last executing test programs: 7.728563868s ago: executing program 0 (id=50): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x90}, 0x4000000) socket$xdp(0x2c, 0x3, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000380)={0x74, 0x2, 0x9, 0x101, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFCTH_TUPLE={0x48, 0x2, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x1d}}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x966}, @CTA_TUPLE_ZONE={0x6}]}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x6c}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0xb}]}, 0x74}, 0x1, 0x0, 0x0, 0x4}, 0x80) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 6.476208737s ago: executing program 0 (id=56): r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x4001, @remote, 'batadv0\x00'}}, 0x1e) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="48706882a8d013c0f79b9853ae000000100000022bbd7000fbdbdf25080000000000", @ANYRES32=0x0, @ANYBLOB="174605000000000028001280090001007665746800000000180002801400010000000000", @ANYRES32=0x0, @ANYBLOB="0200000030700100"], 0x48}, 0x1, 0x0, 0x0, 0x1}, 0xc31fe084736598c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="240000001800090000000000000000001c140000fe"], 0x24}}, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r3, &(0x7f0000000c40)=[{{&(0x7f0000000240)={0xa, 0x4e21, 0x2, @private0}, 0x1c, &(0x7f0000000d00)=[{&(0x7f00000002c0)='\n', 0x1}], 0x1}}], 0x1, 0x40088d4) r4 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x3c, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$smc(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$SMC_PNETID_DEL(r5, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000004c0)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r6, @ANYBLOB="01002abd7000fb5bdf25030000000000000073797a3100000000"], 0x20}, 0x1, 0x0, 0x0, 0x20040040}, 0x20000000) shutdown(r3, 0x1) socket$inet6_tcp(0xa, 0x1, 0x0) socket$tipc(0x1e, 0x2, 0x0) socket$tipc(0x1e, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000050)) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8b04, &(0x7f0000000040)={'wlan0\x00'}) 6.287746166s ago: executing program 0 (id=58): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_EXTERNAL_AUTH(r0, 0x0, 0x4090) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000497000/0x2000)=nil, 0x2000, 0x3, 0x810, r1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x13, r3, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3, 0x28011, r2, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000540)={0x1100, 0x1, 0x2e38, 0x11000}) r4 = socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$inet_sctp(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[], 0x20, 0x2400e044}, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1d}}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) recvmmsg(r5, &(0x7f0000000340), 0x40001ca, 0x20, 0x0) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x9, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) sendto$inet6(r5, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$sock_int(r2, 0x1, 0x29, &(0x7f00000000c0)=0xffff1888, 0x4) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) 5.419738366s ago: executing program 2 (id=60): socket$inet6_udp(0xa, 0x2, 0x0) socket$inet(0x2, 0x4000000000000001, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_crypto(0x10, 0x3, 0x15) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket(0x2, 0x80805, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB], 0x50) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="190000000400000004"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000480)={{r2}, &(0x7f0000000240), &(0x7f0000000340)=r3}, 0x20) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000008c0)={r3, r1, 0x25, 0x2, @val=@tracing={0x0, 0x2e5b}}, 0x20) syz_emit_ethernet(0x3e, &(0x7f0000000340)={@multicast, @empty, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "76b2af", 0x8, 0x2f, 0x0, @private0, @mcast2, {[], {0x0, 0x883e, 0x8}}}}}}, 0x0) 5.246884244s ago: executing program 2 (id=62): socket(0x1d, 0x2, 0x6) getsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4b, 0x0, &(0x7f0000000080)) socket(0x1d, 0x2, 0x6) r0 = socket(0x2b, 0x1, 0x1) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000100)={@dev={0xac, 0x14, 0x14, 0x39}, @loopback}, 0x10) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) setsockopt$nfc_llcp_NFC_LLCP_RW(r1, 0x118, 0x0, &(0x7f00000002c0)=0x8000004, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) sendmsg$RDMA_NLDEV_CMD_GET(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x18, 0x1401, 0x10, 0x70bd27, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}, 0x1, 0x0, 0x0, 0x5}, 0x4000050) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)}, 0x48000) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000003c0)={0xffffffffffffffff, 0x20, &(0x7f0000000380)={&(0x7f0000000140)=""/220, 0xdc, 0x0, &(0x7f0000000340)=""/9, 0x9}}, 0x10) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, &(0x7f0000000240)={'security\x00', 0x3, [{}, {}, {}]}, 0x58) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x4, 0x3, &(0x7f00000005c0)=ANY=[@ANYBLOB="b40800000000000073113f20000000009500e212000000000af2c773bf444231da6e7ede5362c4f31a9413a7f8d63d620b3e32875b984cd314de15ff964d207a9222fd26cb8b3c0cf12a3370ad2e3c1505367f7061636ac311e9a6b26e116d367157c0a599993f902b1dd8e09165247228f25d454188e146dba5086ecd16ce66e62a9f82045d897fb95ac3240d6723d0d395f5c56012fdf98aa3"], &(0x7f0000000440)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xf}, 0x94) 5.183898517s ago: executing program 4 (id=63): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x90}, 0x4000000) socket$xdp(0x2c, 0x3, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000380)={0x74, 0x2, 0x9, 0x101, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFCTH_TUPLE={0x48, 0x2, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x1d}}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x966}, @CTA_TUPLE_ZONE={0x6}]}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x6c}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0xb}]}, 0x74}, 0x1, 0x0, 0x0, 0x4}, 0x80) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 5.111548551s ago: executing program 2 (id=64): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x82c03, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffff, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x40004}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000001300)=@newtfilter={0x88, 0x2c, 0xd3f, 0x10bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x8, 0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0x58, 0x2, [@TCA_BASIC_ACT={0x54, 0x3, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x7, 0x4, 0x4, 0xb, 0xdc}, 0x1, r8}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x95}, 0x8080) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r6, &(0x7f0000000280)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r5, 0x42, 0x4000}, 0x80, &(0x7f0000000440)=[{&(0x7f00000001c0)="27030200dc0f14000e0003000024c1020000ff1107c2fb7fe0400018534b4f6b3d327db412f40000000000000000", 0x2e}], 0x1}, 0x4005) 4.536397158s ago: executing program 2 (id=66): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r8, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8, 0x3, 0x6, 0x1, 0xfffffffd, 0xd, 0xfff, 0xfffffffa, 0x8}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56561, 0x70bd2a, 0x25dfdbfa, {0x0, 0x0, 0x0, r8, {0x0, 0x1}, {0x0, 0x8}, {0xc, 0x3}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x4048090) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 4.525754458s ago: executing program 0 (id=67): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) writev(r0, &(0x7f00000005c0), 0x0) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) 4.437168913s ago: executing program 3 (id=68): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0xfff, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x8000, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x8, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x5, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0x5, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0x0, @fixed}, &(0x7f0000000280)=0xe, 0x80000) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000800)=ANY=[@ANYBLOB="a4010000100001"], 0x1a4}}, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) sendmsg$NLBL_UNLABEL_C_STATICADD(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8004) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f000000c280)=[{&(0x7f0000000a00)=ANY=[@ANYBLOB="1403000030000100000100000400000001"], 