last executing test programs: 1m56.611933043s ago: executing program 1 (id=26): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$netlink(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000002c0)={0x14, 0x27, 0x1, 0x0, 0x0, "", [@nested={0x4}]}, 0x14}], 0x1}, 0x0) 1m56.494524196s ago: executing program 1 (id=28): r0 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000240)={'macsec0\x00', &(0x7f0000019500)=@ethtool_ringparam={0x11, 0x8, 0x4, 0x95, 0x8, 0x3, 0x40, 0x9, 0x10409e0c}}) 1m56.399956189s ago: executing program 1 (id=29): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000bc0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000c00)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000cc0)={0x2c, r1, 0x1, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6, 0x6d, 0x8}, @NL80211_ATTR_BSS_SHORT_SLOT_TIME={0x5, 0x1e, 0xf9}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000001}, 0xc818) 1m56.35664747s ago: executing program 1 (id=31): socket$packet(0x11, 0x3, 0x300) r0 = syz_genetlink_get_family_id$smc(&(0x7f0000000380), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) fsopen(0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x401, 0x0) r2 = openat$kvm(0xffffff9c, &(0x7f0000000000), 0x41, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_CREATE_PIT2(r3, 0x4040ae77, &(0x7f00000004c0)) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_PIT(r3, 0x8048ae66, &(0x7f0000000500)={[{0x5, 0x0, 0x1, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7}, {0x0, 0x4, 0x9, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}]}) r5 = socket(0x10, 0x80002, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8b24, &(0x7f0000000580)={'wlan0\x00'}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000005c0)={[0xf, 0x3, 0xffffffffffffffff, 0x1000000000000002, 0x102000000000002, 0x8000000d, 0x2004c8, 0xffff, 0x3, 0x2000000fffffffd, 0x10000, 0x7fffffffffffffff, 0xd0b, 0xfffffffffffffff9, 0x2000000000000002, 0x15], 0x80a0000, 0x80284}) ioctl$KVM_RUN(r4, 0xae80, 0x0) syz_emit_vhci(&(0x7f0000000680)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_status={{0xf, 0x4}, {0x5, 0x0, 0x2019}}}, 0x7) ioctl$KVM_RUN(r4, 0xae80, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$SMC_PNETID_ADD(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010027bd7000fbd3df2502000000050004000100000005000400410000001400020076657468315f746f5f7465616d0000000900030073797a32000000000900010073"], 0x68}, 0x1, 0x0, 0x0, 0x4000145}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), 0xffffffffffffffff) 1m55.307537295s ago: executing program 1 (id=39): openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$vimc2(0xffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$VIDIOC_G_CTRL(r0, 0xc008561b, &(0x7f0000000200)={0x9, 0x9}) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./proc\x00', &(0x7f00000002c0)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/sys/kernel/printk_devkmsg\x00', 0x2, 0x0) write(r1, &(0x7f0000000340)='on', 0x2) r2 = getpgrp(0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x7, 0x7ffc0001}]}) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) read$FUSE(r3, &(0x7f0000002180)={0x2020}, 0x2020) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x57, 0x0, 0x8, {0x0, 0x1}, {0x74, 0x2}, @rumble={0x1, 0x8}}) r4 = syz_open_dev$evdev(&(0x7f0000000100), 0x0, 0x822b01) ioctl$EVIOCSMASK(r4, 0x40104593, &(0x7f0000000140)={0x0, 0x0, 0x0}) write$char_usb(r4, &(0x7f0000000180)="e2", 0xff0f) lseek(r3, 0xfffffffffffffff5, 0x2) openat(r3, &(0x7f0000002140)='./file0\x00', 0x44800, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chown(0x0, 0x0, 0xee00) r5 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) kcmp(r2, r5, 0x2, 0xffffffffffffffff, 0xffffffffffffffff) 1m54.733112849s ago: executing program 1 (id=41): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$sock_inet6_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) syz_open_dev$sg(&(0x7f00000002c0), 0xf9ba, 0x14b082) syz_open_dev$sg(&(0x7f0000000500), 0x0, 0x2) 1m39.680400198s ago: executing program 32 (id=41): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$sock_inet6_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) syz_open_dev$sg(&(0x7f00000002c0), 0xf9ba, 0x14b082) syz_open_dev$sg(&(0x7f0000000500), 0x0, 0x2) 1m32.171060372s ago: executing program 4 (id=121): syz_usb_connect$uac3(0x5, 