547c92a21d0ec5589e228922b105d0b8b29256620c44d2118334025dedd46db5194f22b34", 0xb4}], 0x3, &(0x7f0000000cc0)=[@mark={{0x14, 0x1, 0x24, 0x9a9}}, @mark={{0x14, 0x1, 0x24, 0x4}}, @timestamping={{0x14, 0x1, 0x25, 0x101}}, @txtime={{0x18, 0x1, 0x3d, 0x2}}, @txtime={{0x18, 0x1, 0x3d, 0x9d}}], 0x78}}, {{0x0, 0x0, &(0x7f0000003a40)=[{&(0x7f0000000640)="f3f4c60f4caeeeb0b0c17aa4", 0xc}], 0x1}}], 0x3, 0x20000044) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'vlan1\x00'}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 3.70846926s ago: executing program 6 (id=4118): socket$kcm(0xa, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000280)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, 0x0) ptrace$peekuser(0x3, r0, 0x1) mount(0x0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='xfs\x00', 0x2208004, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000003480)={0x2020}, 0x2020) r2 = socket(0x2, 0x80805, 0x0) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x64010101, 0x4e22, 0x3, 'dh\x00', 0x1, 0x80005, 0x6f}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e21, 0x3, 'sh\x00', 0x5, 0x9, 0x77}, {@remote, 0x4e20, 0x2000, 0xcd}}, 0x44) 3.70350762s ago: executing program 4 (id=4119): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$wireguard(0x0, 0xffffffffffffffff) socket$inet6_sctp(0xa, 0x1, 0x84) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) connect$inet(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000007fc0), 0x800001d, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'rmd160-generic\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) recvmmsg$unix(r2, &(0x7f0000003700)=[{{0x0, 0x700, 0x0, 0x0, 0x0, 0x500}}], 0x600, 0x0, 0x0) mremap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000, 0x7, &(0x7f0000ffe000/0x2000)=nil) 3.414807405s ago: executing program 9 (id=4120): socket$kcm(0x10, 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000380)={'wlan1\x00'}) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$SEG6_CMD_SETHMAC(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x1}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x1}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}]}, 0x2c}}, 0x0) r3 = syz_open_dev$sndpcmc(&(0x7f0000000300), 0x0, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) mmap$snddsp_control(&(0x7f0000000000/0x3000)=nil, 0x1000, 0x1, 0x11, r3, 0x82000000) ioprio_get$uid(0x3, 0x0) 3.228931015s ago: executing program 9 (id=4121): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000003, 0x50032, 0xffffffffffffffff, 0x0) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001000)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef42d430f6296b72a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed40000000022278d00031e5388ee5c867ddd58211d6ece3ccb0cd2b6d3cffd962867a3a2f624f992daa94a6a556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff020000000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409e011f1264d43f153b3d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7000026a4e739c60f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf3f704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eedd9068ca1457870eb30d219e23ccc8e06dddeb61799257ab5000013c86ba99523d61a00000000c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb8629aeec90e6d1857da822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae200f279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522e8dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87995b51cb6febd5f34a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724be3733c26f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be10ba7dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2db484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b00ffffff7f000000000801f71d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cf0d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67856ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e2b8e7370baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e5ee341a17bf8132b09000000d31df213c802d74797056fd3bca8b2d6cb134437cba0193ba4360bdcc98aad2560aa48291c4eb9d4e08ad7a9c5f04be1ab597124d84dfc7bd8cca8f68154a0ed356e773a797ca6d66748857b4abbf8830abeea2a46342e6a7378173cb29d5cdcd698a0203f78116b710008000000000000007c2d86b94472807c10eb9a8e2fb8bd79fe3a8316deff3ee641c9a080a2173642e673a672279bae4e7e28055da9497d7edb53be6e80482bd4d9a74b8dd4221fff0f0000705d7257ff7f76c78ba0b44ec0bdfa0d32d7042059b13a079639f14f9032b856d892ad6af5124c9c3130485e9682ff1f3c54e475d5bb496aef4bb537d7e191dfdeba109fdcf7864763f87a6d711cf52e520a6ce30e134c55e0caac037209d2f14fcddd00000000000000000000000000000000e609893bdce015e8ccfb36399844db61f6171b0b0e845e48728450c6ba4f7098f8e000676b59ab9f851f3ab77847ce05c89411277ec69c409b7ec50a3337a78675f38a568612c235ab5f2cd6d035d5f5f6a693c381adbbf7b37e37292783b2c7efe7d3a067906552f76d419e0300000000000000000000008f3a20b49fe7636806867283e35cff8d00e7b251bab3cf6377a24f8e8d4bda7503674bc94bf7f4d2fa6f25944bf0a186436d9f6831995976328a1fdc78492c65c1434855dc35c3cf7cf9610c5387794443c99b304799114132362849c3fa85d6379729ff9094933db0cfbe8887c50b87e1469fdf454cef4cbc5f7bf384000000000000a4e8c1a25f47c440144a9776be6cb40aafdb9d3cc8f6a6050974e1c4000000000000008b753f4e1bef9556efcc087a99dbf231167013a4b2eaf6338a0b100c98a331dffc09"], &(0x7f0000000140)='GPL\x00'}, 0x48) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f0000000040)={0xffffffffffffffff, r2}) mlock(&(0x7f00007d8000/0x800000)=nil, 0x800000) syz_clone(0x100, 0x0, 0x0, 0x0, 0x0, 0x0) mlock(&(0x7f00007d8000/0x800000)=nil, 0x800000) 3.14296005s ago: executing program 7 (id=4122): sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{&(0x7f0000000240)=@generic={0x21, "1aee2c4f6843c6782466293e62d4f664c2efa8906f0d97822ac0d88ecdd9d47e182b3b523c6243022c1be9fd662325c023ac48a28ae996c41561bb7e9903c408613b4d29da0b9d5af499caa7759c17c667af8acea6dc52148f1233494efd8f08aaab6382d5e33471a107ec47df5b5312764e134c68842fd1a2078151812e"}, 0x80, &(0x7f00000009c0)=[{&(0x7f00000002c0)="f973085a6ea39ea1b25a1c6b351e11245900557d1c8e9f86bae5e5c64e50ef25afb0295d0c303850b4bff4d088bf9df67e013836e2882dad3f7698b52997f7efa9eb96f09be1c3019445927c6b2fe32d38ae2bcad2ac0d85ebd42914fb18b7d0670f8b3be16755ead6a6fb713fa618ce2cf424ea7cc84b04016b9a2afbfaf68803f1c1acb74fef", 0x87}, {&(0x7f0000000380)="82f294054d05973abfac6a6f31050418457d017c5fd68b034cf51b9f6a6d71daa5c776bca90037bc7c3d88b151fbf856f69ebd05e750f13f02af646b284953b6640a08c827c6f2ff4ad8e84077f9f03f94792aa17c4743cba3f355bb9c5b04b91ed70d253db68e17cdd561fab504479f723388dda974e2a9fb1bcda474c08d6222179b19e902009ea3cb3e42408bab6c1f29cb62d05805063967de38327e", 0x9e}, {&(0x7f0000000480)}, {&(0x7f0000000780)="8ff2f15bd0017ce4b36b6bc4335634254cffcc40c0312f5ff35991272b79d76712dc0c3cfdc0d70ce8004884e6917bed9ffee1584df7f06c7bccac71daf78bf3c68b8d5e56357654784bdbc700bceb1049c6a47d53c5ac29f83aed3ae9968fe8", 0x60}, {&(0x7f0000000800)="5193f0b40db29d9ce06f429ed3c2c6405967f1e559f08c35f5e63ad64c2746967cca1bbeaf6206a79c42badb4fb453f294c2932cb5552a5f9c1d633207a53c2f54d98c2f9e4323eac6c20c56e7607d212b210a0325f7c289d1a2552d7a3f2176a47e95bc46471fae9167768d58f22ff10ba3cc2050b1ee838ce9e4ac5a1544fec3e291272cfaaa4817539972fb8bb2ed", 0x90}, {&(0x7f0000000900)="a9be9b2ff3a19d5a1226e5243d37d1fd2894c1ae880dc2316aa2d5ad08944c7135eb837eff354282dd5863c051eb7b9b17be0e4fdd6560f3f2c2c04af73a6cb75b5d05d6037f91e8f4f08e90d5313fb91fbdc5acd212f7d8c800a837a0236309d25e82d5767d8df7512b2beb324c2a2fd6f4ed3a3eb7396f02d515396a3be574d721df257dbf0bc39c61", 0x8a}, {&(0x7f00000000c0)}], 0x7}}, {{&(0x7f0000000a40)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x80, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000bc0)="61275006ed747229311198ab94c7e6699587b0d033c2f17d1ccbd45cba520b6888fbad95d4d6ae3cc7172b392f90693e992e52408ba7f1874d1767303d6acb170f216f71908f53a3be1833a25eb1fb2ba3913dcc1de30c5c7e914b13514dea44fb2b964aaa280d5a85512fede48830ca6ea5cd18ff95c871d91454240f370e0c8e2629e58605c4b29017a160709ec76547c92a21d0ec5589e228922b105d0b8b29256620c44d2118334025dedd46db5194f22b34", 0xb4}], 0x2, &(0x7f0000000cc0)=[@mark={{0x14, 0x1, 0x24, 0x9a9}}, @mark={{0x14, 0x1, 0x24, 0x4}}, @timestamping={{0x14, 0x1, 0x25, 0x101}}, @txtime={{0x18, 0x1, 0x3d, 0x2}}, @txtime={{0x18, 0x1, 0x3d, 0x9d}}], 0x78}}], 0x2, 0x20000044) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'vlan1\x00'}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 2.834391846s ago: executing program 7 (id=4123): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000140)='vegas', 0xd) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) 2.742981171s ago: executing program 9 (id=4124): bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x2, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r1 = syz_io_uring_setup(0x45, &(0x7f0000000300)={0x0, 0xf20f, 0x40, 0x2, 0x1b}, &(0x7f0000000100), 0x0, &(0x7f0000000000)) io_uring_register$IORING_REGISTER_PBUF_RING(r1, 0x22, &(0x7f0000000380)={&(0x7f0000006000)={[{0x0, 0x0, 0x103}]}, 0x1}, 0x1) sched_setscheduler(0x0, 0x1, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0xa, 0x1, 0x106) 2.40050437s ago: executing program 9 (id=4125): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='lp', 0x2) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) 2.099723166s ago: executing program 6 (id=4126): openat(0xffffffffffffffff, 0x0, 0x600, 0x0) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f0000000040), &(0x7f0000000340)=@v3={0x3000000, [{0xdb7, 0x5}, {0x6, 0x5}]}, 0x18, 0x1) socket$nl_route(0x10, 0x3, 0x0) socket$inet6(0xa, 0x3, 0x5) socket$nl_sock_diag(0x10, 0x3, 0x4) socket$inet_sctp(0x2, 0x1, 0x84) syz_usb_connect$uac1(0x2, 0xa5, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000106b1d0101400001020301090293000301000000090400000001"], 0x0) socket$inet6(0xa, 0x3, 0x87) socket$inet6_udp(0xa, 0x2, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0x77, 0x101301) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)) socket$inet_sctp(0x2, 0x1, 0x84) socket$packet(0x11, 0x2, 0x300) socket(0x10, 0x803, 0x0) socket(0x10, 0x803, 0x0) socket(0x400000000010, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001c00010429bd7000ffdbdf25070000", @ANYRES32=r1, @ANYBLOB="e0ff8b0a0a0002"], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x24040040) 1.6675151s ago: executing program 7 (id=4127): ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(0xffffffffffffffff, 0x4048587b, &(0x7f0000000d40)={{0xffffffffffffffff, &(0x7f0000000300)='skcipher\x00', 0x0, 0x0, 0x3, 0x0, 0x0}, 0x0, 0x0}) socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$fb0(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wlan0\x00'}) sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) setreuid(0x0, 0x0) r4 = socket(0x1, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f00000008c0)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f670600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b52710aeee835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5bc6d3fd0500000022eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe326c2ed0a432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1b172191d359645fae2d074ea5724ab77ea04fe507938b1213cdd4a92860e59808689382734d24b3123dd40c6d612c8a19948cd257748b1e7324adddbe61d51013f7d6b313c6df7b7b29678d70fc94dcc3e99e2472e78968ed94e7a54988656e8fff6b1d9b9993c71edd5cc10a2bea8d94d751b77fa7c48c712af35a9ffe670e8fa451942f48741119496bc30137e1202aed6bb5cd5c2d0256d049e4a335e2ea5545e5624be2391c37c0a2ae3bbb5b58778b85424bcdb84358359b2cb2782fc0e82f17b12d641ce6a72ab0ac794f878140897703bebe4420115d26675f27598841965fa91088252"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) bind$unix(r4, &(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000001680)=[{{&(0x7f0000000380)=@file={0x1, './file0\x00'}, 0x6e, 0x0}}], 0x1, 0x0) 1.624191132s ago: executing program 3 (id=4128): sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{&(0x7f0000000240)=@generic={0x21, "1aee2c4f6843c6782466293e62d4f664c2efa8906f0d97822ac0d88ecdd9d47e182b3b523c6243022c1be9fd662325c023ac48a28ae996c41561bb7e9903c408613b4d29da0b9d5af499caa7759c17c667af8acea6dc52148f1233494efd8f08aaab6382d5e33471a107ec47df5b5312764e134c68842fd1a2078151812e"}, 0x80, &(0x7f00000009c0)=[{&(0x7f00000002c0)="f973085a6ea39ea1b25a1c6b351e11245900557d1c8e9f86bae5e5c64e50ef25afb0295d0c303850b4bff4d088bf9df67e013836e2882dad3f7698b52997f7efa9eb96f0", 0x44}, {&(0x7f0000000380)="82f294054d05973abfac6a6f31050418457d017c5fd68b034cf51b9f6a6d71daa5c776bca90037bc7c3d88b151fbf856f69ebd05e750f13f02af646b284953b6640a08c827c6f2ff4ad8e84077f9f03f94792aa17c4743cba3f355bb9c5b04b91ed70d253db68e17cdd561fab504479f723388dda974e2a9fb1bcda474c08d6222179b19e902009ea3cb3e42408bab6c1f29cb62d05805063967de38327e", 0x9e}, {&(0x7f0000000480)}, {&(0x7f0000000780)="8ff2f15bd0017ce4b36b6bc4335634254cffcc40c0312f5ff35991272b79d76712dc0c3cfdc0d70ce8004884e6917bed9ffee1584df7f06c7bccac71daf78bf3c68b8d5e56357654784bdbc700bceb1049c6a47d53c5ac29f83aed3ae9968fe8", 0x60}, {0x0}, {&(0x7f0000000900)="a9be9b2ff3a19d5a1226e5243d37d1fd2894c1ae880dc2316aa2d5ad08944c7135eb837eff354282dd5863c051eb7b9b17be0e4fdd6560f3f2c2c04af73a6cb75b5d05d6037f91e8f4f08e90d5313fb91fbdc5acd212f7d8c800a837a0236309d25e82d5767d8df7512b2beb324c2a2fd6f4ed3a3eb7396f02d515396a3be574d721df257dbf0bc39c617c69458d721eb85d0e", 0x93}, {&(0x7f00000000c0)}], 0x7}}, {{&(0x7f0000000a40)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x80, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000ac0)="3eb85e3024a2953147f5444738e1388e15fef01893884c2eeb5c559f4a030ee6b08fca1e38ee56dac9cbbea3d6d43e34d9daf81d45289d2bc841e2c4c7072582b15ce7ff3e22b0f19d8a2643280daeb9791b2d0f9b216a0fda4f30804b739da3cce1691d6d88ff52d3e43b26d935d69e99673e98e92fe2fd18e63d4d5699814d9843367774e155678592d0eec07073e851f50827bde418748aa0741684fe603e34dcc960678c7b3e71e48befa166d4a5247325fa881fc7857a8caadde6a2ac9cdc", 0xc1}, {&(0x7f0000000bc0)="61275006ed747229311198ab94c7e6699587b0d033c2f17d1ccbd45cba520b6888fbad95d4d6ae3cc7172b392f90693e992e52408ba7f1874d1767303d6acb170f216f71908f53a3be1833a25eb1fb2ba3913dcc1de30c5c7e914b13514dea44fb2b964aaa280d5a85512fede48830ca6ea5cd18ff95c871d91454240f370e0c8e2629e58605c4b29017a160709ec76547c92a21d0ec5589e228922b105d0b8b29256620c44d2118334025dedd46db5194f22b34", 0xb4}], 0x3, &(0x7f0000000cc0)=[@mark={{0x14, 0x1, 0x24, 0x9a9}}, @mark={{0x14, 0x1, 0x24, 0x4}}, @timestamping={{0x14, 0x1, 0x25, 0x101}}, @txtime={{0x18, 0x1, 0x3d, 0x2}}, @txtime={{0x18, 0x1, 0x3d, 0x9d}}], 0x78}}, {{0x0, 0x0, &(0x7f0000003a40)=[{&(0x7f0000000640)="f3f4c60f4caeeeb0b0c17aa4", 0xc}], 0x1}}], 0x3, 0x20000044) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'vlan1\x00'}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {0x0}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 697.922902ms ago: executing program 7 (id=4129): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000400), r0) sendmsg$MPTCP_PM_CMD_GET_ADDR(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)={0x18, r1, 0x1, 0x70bd2d, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_ADDR={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x20008081}, 0x20000004) 625.278716ms ago: executing program 9 (id=4130): ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(0xffffffffffffffff, 0x4048587b, &(0x7f0000000d40)={{0xffffffffffffffff, &(0x7f0000000300)='skcipher\x00', 0x0, 0x0, 0x3, 0x0, 0x0}, 0x0, 0x0}) socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$fb0(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wlan0\x00'}) sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) r3 = socket$rds(0x15, 0x5, 0x0) bind$rds(r3, &(0x7f0000000040)={0x2, 0x4e22, @loopback}, 0x10) sendmsg$rds(r3, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000780)=[@rdma_args={0x48, 0x114, 0x1, {{}, {0x0, 0x2c}, &(0x7f00000006c0)=[{&(0x7f0000000100)=""/44, 0x410200}], 0x1}}], 0x48}, 0x0) 605.933757ms ago: executing program 3 (id=4131): socket$kcm(0x10, 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000380)={'wlan1\x00'}) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$SEG6_CMD_SETHMAC(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x1}, @SEG6_ATTR_ALGID={0x5, 0x6, 0x1}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}]}, 0x2c}}, 0x0) r3 = syz_open_dev$sndpcmc(&(0x7f0000000300), 0x0, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) mmap$snddsp_control(&(0x7f0000000000/0x3000)=nil, 0x1000, 0x1, 0x11, r3, 0x82000000) ioprio_get$uid(0x3, 0x0) 402.971148ms ago: executing program 7 (id=4132): sendmsg$DEVLINK_CMD_RELOAD(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, 0x0, 0x1, 0x70bd27, 0x25dfdbfb, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x30) syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000040)=ANY=[@ANYBLOB="12010003000000103d10000140000102030109026e000301d8100c080b"], 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/key-users\x00', 0x0, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043ef50d"], 0xf8) 135.710572ms ago: executing program 3 (id=4133): sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{&(0x7f0000000240)=@generic={0x21, "1aee2c4f6843c6782466293e62d4f664c2efa8906f0d97822ac0d88ecdd9d47e182b3b523c6243022c1be9fd662325c023ac48a28ae996c41561bb7e9903c408613b4d29da0b9d5af499caa7759c17c667af8acea6dc52148f1233494efd8f08aaab6382d5e33471a107ec47df5b5312764e134c68842fd1a2078151812e"}, 0x80, &(0x7f00000009c0)=[{&(0x7f00000002c0)="f973085a6ea39ea1b25a1c6b351e11245900557d1c8e9f86bae5e5c64e50ef25afb0295d0c303850b4bff4d088bf9df67e013836e2882dad3f7698b52997f7efa9eb96f09be1c3019445927c6b2fe32d38ae2bcad2ac0d85ebd42914fb18b7d0670f8b3be16755ead6a6fb713fa618ce2cf424ea7cc84b04016b9a2afbfaf68803f1c1acb74fef", 0x87}, {&(0x7f0000000380)="82f294054d05973abfac6a6f31050418457d017c5fd68b034cf51b9f6a6d71daa5c776bca90037bc7c3d88b151fbf856f69ebd05e750f13f02af646b284953b6640a08c827c6f2ff4ad8e84077f9f03f94792aa17c4743cba3f355bb9c5b04b91ed70d253db68e17cdd561fab504479f723388dda974e2a9fb1bcda474c08d6222179b19e902009ea3cb3e42408bab6c1f29cb62d05805063967de38327e", 