0x314}], 0x1}, 0x800) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 4.180649504s ago: executing program 2 (id=69): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x90}, 0x4000000) socket$xdp(0x2c, 0x3, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000380)={0x6c, 0x2, 0x9, 0x101, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFCTH_TUPLE={0x40, 0x2, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x1d}}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x966}, @CTA_TUPLE_ZONE={0x6}]}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x6c}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0xb}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4}, 0x80) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 3.866323549s ago: executing program 0 (id=70): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa3, 0xb69b, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x5a7, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0xffffffff, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x808, 0x40, 0xa6, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x80000000, 0x6, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0xffd, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0xffffffff, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0xfc33, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={0x0}, 0x1, 0x0, 0x0, 0x8091}, 0x4000000) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="40000000020901010000000000000000011a0001010000800000000008000100ac14141d08"], 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x80) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 3.694499257s ago: executing program 4 (id=72): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0xfff, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x8000, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x8, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x5, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0x5, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0x0, @fixed}, &(0x7f0000000280)=0xe, 0x80000) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000800)=ANY=[@ANYBLOB="a4010000100001"], 0x1a4}}, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) sendmsg$NLBL_UNLABEL_C_STATICADD(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8004) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f000000c280)=[{&(0x7f0000000a00)=ANY=[@ANYBLOB="1403000030000100000100000400000001"], 0x314}], 0x1}, 0x800) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 3.518124375s ago: executing program 0 (id=73): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_EXTERNAL_AUTH(r0, 0x0, 0x4090) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000497000/0x2000)=nil, 0x2000, 0x3, 0x810, r1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x13, r3, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3, 0x28011, r2, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000540)={0x1100, 0x1, 0x2e38, 0x11000}) r4 = socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$inet_sctp(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[], 0x20, 0x2400e044}, 0x0) ioctl$BTRFS_IOC_START_SYNC(r3, 0x80089418, &(0x7f0000000080)) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1d}}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) recvmmsg(r5, &(0x7f0000000340), 0x40001ca, 0x20, 0x0) sendto$inet6(r5, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$sock_int(r2, 0x1, 0x29, &(0x7f00000000c0)=0xffff1888, 0x4) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) 2.99591404s ago: executing program 3 (id=75): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0xfff, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x8000, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x8, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x5, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0x5, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0x0, @fixed}, &(0x7f0000000280)=0xe, 0x80000) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000800)=ANY=[@ANYBLOB="a4010000100001"], 0x1a4}}, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) sendmsg$NLBL_UNLABEL_C_STATICADD(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8004) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f000000c280)=[{&(0x7f0000000a00)=ANY=[@ANYBLOB="14030000300001000001000004000000"], 0x314}], 0x1}, 0x800) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 2.710756843s ago: executing program 2 (id=76): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_EXTERNAL_AUTH(r0, 0x0, 0x4090) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000497000/0x2000)=nil, 0x2000, 0x3, 0x810, r1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x13, r3, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3, 0x28011, r2, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000540)={0x1100, 0x1, 0x2e38, 0x11000}) r4 = socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$inet_sctp(r4, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[], 0x20, 0x2400e044}, 0x0) ioctl$BTRFS_IOC_START_SYNC(r3, 0x80089418, &(0x7f0000000080)) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r5, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1d}}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) recvmmsg(r5, &(0x7f0000000340), 0x40001ca, 0x20, 0x0) sendto$inet6(r5, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$sock_int(r2, 0x1, 0x29, &(0x7f00000000c0)=0xffff1888, 0x4) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) 2.520390152s ago: executing program 3 (id=78): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0xfff, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x8000, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x8, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x5, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0x5, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0x0, @fixed}, &(0x7f0000000280)=0xe, 0x80000) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000800)=ANY=[@ANYBLOB="a4010000100001"], 0x1a4}}, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) sendmsg$NLBL_UNLABEL_C_STATICADD(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8004) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f000000c280)=[{&(0x7f0000000a00)=ANY=[@ANYBLOB="14030000300001000001000004"], 0x314}], 0x1}, 0x800) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 2.221067846s ago: executing program 4 (id=80): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x68, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) ptrace(0x10, 0x0) ptrace$pokeuser(0x6, r0, 0x92, 0xfdff8881f5c0a084) pipe2$9p(0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r2, 0x0, 0x8004) socket$can_j1939(0x1d, 0x2, 0x7) write$P9_RSETATTR(0xffffffffffffffff, &(0x7f0000000000)={0x7, 0x1b, 0x5}, 0x7) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000002c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha224-ssse3\x00'}, 0x58) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000080)='./file0\x00', 0x0, &(0x7f0000000040)={[], [{@smackfsdef={'smackfsdef', 0x3d, '+'}}]}, 0x1, 0x4a0, &(0x7f0000000b80)="$eJzs289rHGUfAPDvTH60ffsjefv2VVurRosQFJMmrdqDBxUFkYqCHiqeYrItodtGkii2FBtF6kWQgp6LR9G/wJsoop4Er3rxJIWivbT1IJGZnU02293GJptszH4+MNnnmXlm5vnu/HrmeTYBdKyB7E8SsSMifo6Ivkp2aYGBysf1q+fGb1w9N57E/PzLvyd5uWtXz41Xi1bX215kBtOI9P2k2MlSM2fOnhwrl0vTRX549tQbwzNnzj7y1qmxE6UTpdOjR44cPjTy+GOjj9atmSQriTOL69q+d6b2733u1YsvjB+7+Pr3X2Qb2lEsr42jVQaywP+Yz9Uve7DVO2uznTXppLuNFeG2dEVEdrh68uu/L7pi8eD1xbPvtbVywJrKnk1bmi+emwc2sSTaXQOgPaoP+uz9tzqtU9NjQ7jyVOUFKIv7ejFVlnRHWpTpqXu/baWBiDg29+elbIo16ocAAKj14fgnR3sj5vtufP581vboW1iSxh3556/5313FGEp/RPw3InZHxP8iYk9E/D8iL3tnRNy1yvrc3P5JL69yk7eUtf+eKMa2lrb/qq2/6O8qcjvz+HuS45Pl0sHiOxmMni1ZfuQW+/jqmZ8+arastv2XTdn+j6VxabFEerm7roNuYmx2LG+UtsCVdyP2dTeKP1kYCUgiYm9E7Lu9Te+qJiYf+mx/s0IN4y/awstqwTjT/KdZeHNZ/HNRF39VUjs+OXnT+OTw1iiXDg5Xz4qb/fDjhZea7b9p/Os0hnalVPmsOf71RfqTxS+jND1z+/u48MsHTd9plj/+Dc//tDd5JR9n7i3mvT02Ozs9EtGbHM3zS+aP9i6sW8kvls/O/8EDja//3cU6WfB3R0R2Et8TEfc+GXFfUff7I+KBiDhwi/i/e7r5smr8ka7g/G+BLP6Jhve/hfM/O/6L4/UrSHSd/PbLZvv/Z8f/cJ4aLObk979lNKpOdknVV3A13x0AAAD8W6T5b+CTdGghnaZDQ5Xf8O+J/6TlqZnZh49PvXl6ovJb+f7oSas9XX1Ff2h5slwaSeaKLVb6R0eLvuJqf+mhot/4465teX5ofKo80ebYodNtb3L9Z37ranftgDW2reHcmjETYBOrH2tOl2bPvxhuBrBZ+X9t6FxNrv/q7HQ96wKsr5U+/19rcT2A9dfo+j9flzcWAJuT93/oXK5/6FDp1+2uAdBGnv/QkVbzf/1rmNg6PfPNxq7hGiY2dMgR1US6TOG/5jdKnTsssSVasZ0235gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABa5O8AAAD///B74xQ=") r4 = openat(0xffffffffffffff9c, &(0x7f0000000680)='./file0\x00', 0x28000, 0x1cd) ioctl$FS_IOC_FSSETXATTR(r4, 0x401c5820, &(0x7f0000000000)={0x200, 