0x80, &(0x7f0000000200)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0xd8c, 0x103, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x20, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0x9}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x23, 0x5, {0xa, 0x25, 0x25, 0x401, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x74, 0x9, 0xc0, {0xa, 0x25, 0x25, 0x7fffffff, 0x1, 0xbe1}}}}}}}}]}}, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="020000000400000006000000aa0b"], 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0), &(0x7f0000000400), 0xa7c, r0}, 0x38) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'veth1_to_bond\x00'}) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24041091}, 0x844) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000480)=@filename='mtd0\x00', &(0x7f00000004c0)='./mnt\x00', &(0x7f0000000500)='jffs2\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./mnt/fillfile\x00', 0x42, 0x9f) write(r2, &(0x7f0000000580)="000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f", 0x8000) 1m30.324222967s ago: executing program 4 (id=130): io_getevents(0x0, 0x2e5, 0x4, &(0x7f0000000240)=[{}, {}, {}, {}], &(0x7f0000000180)={0x0, 0x3938700}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x4) write(r3, &(0x7f0000005c00)="2700000014000707030e0000120f0a0011000100f5fe0012ff000000078a151f750800", 0x23) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r4, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r4, 0x402) syz_emit_ethernet(0x56, &(0x7f00000003c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa0b475173ddd486dd6000000000200601fe8000000000000000000000000000aafe8000000000000000000000000000aa00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="80c2991cf6fd2b053e279e9dcc7f06e734ee72120000907800001e0c6c000900000000f20000"], 0x0) r5 = socket$netlink(0x10, 0x3, 0x4) writev(r5, &(0x7f0000000200)=[{&(0x7f00000000c0)="480000001400190d09004beafc0d8c560a84696080060000000000000000bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed51000000000000000000", 0x48}], 0x1) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, 0x0, &(0x7f0000000100)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={0x0}, 0x1, 0x0, 0x0, 0x20048084}, 0x44050) socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x9, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x16, 0x11, &(0x7f0000000640)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r6}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffffb}}, @map_fd={0x18, 0x1, 0x1, 0x0, r7}, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff8}, @generic={0x85, 0x0, 0x0, 0x0, 0x1}]}, &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000740)={r8, 0x0, 0xe, 0x0, &(0x7f00000007c0)='\x00'/14, 0x0, 0x80000004, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1m29.050840099s ago: executing program 4 (id=134): socket$inet6(0xa, 0x3, 0x6) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@local, @link_local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "804479", 0x14, 0x6, 0x0, @private2, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) 1m28.963996111s ago: executing program 4 (id=135): r0 = openat$sw_sync(0xffffff9c, &(0x7f0000000380), 0x8000, 0x0) vmsplice(r0, &(0x7f0000001680)=[{&(0x7f0000001400)="e8839aef83", 0x5}], 0x1, 0x2) 1m28.963886931s ago: executing program 4 (id=136): mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f00000002c0)='./tracing\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x0) r1 = getpid() r2 = syz_pidfd_open(r1, 0x0) setns(r2, 0x24020000) syz_clone(0xb21e0000, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000380)={0x1, &(0x7f00000003c0)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) sendfile(r3, r0, 0x0, 0x7ffff000) 1m28.032089574s ago: executing program 4 (id=141): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x44040}, 0x4000000) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, 0x0, 0x0) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000140)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)={0xffffffffffffffff}) mkdirat(0xffffffffffffff9c, &(0x7f0000000940)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000980)='./sec\x00', &(0x7f00000009c0)='securityfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sec/tomoyo/domain_policy\x00', 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0xe, 0x4, 