0x9e}, {&(0x7f0000000480)}, {&(0x7f0000000780)="8ff2f15bd0017ce4b36b6bc4335634254cffcc40c0312f5ff35991272b79d76712dc0c3cfdc0d70ce8004884e6917bed9ffee1584df7f06c7bccac71daf78bf3c68b8d5e56357654784bdbc700bceb1049c6a47d53c5ac29f83aed3ae9968fe8", 0x60}, {&(0x7f0000000800)="5193f0b40db29d9ce06f429ed3c2c6405967f1e559f08c35f5e63ad64c2746967cca1bbeaf6206a79c42badb4fb453f294c2932cb5552a5f9c1d633207a53c2f54d98c2f9e4323eac6c20c56e7607d212b210a0325f7c289d1a2552d7a3f2176a47e95bc46471fae9167768d58f22ff10ba3cc2050b1ee838ce9e4ac5a1544fec3e291272cfaaa4817539972fb8bb2ed", 0x90}, {&(0x7f0000000900)="a9be9b2ff3a19d5a1226e5243d37d1fd2894c1ae880dc2316aa2d5ad08944c7135eb837eff354282dd5863c051eb7b9b17be0e4fdd6560f3f2c2c04af73a6cb75b5d05d6037f91e8f4f08e90d5313fb91fbdc5acd212f7d8c800a837a0236309d25e82d5767d8df7512b2beb324c2a2fd6f4ed3a3eb7396f02d515396a3be574d721df257dbf0bc39c617c69458d72", 0x8f}, {&(0x7f00000000c0)}], 0x7}}, {{&(0x7f0000000a40)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x80, &(0x7f0000000600)=[{0x0}, {&(0x7f0000000bc0)="61275006ed747229311198ab94c7e6699587b0d033c2f17d1ccbd45cba520b6888fbad95d4d6ae3cc7172b392f90693e992e52408ba7f1874d1767303d6acb170f216f71908f53a3be1833a25eb1fb2ba3913dcc1de30c5c7e914b13514dea44fb2b964aaa280d5a85512fede48830ca6ea5cd18ff95c871d91454240f370e0c8e2629e58605c4b29017a160709ec76547c92a21d0ec5589e228922b105d0b8b29256620c44d2118334025dedd46db5194f22b34", 0xb4}], 0x2, &(0x7f0000000cc0)=[@mark={{0x14, 0x1, 0x24, 0x9a9}}, @mark={{0x14, 0x1, 0x24, 0x4}}, @timestamping={{0x14, 0x1, 0x25, 0x101}}, @txtime={{0x18, 0x1, 0x3d, 0x2}}, @txtime={{0x18, 0x1, 0x3d, 0x9d}}], 0x78}}], 0x2, 0x20000044) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'vlan1\x00'}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 0s ago: executing program 3 (id=4134): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$kcm(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)}, {0x0}], 0x2) socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x9, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x44, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, 0x0, {0x0, 0xffe0}, {0xffff, 0xffff}, {0x0, 0xfff2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_SPLIT_GSO={0x8, 0x11, 0x1}, @TCA_CAKE_AUTORATE={0x8}]}}]}, 0x44}}, 0x0) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad44afac11d875397bdb22d0000b420a1a93c5240f45f819ef6167d3d458dd4992861ac00", "f4bd00ac6700000000000000000000c2888e7d52164ec480e79200000100", [0x0, 0x2000000000001]}}) ioctl$XFS_IOC_SCRUBV_METADATA(r0, 0xc0285840, &(0x7f0000000000)={0xd22, 0x200, 0x5, 0x0, 0x3, 0x0, 0x0, 0xffffffffffffffff}) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x4, 0xf, 0x80000006}, 0x0, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r2, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): 2] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 610.149626][T12702] usb 7-1: Product: syz [ 610.163292][T12702] usb 7-1: Manufacturer: syz [ 610.213481][T12702] usb 7-1: can't set config #1, error -71 [ 610.415233][T12702] usb 7-1: USB disconnect, device number 3 [ 611.051308][T13803] Bluetooth: hci2: command 0x0406 tx timeout [ 612.309636][T13836] trusted_key: encrypted_key: insufficient parameters specified [ 613.447944][T13854] 9pnet: Insufficient options for proto=fd [ 613.488367][T13854] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 614.816768][ T4231] Bluetooth: hci2: command 0x0406 tx timeout [ 615.500343][T13848] netlink: 'syz.0.3341': attribute type 4 has an invalid length. [ 615.508644][T13848] netlink: 152 bytes leftover after parsing attributes in process `syz.0.3341'. [ 615.517879][T13848] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 616.802793][T12230] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 617.483091][T12230] usb 7-1: Using ep0 maxpacket: 8 [ 617.601770][ T4238] device hsr_slave_0 left promiscuous mode [ 617.643146][ T4238] device hsr_slave_1 left promiscuous mode [ 617.680033][ T4238] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 617.693028][T12230] usb 7-1: config 255 has an invalid interface number: 106 but max is 0 [ 617.710367][ T4238] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 617.720394][T12230] usb 7-1: config 255 has no interface number 0 [ 617.751808][T12230] usb 7-1: config 255 interface 106 altsetting 15 endpoint 0xE has invalid maxpacket 1024, setting to 64 [ 617.774552][ T4238] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 617.802379][T12230] usb 7-1: config 255 interface 106 altsetting 15 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 617.802403][ T4238] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 618.223903][T12230] usb 7-1: config 255 interface 106 altsetting 15 endpoint 0x7 has invalid maxpacket 1024, setting to 64 [ 618.262658][T12230] usb 7-1: config 255 interface 106 has no altsetting 0 [ 618.286841][ T4238] device bridge_slave_1 left promiscuous mode [ 618.323103][ T4238] bridge0: port 2(bridge_slave_1) entered disabled state [ 618.361449][ T4238] device bridge_slave_0 left promiscuous mode [ 618.378157][ T4238] bridge0: port 1(bridge_slave_0) entered disabled state [ 618.503070][T12230] usb 7-1: New USB device found, idVendor=1199, idProduct=0218, bcdDevice=9a.82 [ 618.512731][T12230] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 618.523700][T12230] usb 7-1: Product: syz [ 618.527971][T12230] usb 7-1: Manufacturer: syz [ 618.533876][T12230] usb 7-1: SerialNumber: syz [ 618.750785][ T4238] device veth1_macvtap left promiscuous mode [ 618.757085][ T4238] device veth0_macvtap left promiscuous mode [ 618.777442][ T4238] device veth1_vlan left promiscuous mode [ 618.787532][ T4238] device veth0_vlan left promiscuous mode [ 618.875329][ T150] block nbd3: Attempted send on invalid socket [ 618.881889][ T150] blk_update_request: I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 618.902363][T13896] exFAT-fs (nbd3): unable to read boot sector [ 618.941365][T13896] exFAT-fs (nbd3): failed to read boot sector [ 618.947628][T13896] exFAT-fs (nbd3): failed to recognize exfat type [ 619.043964][T12230] sierra 7-1:255.106: Sierra USB modem converter detected [ 619.097176][T12230] usb 7-1: Sierra USB modem converter now attached to ttyUSB0 [ 619.138139][T12230] usb 7-1: Sierra USB modem converter now attached to ttyUSB1 [ 619.208134][T12230] usb 7-1: USB disconnect, device number 4 [ 620.046093][T13900] vivid-000: kernel_thread() failed [ 620.189053][T12230] sierra ttyUSB0: Sierra USB modem converter now disconnected from ttyUSB0 [ 620.367208][T12230] sierra ttyUSB1: Sierra USB modem converter now disconnected from ttyUSB1 [ 620.383687][T12230] sierra 7-1:255.106: device disconnected [ 621.150161][ T4238] team0 (unregistering): Port device team_slave_1 removed [ 621.203566][ T4238] team0 (unregistering): Port device team_slave_0 removed [ 621.272986][ T4238] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 621.326391][ T4238] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 621.608635][ T4238] bond0 (unregistering): Released all slaves [ 622.027813][T13884] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3347'. [ 622.098824][T13908] tipc: Enabling of bearer rejected, failed to enable media [ 623.227113][T13005] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci5/hci5:201' [ 623.237909][T13005] CPU: 1 PID: 13005 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 623.245570][T13005] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 623.255735][T13005] Workqueue: hci5 hci_rx_work [ 623.260447][T13005] Call Trace: [ 623.263725][T13005] [ 623.266662][T13005] dump_stack_lvl+0x188/0x250 [ 623.271349][T13005] ? show_regs_print_info+0x20/0x20 [ 623.276553][T13005] ? load_image+0x400/0x400 [ 623.281064][T13005] sysfs_create_dir_ns+0x26a/0x290 [ 623.286171][T13005] ? sysfs_warn_dup+0xa0/0xa0 [ 623.291108][T13005] ? process_one_work+0x85f/0x1010 [ 623.296219][T13005] ? do_raw_spin_unlock+0x11d/0x230 [ 623.301417][T13005] kobject_add_internal+0x6e0/0xd90 [ 623.306622][T13005] kobject_add+0x160/0x230 [ 623.311164][T13005] ? kobject_init+0x1d0/0x1d0 [ 623.315867][T13005] ? klist_children_get+0x50/0x50 [ 623.320897][T13005] ? get_device_parent+0x121/0x3f0 [ 623.326009][T13005] device_add+0x483/0xfb0 [ 623.330341][T13005] hci_conn_add_sysfs+0xd1/0x1e0 [ 623.335275][T13005] le_conn_complete_evt+0xc48/0x15c0 [ 623.340564][T13005] ? cs_le_create_conn+0x5e0/0x5e0 [ 623.345670][T13005] ? __mutex_trylock_common+0x155/0x260 [ 623.351212][T13005] hci_le_meta_evt+0x285/0x3c90 [ 623.356056][T13005] ? hci_event_packet+0x37b/0x1370 [ 623.361160][T13005] ? __lock_acquire+0x7d10/0x7d10 [ 623.366269][T13005] ? hci_remote_host_features_evt+0x280/0x280 [ 623.372333][T13005] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 623.377964][T13005] ? mark_lock+0x94/0x320 [ 623.382285][T13005] ? mutex_unlock+0x10/0x10 [ 623.386787][T13005] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 623.392777][T13005] ? lock_chain_count+0x20/0x20 [ 623.397643][T13005] ? __rwlock_init+0x140/0x140 [ 623.402399][T13005] hci_event_packet+0xe48/0x1370 [ 623.407330][T13005] ? lockdep_hardirqs_on+0x94/0x140 [ 623.412554][T13005] ? rcu_lock_release+0x20/0x20 [ 623.417493][T13005] ? hci_send_to_monitor+0x9c/0x4a0 [ 623.422711][T13005] hci_rx_work+0x255/0xa10 [ 623.427130][T13005] process_one_work+0x85f/0x1010 [ 623.432247][T13005] ? worker_detach_from_pool+0x240/0x240 [ 623.437876][T13005] ? lockdep_hardirqs_off+0x70/0x100 [ 623.443160][T13005] ? _raw_spin_lock_irq+0xb7/0xf0 [ 623.448185][T13005] ? _raw_spin_lock_irqsave+0x100/0x100 [ 623.453725][T13005] ? wq_worker_running+0x97/0x170 [ 623.458747][T13005] worker_thread+0xaa6/0x1290 [ 623.463425][T13005] ? lockdep_hardirqs_on+0x94/0x140 [ 623.468622][T13005] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 623.474517][T13005] kthread+0x436/0x520 [ 623.478580][T13005] ? rcu_lock_release+0x20/0x20 [ 623.483423][T13005] ? kthread_blkcg+0xd0/0xd0 [ 623.488012][T13005] ret_from_fork+0x1f/0x30 [ 623.492446][T13005] [ 623.502679][T13005] kobject_add_internal failed for hci5:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 623.516433][T13005] Bluetooth: hci5: failed to register connection device [ 623.524036][T13005] Bluetooth: hci5: link tx timeout [ 623.530894][T13005] Bluetooth: hci5: killing stalled connection 10:aa:aa:aa:aa:aa [ 623.905334][T13961] device syzkaller0 entered promiscuous mode [ 624.445069][ T1431] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.451376][ T1431] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.949668][T13967] device erspan0 entered promiscuous mode [ 626.222721][T12721] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 626.872797][ T4231] usb 3-1: new full-speed USB device number 61 using dummy_hcd [ 626.912824][T12721] usb 6-1: Using ep0 maxpacket: 8 [ 627.037826][T12721] usb 6-1: config 255 has an invalid interface number: 106 but max is 0 [ 627.058882][T12721] usb 6-1: config 255 has no interface number 0 [ 627.084324][T12721] usb 6-1: config 255 interface 106 altsetting 15 endpoint 0xE has invalid maxpacket 1024, setting to 64 [ 627.102761][ T4231] usb 3-1: device descriptor read/64, error -71 [ 627.126975][T12721] usb 6-1: config 255 interface 106 altsetting 15 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 627.311329][T12721] usb 6-1: config 255 interface 106 altsetting 15 endpoint 0x7 has invalid maxpacket 1024, setting to 64 [ 627.323256][T12721] usb 6-1: config 255 interface 106 has no altsetting 0 [ 627.412765][ T4231] usb 3-1: new full-speed USB device number 62 using dummy_hcd [ 627.482894][T12721] usb 6-1: New USB device found, idVendor=1199, idProduct=0218, bcdDevice=9a.82 [ 627.491995][T12721] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 627.540547][T12721] usb 6-1: Product: syz [ 627.560449][T12721] usb 6-1: Manufacturer: syz [ 627.579615][T12721] usb 6-1: SerialNumber: syz [ 627.632763][ T4231] usb 3-1: device descriptor read/64, error -71 [ 627.772990][ T4231] usb usb3-port1: attempt power cycle [ 627.923930][T12721] sierra 6-1:255.106: Sierra USB modem converter detected [ 627.959590][T12721] usb 6-1: Sierra USB modem converter now attached to ttyUSB0 [ 628.011916][T12721] usb 6-1: Sierra USB modem converter now attached to ttyUSB1 [ 628.050139][T14012] tipc: Started in network mode [ 628.066419][T12721] usb 6-1: USB disconnect, device number 2 [ 628.086372][T14012] tipc: Node identity 5e1591802df2, cluster identity 4711 [ 628.116153][T12721] sierra ttyUSB0: Sierra USB modem converter now disconnected from ttyUSB0 [ 628.142140][T14012] tipc: Enabled bearer , priority 0 [ 628.168443][T12721] sierra ttyUSB1: Sierra USB modem converter now disconnected from ttyUSB1 [ 628.195661][T12721] sierra 6-1:255.106: device disconnected [ 628.195960][T14015] device syzkaller0 entered promiscuous mode [ 628.207961][ T4231] usb 3-1: new full-speed USB device number 63 using dummy_hcd [ 628.306088][T14017] tipc: Resetting bearer [ 628.322896][ T4231] usb 3-1: device descriptor read/8, error -71 [ 628.403080][T14011] tipc: Resetting bearer [ 628.469420][T14011] tipc: Disabling bearer [ 628.495436][ T4198] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 628.505401][ T4198] CPU: 1 PID: 4198 Comm: kworker/u5:5 Not tainted syzkaller #0 [ 628.512987][ T4198] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 628.523074][ T4198] Workqueue: hci0 hci_rx_work [ 628.527799][ T4198] Call Trace: [ 628.531097][ T4198] [ 628.534048][ T4198] dump_stack_lvl+0x188/0x250 [ 628.538854][ T4198] ? show_regs_print_info+0x20/0x20 [ 628.544167][ T4198] ? load_image+0x400/0x400 [ 628.548707][ T4198] sysfs_create_dir_ns+0x26a/0x290 [ 628.553832][ T4198] ? sysfs_warn_dup+0xa0/0xa0 [ 628.558525][ T4198] ? process_one_work+0x85f/0x1010 [ 628.563648][ T4198] ? do_raw_spin_unlock+0x11d/0x230 [ 628.568865][ T4198] kobject_add_internal+0x6e0/0xd90 [ 628.574074][ T4198] kobject_add+0x160/0x230 [ 628.578507][ T4198] ? kobject_init+0x1d0/0x1d0 [ 628.583193][ T4198] ? klist_children_get+0x50/0x50 [ 628.588222][ T4198] ? get_device_parent+0x121/0x3f0 [ 628.593339][ T4198] device_add+0x483/0xfb0 [ 628.597686][ T4198] hci_conn_add_sysfs+0xd1/0x1e0 [ 628.602643][ T4198] le_conn_complete_evt+0xc48/0x15c0 [ 628.607978][ T4198] ? cs_le_create_conn+0x5e0/0x5e0 [ 628.613099][ T4198] ? __mutex_trylock_common+0x155/0x260 [ 628.618925][ T4198] hci_le_meta_evt+0x285/0x3c90 [ 628.623813][ T4198] ? hci_event_packet+0x37b/0x1370 [ 628.628929][ T4198] ? __lock_acquire+0x7d10/0x7d10 [ 628.633966][ T4198] ? hci_remote_host_features_evt+0x280/0x280 [ 628.640210][ T4198] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 628.645849][ T4198] ? mark_lock+0x94/0x320 [ 628.650184][ T4198] ? mutex_unlock+0x10/0x10 [ 628.654694][ T4198] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 628.660687][ T4198] ? lock_chain_count+0x20/0x20 [ 628.665547][ T4198] ? __rwlock_init+0x140/0x140 [ 628.670315][ T4198] hci_event_packet+0xe48/0x1370 [ 628.675254][ T4198] ? lockdep_hardirqs_on+0x94/0x140 [ 628.680478][ T4198] ? rcu_lock_release+0x20/0x20 [ 628.685337][ T4198] ? hci_send_to_monitor+0x9c/0x4a0 [ 628.690543][ T4198] hci_rx_work+0x255/0xa10 [ 628.694975][ T4198] process_one_work+0x85f/0x1010 [ 628.699957][ T4198] ? worker_detach_from_pool+0x240/0x240 [ 628.706030][ T4198] ? lockdep_hardirqs_off+0x70/0x100 [ 628.711414][ T4198] ? _raw_spin_lock_irq+0xb7/0xf0 [ 628.716445][ T4198] ? _raw_spin_lock_irqsave+0x100/0x100 [ 628.721997][ T4198] ? wq_worker_running+0x97/0x170 [ 628.727030][ T4198] worker_thread+0xaa6/0x1290 [ 628.731735][ T4198] kthread+0x436/0x520 [ 628.735808][ T4198] ? rcu_lock_release+0x20/0x20 [ 628.740665][ T4198] ? kthread_blkcg+0xd0/0xd0 [ 628.745264][ T4198] ret_from_fork+0x1f/0x30 [ 628.749705][ T4198] [ 628.756376][ T4198] kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 628.771012][ T4198] Bluetooth: hci0: failed to register connection device [ 628.832740][ T4231] usb 3-1: new full-speed USB device number 64 using dummy_hcd [ 628.942952][ T4231] usb 3-1: device descriptor read/8, error -71 [ 629.063799][ T4231] usb usb3-port1: unable to enumerate USB device [ 629.940609][ T21] Bluetooth: hci5: command 0x0406 tx timeout [ 630.232814][T12702] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 630.482865][T12702] usb 6-1: Using ep0 maxpacket: 16 [ 632.153201][T12702] usb 6-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 632.260649][T12702] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 632.429101][T12702] usb 6-1: Product: syz [ 632.511645][T12702] usb 6-1: Manufacturer: syz [ 632.586091][T12702] usb 6-1: SerialNumber: syz [ 632.736831][T12702] usb 6-1: config 0 descriptor?? [ 632.784831][ T4231] Bluetooth: hci3: command 0x0406 tx timeout [ 632.934819][T14069] binder: 14068:14069 ioctl c0285840 200000000000 returned -22 [ 633.063473][T12702] dvb_usb_dtv5100: probe of 6-1:0.0 failed with error -71 [ 633.123075][T12702] usb 6-1: USB disconnect, device number 3 [ 633.335254][T14077] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 634.146368][T14085] vivid-000: kernel_thread() failed [ 634.352427][T14088] tipc: Enabled bearer , priority 0 [ 634.420014][T14090] device syzkaller0 entered promiscuous mode [ 634.540810][T14088] tipc: Resetting bearer [ 634.582888][T14087] tipc: Resetting bearer [ 635.204457][T14087] tipc: Disabling bearer [ 638.648384][T14124] binder: 14119:14124 ioctl c0285840 200000000000 returned -22 [ 639.129537][T14132] trusted_key: encrypted_key: insufficient parameters specified [ 640.684079][ T4262] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 641.006652][T14150] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 641.043013][ T4262] usb 4-1: config 220 has an invalid interface number: 76 but max is 2 [ 641.064191][ T4262] usb 4-1: config 220 has an invalid descriptor of length 99, skipping remainder of the config [ 641.083311][ T4262] usb 4-1: config 220 has 2 interfaces, different from the descriptor's value: 3 [ 641.092774][ T4262] usb 4-1: config 220 has no interface number 1 [ 641.099161][ T4262] usb 4-1: config 220 interface 0 has no altsetting 0 [ 641.106169][ T4262] usb 4-1: config 220 interface 76 has no altsetting 0 [ 641.273295][ T4262] usb 4-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 641.292896][ T4262] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 641.327305][ T4262] usb 4-1: Product: syz [ 641.346426][ T4262] usb 4-1: Manufacturer: syz [ 641.367058][ T4262] usb 4-1: SerialNumber: syz [ 642.033995][T14165] vivid-000: kernel_thread() failed [ 642.292842][ T4262] usb 4-1: Found UVC 7.01 device syz (8086:0b07) [ 642.302686][ T4262] usb 4-1: No valid video chain found. [ 642.356527][T14172] tipc: Enabled bearer , priority 0 [ 642.393193][T14172] device syzkaller0 entered promiscuous mode [ 643.192809][ T4262] usb 4-1: USB disconnect, device number 72 [ 643.231713][T14172] tipc: Resetting bearer [ 643.404551][T14171] tipc: Resetting bearer [ 643.733183][T14171] tipc: Disabling bearer [ 644.659591][T14219] trusted_key: encrypted_key: insufficient parameters specified [ 644.896796][T14190] chnl_net:caif_netlink_parms(): no params data found [ 645.708786][T14190] bridge0: port 1(bridge_slave_0) entered blocking state [ 645.764049][T14190] bridge0: port 1(bridge_slave_0) entered disabled state [ 645.776315][T14235] netlink: 1688 bytes leftover after parsing attributes in process `syz.6.3411'. [ 645.805752][T14190] device bridge_slave_0 entered promiscuous mode [ 645.814618][T14190] bridge0: port 2(bridge_slave_1) entered blocking state [ 645.821787][T14190] bridge0: port 2(bridge_slave_1) entered disabled state [ 645.830812][T14190] device bridge_slave_1 entered promiscuous mode [ 645.849182][T14237] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 645.871312][T14190] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 645.895494][T14190] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 645.952889][ T4262] usb 4-1: new high-speed USB device number 73 using dummy_hcd [ 645.973128][T12721] Bluetooth: hci1: command 0x0409 tx timeout [ 646.032161][T14190] team0: Port device team_slave_0 added [ 646.057501][T14190] team0: Port device team_slave_1 added [ 646.123227][T14190] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 646.130305][T14190] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 646.192752][T14190] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 646.229773][T14190] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 646.243053][T14190] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 646.286888][T14190] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 646.306380][T14244] tipc: Enabled bearer , priority 0 [ 646.333420][T14246] device syzkaller0 entered promiscuous mode [ 646.390578][T14244] tipc: Resetting bearer [ 646.417673][ T4262] usb 4-1: config 220 has an invalid interface number: 76 but max is 2 [ 646.436842][ T4262] usb 4-1: config 220 has an invalid descriptor of length 99, skipping remainder of the config [ 646.452654][ T4262] usb 4-1: config 220 has 2 interfaces, different from the descriptor's value: 3 [ 646.462074][ T4262] usb 4-1: config 220 has no interface number 1 [ 646.472937][ T4262] usb 4-1: config 220 interface 0 has no altsetting 0 [ 646.484714][T14190] device hsr_slave_0 entered promiscuous mode [ 646.491384][ T4262] usb 4-1: config 220 interface 76 has no altsetting 0 [ 646.503958][T14190] device hsr_slave_1 entered promiscuous mode [ 646.523595][T14243] tipc: Resetting bearer [ 646.551515][T14243] tipc: Disabling bearer [ 646.683180][ T4262] usb 4-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 646.696894][ T4262] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 646.874325][ T4262] usb 4-1: Product: syz [ 646.889845][ T4262] usb 4-1: Manufacturer: syz [ 646.912645][ T4262] usb 4-1: SerialNumber: syz [ 647.828668][ T263] block nbd2: Attempted send on invalid socket [ 647.837400][ T263] blk_update_request: I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 647.852716][T14274] exFAT-fs (nbd2): unable to read boot sector [ 647.858928][T14274] exFAT-fs (nbd2): failed to read boot sector [ 647.914524][T14275] trusted_key: encrypted_key: insufficient parameters specified [ 648.717051][T14274] exFAT-fs (nbd2): failed to recognize exfat type [ 648.758575][T12721] Bluetooth: hci1: command 0x041b tx timeout [ 648.890651][ T4262] usb 4-1: Found UVC 7.01 device syz (8086:0b07) [ 648.934181][ T4262] usb 4-1: No valid video chain found. [ 649.065238][ T4262] usb 4-1: USB disconnect, device number 73 [ 649.282785][T14190] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 649.702568][T14190] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 650.050334][T14190] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 650.101441][T14190] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 650.249593][T14290] netlink: 'syz.2.3422': attribute type 72 has an invalid length. [ 651.125373][T14300] vivid-002: kernel_thread() failed [ 651.223637][ T4262] Bluetooth: hci1: command 0x040f tx timeout [ 651.507819][T14303] binder: 14302:14303 ioctl c0285840 200000000000 returned -22 [ 651.518944][T14190] 8021q: adding VLAN 0 to HW filter on device bond0 [ 651.565521][T14190] 8021q: adding VLAN 0 to HW filter on device team0 [ 651.579513][T12277] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 651.611966][T12277] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 651.666997][T12288] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 651.715978][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 651.736537][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 651.745094][ T4193] usb 3-1: new full-speed USB device number 65 using dummy_hcd [ 651.879726][T12275] bridge0: port 1(bridge_slave_0) entered blocking state [ 651.886960][T12275] bridge0: port 1(bridge_slave_0) entered forwarding state [ 651.930501][T14313] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 651.964807][T12288] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 651.996509][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 652.014531][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 652.026011][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 652.036131][T12275] bridge0: port 2(bridge_slave_1) entered blocking state [ 652.043459][T12275] bridge0: port 2(bridge_slave_1) entered forwarding state [ 652.052444][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 652.088243][T12288] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 652.133493][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 652.163313][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 652.174600][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 652.188842][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 652.196546][ T4193] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 652.208487][ T4193] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 652.239044][T12288] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 652.426421][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 652.443536][ T4193] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 652.464088][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 652.471964][ T4193] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 653.203953][ T4193] usb 3-1: Product: syz [ 653.208182][ T4193] usb 3-1: Manufacturer: syz [ 653.213920][ T4193] usb 3-1: SerialNumber: syz [ 653.243454][ T4227] Bluetooth: hci1: command 0x0419 tx timeout [ 653.273975][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 653.311632][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 653.465873][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 653.535521][T14336] trusted_key: encrypted_key: insufficient parameters specified [ 653.672076][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 654.070361][T12230] usb 3-1: USB disconnect, device number 65 [ 654.321260][T14190] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 654.332699][ T4227] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 654.508388][T14347] tipc: Enabled bearer , priority 0 [ 654.553675][T14347] device syzkaller0 entered promiscuous mode [ 654.564824][T12288] tipc: Left network mode [ 654.608248][T14347] tipc: Resetting bearer [ 654.680107][T14345] tipc: Resetting bearer [ 654.698562][T14355] netlink: 'syz.2.3435': attribute type 72 has an invalid length. [ 654.707701][T14345] tipc: Disabling bearer [ 654.712757][ T4227] usb 4-1: config 220 has an invalid interface number: 76 but max is 2 [ 654.721876][ T4227] usb 4-1: config 220 has an invalid descriptor of length 99, skipping remainder of the config [ 654.746607][ T4227] usb 4-1: config 220 has 2 interfaces, different from the descriptor's value: 3 [ 654.766342][ T4227] usb 4-1: config 220 has no interface number 1 [ 654.776547][ T4227] usb 4-1: config 220 interface 0 has no altsetting 0 [ 654.786640][ T4227] usb 4-1: config 220 interface 76 has no altsetting 0 [ 655.042762][ T4227] usb 4-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 655.888469][T14366] binder: 14359:14366 ioctl c0285840 200000000000 returned -22 [ 655.890222][ T4227] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 655.960359][ T4227] usb 4-1: Product: syz [ 655.964730][ T4227] usb 4-1: Manufacturer: syz [ 655.972637][ T4227] usb 4-1: SerialNumber: syz [ 656.587436][T12286] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 656.598100][T12286] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 656.644281][T14190] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 657.107447][T14386] netlink: 104 bytes leftover after parsing attributes in process `syz.2.3442'. [ 657.137191][ T4227] usb 4-1: Found UVC 7.01 device syz (8086:0b07) [ 657.173513][T14388] trusted_key: encrypted_key: insufficient parameters specified [ 657.265572][ T4227] usb 4-1: No valid video chain found. [ 657.413882][ T4227] usb 4-1: USB disconnect, device number 74 [ 657.800313][T14400] netlink: 'syz.6.3445': attribute type 72 has an invalid length. [ 657.912711][T12721] usb 6-1: new full-speed USB device number 4 using dummy_hcd [ 659.083193][T12721] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 659.109556][T12721] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 659.145196][T12284] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 659.188123][T12284] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 659.290440][T12277] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 659.320084][T12277] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 659.362512][T12288] device hsr_slave_0 left promiscuous mode [ 659.381761][T12288] device hsr_slave_1 left promiscuous mode [ 659.382929][T12721] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 659.414348][T12721] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 659.433013][T12721] usb 6-1: Product: syz [ 659.438241][T12288] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 659.454736][T12721] usb 6-1: Manufacturer: syz [ 659.465406][T12288] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 659.476641][T12721] usb 6-1: SerialNumber: syz [ 659.521011][T12288] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 659.538110][T12288] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 659.567657][T12288] device bridge_slave_1 left promiscuous mode [ 659.625620][T12288] bridge0: port 2(bridge_slave_1) entered disabled state [ 659.659892][T12288] device bridge_slave_0 left promiscuous mode [ 659.679521][T12288] bridge0: port 1(bridge_slave_0) entered disabled state [ 659.728708][T12288] device veth1_macvtap left promiscuous mode [ 659.742038][T12288] device veth0_macvtap left promiscuous mode [ 659.758163][T12288] device veth1_vlan left promiscuous mode [ 659.785510][T13803] usb 6-1: USB disconnect, device number 4 [ 659.800562][T12288] device veth0_vlan left promiscuous mode [ 660.285043][ T4231] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 660.723012][ T4231] usb 7-1: config 220 has an invalid interface number: 76 but max is 2 [ 660.783205][ T4231] usb 7-1: config 220 has an invalid descriptor of length 99, skipping remainder of the config [ 660.835237][ T4231] usb 7-1: config 220 has 2 interfaces, different from the descriptor's value: 3 [ 660.892775][ T4231] usb 7-1: config 220 has no interface number 1 [ 661.404117][ T4231] usb 7-1: config 220 interface 0 has no altsetting 0 [ 661.423457][ T4231] usb 7-1: config 220 interface 76 has no altsetting 0 [ 661.516350][T14443] netlink: 1088 bytes leftover after parsing attributes in process `syz.5.3453'. [ 661.622822][ T4231] usb 7-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 661.637155][ T4231] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 661.654249][ T4231] usb 7-1: Product: syz [ 661.662207][ T4231] usb 7-1: Manufacturer: syz [ 661.667607][ T4231] usb 7-1: SerialNumber: syz [ 661.718586][T12288] team0 (unregistering): Port device team_slave_1 removed [ 661.737777][T12288] team0 (unregistering): Port device team_slave_0 removed [ 661.755153][T12288] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 661.772948][T12288] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 661.850972][T12288] bond0 (unregistering): Released all slaves [ 661.900147][T12277] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 661.908199][T12277] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 661.917822][T14441] netlink: 'syz.3.3452': attribute type 4 has an invalid length. [ 661.926868][T14441] netlink: 152 bytes leftover after parsing attributes in process `syz.3.3452'. [ 661.963826][T14441] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 661.993138][T14190] device veth0_vlan entered promiscuous mode [ 662.033155][T14190] device veth1_vlan entered promiscuous mode [ 662.042933][ T4231] usb 7-1: Found UVC 7.01 device syz (8086:0b07) [ 662.049345][ T4231] usb 7-1: No valid video chain found. [ 662.126087][ T4231] usb 7-1: USB disconnect, device number 5 [ 662.162337][T12277] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 662.210907][T12277] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 662.314747][T14190] device veth0_macvtap entered promiscuous mode [ 662.390244][T14190] device veth1_macvtap entered promiscuous mode [ 662.449616][T14457] trusted_key: encrypted_key: insufficient parameters specified [ 662.925095][T12277] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 663.001476][T12277] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 663.087042][T14190] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 663.182031][T14190] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 663.199573][T14190] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 663.233340][T14190] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 663.279970][T14190] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 663.319598][T14190] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 663.342749][T14190] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 663.385739][T14190] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 663.450483][T14190] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 663.490497][T12286] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 663.499364][ T4193] usb 6-1: new full-speed USB device number 5 using dummy_hcd [ 663.514978][T12286] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 663.541689][T14190] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 663.576166][T14190] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 664.145552][T14190] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 664.185526][T14190] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 664.206562][T14190] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 664.242623][T14190] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 664.262636][T14190] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 664.321102][T14190] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 664.343954][T14190] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 664.401493][T12284] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 664.410140][ T4193] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 664.430837][ T4193] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 664.446500][T12284] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 664.469264][T14190] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 664.488790][T14190] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 664.510013][T14190] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 664.532635][T14190] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 664.665802][ T4193] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 664.696016][ T4193] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 664.717848][ T4193] usb 6-1: Product: syz [ 664.722081][ T4193] usb 6-1: Manufacturer: syz [ 665.212437][ T4193] usb 6-1: SerialNumber: syz [ 665.411938][ T4267] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 665.442644][ T4267] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 665.453856][T11956] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 665.521463][T11956] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 665.547284][T11956] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 665.572017][ T4193] usb 6-1: USB disconnect, device number 5 [ 665.592171][T14495] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 665.600817][T12286] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 665.690652][T14495] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 