0x4, 0x0, 0x8, 0x6}) chdir(&(0x7f0000000140)='./file0\x00') socket$unix(0x1, 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY(0xffffffffffffffff, 0x5000940f, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r5, 0x0, 0x0) getgroups(0x4, &(0x7f00000031c0)=[0x0, 0xffffffffffffffff, 0x0, 0xee01]) shmctl$IPC_SET(0x0, 0x1, &(0x7f0000003200)={{0x2, 0x0, 0x0, 0x0, r6, 0x10a, 0xffff}, 0xe, 0x8001, 0x3, 0x7, r0, r0, 0x4}) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) 1.657078972s ago: executing program 4 (id=82): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xd, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0xfff, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1ff, 0x1, 0x8000, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x8, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x5, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0x5, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) accept4$bt_l2cap(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0x0, @fixed}, &(0x7f0000000280)=0xe, 0x80000) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000800)=ANY=[@ANYBLOB="a4010000100001"], 0x1a4}}, 0x0) sendmsg$NLBL_UNLABEL_C_STATICADD(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x8004) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 1.517285149s ago: executing program 3 (id=84): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x90}, 0x4000000) socket$xdp(0x2c, 0x3, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x4, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 1.388672285s ago: executing program 1 (id=85): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000a40), 0x0, 0x0) close(r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000280)=ANY=[@ANYBLOB="1e030600bc5cb60128876360864666702c1ffe80000000000000", @ANYRESDEC], 0xffdd) 1.324404428s ago: executing program 4 (id=86): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0x10080, 0x2, 0x91, 0x129, 0x4, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x9, 0xf9a2, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x2, 0x1000000, 0x489, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x4], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x5, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x408, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socket$xdp(0x2c, 0x3, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 726.398246ms ago: executing program 1 (id=87): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_DEL_MPATH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYRES16=r1, @ANYBLOB="0500000000000000000018"], 0x28}}, 0x0) 640.27424ms ago: executing program 1 (id=88): r0 = socket$netlink(0x10, 0x3, 0x400000000000004) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000200)}], 0x1) 442.75302ms ago: executing program 1 (id=89): r0 = socket(0x840000000002, 0x3, 0xff) sendmsg$inet(r0, &(0x7f0000000180)={&(0x7f00000006c0)={0x2, 0x4e23, @multicast1}, 0x10, &(0x7f00000019c0)=[{&(0x7f0000000600)="9745010000004000012c8cc5ff", 0xd}, {&(0x7f0000000340)}], 0x2, &(0x7f00000008c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x16}, @rand_addr=0x64010100}}}], 0x20}, 0x400c804) 391.466132ms ago: executing program 3 (id=90): bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x6, 0x0, &(0x7f0000000300), &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 318.499606ms ago: executing program 1 (id=91): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000ac0)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, 0x0, {0x0, 0x3}, {}, {0xfff3, 0xffe0}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x50}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r5, {0xc, 0xc}, {0x0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) 254.378828ms ago: executing program 3 (id=92): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TIOCPKT(r0, 0x5420, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x6000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getcwd(0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f00000001c0)=[{0x0}], 0x1, 0x33, 0x0) r5 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r6 = dup2(r5, r5) ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000140)={'\x00', 0x3e, 0x2006, 0x8, 0x0, 0x5}) ioctl$BLKTRACESTART(r5, 0x1274, 0x0) ioctl$BLKTRACETEARDOWN(r5, 0x1276, 0x0) r7 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) llistxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000002c0)=""/173, 0xad) r8 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') lseek(r8, 0xffffff7f00000000, 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, 0x0) 128.410844ms ago: executing program 4 (id=93): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4102}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xb}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x5, 0x4, 0x400, 0x6}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40088c1}, 0x800) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, 0x0, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200affd14120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1, 0x0, 0x0, 0x1000000}, 0x0) 0s ago: executing program 1 (id=94): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000300)=ANY=[@ANYBLOB="b700000001000000bfa30000000000000703000003feffff620af0fff8ffffff71a4f0ff00000000ae04020000000000be400300000000006504030001ed00007b130000000000004d44000000000000620a00fe000000007133000000000000b5030000000000009500000000000000023bc065b7a379d17cf9333379fc05000000912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50bec919bc461e91a7168c5181554d1b583c587e436fe275daf51efd601b6bf01c8e8b1b526375ec5dd6fcd82e4fee5bef7af9a0200000000000000e3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f645679c294392cf538b07ce2646cb7798b3e6440c2fbdb00a3e35208b0bb1d2cd871c5548930be3835f2554b4a28610643a98d9ec21ead2ed51b104d4d91af25b84550a7925c3109b151b8b9f75d80000000eda88c658d42ecbf28bf7076c15b463bebc72f526d8e4a9e231d512381e7a78afcb913466aae7f6df70252e79166d858fc152b659da074e1320060d0b11008e59a5923906f88b53987ad1714e72ba7a5b74f0c33d39000d06a59ff61622cfd9aa58fe8d485ae2c0cc65c2a36aaec2477584b6a89adaf17b0a6041bde4cc3ed54d27f777e92b87496e6649cf728d236619074d6ebdf098bc908c423d228a40f9411fe7226a40409d6e37c4f46756d31cb46761bade70063e5291569b33d21dae356e1c51f03fb8a63e089679216da18de0ae564162a27afea62d84f3a10746443d64364f56e24e6d21053d901204a1deeed41556175cbd4041b7d301bcb72652d950ad31928b0b093778b68e2e9853c02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f98928d5e9b94ff9ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cff538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595bcf50ab32d710b651f898ba749e40bc6980fe78683ac5c0c31030699ddd71063b59261b2e1aab1675b34a220"], 0x0}, 0x94) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000040)={'veth0_to_team\x00', 0x818}) r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x3a, &(0x7f0000000080)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x3c, 0x2c, 0x0, 0x0, 0xd3, 0x6, 0x0, @private=0xa010102, @local}, {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0x0, {[@window={0x3, 0x3, 0x10}]}}}}}}}, 0x0) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuset.effective_cpus\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuset.effective_cpus\x00', 0x275a, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000001100)='fdinfo/4\x00') pread64(r3, &(0x7f0000000040)=""/17, 0x11, 0x1) r4 = getpid() recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2022, 0x0) socket(0x1d, 0x2, 0x6) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x3c, 0x0, 0x0) r5 = getpgid(r4) syz_open_procfs(r5, &(0x7f0000000000)='fd/4\x00') r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=@updpolicy={0xb8, 0x19, 0xfd3649826d894c67, 0x0, 0x0, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@private1, 0x0, 0x0, 0x4e22, 0x2, 0x2, 0xa0, 0x80}, {0x0, 0x80, 0x0, 0x0, 0xffffffffffffffff, 0x1}}}, 0xb8}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000000)=ANY=[], 0x47) syz_emit_vhci(&(0x7f0000000400)=@HCI_EVENT_PKT={0x4, @hci_ev_encrypt_change={{0x8, 0x4}, {0xfe, 0xc8, 0x9}}}, 0x7) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r7], 0x1c}}, 0x840) write$nci(r0, &(0x7f00000005c0)=ANY=[@ANYBLOB="61050103030082"], 0x10e6) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.43' (ED25519) to the list of known hosts. [ 75.244564][ T4173] cgroup: Unknown subsys name 'net' [ 75.374489][ T4173] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 77.001029][ T4173] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 78.497381][ T4187] chnl_net:caif_netlink_parms(): no params data