0x0, &(0x7f0000000700)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000840), 0x8, 0x10, &(0x7f0000000880), 0x10}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x10) close_range(r2, 0xffffffffffffffff, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000a80)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r4, 0x26, &(0x7f0000000ac0)={0x0, 0x1, 0x2, 0x80004}) fcntl$lock(r4, 0x5, &(0x7f0000000b00)={0x1, 0x0, 0x20000000000103ff, 0x800000000}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'gre0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000280)=0xe9, 0x4) getsockopt$inet_sctp6_SCTP_ASCONF_SUPPORTED(r1, 0x84, 0x80, &(0x7f0000000340)={0x0, 0x18}, &(0x7f0000000380)=0x8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_buf(r6, 0x29, 0x20, &(0x7f0000000c40)="ff020400f400ffbffff7ff00", 0xc) 1m12.436774876s ago: executing program 33 (id=141): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x44040}, 0x4000000) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, 0x0, 0x0) r1 = openat$ipvs(0xffffff9c, &(0x7f0000000140)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)={0xffffffffffffffff}) mkdirat(0xffffffffffffff9c, &(0x7f0000000940)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000980)='./sec\x00', &(0x7f00000009c0)='securityfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sec/tomoyo/domain_policy\x00', 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0xe, 0x4, 0x0, &(0x7f0000000700)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000840), 0x8, 0x10, &(0x7f0000000880), 0x10}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x10) close_range(r2, 0xffffffffffffffff, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000a80)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r4, 0x26, &(0x7f0000000ac0)={0x0, 0x1, 0x2, 0x80004}) fcntl$lock(r4, 0x5, &(0x7f0000000b00)={0x1, 0x0, 0x20000000000103ff, 0x800000000}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'gre0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f0000000240)={0x11, 0x0, r5}, 0x14) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000280)=0xe9, 0x4) getsockopt$inet_sctp6_SCTP_ASCONF_SUPPORTED(r1, 0x84, 0x80, &(0x7f0000000340)={0x0, 0x18}, &(0x7f0000000380)=0x8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_buf(r6, 0x29, 0x20, &(0x7f0000000c40)="ff020400f400ffbffff7ff00", 0xc) 16.920504325s ago: executing program 5 (id=437): syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x109000, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x18, 0xe, &(0x7f00000001c0)=ANY=[@ANYBLOB="18080000d0ff0000000000003e00000018000000", @ANYRES32, @ANYBLOB="00000000000000006608000000000000180100002028782500000000002020207b1bf0ff00000000bfa100000000000007010000f8fffeffb702000008000000b50afbff00000000850000000600000095"], &(0x7f0000000240)='GPL\x00', 0xb, 0x0, 0x0, 0x0, 0xc}, 0x94) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0xf) ioctl$TCFLSH(r0, 0x400455c8, 0x4) ioctl$TIOCSTI(r0, 0x5412, &(0x7f00000000c0)=0x32) 9.509897147s ago: executing program 0 (id=477): r0 = syz_open_procfs(0x0, &(0x7f0000000000)='smaps_rollup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mremap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f00000fc000/0x2000)=nil) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) rmdir(&(0x7f0000000040)='./file0/file3\x00') madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) pread64(r0, &(0x7f00000003c0)=""/154, 0x9a, 0x4) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e22, @multicast2}, @in6={0xa, 0x4e25, 0xfffffffe, @mcast1, 0x4}, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x2c}}], 0x3c) sendto$inet6(r2, &(0x7f0000000180)='\x00', 0x1, 0x0, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f0000000240)={0x7, 0x84, 0x2, 0x5, 0x1, 0xf2, 0x0, 0x0, 0xfa, 0x2, 0x3, 0x6, 0x2, 0x2}, 0xe) recvmmsg(r2, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000500)=""/229, 0xe5}], 0x1}, 0xfffffffe}], 0x1, 0x40000100, 0x0) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) userfaultfd(0x180001) r3 = socket$netlink(0x10, 0x3, 0x0) writev(r3, &(0x7f0000000480)=[{&(0x7f0000000600)="290000002000190f00003fffffffda060200000000e80001dd0000040d000600ea11004a35f4667d41", 0x29}], 0x1) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000009c0)={r0, 