665.716703][T14503] netlink: 1088 bytes leftover after parsing attributes in process `syz.6.3465'. [ 666.192148][T14519] tipc: Enabled bearer , priority 0 [ 666.273411][T14521] device syzkaller0 entered promiscuous mode [ 666.320790][T14517] netlink: 1752 bytes leftover after parsing attributes in process `syz.7.3467'. [ 666.340390][T14519] tipc: Resetting bearer [ 666.417799][T14514] tipc: Resetting bearer [ 666.452763][ T4263] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 666.474737][T14514] tipc: Disabling bearer [ 667.973731][ T4263] usb 6-1: config 220 has an invalid interface number: 76 but max is 2 [ 668.032683][ T4263] usb 6-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 668.060115][ T4263] usb 6-1: config 220 has an invalid descriptor of length 99, skipping remainder of the config [ 668.106687][ T4263] usb 6-1: config 220 has no interface number 2 [ 668.125223][ T4263] usb 6-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 668.148960][ T4263] usb 6-1: config 220 interface 0 has no altsetting 0 [ 668.169329][ T4263] usb 6-1: config 220 interface 76 has no altsetting 0 [ 668.177399][ T4263] usb 6-1: config 220 interface 1 has no altsetting 0 [ 668.272726][T12702] usb 7-1: new high-speed USB device number 6 using dummy_hcd [ 668.341484][T14548] netlink: 'syz.3.3476': attribute type 72 has an invalid length. [ 668.352927][ T4263] usb 6-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 668.374641][ T4263] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 668.429242][ T4263] usb 6-1: Product: syz [ 668.451043][ T4263] usb 6-1: Manufacturer: syz [ 668.478738][ T4263] usb 6-1: SerialNumber: syz [ 668.702742][T12702] usb 7-1: Using ep0 maxpacket: 8 [ 668.874110][ T4263] usb 6-1: Found UVC 7.01 device syz (8086:0b07) [ 668.915099][ T4263] usb 6-1: No valid video chain found. [ 669.371670][ T4263] usb 6-1: USB disconnect, device number 6 [ 669.592881][T12702] usb 7-1: config 255 has an invalid interface number: 106 but max is 0 [ 669.609975][T12702] usb 7-1: config 255 has no interface number 0 [ 669.634000][T12702] usb 7-1: config 255 interface 106 altsetting 15 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 669.677666][T14565] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.3481'. [ 669.682676][T12702] usb 7-1: config 255 interface 106 altsetting 15 endpoint 0x7 has invalid maxpacket 1024, setting to 64 [ 669.733203][T12702] usb 7-1: config 255 interface 106 has no altsetting 0 [ 669.842721][ T4226] usb 4-1: new full-speed USB device number 75 using dummy_hcd [ 670.692994][T12702] usb 7-1: New USB device found, idVendor=1199, idProduct=0218, bcdDevice=9a.82 [ 670.702107][T12702] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 670.733736][T12702] usb 7-1: Product: syz [ 670.737983][T12702] usb 7-1: Manufacturer: syz [ 670.766880][T12702] usb 7-1: SerialNumber: syz [ 670.822888][ T4226] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 670.844577][ T4226] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 670.984295][T12702] sierra 7-1:255.106: Sierra USB modem converter detected [ 671.017778][T12702] usb 7-1: Sierra USB modem converter now attached to ttyUSB0 [ 671.038135][ T4226] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 671.062755][ T4226] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 671.065362][T12702] usb 7-1: USB disconnect, device number 6 [ 671.112065][ T4226] usb 4-1: Product: syz [ 671.131861][ T4226] usb 4-1: Manufacturer: syz [ 671.138321][T12702] sierra ttyUSB0: Sierra USB modem converter now disconnected from ttyUSB0 [ 671.153061][ T4226] usb 4-1: SerialNumber: syz [ 671.174752][T12702] sierra 7-1:255.106: device disconnected [ 671.437045][ T4226] usb 4-1: USB disconnect, device number 75 [ 671.764733][T14604] netlink: 'syz.7.3488': attribute type 72 has an invalid length. [ 672.384752][ T4226] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 672.763374][ T4226] usb 4-1: config 220 has an invalid interface number: 76 but max is 2 [ 672.774377][ T4226] usb 4-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 672.834052][ T4226] usb 4-1: config 220 has an invalid descriptor of length 99, skipping remainder of the config [ 672.868503][ T4226] usb 4-1: config 220 has no interface number 2 [ 672.890794][ T4226] usb 4-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 672.955059][ T4226] usb 4-1: config 220 interface 0 has no altsetting 0 [ 672.980906][ T4226] usb 4-1: config 220 interface 76 has no altsetting 0 [ 673.017634][ T4226] usb 4-1: config 220 interface 1 has no altsetting 0 [ 673.222908][ T4226] usb 4-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 673.242757][ T4226] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 673.286764][ T4226] usb 4-1: Product: syz [ 673.307514][ T4226] usb 4-1: Manufacturer: syz [ 673.372085][ T4226] usb 4-1: SerialNumber: syz [ 673.491116][T14646] netlink: 'syz.2.3499': attribute type 72 has an invalid length. [ 673.881736][ T4226] usb 4-1: Found UVC 7.01 device syz (8086:0b07) [ 673.883772][T14654] netlink: 'syz.5.3500': attribute type 4 has an invalid length. [ 673.898121][T14654] netlink: 152 bytes leftover after parsing attributes in process `syz.5.3500'. [ 673.955977][ T4226] usb 4-1: No valid video chain found. [ 673.979681][T14654] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 674.044008][ T4226] usb 4-1: USB disconnect, device number 76 [ 675.401517][T13005] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 675.411345][T13005] CPU: 0 PID: 13005 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 675.419096][T13005] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 675.429156][T13005] Workqueue: hci3 hci_rx_work [ 675.433838][T13005] Call Trace: [ 675.437217][T13005] [ 675.440143][T13005] dump_stack_lvl+0x188/0x250 [ 675.444823][T13005] ? show_regs_print_info+0x20/0x20 [ 675.450033][T13005] ? load_image+0x400/0x400 [ 675.454539][T13005] sysfs_create_dir_ns+0x26a/0x290 [ 675.459654][T13005] ? sysfs_warn_dup+0xa0/0xa0 [ 675.464346][T13005] ? process_one_work+0x85f/0x1010 [ 675.469486][T13005] ? do_raw_spin_unlock+0x11d/0x230 [ 675.474720][T13005] kobject_add_internal+0x6e0/0xd90 [ 675.479958][T13005] kobject_add+0x160/0x230 [ 675.484487][T13005] ? kobject_init+0x1d0/0x1d0 [ 675.489164][T13005] ? klist_children_get+0x50/0x50 [ 675.494185][T13005] ? get_device_parent+0x121/0x3f0 [ 675.499483][T13005] device_add+0x483/0xfb0 [ 675.504160][T13005] hci_conn_add_sysfs+0xd1/0x1e0 [ 675.509093][T13005] le_conn_complete_evt+0xc48/0x15c0 [ 675.514379][T13005] ? cs_le_create_conn+0x5e0/0x5e0 [ 675.519490][T13005] ? __mutex_trylock_common+0x155/0x260 [ 675.525047][T13005] hci_le_meta_evt+0x285/0x3c90 [ 675.529895][T13005] ? hci_event_packet+0x37b/0x1370 [ 675.535015][T13005] ? __lock_acquire+0x7d10/0x7d10 [ 675.540038][T13005] ? hci_remote_host_features_evt+0x280/0x280 [ 675.546096][T13005] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 675.551719][T13005] ? mark_lock+0x94/0x320 [ 675.556036][T13005] ? mutex_unlock+0x10/0x10 [ 675.560532][T13005] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 675.566522][T13005] ? lock_chain_count+0x20/0x20 [ 675.571390][T13005] ? __rwlock_init+0x140/0x140 [ 675.576146][T13005] hci_event_packet+0xe48/0x1370 [ 675.581077][T13005] ? lockdep_hardirqs_on+0x94/0x140 [ 675.586391][T13005] ? rcu_lock_release+0x20/0x20 [ 675.591271][T13005] ? hci_send_to_monitor+0x9c/0x4a0 [ 675.596653][T13005] hci_rx_work+0x255/0xa10 [ 675.601098][T13005] process_one_work+0x85f/0x1010 [ 675.606073][T13005] ? worker_detach_from_pool+0x240/0x240 [ 675.611748][T13005] ? lockdep_hardirqs_off+0x70/0x100 [ 675.617053][T13005] ? _raw_spin_lock_irq+0xb7/0xf0 [ 675.622105][T13005] ? _raw_spin_lock_irqsave+0x100/0x100 [ 675.627694][T13005] ? wq_worker_running+0x97/0x170 [ 675.632783][T13005] worker_thread+0xaa6/0x1290 [ 675.637493][T13005] ? lockdep_hardirqs_on+0x94/0x140 [ 675.642704][T13005] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 675.648612][T13005] kthread+0x436/0x520 [ 675.652683][T13005] ? rcu_lock_release+0x20/0x20 [ 675.657561][T13005] ? kthread_blkcg+0xd0/0xd0 [ 675.662151][T13005] ret_from_fork+0x1f/0x30 [ 675.666588][T13005] [ 675.676592][T13005] kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 675.689915][T13005] Bluetooth: hci3: failed to register connection device [ 676.093752][T14693] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.3511'. [ 676.313188][ T4226] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 676.822780][ T4226] usb 8-1: Using ep0 maxpacket: 8 [ 676.892395][T14705] netlink: 'syz.2.3513': attribute type 4 has an invalid length. [ 676.900354][T14705] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3513'. [ 676.912861][T14705] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 676.983025][ T4226] usb 8-1: config 255 has an invalid interface number: 106 but max is 0 [ 677.053062][ T4226] usb 8-1: config 255 has no interface number 0 [ 677.076466][ T4226] usb 8-1: config 255 interface 106 altsetting 15 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 677.109249][ T4226] usb 8-1: config 255 interface 106 altsetting 15 endpoint 0x7 has invalid maxpacket 1024, setting to 64 [ 677.147219][ T4226] usb 8-1: config 255 interface 106 has no altsetting 0 [ 677.423095][ T4226] usb 8-1: New USB device found, idVendor=1199, idProduct=0218, bcdDevice=9a.82 [ 677.844924][ T4226] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 677.946211][ T4226] usb 8-1: Product: syz [ 677.996271][ T4226] usb 8-1: Manufacturer: syz [ 678.056463][ T4226] usb 8-1: SerialNumber: syz [ 678.241283][T13005] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 678.252156][T13005] CPU: 0 PID: 13005 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 678.259803][T13005] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 678.269858][T13005] Workqueue: hci4 hci_rx_work [ 678.274541][T13005] Call Trace: [ 678.277826][T13005] [ 678.280751][T13005] dump_stack_lvl+0x188/0x250 [ 678.285427][T13005] ? show_regs_print_info+0x20/0x20 [ 678.290623][T13005] ? load_image+0x400/0x400 [ 678.295216][T13005] sysfs_create_dir_ns+0x26a/0x290 [ 678.300322][T13005] ? sysfs_warn_dup+0xa0/0xa0 [ 678.304990][T13005] ? process_one_work+0x85f/0x1010 [ 678.310101][T13005] ? do_raw_spin_unlock+0x11d/0x230 [ 678.315296][T13005] kobject_add_internal+0x6e0/0xd90 [ 678.320498][T13005] kobject_add+0x160/0x230 [ 678.324917][T13005] ? kobject_init+0x1d0/0x1d0 [ 678.329597][T13005] ? klist_children_get+0x50/0x50 [ 678.334729][T13005] ? get_device_parent+0x121/0x3f0 [ 678.339832][T13005] device_add+0x483/0xfb0 [ 678.344157][T13005] hci_conn_add_sysfs+0xd1/0x1e0 [ 678.349177][T13005] le_conn_complete_evt+0xc48/0x15c0 [ 678.354460][T13005] ? cs_le_create_conn+0x5e0/0x5e0 [ 678.359568][T13005] ? __mutex_trylock_common+0x155/0x260 [ 678.365112][T13005] hci_le_meta_evt+0x285/0x3c90 [ 678.369958][T13005] ? hci_event_packet+0x37b/0x1370 [ 678.375068][T13005] ? __lock_acquire+0x7d10/0x7d10 [ 678.380090][T13005] ? hci_remote_host_features_evt+0x280/0x280 [ 678.386146][T13005] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 678.391774][T13005] ? mark_lock+0x94/0x320 [ 678.396098][T13005] ? mutex_unlock+0x10/0x10 [ 678.400591][T13005] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 678.406564][T13005] ? lock_chain_count+0x20/0x20 [ 678.411408][T13005] ? __rwlock_init+0x140/0x140 [ 678.416320][T13005] hci_event_packet+0xe48/0x1370 [ 678.421264][T13005] ? lockdep_hardirqs_on+0x94/0x140 [ 678.426466][T13005] ? rcu_lock_release+0x20/0x20 [ 678.431393][T13005] ? hci_send_to_monitor+0x9c/0x4a0 [ 678.436600][T13005] hci_rx_work+0x255/0xa10 [ 678.441044][T13005] process_one_work+0x85f/0x1010 [ 678.445983][T13005] ? worker_detach_from_pool+0x240/0x240 [ 678.451608][T13005] ? lockdep_hardirqs_off+0x70/0x100 [ 678.456890][T13005] ? _raw_spin_lock_irq+0xb7/0xf0 [ 678.461922][T13005] ? _raw_spin_lock_irqsave+0x100/0x100 [ 678.467467][T13005] ? wq_worker_running+0x97/0x170 [ 678.472486][T13005] worker_thread+0xaa6/0x1290 [ 678.477167][T13005] ? lockdep_hardirqs_on+0x94/0x140 [ 678.482360][T13005] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 678.488249][T13005] kthread+0x436/0x520 [ 678.492309][T13005] ? rcu_lock_release+0x20/0x20 [ 678.497255][T13005] ? kthread_blkcg+0xd0/0xd0 [ 678.501846][T13005] ret_from_fork+0x1f/0x30 [ 678.506277][T13005] [ 678.528414][T13005] kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 678.541776][T13005] Bluetooth: hci4: failed to register connection device [ 678.633754][ T4226] sierra 8-1:255.106: Sierra USB modem converter detected [ 678.675644][ T4226] usb 8-1: Sierra USB modem converter now attached to ttyUSB0 [ 678.703521][ T4226] usb 8-1: USB disconnect, device number 2 [ 678.717022][ T4226] sierra ttyUSB0: Sierra USB modem converter now disconnected from ttyUSB0 [ 678.743572][ T4226] sierra 8-1:255.106: device disconnected [ 679.253921][T14753] netlink: 1752 bytes leftover after parsing attributes in process `syz.6.3523'. [ 679.802772][ T4231] usb 7-1: new full-speed USB device number 7 using dummy_hcd [ 680.029369][T14766] netlink: 'syz.3.3526': attribute type 4 has an invalid length. [ 680.037364][T14766] netlink: 152 bytes leftover after parsing attributes in process `syz.3.3526'. [ 680.046571][T14766] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 680.683006][ T4231] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 680.713376][ T4231] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 680.832777][ T4231] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 680.892734][ T4231] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 681.032944][ T4231] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 681.070626][ T4231] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 681.552795][ T4231] usb 7-1: New USB device found, idVendor=0451, idProduct=5152, bcdDevice=c0.b9 [ 681.592805][ T4231] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 681.636034][ T4231] usb 7-1: Product: syz [ 681.665957][ T4231] usb 7-1: Manufacturer: syz [ 681.680899][ T4231] usb 7-1: SerialNumber: syz [ 681.737540][ T4231] usb 7-1: config 0 descriptor?? [ 681.814244][ T4231] ti_usb_3410_5052 7-1:0.0: TI USB 5052 2 port adapter converter detected [ 681.859708][T13005] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 681.861654][ T4231] ti_usb_3410_5052 7-1:0.0: missing endpoints [ 681.869905][T13005] CPU: 0 PID: 13005 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 681.883220][T13005] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 681.893271][T13005] Workqueue: hci2 hci_rx_work [ 681.897951][T13005] Call Trace: [ 681.901226][T13005] [ 681.904151][T13005] dump_stack_lvl+0x188/0x250 [ 681.908828][T13005] ? show_regs_print_info+0x20/0x20 [ 681.914038][T13005] ? load_image+0x400/0x400 [ 681.918582][T13005] sysfs_create_dir_ns+0x26a/0x290 [ 681.923729][T13005] ? sysfs_warn_dup+0xa0/0xa0 [ 681.928417][T13005] ? process_one_work+0x85f/0x1010 [ 681.933557][T13005] ? do_raw_spin_unlock+0x11d/0x230 [ 681.938764][T13005] kobject_add_internal+0x6e0/0xd90 [ 681.943984][T13005] kobject_add+0x160/0x230 [ 681.948464][T13005] ? kobject_init+0x1d0/0x1d0 [ 681.953174][T13005] ? klist_children_get+0x50/0x50 [ 681.958201][T13005] ? get_device_parent+0x121/0x3f0 [ 681.963323][T13005] device_add+0x483/0xfb0 [ 681.967672][T13005] hci_conn_add_sysfs+0xd1/0x1e0 [ 681.972625][T13005] le_conn_complete_evt+0xc48/0x15c0 [ 681.977965][T13005] ? cs_le_create_conn+0x5e0/0x5e0 [ 681.983092][T13005] ? __mutex_trylock_common+0x155/0x260 [ 681.988648][T13005] hci_le_meta_evt+0x285/0x3c90 [ 681.993597][T13005] ? hci_event_packet+0x37b/0x1370 [ 681.998717][T13005] ? __lock_acquire+0x7d10/0x7d10 [ 682.003768][T13005] ? hci_remote_host_features_evt+0x280/0x280 [ 682.009869][T13005] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 682.015511][T13005] ? mark_lock+0x94/0x320 [ 682.019836][T13005] ? mutex_unlock+0x10/0x10 [ 682.024362][T13005] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 682.030342][T13005] ? lock_chain_count+0x20/0x20 [ 682.035188][T13005] ? __rwlock_init+0x140/0x140 [ 682.040058][T13005] hci_event_packet+0xe48/0x1370 [ 682.044996][T13005] ? lockdep_hardirqs_on+0x94/0x140 [ 682.050205][T13005] ? rcu_lock_release+0x20/0x20 [ 682.055052][T13005] ? hci_send_to_monitor+0x9c/0x4a0 [ 682.060244][T13005] hci_rx_work+0x255/0xa10 [ 682.064683][T13005] process_one_work+0x85f/0x1010 [ 682.069736][T13005] ? worker_detach_from_pool+0x240/0x240 [ 682.075393][T13005] ? lockdep_hardirqs_off+0x70/0x100 [ 682.080703][T13005] ? _raw_spin_lock_irq+0xb7/0xf0 [ 682.085773][T13005] ? _raw_spin_lock_irqsave+0x100/0x100 [ 682.091343][T13005] ? wq_worker_running+0x97/0x170 [ 682.096385][T13005] worker_thread+0xaa6/0x1290 [ 682.101077][T13005] ? lockdep_hardirqs_on+0x94/0x140 [ 682.106271][T13005] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 682.112163][T13005] kthread+0x436/0x520 [ 682.116242][T13005] ? rcu_lock_release+0x20/0x20 [ 682.121099][T13005] ? kthread_blkcg+0xd0/0xd0 [ 682.125681][T13005] ret_from_fork+0x1f/0x30 [ 682.130102][T13005] [ 682.143487][T13005] kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 682.156968][T13005] Bluetooth: hci2: failed to register connection device [ 682.164247][T13005] Bluetooth: hci2: link tx timeout [ 682.169530][T13005] Bluetooth: hci2: killing stalled connection 10:aa:aa:aa:aa:aa [ 682.177333][T13005] Bluetooth: hci2: link tx timeout [ 682.182828][T13005] Bluetooth: hci2: killing stalled connection 00:00:00:00:00:00 [ 682.190464][T13005] Bluetooth: hci2: killing stalled connection 00:00:00:00:00:00 [ 682.198226][T13005] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 684.940515][T14819] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.3535'. [ 685.924948][ T1431] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.931334][ T1431] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.757445][T14829] netlink: 'syz.5.3538': attribute type 4 has an invalid length. [ 686.765524][T14829] netlink: 152 bytes leftover after parsing attributes in process `syz.5.3538'. [ 686.775119][T14829] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 687.829570][T14849] tipc: Enabling of bearer rejected, failed to enable media [ 688.198078][T14865] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3543'. [ 688.517205][ T4227] usb 7-1: USB disconnect, device number 7 [ 689.167716][T14885] trusted_key: encrypted_key: insufficient parameters specified [ 689.892670][ T4231] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 691.502805][ T4231] usb 6-1: config 220 has an invalid interface number: 76 but max is 2 [ 692.195982][ T4231] usb 6-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 692.365903][T13005] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 692.376994][T13005] CPU: 1 PID: 13005 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 692.384711][T13005] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 692.394785][T13005] Workqueue: hci0 hci_rx_work [ 692.399511][T13005] Call Trace: [ 692.402790][T13005] [ 692.405720][T13005] dump_stack_lvl+0x188/0x250 [ 692.410413][T13005] ? show_regs_print_info+0x20/0x20 [ 692.415637][T13005] ? load_image+0x400/0x400 [ 692.420152][T13005] sysfs_create_dir_ns+0x26a/0x290 [ 692.425317][T13005] ? sysfs_warn_dup+0xa0/0xa0 [ 692.430004][T13005] ? process_one_work+0x85f/0x1010 [ 692.435123][T13005] ? do_raw_spin_unlock+0x11d/0x230 [ 692.440328][T13005] kobject_add_internal+0x6e0/0xd90 [ 692.445541][T13005] kobject_add+0x160/0x230 [ 692.449966][T13005] ? kobject_init+0x1d0/0x1d0 [ 692.454645][T13005] ? klist_children_get+0x50/0x50 [ 692.459678][T13005] ? get_device_parent+0x121/0x3f0 [ 692.464793][T13005] device_add+0x483/0xfb0 [ 692.469126][T13005] hci_conn_add_sysfs+0xd1/0x1e0 [ 692.474074][T13005] le_conn_complete_evt+0xc48/0x15c0 [ 692.479623][T13005] ? cs_le_create_conn+0x5e0/0x5e0 [ 692.484749][T13005] ? __mutex_trylock_common+0x155/0x260 [ 692.490302][T13005] hci_le_meta_evt+0x285/0x3c90 [ 692.495157][T13005] ? hci_event_packet+0x37b/0x1370 [ 692.500270][T13005] ? __lock_acquire+0x7d10/0x7d10 [ 692.505319][T13005] ? hci_remote_host_features_evt+0x280/0x280 [ 692.511525][T13005] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 692.517175][T13005] ? mark_lock+0x94/0x320 [ 692.521515][T13005] ? mutex_unlock+0x10/0x10 [ 692.526028][T13005] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 692.532019][T13005] ? lock_chain_count+0x20/0x20 [ 692.536897][T13005] ? __rwlock_init+0x140/0x140 [ 692.541684][T13005] hci_event_packet+0xe48/0x1370 [ 692.546631][T13005] ? lockdep_hardirqs_on+0x94/0x140 [ 692.551832][T13005] ? rcu_lock_release+0x20/0x20 [ 692.556703][T13005] ? hci_send_to_monitor+0x9c/0x4a0 [ 692.561932][T13005] hci_rx_work+0x255/0xa10 [ 692.566452][T13005] process_one_work+0x85f/0x1010 [ 692.571404][T13005] ? worker_detach_from_pool+0x240/0x240 [ 692.577034][T13005] ? lockdep_hardirqs_off+0x70/0x100 [ 692.582338][T13005] ? _raw_spin_lock_irq+0xb7/0xf0 [ 692.587360][T13005] ? _raw_spin_lock_irqsave+0x100/0x100 [ 692.593030][T13005] ? wq_worker_running+0x97/0x170 [ 692.598320][T13005] worker_thread+0xaa6/0x1290 [ 692.603023][T13005] ? lockdep_hardirqs_on+0x94/0x140 [ 692.608228][T13005] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 692.614218][T13005] kthread+0x436/0x520 [ 692.618284][T13005] ? rcu_lock_release+0x20/0x20 [ 692.623133][T13005] ? kthread_blkcg+0xd0/0xd0 [ 692.627719][T13005] ret_from_fork+0x1f/0x30 [ 692.632145][T13005] [ 692.640260][T13005] kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 692.653598][T13005] Bluetooth: hci0: failed to register connection device [ 692.667519][ T4231] usb 6-1: config 220 has an invalid descriptor of length 99, skipping remainder of the config [ 692.679150][ T4231] usb 6-1: config 220 has no interface number 2 [ 692.686929][ T4231] usb 6-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 692.700971][ T4231] usb 6-1: config 220 interface 0 has no altsetting 0 [ 692.709134][ T4231] usb 6-1: config 220 interface 76 has no altsetting 0 [ 692.717265][ T4231] usb 6-1: config 220 interface 1 has no altsetting 0 [ 692.773007][ T4231] usb 6-1: string descriptor 0 read error: -71 [ 692.780585][ T4231] usb 6-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 692.790994][ T4231] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 692.842825][ T4231] usb 6-1: can't set config #220, error -71 [ 692.861768][ T4231] usb 6-1: USB disconnect, device number 7 [ 693.399943][T14911] tipc: Enabled bearer , priority 0 [ 693.466617][T14914] device syzkaller0 entered promiscuous mode [ 693.493021][ T4231] Bluetooth: hci4: command 0x0406 tx timeout [ 693.539483][T14911] tipc: Resetting bearer [ 693.568495][T14910] tipc: Resetting bearer [ 693.635649][T14910] tipc: Disabling bearer [ 693.972778][ T4193] Bluetooth: hci0: command 0x0406 tx timeout [ 694.343047][ T4231] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 695.432754][ T4231] usb 8-1: config 220 has an invalid interface number: 76 but max is 2 [ 695.452758][ T4231] usb 8-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 695.519047][ T4231] usb 8-1: config 220 has an invalid descriptor of length 99, skipping remainder of the config [ 695.562499][ T4231] usb 8-1: config 220 has no interface number 2 [ 695.593100][ T4231] usb 8-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 695.634489][ T4231] usb 8-1: config 220 interface 0 has no altsetting 0 [ 695.683675][ T4231] usb 8-1: config 220 interface 76 has no altsetting 0 [ 695.691095][ T4231] usb 8-1: config 220 interface 1 has no altsetting 0 [ 695.893431][T14957] netlink: 1752 bytes leftover after parsing attributes in process `syz.5.3565'. [ 696.003193][ T4231] usb 8-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 696.024445][ T4231] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 696.042745][ T4231] usb 8-1: Product: syz [ 696.047864][ T4231] usb 8-1: Manufacturer: syz [ 696.052793][ T4231] usb 8-1: SerialNumber: syz [ 696.432814][ T4231] usb 8-1: Found UVC 7.01 device syz (8086:0b07) [ 696.439242][ T4231] usb 8-1: No valid video chain found. [ 696.569409][ T4231] usb 8-1: USB disconnect, device number 3 [ 696.808432][T14979] tipc: Enabling of bearer rejected, failed to enable media [ 698.004694][T15013] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.3576'. [ 698.508248][T15033] device syzkaller0 entered promiscuous mode [ 698.773077][ T4227] Bluetooth: hci0: command 0x0406 tx timeout [ 699.398654][T15055] netlink: 1752 bytes leftover after parsing attributes in process `syz.5.3589'. [ 699.602902][T15062] trusted_key: encrypted_key: insufficient parameters specified [ 701.882879][ T4172] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 702.132725][ T4172] usb 4-1: Using ep0 maxpacket: 8 [ 702.252999][ T4172] usb 4-1: config 255 has an invalid interface number: 106 but max is 0 [ 702.291850][ T4172] usb 4-1: config 255 has no interface number 0 [ 702.322471][ T4172] usb 4-1: config 255 interface 106 altsetting 15 endpoint 0xE has invalid maxpacket 1024, setting to 64 [ 702.384725][ T4172] usb 4-1: config 255 interface 106 altsetting 15 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 702.449609][ T4172] usb 4-1: config 255 interface 106 altsetting 15 endpoint 0x7 has invalid maxpacket 1024, setting to 64 [ 702.461319][T15109] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.3601'. [ 702.491706][ T4172] usb 4-1: config 255 interface 106 has no altsetting 0 [ 702.722975][ T4172] usb 4-1: New USB device found, idVendor=1199, idProduct=0218, bcdDevice=9a.82 [ 702.762903][ T4172] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 702.795423][ T4172] usb 4-1: Product: syz [ 702.812681][ T4172] usb 4-1: Manufacturer: syz [ 702.836565][ T4172] usb 4-1: SerialNumber: syz [ 703.204620][ T4172] sierra 4-1:255.106: Sierra USB modem converter detected [ 703.257438][ T4172] usb 4-1: Sierra USB modem converter now attached to ttyUSB0 [ 703.280679][ T4172] usb 4-1: Sierra USB modem converter now attached to ttyUSB1 [ 703.313681][ T4172] usb 4-1: USB disconnect, device number 77 [ 703.340318][ T4172] sierra ttyUSB0: Sierra USB modem converter now disconnected from ttyUSB0 [ 703.363496][ T4172] sierra ttyUSB1: Sierra USB modem converter now disconnected from ttyUSB1 [ 703.373125][ T4172] sierra 4-1:255.106: device disconnected [ 706.267897][T15159] netlink: 1752 bytes leftover after parsing attributes in process `syz.6.3613'. [ 707.715174][T15201] tipc: Enabled bearer , priority 0 [ 707.760515][T15201] device syzkaller0 entered promiscuous mode [ 707.851712][T15201] tipc: Resetting bearer [ 707.892678][T15200] tipc: Resetting bearer [ 707.967515][T15200] tipc: Disabling bearer [ 712.291127][T15241] binder: 15240:15241 ioctl c0285840 200000000000 returned -22 [ 717.028187][T15293] tipc: Enabled bearer , priority 0 [ 717.103059][T15295] device syzkaller0 entered promiscuous mode [ 717.252398][T15293] tipc: Resetting bearer [ 718.150036][T15292] tipc: Resetting bearer [ 719.010508][T15292] tipc: Disabling bearer [ 719.950822][T15338] netlink: 'syz.2.3646': attribute type 4 has an invalid length. [ 719.958719][T15338] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3646'. [ 719.968150][T15338] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 721.453832][T15365] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3654'. [ 722.502724][ T4263] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 722.710917][T15385] netlink: 'syz.3.3658': attribute type 4 has an invalid length. [ 722.720632][T15385] netlink: 152 bytes leftover after parsing attributes in process `syz.3.3658'. [ 722.730820][T15385] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 723.024315][ T4263] usb 6-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 723.045827][ T4263] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 723.072390][ T4263] usb 6-1: config 0 descriptor?? [ 723.175433][ T4263] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 723.475365][ T4263] gspca_cpia1: usb_control_msg 05, error -71 [ 723.522760][ T4263] gspca_cpia1: usb_control_msg 01, error -71 [ 723.533999][ T4263] cpia1 6-1:0.0: only firmware version 1 is supported (got: 0) [ 723.568782][ T4263] usb 6-1: USB disconnect, device number 8 [ 723.695826][T15408] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3665'. [ 726.040794][T15448] netlink: 'syz.7.3674': attribute type 4 has an invalid length. [ 726.052313][T15448] netlink: 152 bytes leftover after parsing attributes in process `syz.7.3674'. [ 726.284846][T15448] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 727.224774][T15477] trusted_key: encrypted_key: insufficient parameters specified [ 728.922921][ T4227] usb 8-1: new full-speed USB device number 4 using dummy_hcd [ 729.282708][T12702] usb 7-1: new full-speed USB device number 8 using dummy_hcd [ 729.312783][ T4227] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 729.348783][ T4227] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 730.305460][T12702] usb 7-1: New USB device found, idVendor=046d, idProduct=0960, bcdDevice=97.b4 [ 730.315101][T12702] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 730.385104][T12702] gspca_main: sunplus-2.14.0 probing 046d:0960 [ 730.427187][ T4227] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 730.452090][ T4227] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 730.522841][ T4227] usb 8-1: Product: syz [ 730.545514][ T4227] usb 8-1: Manufacturer: syz [ 730.568467][ T4227] usb 8-1: SerialNumber: syz [ 730.793058][T15521] netlink: 'syz.5.3689': attribute type 4 has an invalid length. [ 730.800935][T15521] netlink: 152 bytes leftover after parsing attributes in process `syz.5.3689'. [ 730.810119][T15521] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 730.912960][T12702] gspca_sunplus: reg_w_riv err -110 [ 730.919716][T12702] sunplus: probe of 7-1:8.0 failed with error -110 [ 731.059761][T15517] tipc: Enabled bearer , priority 0 [ 731.255891][T15517] device syzkaller0 entered promiscuous mode [ 731.334881][T15517] tipc: Resetting bearer [ 731.348261][T15484] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3681'. [ 731.375180][ T4227] usb 8-1: USB disconnect, device number 4 [ 731.421940][T15516] tipc: Resetting bearer [ 731.446510][T15516] tipc: Disabling bearer [ 731.713881][T12702] usb 7-1: USB disconnect, device number 8 [ 731.813390][T15540] trusted_key: encrypted_key: insufficient parameters specified [ 734.732075][T15589] trusted_key: encrypted_key: insufficient parameters specified [ 737.885491][T15608] trusted_key: encrypted_key: insufficient parameters specified [ 740.502728][T15640] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 740.522635][T12721] usb 7-1: new full-speed USB device number 9 using dummy_hcd [ 740.849350][T15647] overlayfs: failed to resolve './bus': -2 [ 741.672737][T12721] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 741.708227][T12721] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 741.892733][T12721] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 741.901913][T12721] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 741.941050][T12721] usb 7-1: Product: syz [ 741.946049][T12721] usb 7-1: Manufacturer: syz [ 741.961298][T12721] usb 7-1: SerialNumber: syz [ 742.232384][T15632] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3706'. [ 742.284052][T12721] usb 7-1: USB disconnect, device number 9 [ 747.433354][ T1431] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.439858][ T1431] ieee802154 phy1 wpan1: encryption failed: -22 [ 748.952706][T13206] usb 7-1: new full-speed USB device number 10 using dummy_hcd [ 749.013467][T15720] trusted_key: encrypted_key: insufficient parameters specified [ 749.484454][T13206] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 749.549453][T13206] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 749.762993][T13206] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 749.772137][T13206] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 749.930944][T13206] usb 7-1: Product: syz [ 749.959473][T13206] usb 7-1: Manufacturer: syz [ 749.969607][T13206] usb 7-1: SerialNumber: syz [ 750.279510][T15704] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3729'. [ 750.334567][T15752] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 750.467387][T13206] usb 7-1: USB disconnect, device number 10 [ 756.952796][T13206] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 757.278277][T13206] usb 7-1: Using ep0 maxpacket: 16 [ 757.422924][T13206] usb 7-1: config 0 interface 0 altsetting 7 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 757.463487][T13206] usb 7-1: config 0 interface 0 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 25 [ 759.443677][T13206] usb 7-1: config 0 interface 0 has no altsetting 0 [ 759.450460][T13206] usb 7-1: New USB device found, idVendor=0c45, idProduct=5112, bcdDevice= 0.00 [ 759.460219][T13206] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 760.512999][T13206] usb 7-1: config 0 descriptor?? [ 760.532888][T13206] usb 7-1: can't set config #0, error -71 [ 760.543623][T13206] usb 7-1: USB disconnect, device number 11 [ 762.022768][T13206] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 762.293612][T13206] usb 6-1: Using ep0 maxpacket: 8 [ 762.412988][T13206] usb 6-1: config 255 has an invalid interface number: 106 but max is 0 [ 762.437475][T13206] usb 6-1: config 255 has no interface number 0 [ 762.466596][T13206] usb 6-1: config 255 interface 106 altsetting 15 endpoint 0xE has invalid maxpacket 1024, setting to 64 [ 762.491871][T13206] usb 6-1: config 255 interface 106 altsetting 15 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 762.526181][T13206] usb 6-1: config 255 interface 106 altsetting 15 endpoint 0x7 has invalid maxpacket 1024, setting to 64 [ 762.587440][T13206] usb 6-1: config 255 interface 106 has no altsetting 0 [ 763.133442][T13206] usb 6-1: New USB device found, idVendor=1199, idProduct=0218, bcdDevice=9a.82 [ 763.408774][T13206] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 763.467026][T13206] usb 6-1: Product: syz [ 763.491763][T13206] usb 6-1: Manufacturer: syz [ 763.507201][T13206] usb 6-1: SerialNumber: syz [ 763.873909][T13206] sierra 6-1:255.106: Sierra USB modem converter detected [ 764.365050][T13206] usb 6-1: Sierra USB modem converter now attached to ttyUSB0 [ 764.414147][T13206] usb 6-1: Sierra USB modem converter now attached to ttyUSB1 [ 764.550501][T13206] usb 6-1: USB disconnect, device number 9 [ 764.623692][T13206] sierra ttyUSB0: Sierra USB modem converter now disconnected from ttyUSB0 [ 764.744018][T13206] sierra ttyUSB1: Sierra USB modem converter now disconnected from ttyUSB1 [ 764.754100][T13206] sierra 6-1:255.106: device disconnected [ 765.643789][ T4200] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 765.653494][ T4200] CPU: 1 PID: 4200 Comm: kworker/u5:7 Not tainted syzkaller #0 [ 765.661039][ T4200] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 765.671362][ T4200] Workqueue: hci0 hci_rx_work [ 765.676052][ T4200] Call Trace: [ 765.679363][ T4200] [ 765.682311][ T4200] dump_stack_lvl+0x188/0x250 [ 765.687022][ T4200] ? show_regs_print_info+0x20/0x20 [ 765.692255][ T4200] ? load_image+0x400/0x400 [ 765.696799][ T4200] sysfs_create_dir_ns+0x26a/0x290 [ 765.702005][ T4200] ? sysfs_warn_dup+0xa0/0xa0 [ 765.706683][ T4200] ? process_one_work+0x85f/0x1010 [ 765.711806][ T4200] ? do_raw_spin_unlock+0x11d/0x230 [ 765.717017][ T4200] kobject_add_internal+0x6e0/0xd90 [ 765.722272][ T4200] kobject_add+0x160/0x230 [ 765.726698][ T4200] ? kobject_init+0x1d0/0x1d0 [ 765.731472][ T4200] ? klist_children_get+0x50/0x50 [ 765.736589][ T4200] ? get_device_parent+0x121/0x3f0 [ 765.741710][ T4200] device_add+0x483/0xfb0 [ 765.746066][ T4200] hci_conn_add_sysfs+0xd1/0x1e0 [ 765.751015][ T4200] le_conn_complete_evt+0xc48/0x15c0 [ 765.756322][ T4200] ? cs_le_create_conn+0x5e0/0x5e0 [ 765.761450][ T4200] ? __mutex_trylock_common+0x155/0x260 [ 765.767010][ T4200] hci_le_meta_evt+0x285/0x3c90 [ 765.771874][ T4200] ? hci_event_packet+0x37b/0x1370 [ 765.777010][ T4200] ? __lock_acquire+0x7d10/0x7d10 [ 765.782048][ T4200] ? hci_remote_host_features_evt+0x280/0x280 [ 765.788213][ T4200] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 765.793859][ T4200] ? mark_lock+0x94/0x320 [ 765.798280][ T4200] ? mutex_unlock+0x10/0x10 [ 765.802786][ T4200] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 765.808776][ T4200] ? lock_chain_count+0x20/0x20 [ 765.813631][ T4200] ? __rwlock_init+0x140/0x140 [ 765.818401][ T4200] hci_event_packet+0xe48/0x1370 [ 765.823346][ T4200] ? lockdep_hardirqs_on+0x94/0x140 [ 765.828572][ T4200] ? rcu_lock_release+0x20/0x20 [ 765.833432][ T4200] ? hci_send_to_monitor+0x9c/0x4a0 [ 765.838672][ T4200] hci_rx_work+0x255/0xa10 [ 765.843110][ T4200] process_one_work+0x85f/0x1010 [ 765.848075][ T4200] ? worker_detach_from_pool+0x240/0x240 [ 765.853712][ T4200] ? lockdep_hardirqs_off+0x70/0x100 [ 765.859006][ T4200] ? _raw_spin_lock_irq+0xb7/0xf0 [ 765.864031][ T4200] ? _raw_spin_lock_irqsave+0x100/0x100 [ 765.869581][ T4200] ? wq_worker_running+0x97/0x170 [ 765.874613][ T4200] worker_thread+0xaa6/0x1290 [ 765.879346][ T4200] kthread+0x436/0x520 [ 765.883416][ T4200] ? rcu_lock_release+0x20/0x20 [ 765.888278][ T4200] ? kthread_blkcg+0xd0/0xd0 [ 765.892871][ T4200] ret_from_fork+0x1f/0x30 [ 765.897305][ T4200] [ 765.906294][ T4200] kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 765.919598][ T4200] Bluetooth: hci0: failed to register connection device [ 767.365549][T15971] trusted_key: encrypted_key: insufficient parameters specified [ 768.050862][ T4263] Bluetooth: hci0: command 0x2016 tx timeout [ 768.106093][ T263] block nbd5: Attempted send on invalid socket [ 768.112339][ T263] blk_update_request: I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 768.145138][T15972] exFAT-fs (nbd5): unable to read boot sector [ 768.151389][T15972] exFAT-fs (nbd5): failed to read boot sector [ 768.159993][T15972] exFAT-fs (nbd5): failed to recognize exfat type [ 769.892714][ T4226] Bluetooth: hci1: command 0x0406 tx timeout [ 770.670137][T13206] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 770.932701][T13206] usb 8-1: Using ep0 maxpacket: 8 [ 771.051015][T16005] No such timeout policy "syz1" [ 771.067544][T13206] usb 8-1: config 255 has an invalid interface number: 106 but max is 0 [ 771.119129][T13206] usb 8-1: config 255 has no interface number 0 [ 771.255344][T13206] usb 8-1: config 255 interface 106 altsetting 15 endpoint 0xE has invalid maxpacket 1024, setting to 64 [ 771.418171][T13206] usb 8-1: config 255 interface 106 altsetting 15 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 771.535464][T13206] usb 8-1: config 255 interface 106 altsetting 15 endpoint 0x7 has invalid maxpacket 1024, setting to 64 [ 771.690873][T13206] usb 8-1: config 255 interface 106 has no altsetting 0 [ 772.702805][T13206] usb 8-1: New USB device found, idVendor=1199, idProduct=0218, bcdDevice=9a.82 [ 773.565996][T13206] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 773.578639][T13206] usb 8-1: Product: syz [ 773.583142][T13206] usb 8-1: Manufacturer: syz [ 773.612740][T13206] usb 8-1: can't set config #255, error -71 [ 773.645504][T13206] usb 8-1: USB disconnect, device number 5 [ 774.142786][ T4263] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 775.372715][ T4263] usb 7-1: config 0 has too many interfaces: 129, using maximum allowed: 32 [ 775.390574][ T4263] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 129 [ 775.602808][ T4263] usb 7-1: New USB device found, idVendor=0856, idProduct=ac31, bcdDevice=93.1e [ 775.652635][ T4263] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 775.686080][ T4263] usb 7-1: Product: syz [ 775.712618][ T4263] usb 7-1: Manufacturer: syz [ 775.727514][ T4263] usb 7-1: SerialNumber: syz [ 775.767000][ T4263] usb 7-1: config 0 descriptor?? [ 776.265195][T16064] No such timeout policy "syz0" [ 778.342874][ T4263] mos7840 7-1:0.0: required endpoints missing [ 778.364417][ T4263] usb 7-1: USB disconnect, device number 12 [ 783.480833][T16143] netlink: 1624 bytes leftover after parsing attributes in process `syz.3.3822'. [ 784.257256][T16141] chnl_net:caif_netlink_parms(): no params data found [ 786.010899][ T4227] Bluetooth: hci5: command 0x0409 tx timeout [ 786.133444][T16141] bridge0: port 1(bridge_slave_0) entered blocking state [ 786.140646][T16141] bridge0: port 1(bridge_slave_0) entered disabled state [ 786.592461][T16141] device bridge_slave_0 entered promiscuous mode [ 786.828711][T16141] bridge0: port 2(bridge_slave_1) entered blocking state [ 786.967381][T16141] bridge0: port 2(bridge_slave_1) entered disabled state [ 787.042208][T16141] device bridge_slave_1 entered promiscuous mode [ 787.077563][T16141] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 787.166347][T16141] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 787.211279][T16141] team0: Port device team_slave_0 added [ 787.323632][T16141] team0: Port device team_slave_1 added [ 787.341441][T16209] netlink: 1624 bytes leftover after parsing attributes in process `syz.6.3833'. [ 787.699930][T16141] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 788.840279][T16141] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 789.733222][T16141] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 789.770619][T16141] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 789.779600][T16141] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 789.823369][T16141] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 790.244205][ T4227] Bluetooth: hci5: command 0x041b tx timeout [ 790.450989][T16233] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 790.612050][T12292] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 790.815149][T16141] device hsr_slave_0 entered promiscuous mode [ 790.832967][T16141] device hsr_slave_1 entered promiscuous mode [ 790.871545][T16141] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 791.102707][T16141] Cannot create hsr debugfs directory [ 791.133958][T12292] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 792.149454][T12292] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 792.514606][ T4263] Bluetooth: hci5: command 0x040f tx timeout [ 792.549118][T12292] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 793.352917][ T21] usb 4-1: new full-speed USB device number 78 using dummy_hcd [ 793.405727][T16254] netlink: 1624 bytes leftover after parsing attributes in process `syz.6.3844'. [ 793.732969][ T21] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 793.779967][ T21] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 793.802706][ T21] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 793.818091][ T21] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 794.022875][ T21] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 794.101110][ T21] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 794.156281][ T21] usb 4-1: Product: syz [ 794.172852][ T21] usb 4-1: Manufacturer: syz [ 794.273452][ T21] cdc_wdm 4-1:1.0: skipping garbage [ 794.278679][ T21] cdc_wdm 4-1:1.0: skipping garbage [ 794.284075][ T21] cdc_wdm 4-1:1.0: skipping garbage [ 794.293756][ T21] cdc_wdm: probe of 4-1:1.0 failed with error -22 [ 794.523762][T12292] tipc: Left network mode [ 794.524267][T13803] usb 4-1: USB disconnect, device number 78 [ 794.534995][ T4226] Bluetooth: hci5: command 0x0419 tx timeout [ 795.003432][T16141] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 795.370449][T16141] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 797.601995][T16141] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 797.821759][T16141] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 798.465175][T16290] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 799.590709][T16141] 8021q: adding VLAN 0 to HW filter on device bond0 [ 799.673295][T16141] 8021q: adding VLAN 0 to HW filter on device team0 [ 799.680313][T12279] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 799.688885][T12279] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 799.733039][T12279] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 799.765691][T12279] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 799.828584][T12279] bridge0: port 1(bridge_slave_0) entered blocking state [ 799.835732][T12279] bridge0: port 1(bridge_slave_0) entered forwarding state [ 799.900886][T12279] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 799.958445][T12279] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 800.199850][T12279] bridge0: port 2(bridge_slave_1) entered blocking state [ 800.207044][T12279] bridge0: port 2(bridge_slave_1) entered forwarding state [ 800.909732][T12279] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 801.062864][T12279] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 801.105649][T12279] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 801.147098][T12279] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 801.182120][T12279] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 802.085891][T12279] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 802.317132][T12279] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 802.404197][T12279] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 804.312940][ T4910] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 804.323382][ T4910] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 804.369673][ T4910] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 804.378765][ T4910] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 804.392097][T16141] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 804.490809][T16356] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3869'. [ 807.442396][T16141] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 807.499957][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 807.518274][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 808.789066][ T1431] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.796669][ T1431] ieee802154 phy1 wpan1: encryption failed: -22 [ 809.151050][T12292] device hsr_slave_0 left promiscuous mode [ 809.161546][T12292] device hsr_slave_1 left promiscuous mode [ 809.168319][T12292] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 809.176042][T12292] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 809.184161][T12292] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 809.192480][T12292] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 809.200522][T12292] device bridge_slave_1 left promiscuous mode [ 809.207023][T12292] bridge0: port 2(bridge_slave_1) entered disabled state [ 809.242770][T12292] device bridge_slave_0 left promiscuous mode [ 809.249332][T12292] bridge0: port 1(bridge_slave_0) entered disabled state [ 809.264560][T12292] device veth1_macvtap left promiscuous mode [ 809.270914][T12292] device veth0_macvtap left promiscuous mode [ 809.279251][T12292] device veth1_vlan left promiscuous mode [ 809.285421][T12292] device veth0_vlan left promiscuous mode [ 809.461368][T16409] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3880'. [ 809.823750][T12292] team0 (unregistering): Port device team_slave_1 removed [ 809.840181][T12292] team0 (unregistering): Port device team_slave_0 removed [ 809.865850][T12292] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 810.155734][T12292] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 811.115483][T12292] bond0 (unregistering): Released all slaves [ 812.755933][T16456] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3890'. [ 812.767767][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 812.788970][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 812.891010][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 812.918078][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 812.953805][T16141] device veth0_vlan entered promiscuous mode [ 812.991419][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 813.018505][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 813.085611][T16141] device veth1_vlan entered promiscuous mode [ 813.179751][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 813.297068][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 813.601030][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 813.813672][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 813.870994][T16471] xt_hashlimit: size too large, truncated to 1048576 [ 813.935617][T16141] device veth0_macvtap entered promiscuous mode [ 814.088162][T16141] device veth1_macvtap entered promiscuous mode [ 815.718756][T16141] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 815.743421][T16141] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 815.762613][T16141] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 815.782564][T16141] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 815.792419][T16141] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 815.872559][T16141] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 815.882444][T16141] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 816.084478][T16141] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 816.201829][T16141] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 816.275877][T16141] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 816.349217][T16141] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 816.411251][T16141] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 816.526437][T16141] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 816.566140][T16141] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 816.607786][T16141] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 816.632729][T16141] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 816.692564][T16141] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 816.899410][T16141] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 816.923774][ T4267] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 817.626130][ T4267] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 817.710543][ T4267] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 817.720199][ T4267] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 817.736212][T16141] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 817.776680][T16141] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 817.806312][T16141] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 817.858607][T16141] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 819.299654][T12277] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 819.650556][T12277] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 819.812709][T11764] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 819.820619][T11764] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 819.843975][T12284] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 819.864139][T11764] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 820.413328][T16546] binder: 16542:16546 ioctl c0285840 200000000000 returned -22 [ 821.738134][T16553] netlink: 1752 bytes leftover after parsing attributes in process `syz.8.3908'. [ 821.767190][T16557] netlink: 468 bytes leftover after parsing attributes in process `syz.3.3909'. [ 825.760321][T16592] IPv6: ADDRCONF(NETDEV_CHANGE): bpq0: link becomes ready [ 825.911460][T16597] binder: 16593:16597 ioctl c0285840 200000000000 returned -22 [ 835.532901][T16649] chnl_net:caif_netlink_parms(): no params data found [ 836.059608][T12721] Bluetooth: hci0: command 0x0409 tx timeout [ 836.242735][ T4263] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 836.290223][T16649] bridge0: port 1(bridge_slave_0) entered blocking state [ 836.309717][T16649] bridge0: port 1(bridge_slave_0) entered disabled state [ 836.318556][T16649] device bridge_slave_0 entered promiscuous mode [ 836.328549][T16649] bridge0: port 2(bridge_slave_1) entered blocking state [ 836.336276][T16649] bridge0: port 2(bridge_slave_1) entered disabled state [ 836.344863][T16649] device bridge_slave_1 entered promiscuous mode [ 836.388835][T16649] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 836.401352][T16649] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 836.439252][T16649] team0: Port device team_slave_0 added [ 836.449655][T16649] team0: Port device team_slave_1 added [ 836.498543][T16649] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 836.532565][ T4263] usb 9-1: Using ep0 maxpacket: 16 [ 836.549995][T16649] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 836.598721][T16649] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 836.660944][T16649] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 836.679439][T16649] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 836.742703][T16649] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 836.933319][ T4263] usb 9-1: New USB device found, idVendor=0d8c, idProduct=0102, bcdDevice= 0.40 [ 836.950968][ T4263] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 836.976756][ T4263] usb 9-1: Product: syz [ 837.048757][ T4263] usb 9-1: Manufacturer: syz [ 837.086653][ T4263] usb 9-1: SerialNumber: syz [ 837.513025][T16672] udc-core: couldn't find an available UDC or it's busy [ 837.588340][T16672] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 838.122939][T12721] Bluetooth: hci0: command 0x041b tx timeout [ 840.691409][T13206] Bluetooth: hci0: command 0x040f tx timeout [ 840.771386][T16649] device hsr_slave_0 entered promiscuous mode [ 841.326970][T16649] device hsr_slave_1 entered promiscuous mode [ 841.349461][T16649] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 841.379138][T16649] Cannot create hsr debugfs directory [ 841.561283][T11764] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 843.285053][T12721] Bluetooth: hci0: command 0x0419 tx timeout [ 843.382761][ T4263] snd-usb-audio: probe of 9-1:1.0 failed with error -32 [ 843.531688][T11764] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 843.751227][T11764] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 843.978426][T16748] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 844.006724][T16748] overlayfs: failed to look up (tracing) for ino (-66) [ 844.017008][T16757] trusted_key: encrypted_key: insufficient parameters specified [ 844.450146][T11764] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 844.460547][ T144] af_packet: tpacket_rcv: packet too big, clamped from 60 to 4294967272. macoff=96 [ 845.750575][T16774] netlink: 1752 bytes leftover after parsing attributes in process `syz.7.3959'. [ 847.207262][T12721] Bluetooth: hci3: command 0x0409 tx timeout [ 847.486475][T16752] chnl_net:caif_netlink_parms(): no params data found [ 847.718232][T16794] trusted_key: encrypted_key: insufficient parameters specified [ 848.178297][T16810] tmpfs: Bad value for 'mpol' [ 848.384585][T16752] bridge0: port 1(bridge_slave_0) entered blocking state [ 848.452562][T16752] bridge0: port 1(bridge_slave_0) entered disabled state [ 848.505309][T16752] device bridge_slave_0 entered promiscuous mode [ 848.633224][T16752] bridge0: port 2(bridge_slave_1) entered blocking state [ 848.649526][T16752] bridge0: port 2(bridge_slave_1) entered disabled state [ 848.660171][T16752] device bridge_slave_1 entered promiscuous mode [ 848.709987][T16752] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 848.733552][T16752] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 848.820095][T16752] team0: Port device team_slave_0 added [ 848.857867][T16752] team0: Port device team_slave_1 added [ 848.891099][T16752] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 848.906519][T16752] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 848.986678][T16752] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 849.012811][T16752] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 849.021956][T16752] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 849.131317][T16752] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 849.242683][ T4264] Bluetooth: hci3: command 0x041b tx timeout [ 849.254050][T16752] device hsr_slave_0 entered promiscuous mode [ 849.295170][T16752] device hsr_slave_1 entered promiscuous mode [ 849.305540][T16752] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 849.314061][T16752] Cannot create hsr debugfs directory [ 850.687141][T11764] tipc: Left network mode [ 851.075643][T16649] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 851.179857][T16649] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 851.241121][T16649] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 851.310356][T16649] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 851.322850][ T4264] Bluetooth: hci3: command 0x040f tx timeout [ 851.824997][T16649] 8021q: adding VLAN 0 to HW filter on device bond0 [ 851.970888][T16889] binder: 16888:16889 ioctl c0285840 200000000000 returned -22 [ 851.991973][T11956] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 852.025373][T11956] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 852.055024][T16649] 8021q: adding VLAN 0 to HW filter on device team0 [ 852.082871][T11956] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 852.162009][T11956] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 852.171234][T11956] bridge0: port 1(bridge_slave_0) entered blocking state [ 852.178388][T11956] bridge0: port 1(bridge_slave_0) entered forwarding state [ 852.224672][T11956] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 852.257328][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 852.335123][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 852.361034][ T144] bridge0: port 2(bridge_slave_1) entered blocking state [ 852.368165][ T144] bridge0: port 2(bridge_slave_1) entered forwarding state [ 852.390491][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 852.539641][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 853.474578][T12230] Bluetooth: hci3: command 0x0419 tx timeout [ 853.522350][T12277] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 853.565619][T12277] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 853.665610][T12277] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 853.740590][T12277] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 853.771165][T12277] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 853.815712][T12277] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 853.840123][T12277] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 853.933301][T16649] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 854.004297][T16649] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 854.033733][T12286] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 854.044148][T12286] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 854.528692][T11764] device hsr_slave_0 left promiscuous mode [ 854.535105][T11764] device hsr_slave_1 left promiscuous mode [ 854.604750][T11764] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 854.619279][T11764] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 854.656664][T11764] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 854.682323][T11764] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 854.705790][T11764] device bridge_slave_1 left promiscuous mode [ 854.725851][T11764] bridge0: port 2(bridge_slave_1) entered disabled state [ 854.759602][T11764] device bridge_slave_0 left promiscuous mode [ 854.781989][T11764] bridge0: port 1(bridge_slave_0) entered disabled state [ 854.836863][T11764] device veth1_macvtap left promiscuous mode [ 854.890651][T11764] device veth0_macvtap left promiscuous mode [ 854.915360][T11764] device veth1_vlan left promiscuous mode [ 854.939347][T11764] device veth0_vlan left promiscuous mode [ 855.516669][T11764] team0 (unregistering): Port device team_slave_1 removed [ 855.531629][T11764] team0 (unregistering): Port device team_slave_0 removed [ 855.546596][T11764] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 855.559707][T11764] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 855.634872][T11764] bond0 (unregistering): Released all slaves [ 855.901623][T16950] binder: 16948:16950 ioctl c0285840 200000000000 returned -22 [ 855.924346][T12286] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 855.931862][T12286] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 855.996062][T16649] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 856.050538][ T4262] usb 9-1: USB disconnect, device number 2 [ 856.446355][T16752] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 856.483570][T16752] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 856.516075][T16752] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 856.562062][T16752] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 856.874456][T11956] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 856.903922][T11956] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 858.197493][T11956] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 858.241310][T11956] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 858.289182][T11956] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 858.313686][T11956] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 858.336703][T16649] device veth0_vlan entered promiscuous mode [ 858.439697][T16649] device veth1_vlan entered promiscuous mode [ 858.572472][T16752] 8021q: adding VLAN 0 to HW filter on device bond0 [ 858.647053][T16649] device veth0_macvtap entered promiscuous mode [ 858.698272][T16752] 8021q: adding VLAN 0 to HW filter on device team0 [ 858.714735][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 858.727244][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 858.762084][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 858.790621][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 858.878962][T16649] device veth1_macvtap entered promiscuous mode [ 858.905622][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 858.916296][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 858.932202][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 858.961348][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 858.974900][ T4238] bridge0: port 1(bridge_slave_0) entered blocking state [ 858.982047][ T4238] bridge0: port 1(bridge_slave_0) entered forwarding state [ 859.020968][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 859.043990][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 859.070654][ T4238] bridge0: port 2(bridge_slave_1) entered blocking state [ 859.077823][ T4238] bridge0: port 2(bridge_slave_1) entered forwarding state [ 859.164099][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 859.221572][T16649] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 859.272539][T16649] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 859.282417][T16649] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 859.317229][T16649] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 859.334393][T16649] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 859.345154][T16649] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 859.355539][T16649] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 859.369463][T16649] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 859.382080][T16649] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 859.405216][T17001] device syzkaller0 entered promiscuous mode [ 859.417406][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 859.444264][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 859.463650][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 859.488736][T16649] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 859.512738][T16649] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 859.532656][T16649] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 859.562609][T16649] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 859.580476][T17012] binder: 17011:17012 ioctl c0285840 200000000000 returned -22 [ 859.588888][T16649] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 859.613923][T16649] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 859.632548][T16649] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 859.656876][T16649] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 859.681024][T16649] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 859.735922][T12286] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 859.762136][T12286] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 859.788786][T16649] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 859.806227][T16649] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 859.826334][T16649] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 859.845491][T16649] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 859.870572][T12286] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 859.899691][T11956] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 859.937428][T11956] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 859.961994][T11956] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 860.045900][T11956] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 860.069428][T11956] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 860.091390][T11956] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 860.119729][T11956] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 860.141962][T11956] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 860.171618][T11956] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 860.215379][T16752] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 860.355863][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 860.380975][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 860.436601][T11956] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 861.742651][T11956] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 861.783753][T11956] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 861.817432][T12288] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 862.203878][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 862.211441][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 862.452118][T16752] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 864.283238][T17075] binder: 17074:17075 ioctl c0285840 200000000000 returned -22 [ 864.610917][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 864.625893][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 864.696243][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 864.711098][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 864.748231][T16752] device veth0_vlan entered promiscuous mode [ 864.764223][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 864.772742][ T4226] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 864.789189][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 864.825437][T16752] device veth1_vlan entered promiscuous mode [ 864.940963][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 864.955783][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 864.982074][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 865.023296][ T4226] usb 10-1: Using ep0 maxpacket: 32 [ 865.035234][T12275] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 865.067536][T16752] device veth0_macvtap entered promiscuous mode [ 866.319430][T12288] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 866.336782][T16752] device veth1_macvtap entered promiscuous mode [ 866.357430][T16752] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 866.368829][T16752] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 866.382833][ T4226] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 866.402597][T16752] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 866.425930][ T4226] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 866.477569][T16752] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 866.580745][T16752] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 866.687303][T16752] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 866.778700][T16752] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 866.853467][T16752] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 866.909242][T16752] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 866.969326][T16752] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 867.050849][T16752] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 867.538536][ T4226] usb 10-1: New USB device found, idVendor=1e7d, idProduct=2d51, bcdDevice= 0.00 [ 867.548007][ T4226] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 867.567980][ T4226] usb 10-1: config 0 descriptor?? [ 867.599281][T12286] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 867.619311][ T4226] usb 10-1: can't set config #0, error -71 [ 867.631049][T12286] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 867.633558][ T4226] usb 10-1: USB disconnect, device number 2 [ 867.658206][T16752] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 867.689284][T16752] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 867.731231][T16752] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 867.742371][T16752] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 867.752801][T16752] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 867.767277][T16752] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 867.777784][T16752] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 867.788946][T16752] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 867.799354][T16752] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 867.810403][T16752] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 867.822443][T16752] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 867.860879][T16752] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 867.870209][T16752] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 867.879710][T16752] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 867.888965][T16752] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 867.934622][ T4267] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 867.945567][ T4267] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 868.014959][T11764] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 868.120184][T11764] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 868.371627][T11764] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 868.679373][T11764] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 868.752337][ T4267] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 868.769725][ T4267] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 868.822114][T12288] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 868.891145][T12288] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 868.926551][T12288] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 868.936306][T17136] device syzkaller0 entered promiscuous mode [ 868.995686][T12286] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 871.073597][T13803] usb 8-1: new full-speed USB device number 6 using dummy_hcd [ 871.079222][ T1431] ieee802154 phy0 wpan0: encryption failed: -22 [ 871.087472][ T1431] ieee802154 phy1 wpan1: encryption failed: -22 [ 871.753185][T13803] usb 8-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 