found [ 78.653494][ T4190] chnl_net:caif_netlink_parms(): no params data found [ 78.664815][ T4187] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.673276][ T4187] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.682405][ T4187] device bridge_slave_0 entered promiscuous mode [ 78.708380][ T4187] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.715499][ T4187] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.725252][ T4187] device bridge_slave_1 entered promiscuous mode [ 78.744000][ T4186] chnl_net:caif_netlink_parms(): no params data found [ 78.796286][ T4185] chnl_net:caif_netlink_parms(): no params data found [ 78.806702][ T4191] chnl_net:caif_netlink_parms(): no params data found [ 78.823624][ T4187] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.858008][ T4187] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.902224][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 78.908871][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 78.967783][ T4187] team0: Port device team_slave_0 added [ 78.974194][ T4186] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.981958][ T4186] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.990548][ T4186] device bridge_slave_0 entered promiscuous mode [ 79.003351][ T4186] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.010730][ T4186] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.019347][ T4186] device bridge_slave_1 entered promiscuous mode [ 79.031919][ T4190] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.039221][ T4190] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.047465][ T4190] device bridge_slave_0 entered promiscuous mode [ 79.056576][ T4187] team0: Port device team_slave_1 added [ 79.087543][ T4190] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.096209][ T4190] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.104538][ T4190] device bridge_slave_1 entered promiscuous mode [ 79.125380][ T4185] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.132606][ T4185] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.141589][ T4185] device bridge_slave_0 entered promiscuous mode [ 79.156420][ T4185] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.163731][ T4185] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.172119][ T4185] device bridge_slave_1 entered promiscuous mode [ 79.206962][ T4186] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.233675][ T4190] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.243708][ T4187] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.251987][ T4187] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.278017][ T4187] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.292104][ T4186] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.301719][ T4191] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.309321][ T4191] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.318250][ T4191] device bridge_slave_0 entered promiscuous mode [ 79.327640][ T4185] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.338930][ T4190] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.363801][ T4187] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.370937][ T4187] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.397850][ T4187] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.409456][ T4191] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.416554][ T4191] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.425535][ T4191] device bridge_slave_1 entered promiscuous mode [ 79.434814][ T4185] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.491376][ T4190] team0: Port device team_slave_0 added [ 79.500180][ T4186] team0: Port device team_slave_0 added [ 79.508575][ T4186] team0: Port device team_slave_1 added [ 79.516228][ T4185] team0: Port device team_slave_0 added [ 79.530697][ T4190] team0: Port device team_slave_1 added [ 79.553115][ T4185] team0: Port device team_slave_1 added [ 79.561385][ T4191] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.579013][ T4191] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.635657][ T4187] device hsr_slave_0 entered promiscuous mode [ 79.643323][ T4187] device hsr_slave_1 entered promiscuous mode [ 79.652133][ T4186] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.659717][ T4186] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.685851][ T4186] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.697679][ T4190] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.704855][ T4190] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.731299][ T4190] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.743481][ T4185] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.750841][ T4185] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.776921][ T4185] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.796102][ T4185] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.804154][ T4185] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.830274][ T4185] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.843461][ T4186] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.850831][ T4186] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.877257][ T4186] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.889422][ T4190] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.896434][ T4190] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.922976][ T4190] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.938224][ T4191] team0: Port device team_slave_0 added [ 79.961326][ T4191] team0: Port device team_slave_1 added [ 80.044286][ T4191] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 80.052411][ T4191] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 80.078754][ T4191] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 80.097272][ T4191] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.106446][ T4191] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 80.133195][ T4191] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.147417][ T4190] device hsr_slave_0 entered promiscuous mode [ 80.154540][ T4190] device hsr_slave_1 entered promiscuous mode [ 80.162477][ T4190] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 80.170646][ T4190] Cannot create hsr debugfs directory [ 80.180224][ T4186] device hsr_slave_0 entered promiscuous mode [ 80.187023][ T4186] device hsr_slave_1 entered promiscuous mode [ 80.193873][ T4186] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 80.203048][ T4186] Cannot create hsr debugfs directory [ 80.217364][ T4185] device hsr_slave_0 entered promiscuous mode [ 80.226447][ T4185] device hsr_slave_1 entered promiscuous mode [ 80.234417][ T4185] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 80.242471][ T4185] Cannot create hsr debugfs directory [ 80.258726][ T23] Bluetooth: hci2: command 0x0409 tx timeout [ 80.268390][ T4196] Bluetooth: hci1: command 0x0409 tx timeout [ 80.274467][ T4196] Bluetooth: hci4: command 0x0409 tx timeout [ 80.274659][ T23] Bluetooth: hci3: command 0x0409 tx timeout [ 80.297903][ T23] Bluetooth: hci0: command 0x0409 tx timeout [ 80.399665][ T4191] device hsr_slave_0 entered promiscuous mode [ 80.407004][ T4191] device hsr_slave_1 entered promiscuous mode [ 80.414038][ T4191] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 80.422010][ T4191] Cannot create hsr debugfs directory [ 80.636880][ T4187] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 80.658063][ T4187] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 80.674192][ T4187] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 80.685323][ T4187] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 80.745966][ T4185] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 80.762599][ T4185] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 80.772284][ T4185] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 80.785658][ T4185] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 80.878340][ T4186] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 80.897564][ T4186] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 80.911764][ T4186] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 80.922744][ T4186] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 81.021147][ T4185] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.031157][ T4187] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.045794][ T4190] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 81.057535][ T4190] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 81.086150][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 81.095442][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 