871.881016][T13803] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 872.100760][T13803] usb 8-1: Product: syz [ 872.228981][T13803] usb 8-1: Manufacturer: syz [ 872.315238][T13803] usb 8-1: SerialNumber: syz [ 872.346672][T13803] usb 8-1: config 0 descriptor?? [ 872.656333][T13803] usb 8-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 873.673282][T11764] device hsr_slave_0 left promiscuous mode [ 873.712858][T11764] device hsr_slave_1 left promiscuous mode [ 873.743682][T11764] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 873.783275][T11764] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 873.832970][T13803] dvb_usb_rtl28xxu: probe of 8-1:0.0 failed with error -32 [ 873.851067][T11764] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 873.890428][T11764] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 873.930553][T11764] device bridge_slave_1 left promiscuous mode [ 873.944560][T11764] bridge0: port 2(bridge_slave_1) entered disabled state [ 873.991360][T11764] device bridge_slave_0 left promiscuous mode [ 874.022434][T11764] bridge0: port 1(bridge_slave_0) entered disabled state [ 874.088868][T11764] device veth1_macvtap left promiscuous mode [ 874.740700][T11764] device veth0_macvtap left promiscuous mode [ 874.792066][T11764] device veth1_vlan left promiscuous mode [ 874.814467][T11764] device veth0_vlan left promiscuous mode [ 875.379012][T12230] usb 8-1: USB disconnect, device number 6 [ 875.804753][T11764] team0 (unregistering): Port device team_slave_1 removed [ 875.850388][T11764] team0 (unregistering): Port device team_slave_0 removed [ 875.915879][T11764] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 875.932849][T12230] usb 4-1: new full-speed USB device number 79 using dummy_hcd [ 875.966173][T11764] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 876.164527][T11764] bond0 (unregistering): Released all slaves [ 876.332894][T12230] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 876.362672][T12230] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 876.401969][T17241] autofs4:pid:17241:autofs_fill_super: called with bogus options [ 876.603916][T12230] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 876.681199][T12230] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 876.921456][T12230] usb 4-1: Product: syz [ 877.015824][T12230] usb 4-1: Manufacturer: syz [ 877.147330][T12230] usb 4-1: SerialNumber: syz [ 878.658102][T17220] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4046'. [ 879.172654][T12230] usb 4-1: USB disconnect, device number 79 [ 885.393179][T12702] usb 4-1: new full-speed USB device number 80 using dummy_hcd [ 885.862770][ T4226] usb 5-1: new full-speed USB device number 59 using dummy_hcd [ 886.743225][T12702] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 887.461588][T12702] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 887.514972][T12702] usb 4-1: string descriptor 0 read error: -71 [ 887.521379][T12702] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 887.533103][ T4226] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 887.545369][T12702] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 887.575609][ T4226] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 887.622772][T12702] usb 4-1: can't set config #1, error -71 [ 887.647029][T12702] usb 4-1: USB disconnect, device number 80 [ 887.963140][ T4226] usb 5-1: unable to read config index 1 descriptor/start: -71 [ 887.983762][ T4226] usb 5-1: can't read configurations, error -71 [ 891.852853][T12230] usb 5-1: new full-speed USB device number 61 using dummy_hcd [ 892.112660][T13206] usb 4-1: new full-speed USB device number 81 using dummy_hcd [ 893.922849][T13206] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 893.942583][T13206] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 894.012948][T12230] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 894.032698][T13206] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 894.043391][T12230] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 894.068760][T13206] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 894.232912][T13206] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 894.253092][T12230] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 894.263583][T13206] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 894.274187][T12230] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 894.319536][T12230] usb 5-1: Product: syz [ 894.344186][T12230] usb 5-1: Manufacturer: syz [ 894.366137][T12230] usb 5-1: SerialNumber: syz [ 894.433432][T12230] usb 5-1: can't set config #1, error -71 [ 894.452818][T13206] usb 4-1: New USB device found, idVendor=0451, idProduct=5152, bcdDevice=c0.b9 [ 894.473674][T12230] usb 5-1: USB disconnect, device number 61 [ 894.484427][T13206] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 894.544944][T13206] usb 4-1: Product: syz [ 894.549251][T13206] usb 4-1: Manufacturer: syz [ 894.586762][T13206] usb 4-1: SerialNumber: syz [ 894.627099][T13206] usb 4-1: config 0 descriptor?? [ 894.667475][T13206] ti_usb_3410_5052 4-1:0.0: TI USB 5052 2 port adapter converter detected [ 894.735832][T13206] ti_usb_3410_5052 4-1:0.0: missing endpoints [ 894.821274][T12702] usb 4-1: USB disconnect, device number 81 [ 895.052731][T12230] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 895.434268][T17437] tipc: Cannot configure node identity twice [ 896.308808][T17440] binder: BINDER_SET_CONTEXT_MGR already set [ 896.335466][T17440] binder: 17439:17440 ioctl 4018620d 200000004a80 returned -16 [ 896.362147][T12230] usb 8-1: config index 0 descriptor too short (expected 39, got 27) [ 896.372997][T12230] usb 8-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 896.383011][T12230] usb 8-1: config 0 interface 0 has no altsetting 0 [ 896.447685][T17445] device bridge0 entered promiscuous mode [ 897.252718][T12230] usb 8-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 897.264956][T12230] usb 8-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 897.274799][T12230] usb 8-1: Product: syz [ 897.280803][T12230] usb 8-1: Manufacturer: syz [ 897.285476][T12230] usb 8-1: SerialNumber: syz [ 897.292062][T12230] usb 8-1: config 0 descriptor?? [ 897.374464][T12230] hub 8-1:0.0: bad descriptor, ignoring hub [ 897.395774][T12230] hub: probe of 8-1:0.0 failed with error -5 [ 897.575344][T12230] usb 8-1: selecting invalid altsetting 0 [ 897.629524][T12230] usb 8-1: USB disconnect, device number 7 [ 897.791320][T17457] tmpfs: Bad value for 'mpol' [ 898.122851][T12721] usb 5-1: new full-speed USB device number 62 using dummy_hcd [ 898.532644][T12230] usb 8-1: new full-speed USB device number 8 using dummy_hcd [ 898.712650][T12721] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 898.722982][ T4227] usb 7-1: new full-speed USB device number 13 using dummy_hcd [ 898.752556][T12721] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 899.753002][ T4227] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 899.776489][ T4227] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 899.782674][T12230] usb 8-1: device descriptor read/all, error -71 [ 899.845523][T12721] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 899.892587][T12721] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 899.916807][T12721] usb 5-1: Product: syz [ 899.928516][T12721] usb 5-1: Manufacturer: syz [ 899.948724][T12721] usb 5-1: SerialNumber: syz [ 899.972788][ T4227] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 899.992763][ T4227] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 900.112787][ T4227] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 900.131347][ T4227] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 900.230644][T17458] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4107'. [ 900.301741][T12721] usb 5-1: USB disconnect, device number 62 [ 900.322985][ T4227] usb 7-1: New USB device found, idVendor=0451, idProduct=5152, bcdDevice=c0.b9 [ 900.349647][ T4227] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 900.373127][ T4227] usb 7-1: Product: syz [ 900.377645][ T4227] usb 7-1: Manufacturer: syz [ 900.393494][ T4227] usb 7-1: SerialNumber: syz [ 900.471619][ T4227] usb 7-1: config 0 descriptor?? [ 900.645987][ T4227] ti_usb_3410_5052 7-1:0.0: TI USB 5052 2 port adapter converter detected [ 900.781432][ T4227] ti_usb_3410_5052 7-1:0.0: missing endpoints [ 901.014311][ T4227] usb 7-1: USB disconnect, device number 13 [ 901.103291][T14830] udevd[14830]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 905.682677][T16281] usb 7-1: new full-speed USB device number 14 using dummy_hcd [ 906.052739][T16281] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 906.801660][T16281] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 907.032931][T16281] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 907.132742][T16281] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 907.190262][T16281] usb 7-1: Product: syz [ 907.227616][T16281] usb 7-1: Manufacturer: syz [ 907.276097][T16281] usb 7-1: SerialNumber: syz [ 907.510165][T17589] binder: 17588:17589 ioctl c0285840 200000000000 returned -22 [ 907.542722][T12721] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 907.589567][T17558] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4126'. [ 907.650366][T16281] usb 7-1: USB disconnect, device number 14 [ 907.822905][T12721] usb 8-1: Using ep0 maxpacket: 16 [ 907.884641][ T4200] Bluetooth: hci1: Unknown advertising packet type: 0x3c [ 907.884906][ T4200] ================================================================== [ 907.900562][ T4200] BUG: KASAN: slab-out-of-bounds in hci_le_meta_evt+0x133f/0x3c90 [ 907.908463][ T4200] Read of size 1 at addr ffff888077da8408 by task kworker/u5:7/4200 [ 907.916444][ T4200] [ 907.918775][ T4200] CPU: 1 PID: 4200 Comm: kworker/u5:7 Not tainted syzkaller #0 [ 907.926318][ T4200] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 907.936414][ T4200] Workqueue: hci1 hci_rx_work [ 907.941108][ T4200] Call Trace: [ 907.944393][ T4200] [ 907.947330][ T4200] dump_stack_lvl+0x188/0x250 [ 907.952021][ T4200] ? show_regs_print_info+0x20/0x20 [ 907.957239][ T4200] ? load_image+0x400/0x400 [ 907.961738][ T4200] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 907.967209][ T4200] print_address_description+0x60/0x2d0 [ 907.972770][ T4200] ? hci_le_meta_evt+0x133f/0x3c90 [ 907.977906][ T4200] kasan_report+0xdf/0x130 [ 907.982323][ T4200] ? hci_le_meta_evt+0x133f/0x3c90 [ 907.987434][ T4200] hci_le_meta_evt+0x133f/0x3c90 [ 907.992377][ T4200] ? hci_remote_host_features_evt+0x280/0x280 [ 907.998442][ T4200] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 908.004078][ T4200] ? mark_lock+0x94/0x320 [ 908.008496][ T4200] ? mutex_unlock+0x10/0x10 [ 908.012994][ T4200] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 908.018972][ T4200] ? lock_chain_count+0x20/0x20 [ 908.023817][ T4200] ? __rwlock_init+0x140/0x140 [ 908.028574][ T4200] hci_event_packet+0xe48/0x1370 [ 908.033506][ T4200] ? lockdep_hardirqs_on+0x94/0x140 [ 908.038704][ T4200] ? rcu_lock_release+0x20/0x20 [ 908.043718][ T4200] ? hci_send_to_monitor+0x9c/0x4a0 [ 908.048928][ T4200] hci_rx_work+0x255/0xa10 [ 908.053364][ T4200] process_one_work+0x85f/0x1010 [ 908.058318][ T4200] ? worker_detach_from_pool+0x240/0x240 [ 908.063947][ T4200] ? lockdep_hardirqs_off+0x70/0x100 [ 908.069245][ T4200] ? _raw_spin_lock_irq+0xb7/0xf0 [ 908.074271][ T4200] ? _raw_spin_lock_irqsave+0x100/0x100 [ 908.079826][ T4200] ? wq_worker_running+0x97/0x170 [ 908.084847][ T4200] worker_thread+0xaa6/0x1290 [ 908.089553][ T4200] kthread+0x436/0x520 [ 908.093832][ T4200] ? rcu_lock_release+0x20/0x20 [ 908.098689][ T4200] ? kthread_blkcg+0xd0/0xd0 [ 908.103459][ T4200] ret_from_fork+0x1f/0x30 [ 908.107900][ T4200] [ 908.110946][ T4200] [ 908.113265][ T4200] Allocated by task 17584: [ 908.117682][ T4200] __kasan_kmalloc+0xb5/0xf0 [ 908.122274][ T4200] __alloc_skb+0x22c/0x750 [ 908.126766][ T4200] vhci_write+0xbc/0x450 [ 908.131009][ T4200] vfs_write+0x745/0xd60 [ 908.135242][ T4200] ksys_write+0x152/0x260 [ 908.139577][ T4200] do_syscall_64+0x4c/0xa0 [ 908.143983][ T4200] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 908.149871][ T4200] [ 908.152185][ T4200] The buggy address belongs to the object at ffff888077da8000 [ 908.152185][ T4200] which belongs to the cache kmalloc-1k of size 1024 [ 908.166222][ T4200] The buggy address is located 8 bytes to the right of [ 908.166222][ T4200] 1024-byte region [ffff888077da8000, ffff888077da8400) [ 908.180036][ T4200] The buggy address belongs to the page: [ 908.185658][ T4200] page:ffffea0001df6a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x77da8 [ 908.195808][ T4200] head:ffffea0001df6a00 order:3 compound_mapcount:0 compound_pincount:0 [ 908.204238][ T4200] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 908.212238][ T4200] raw: 00fff00000010200 ffffea0001f05a00 0000000400000004 ffff888016c41dc0 [ 908.220821][ T4200] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 908.229404][ T4200] page dumped because: kasan: bad access detected [ 908.235893][ T4200] page_owner tracks the page as allocated [ 908.241612][ T4200] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 12249, ts 470219976502, free_ts 468309731867 [ 908.261935][ T4200] get_page_from_freelist+0x1bbd/0x1ca0 [ 908.267500][ T4200] __alloc_pages+0x1ee/0x480 [ 908.272088][ T4200] new_slab+0xc0/0x4b0 [ 908.276231][ T4200] ___slab_alloc+0x80a/0xdd0 [ 908.280824][ T4200] __kmalloc_node_track_caller+0x1fc/0x3a0 [ 908.286622][ T4200] __alloc_skb+0x22c/0x750 [ 908.291032][ T4200] xfrm_send_acquire+0x15b/0xf80 [ 908.295961][ T4200] km_query+0xe3/0x1d0 [ 908.300028][ T4200] xfrm_state_find+0x1f75/0x2ac0 [ 908.304954][ T4200] xfrm_resolve_and_create_bundle+0x766/0x2bf0 [ 908.311114][ T4200] xfrm_lookup_with_ifid+0x272/0x2000 [ 908.316502][ T4200] xfrm_lookup_route+0x38/0x1a0 [ 908.321381][ T4200] udp_sendmsg+0x15dd/0x2370 [ 908.325963][ T4200] ____sys_sendmsg+0x5b7/0x8f0 [ 908.330721][ T4200] ___sys_sendmsg+0x236/0x2e0 [ 908.335388][ T4200] __sys_sendmmsg+0x2ba/0x500 [ 908.340057][ T4200] page last free stack trace: [ 908.344720][ T4200] free_unref_page_prepare+0x637/0x6c0 [ 908.350177][ T4200] free_unref_page+0x8f/0x2a0 [ 908.354993][ T4200] __vunmap+0x8b9/0xa50 [ 908.359136][ T4200] kcov_mmap+0x89/0x120 [ 908.363284][ T4200] mmap_file+0x5d/0xb0 [ 908.367344][ T4200] mmap_region+0xf88/0x1650 [ 908.371848][ T4200] do_mmap+0x819/0xe90 [ 908.375904][ T4200] vm_mmap_pgoff+0x1c1/0x2d0 [ 908.380485][ T4200] ksys_mmap_pgoff+0x54b/0x790 [ 908.385267][ T4200] do_syscall_64+0x4c/0xa0 [ 908.389686][ T4200] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 908.395661][ T4200] [ 908.397982][ T4200] Memory state around the buggy address: [ 908.403598][ T4200] ffff888077da8300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 908.411661][ T4200] ffff888077da8380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 908.419710][ T4200] >ffff888077da8400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 908.427786][ T4200] ^ [ 908.432099][ T4200] ffff888077da8480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 908.440148][ T4200] ffff888077da8500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 908.448197][ T4200] ================================================================== [ 908.456245][ T4200] Disabling lock debugging due to kernel taint [ 908.491096][ T4200] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 908.498336][ T4200] CPU: 0 PID: 4200 Comm: kworker/u5:7 Tainted: G B syzkaller #0 [ 908.507352][ T4200] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 908.517408][ T4200] Workqueue: hci1 hci_rx_work [ 908.522194][ T4200] Call Trace: [ 908.525478][ T4200] [ 908.528428][ T4200] dump_stack_lvl+0x188/0x250 [ 908.533222][ T4200] ? show_regs_print_info+0x20/0x20 [ 908.538457][ T4200] ? load_image+0x400/0x400 [ 908.542980][ T4200] panic+0x2e5/0x810 [ 908.546895][ T4200] ? bpf_jit_dump+0xd0/0xd0 [ 908.551419][ T4200] ? _raw_spin_unlock_irqrestore+0x10d/0x120 [ 908.557413][ T4200] ? _raw_spin_unlock+0x40/0x40 [ 908.562284][ T4200] ? hci_le_meta_evt+0x133f/0x3c90 [ 908.567414][ T4200] check_panic_on_warn+0x80/0xa0 [ 908.572375][ T4200] ? hci_le_meta_evt+0x133f/0x3c90 [ 908.577512][ T4200] end_report+0x6d/0xf0 [ 908.581688][ T4200] kasan_report+0x102/0x130 [ 908.586218][ T4200] ? hci_le_meta_evt+0x133f/0x3c90 [ 908.591353][ T4200] hci_le_meta_evt+0x133f/0x3c90 [ 908.596429][ T4200] ? hci_remote_host_features_evt+0x280/0x280 [ 908.602536][ T4200] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 908.608204][ T4200] ? mark_lock+0x94/0x320 [ 908.612563][ T4200] ? mutex_unlock+0x10/0x10 [ 908.617085][ T4200] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 908.623098][ T4200] ? lock_chain_count+0x20/0x20 [ 908.627981][ T4200] ? __rwlock_init+0x140/0x140 [ 908.632770][ T4200] hci_event_packet+0xe48/0x1370 [ 908.637739][ T4200] ? lockdep_hardirqs_on+0x94/0x140 [ 908.643051][ T4200] ? rcu_lock_release+0x20/0x20 [ 908.647932][ T4200] ? hci_send_to_monitor+0x9c/0x4a0 [ 908.653153][ T4200] hci_rx_work+0x255/0xa10 [ 908.657601][ T4200] process_one_work+0x85f/0x1010 [ 908.662565][ T4200] ? worker_detach_from_pool+0x240/0x240 [ 908.668218][ T4200] ? lockdep_hardirqs_off+0x70/0x100 [ 908.673618][ T4200] ? _raw_spin_lock_irq+0xb7/0xf0 [ 908.678659][ T4200] ? _raw_spin_lock_irqsave+0x100/0x100 [ 908.684229][ T4200] ? wq_worker_running+0x97/0x170 [ 908.689278][ T4200] worker_thread+0xaa6/0x1290 [ 908.693991][ T4200] kthread+0x436/0x520 [ 908.698083][ T4200] ? rcu_lock_release+0x20/0x20 [ 908.702960][ T4200] ? kthread_blkcg+0xd0/0xd0 [ 908.707577][ T4200] ret_from_fork+0x1f/0x30 [ 908.712026][ T4200] [ 908.715419][ T4200] Kernel Offset: disabled [ 908.719748][ T4200] Rebooting in 86400 seconds..