81.106633][ T4190] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 81.132454][ T4185] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.141079][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 81.150977][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 81.159690][ T4190] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 81.183151][ T4187] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.193600][ T4191] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 81.209261][ T4191] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 81.221334][ T4191] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 81.241847][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 81.251410][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 81.261340][ T4214] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.268684][ T4214] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.277573][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 81.286971][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 81.297177][ T4214] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.304323][ T4214] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.320315][ T4191] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 81.338552][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 81.346710][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 81.355607][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 81.367433][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 81.376701][ T4214] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.384142][ T4214] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.394216][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 81.403808][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 81.414520][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 81.423599][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 81.432887][ T144] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.440068][ T144] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.459407][ T4186] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.481287][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 81.517278][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 81.526521][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 81.537421][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 81.548412][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 81.556303][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 81.566556][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 81.577504][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 81.587364][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 81.604414][ T4186] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.612381][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 81.622113][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 81.644550][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 81.655613][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 81.679167][ T4185] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 81.692177][ T4185] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 81.701920][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 81.714782][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 81.724228][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 81.733831][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 81.743371][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 81.752921][ T144] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.760081][ T144] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.768116][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 81.796927][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 81.806455][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 81.824223][ T4214] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.831404][ T4214] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.886548][ T4190] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.900616][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 81.909876][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 81.919527][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 81.930893][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 81.940157][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 81.950014][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 81.959314][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 81.969226][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 81.978431][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 81.987719][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 81.997926][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 82.010180][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 82.020184][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 82.035582][ T4187] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 82.064195][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 82.078548][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 82.108569][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 82.123132][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 82.153743][ T4190] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.176347][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 82.186965][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 82.198413][ T4186] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 82.228304][ T4191] 8021q: adding VLAN 0 to HW filter on device bond0 [ 82.268561][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 82.278703][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 82.298640][ T1278] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.305925][ T1278] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.322264][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 82.331535][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 82.339000][ T4235] Bluetooth: hci0: command 0x041b tx timeout [ 82.350862][ T1278] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.358499][ T4235] Bluetooth: hci3: command 0x041b tx timeout [ 82.358658][ T1278] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.364900][ T4235] Bluetooth: hci4: command 0x041b tx timeout [ 82.384293][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 82.389462][ T4235] Bluetooth: hci1: command 0x041b tx timeout [ 82.405853][ T4191] 8021q: adding VLAN 0 to HW filter on device team0 [ 82.418340][ T4235] Bluetooth: hci2: command 0x041b tx timeout [ 82.435919][ T4185] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.451365][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 82.464763][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 82.476461][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 82.491306][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 82.506704][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 82.515070][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 82.530000][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 82.545030][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 82.555381][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 82.610115][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 82.619920][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 82.629533][ T154] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.636766][ T154] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.645065][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 82.653241][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 82.663113][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 82.672688][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 82.681545][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 82.690588][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 82.699413][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 82.708579][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 82.717829][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 82.735162][ T4187] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.744734][ T4190] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 82.760372][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 82.772414][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 82.781418][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 82.790721][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 82.800120][ T154] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.807307][ T154] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.845644][ T4186] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.858540][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 82.874738][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 82.886622][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 82.902397][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 82.914333][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 82.927538][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 82.971089][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 82.979890][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 83.000896][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 83.010642][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 83.019724][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 83.029008][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 83.038425][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 83.055775][ T4185] device veth0_vlan entered promiscuous mode [ 83.069680][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 83.083229][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 83.098016][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 83.106727][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 83.121405][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 83.133296][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 83.147374][ T4191] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 83.190503][ T4187] device veth0_vlan entered promiscuous mode [ 83.204709][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 83.214128][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 83.230393][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 83.243118][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 83.252228][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 83.264742][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 83.274450][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 83.284646][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 83.322800][ T4187] device veth1_vlan entered promiscuous mode [ 83.336421][ T4185] device veth1_vlan entered promiscuous mode [ 83.349760][ T4190] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.362761][ T4186] device veth0_vlan entered promiscuous mode [ 83.380194][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 83.395379][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 83.404139][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 83.418796][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 83.427370][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 83.443718][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 83.452592][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 83.461150][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 83.477383][ T4186] device veth1_vlan entered promiscuous mode [ 83.507058][ T4191] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 83.515748][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 83.532680][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 83.543439][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 83.592039][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 83.601026][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 83.613969][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 83.631835][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 83.640993][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 83.650609][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 83.660060][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 83.674084][ T4185] device veth0_macvtap entered promiscuous mode [ 83.683865][ T4187] device veth0_macvtap entered promiscuous mode [ 83.703921][ T4187] device veth1_macvtap entered promiscuous mode [ 83.721609][ T4185] device veth1_macvtap entered promiscuous mode [ 83.737534][ T4186] device veth0_macvtap entered promiscuous mode [ 83.763397][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 83.774387][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 83.799143][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 83.813299][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 83.822328][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 83.842041][ T4186] device veth1_macvtap entered promiscuous mode [ 83.851594][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 83.863668][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 83.872838][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 83.883496][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 83.895510][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 83.922254][ T4190] device veth0_vlan entered promiscuous mode [ 83.943651][ T4187] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.965553][ T4190] device veth1_vlan entered promiscuous mode [ 83.980219][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 83.994334][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 84.008050][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 84.020321][ T4185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.032622][ T4185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.045206][ T4185] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.056732][ T4185] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.079836][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 84.088916][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 84.099681][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 84.111393][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 84.120765][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 84.130187][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 84.139479][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 84.149356][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.159992][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.170652][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.183646][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.196074][ T4186] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.205771][ T4187] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 84.225836][ T4187] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.237249][ T4187] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.250944][ T4185] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.260277][ T4185] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.270620][ T4185] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.280259][ T4185] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.296890][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 84.306450][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 84.316788][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 84.326448][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 84.340794][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 84.352392][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.362581][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 84.373312][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.384718][ T4186] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.395077][ T4187] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.404749][ T4187] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.413838][ T4187] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.423098][ T4236] Bluetooth: hci1: command 0x040f tx timeout [ 84.426855][ T4187] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.429246][ T4236] Bluetooth: hci4: command 0x040f tx timeout [ 84.429325][ T4236] Bluetooth: hci3: command 0x040f tx timeout [ 84.429638][ T4236] Bluetooth: hci0: command 0x040f tx timeout [ 84.472109][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 84.481325][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 84.495059][ T4186] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.500486][ T4236] Bluetooth: hci2: command 0x040f tx timeout [ 84.510553][ T4186] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.519856][ T4186] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.528987][ T4186] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.577078][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 84.586142][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 84.595639][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 84.604736][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 84.613825][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 84.622169][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 84.631243][ T4191] device veth0_vlan entered promiscuous mode [ 84.665215][ T4190] device veth0_macvtap entered promiscuous mode [ 84.704202][ T4190] device veth1_macvtap entered promiscuous mode [ 84.727119][ T4191] device veth1_vlan entered promiscuous mode [ 84.767093][ T4190] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.780439][ T4190] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.793817][ T4190] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.804864][ T4190] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.815341][ T4190] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 84.831661][ T4190] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.843359][ T4190] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.873907][ T4190] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 84.887361][ T4190] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.898796][ T4190] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 84.912137][ T4190] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.922279][ T4190] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 84.932995][ T4190] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 84.944706][ T4190] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.953248][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 84.963008][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 84.972507][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 84.983536][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 85.003078][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 85.015067][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 85.037674][ T4190] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.047125][ T4190] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.064008][ T4190] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.073088][ T4190] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.088561][ T4191] device veth0_macvtap entered promiscuous mode [ 85.126001][ T4191] device veth1_macvtap entered promiscuous mode [ 85.130801][ T1278] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.141714][ T1278] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.168957][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 85.177211][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 85.186200][ T4214] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 85.203192][ T4191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.215531][ T4191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.226795][ T4191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.238006][ T4191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.248868][ T4191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.260555][ T4191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.270720][ T4191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.281633][ T4191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.293278][ T4191] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.320608][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.330241][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.343665][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 85.353970][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 85.364001][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 85.389585][ T4191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.402055][ T4191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.412599][ T4191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.424164][ T4191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.434864][ T4191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.445970][ T4191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.456624][ T4191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.468393][ T4191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.480882][ T4191] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.514512][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 85.524578][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 85.553222][ T4191] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.560256][ T154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.572074][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.574043][ T4191] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.590546][ T4191] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.600497][ T4191] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.612903][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.622601][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.634904][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 85.645728][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 85.697274][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.721449][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.758343][ T1278] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.766396][ T1278] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.774554][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 85.829719][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 85.856732][ T1278] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.882412][ T1278] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.911317][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 85.947384][ T4214] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.966420][ T4214] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.997172][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 86.169964][ T155] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.188121][ T155] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.206905][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 86.214820][ T155] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.238875][ T4276] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 86.280421][ T155] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.310508][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 86.498997][ T4230] Bluetooth: hci0: command 0x0419 tx timeout [ 86.510754][ T4230] Bluetooth: hci3: command 0x0419 tx timeout [ 86.540970][ T4230] Bluetooth: hci4: command 0x0419 tx timeout [ 86.565286][ T4230] Bluetooth: hci1: command 0x0419 tx timeout [ 86.596454][ T4230] Bluetooth: hci2: command 0x0419 tx timeout [ 87.293359][ T4311] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 87.959479][ T4322] device syzkaller0 entered promiscuous mode [ 88.349671][ T4327] loop2: detected capacity change from 0 to 512 [ 88.444716][ T4327] EXT4-fs (loop2): Unrecognized mount option "smackfsdef=+" or missing value [ 89.399361][ T4343] device syzkaller0 entered promiscuous mode [ 89.603736][ T4365] netlink: 'syz.2.25': attribute type 12 has an invalid length. [ 89.643555][ T4365] netlink: 8 bytes leftover after parsing attributes in process `syz.2.25'. [ 89.921017][ T4374] loop3: detected capacity change from 0 to 512 [ 89.985621][ T4374] EXT4-fs (loop3): Unrecognized mount option "smackfsdef=+" or missing value [ 91.450744][ T4401] device syzkaller0 entered promiscuous mode [ 91.816700][ T4418] device syzkaller0 entered promiscuous mode [ 92.123718][ T4422] netlink: 8 bytes leftover after parsing attributes in process `syz.2.45'. [ 92.144099][ T4421] netlink: 8 bytes leftover after parsing attributes in process `syz.0.44'. [ 92.171017][ T4422] netlink: 12 bytes leftover after parsing attributes in process `syz.2.45'. [ 92.203127][ T4421] netlink: 12 bytes leftover after parsing attributes in process `syz.0.44'. [ 92.400193][ T4424] netlink: 16 bytes leftover after parsing attributes in process `syz.2.46'. [ 92.430218][ T4427] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 92.461699][ T4427] device syzkaller0 entered promiscuous mode [ 92.875947][ T4439] device syzkaller0 entered promiscuous mode [ 93.176213][ T4443] netlink: 4 bytes leftover after parsing attributes in process `syz.2.52'. [ 93.891464][ T2288] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 93.959915][ T4452] netlink: 8 bytes leftover after parsing attributes in process `syz.0.56'. [ 94.019285][ T4452] netlink: 12 bytes leftover after parsing attributes in process `syz.0.56'. [ 94.177968][ T2288] usb 1-1: Dual-Role OTG device on HNP port [ 94.198231][ T2288] usb 1-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 5.15 [ 94.237794][ T2288] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 94.262832][ T1111] cfg80211: failed to load regulatory.db [ 94.371831][ T2288] gspca_main: spca501-2.14.0 probing 0000:0000 [ 94.419940][ T2288] gspca_spca501: reg write: error -32 [ 94.435736][ T2288] spca501 1-1:1.0: Reg write failed for 0x02,0x0f,0x05 [ 94.466236][ T2288] spca501: probe of 1-1:1.0 failed with error -22 [ 94.532489][ T2288] hid-generic 0003:0000:0000.0001: item fetching failed at offset 58/59 [ 94.560835][ T2288] hid-generic: probe of 0003:0000:0000.0001 failed with error -22 [ 94.891059][ T4461] syz.4.59 uses obsolete (PF_INET,SOCK_PACKET) [ 95.504339][ T4475] device syzkaller0 entered promiscuous mode [ 95.990623][ T4483] device syzkaller0 entered promiscuous mode [ 97.298464][ T4522] netlink: 8 bytes leftover after parsing attributes in process `syz.1.74'. [ 97.323248][ T4522] netlink: 8 bytes leftover after parsing attributes in process `syz.1.74'. [ 97.360661][ T4522] netlink: 8 bytes leftover after parsing attributes in process `syz.1.74'. [ 97.399371][ T4522] netlink: 8 bytes leftover after parsing attributes in process `syz.1.74'. [ 97.468381][ T4522] netlink: 8 bytes leftover after parsing attributes in process `syz.1.74'. [ 98.311013][ T4545] loop4: detected capacity change from 0 to 512 [ 98.333772][ T4545] EXT4-fs (loop4): Unrecognized mount option "smackfsdef=+" or missing value [ 99.366241][ T4562] device syzkaller0 entered promiscuous mode [ 100.543928][ T4592] TCP: tcp_parse_options: Illegal window scaling value 16 > 14 received [ 100.714715][ T4592] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 100.784950][ T4199] [ 100.787341][ T4199] ====================================================== [ 100.794418][ T4199] WARNING: possible circular locking dependency detected [ 100.801478][ T4199] syzkaller #0 Not tainted [ 100.805935][ T4199] ------------------------------------------------------ [ 100.812969][ T4199] kworker/u5:4/4199 is trying to acquire lock: [ 100.819141][ T4199] ffffffff8d5b37c8 (rfcomm_mutex){+.+.}-{3:3}, at: rfcomm_security_cfm+0x95/0x780 [ 100.828520][ T4199] [ 100.828520][ T4199] but task is already holding lock: [ 100.835907][ T4199] ffffffff8d593e48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_encrypt_cfm+0x2fe/0x4d0 [ 100.845268][ T4199] [ 100.845268][ T4199] which lock already depends on the new lock. [ 100.845268][ T4199] [ 100.855692][ T4199] [ 100.855692][ T4199] the existing dependency chain (in reverse order) is: [ 100.864728][ T4199] [ 100.864728][ T4199] -> #2 (hci_cb_list_lock){+.+.}-{3:3}: [ 100.872505][ T4199] __mutex_lock_common+0x1e5/0x2400 [ 100.878260][ T4199] mutex_lock_nested+0x17/0x20 [ 100.883577][ T4199] hci_remote_features_evt+0x5d9/0xa10 [ 100.889649][ T4199] hci_event_packet+0x600/0x1310 [ 100.895152][ T4199] hci_rx_work+0x255/0xa10 [ 100.900122][ T4199] process_one_work+0x867/0xff0 [ 100.905532][ T4199] worker_thread+0xad7/0x12a0 [ 100.910867][ T4199] kthread+0x42e/0x520 [ 100.915496][ T4199] ret_from_fork+0x1f/0x30 [ 100.920475][ T4199] [ 100.920475][ T4199] -> #1 (&hdev->lock){+.+.}-{3:3}: [ 100.927803][ T4199] __mutex_lock_common+0x1e5/0x2400 [ 100.933586][ T4199] mutex_lock_nested+0x17/0x20 [ 100.938903][ T4199] l2cap_chan_connect+0xfb/0xe20 [ 100.944402][ T4199] l2cap_sock_connect+0x5a3/0x770 [ 100.949975][ T4199] kernel_connect+0x11c/0x180 [ 100.955214][ T4199] rfcomm_dlc_open+0x600/0x10c0 [ 100.960617][ T4199] rfcomm_sock_connect+0x2e9/0x600 [ 100.966281][ T4199] __sys_connect+0x3cb/0x450 [ 100.971426][ T4199] __x64_sys_connect+0x76/0x80 [ 100.976744][ T4199] do_syscall_64+0x4c/0xa0 [ 100.981717][ T4199] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 100.988176][ T4199] [ 100.988176][ T4199] -> #0 (rfcomm_mutex){+.+.}-{3:3}: [ 100.995613][ T4199] __lock_acquire+0x2c66/0x7b50 [ 101.001029][ T4199] lock_acquire+0x19e/0x400 [ 101.006087][ T4199] __mutex_lock_common+0x1e5/0x2400 [ 101.011832][ T4199] mutex_lock_nested+0x17/0x20 [ 101.017145][ T4199] rfcomm_security_cfm+0x95/0x780 [ 101.022726][ T4199] hci_encrypt_cfm+0x363/0x4d0 [ 101.028040][ T4199] hci_encrypt_change_evt+0x62d/0xdd0 [ 101.033960][ T4199] hci_event_packet+0x67e/0x1310 [ 101.039447][ T4199] hci_rx_work+0x255/0xa10 [ 101.044414][ T4199] process_one_work+0x867/0xff0 [ 101.049812][ T4199] worker_thread+0xad7/0x12a0 [ 101.055036][ T4199] kthread+0x42e/0x520 [ 101.059652][ T4199] ret_from_fork+0x1f/0x30 [ 101.064621][ T4199] [ 101.064621][ T4199] other info that might help us debug this: [ 101.064621][ T4199] [ 101.074902][ T4199] Chain exists of: [ 101.074902][ T4199] rfcomm_mutex --> &hdev->lock --> hci_cb_list_lock [ 101.074902][ T4199] [ 101.087458][ T4199] Possible unsafe locking scenario: [ 101.087458][ T4199] [ 101.094936][ T4199] CPU0 CPU1 [ 101.100322][ T4199] ---- ---- [ 101.105710][ T4199] lock(hci_cb_list_lock); [ 101.110240][ T4199] lock(&hdev->lock); [ 101.116861][ T4199] lock(hci_cb_list_lock); [ 101.123918][ T4199] lock(rfcomm_mutex); [ 101.128109][ T4199] [ 101.128109][ T4199] *** DEADLOCK *** [ 101.128109][ T4199] [ 101.136359][ T4199] 4 locks held by kworker/u5:4/4199: [ 101.141663][ T4199] #0: ffff88801b3ba138 ((wq_completion)hci1#2){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 [ 101.151991][ T4199] #1: ffffc90002f3fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 [ 101.163345][ T4199] #2: ffff8880768f8478 (&hdev->lock){+.+.}-{3:3}, at: hci_encrypt_change_evt+0xd9/0xdd0 [ 101.173220][ T4199] #3: ffffffff8d593e48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_encrypt_cfm+0x2fe/0x4d0 [ 101.183011][ T4199] [ 101.183011][ T4199] stack backtrace: [ 101.188942][ T4199] CPU: 1 PID: 4199 Comm: kworker/u5:4 Not tainted syzkaller #0 [ 101.196512][ T4199] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 101.206679][ T4199] Workqueue: hci1 hci_rx_work [ 101.211417][ T4199] Call Trace: [ 101.214727][ T4199] [ 101.217691][ T4199] dump_stack_lvl+0x188/0x250 [ 101.222409][ T4199] ? load_image+0x410/0x410 [ 101.226938][ T4199] ? show_regs_print_info+0x20/0x20 [ 101.232163][ T4199] ? print_circular_bug+0x12b/0x1a0 [ 101.237388][ T4199] check_noncircular+0x296/0x330 [ 101.242355][ T4199] ? add_chain_block+0x9b0/0x9b0 [ 101.247322][ T4199] ? lockdep_lock+0xf1/0x1f0 [ 101.251947][ T4199] ? mark_lock+0x94/0x320 [ 101.256305][ T4199] ? _find_first_zero_bit+0xd1/0xf0 [ 101.261556][ T4199] __lock_acquire+0x2c66/0x7b50 [ 101.266446][ T4199] ? __lock_acquire+0x13dc/0x7b50 [ 101.271500][ T4199] ? verify_lock_unused+0x140/0x140 [ 101.277195][ T4199] lock_acquire+0x19e/0x400 [ 101.281740][ T4199] ? rfcomm_security_cfm+0x95/0x780 [ 101.286974][ T4199] ? __might_sleep+0xf0/0xf0 [ 101.291598][ T4199] ? read_lock_is_recursive+0x10/0x10 [ 101.297013][ T4199] __mutex_lock_common+0x1e5/0x2400 [ 101.302271][ T4199] ? rfcomm_security_cfm+0x95/0x780 [ 101.307505][ T4199] ? rcu_lock_release+0x20/0x20 [ 101.312384][ T4199] ? __mutex_trylock_common+0x15c/0x260 [ 101.317980][ T4199] ? rfcomm_security_cfm+0x95/0x780 [ 101.323209][ T4199] ? mutex_lock_io_nested+0x60/0x60 [ 101.328439][ T4199] ? l2cap_security_cfm+0x12b4/0x1340 [ 101.333842][ T4199] ? __mutex_lock_common+0x435/0x2400 [ 101.339413][ T4199] ? l2cap_disconn_cfm+0xc0/0xc0 [ 101.344384][ T4199] mutex_lock_nested+0x17/0x20 [ 101.349300][ T4199] rfcomm_security_cfm+0x95/0x780 [ 101.354354][ T4199] ? __lock_acquire+0x7b50/0x7b50 [ 101.359409][ T4199] ? rfcomm_send_msc+0x340/0x340 [ 101.364372][ T4199] ? hci_event_packet+0x363/0x1310 [ 101.369507][ T4199] ? rfcomm_send_msc+0x340/0x340 [ 101.374473][ T4199] hci_encrypt_cfm+0x363/0x4d0 [ 101.379349][ T4199] hci_encrypt_change_evt+0x62d/0xdd0 [ 101.384748][ T4199] ? hci_remote_name_evt+0x5b0/0x5b0 [ 101.390063][ T4199] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 101.395920][ T4199] ? mark_lock+0x94/0x320 [ 101.400270][ T4199] ? mutex_unlock+0x10/0x10 [ 101.404807][ T4199] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 101.410813][ T4199] ? lock_chain_count+0x20/0x20 [ 101.415698][ T4199] ? __rwlock_init+0x140/0x140 [ 101.420485][ T4199] hci_event_packet+0x67e/0x1310 [ 101.425458][ T4199] ? _raw_spin_unlock+0x40/0x40 [ 101.430420][ T4199] ? rcu_lock_release+0x20/0x20 [ 101.435298][ T4199] ? hci_send_to_monitor+0x9c/0x4a0 [ 101.440531][ T4199] hci_rx_work+0x255/0xa10 [ 101.445013][ T4199] process_one_work+0x867/0xff0 [ 101.449901][ T4199] ? worker_detach_from_pool+0x240/0x240 [ 101.455660][ T4199] ? lockdep_hardirqs_off+0x70/0x100 [ 101.460984][ T4199] ? _raw_spin_lock_irq+0xb7/0xf0 [ 101.466064][ T4199] ? _raw_spin_lock_irqsave+0x100/0x100 [ 101.471639][ T4199] ? wq_worker_running+0x97/0x170 [ 101.476700][ T4199] worker_thread+0xad7/0x12a0 [ 101.481446][ T4199] kthread+0x42e/0x520 [ 101.485542][ T4199] ? rcu_lock_release+0x20/0x20 [ 101.490419][ T4199] ? kthread_blkcg+0xd0/0xd0 [ 101.495042][ T4199] ret_from_fork+0x1f/0x30 [ 101.499504][ T4199] [ 103.618137][ T4267] Bluetooth: hci1: command 0x0406 tx timeout