0xe0, &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6, &(0x7f0000000140)=[0x0], &(0x7f0000000740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x85, &(0x7f0000000780)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f00000007c0), &(0x7f0000000800), 0xfffffffffffffe8d, 0x8c, 0x8, 0x5, &(0x7f0000000880)}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000019080)={0x1a, 0x13, &(0x7f00000000c0)=ANY=[], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x5, '\x00', 0x0, @tracing=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) 7.100743536s ago: executing program 0 (id=494): openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket(0x10, 0x3, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FILTER(r1, 0x65, 0x1, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000140)={'vcan0\x00', 0x0}) bind$can_raw(r1, &(0x7f0000000180)={0x1d, r2}, 0x10) write(r0, &(0x7f00000001c0)="2400000011005f0414f9f4070009041f810000000e000000000000ea08000f0001000000", 0x24) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000200)={0x20, 0xff, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x2, 0x0, 0x93}, 0xe) socket(0x18, 0x5, 0x1046) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000240)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r4, &(0x7f0000000280)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) r5 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f00000002c0)=0x1, 0x4) sendmmsg$inet(r4, &(0x7f0000000340)=[{{&(0x7f0000000380)={0x2, 0x4e21, @multicast2}, 0x10, &(0x7f00000003c0)=[{&(0x7f0000000400)="7d9076e251745b28392e79af6da876e09af522f75b705097b9d19a86ed9dea7f6a8d37521489ffa14a7424e15147fc895281d638c8c7fe5a090d36c24750ee997c8c1d28827f20b08f5feb98af1f4217b0097b8a25dd08522383ca88fd45437a73dc58c95b", 0x65}], 0x1, &(0x7f0000000480)=ANY=[@ANYBLOB="0d000000000000000100000005000000bc0000000000000007000000444420a36401010100000069ac1414bb00000006ac14140b000000097f00000100010001ac14142200000008ac14142700000006ffffffff00000009000000000000000f071396ac1e00010a010100ac1414bbac1414aa071f3fe0000002ffffffffe0000002ac1414bbffffffff7f000001ac1e0101863afffffffc000e352990b021f26968033e450e010a04d6e05668e0473a000571e9a90007cafe91db730105661bf6000b79ea3c9d762b635bad440000000000000007000000862d00000000001183929bcf39565a581ff361f87ceb3a050ea02284293e76fb42ac1f6e1d0608a5f4f4f694e7070bafac1e00010000000074000000000000000700000094040100830bb4ffffffffac1e010194040100440ce8e36401010000000a1e890b86ac1e0001e0000002070b827f00000164010101890b3cffffffffac14141294040100442447830000000000000000e0000002000007ffffffffff00000000ffffffff0000000d180000000000000008000000", @ANYRES32=0x0, @ANYBLOB="4001000000000000"], 0x19c}}, {{&(0x7f0000000640)={0x2, 0x4e21, @multicast2}, 0x10, &(0x7f0000000680)=[{&(0x7f00000006c0)="d926f9efb9f83557b4a78c37cf56b61afe0ea1d3fda4a0564cde8cd67ecb9fde364742c6f3584d2a926d389f64822e6c8df5ad96da66729b560ece2d50c090d463603a9ff4294e064b85e200f53428ec77373efd838880196d609bf0827ad5d07c476ebf6d99466f325212fe925c7bef2f167916ac5620e4b04754f81e67bdf40f4faf1139f013b9ac5402989f16b4348173452ba656ba11f0e8cd80cce753643099455d5d453fc521a1616c10b21ddd6e2ed4c53c3832cffb6f771b8942f567bc6f8240", 0xc4}, {&(0x7f00000007c0)="7041b9de595446f4f34c1e8c9c5ebf91d874944344243c5996339f39b86665c2e189f8fa7e8598f5c6a139c834fad84a5b50e10059d3826cca07472c828d5fd269fc8390e92b8605fe37163937423b1e07bf304a9d6efcee1334ba34bd272997b85c451414aaeed27b0d41995108ee8fd91656e317f3942fd13543f1965c9951eeeb44db73d2d175817098ac0d0f64530a9d0143b97e3b22422c0642abe429e5dde7ec2643f876af31d9a683dd02f6f07e716a5537737fa500f82c690215c8adba3acc153de1435db7813a7c7dc6a97bdff932cd6e686e9737ecbb998c65f4b75e9946fb8e66e1fff807b3659a2a87c0647311828564e2178df49da6a26ef6a2e9b95b1948e1247a33d00fff86bb1fe2f0d6462f39621381ac7990d03ad27c5b2821b36a180cdbc4fc5adf2cc7a76bf3c22e65b9c65bf47003d2255ec96ed249cd0c5c7c92e5fb31387a52d0eddfde8908013ee073cad2a3c11760c8f9c4205f22d04883539440f917d77cd3be9bb3d4bd66283186d065dd87476296f11dbe4c897c898deea99d1ae4a099851429df58ce2688587ae082954ea86a87660545bb08b12a38120f34552050ced93f50847f31bc73c3a50e9755e5781b6c7636502183ecaa0ab9baa2ec33f6a6c34469876404c808fa66fe7218c017bbda71a714afc664db33c2a2915b0f6f2bb91d14e50e25bf34367d083bb27c3f7572d23471f6f3b7850f14e1dfd246a46db453f88fda52300e5337b09f188a8380213876cfd88f45d8dece501648031fbfbc77908d8d4c11ee3437ff6040f5959f3d8a0de73015648fd1c97979d2de31a7eb9a02a1a2443c837805d4da62eea8fc9307e4ab4ecac2df9735b9bfc5f0e0a3fc27b955f8d4b7148da88feed62cb611353a235e945eb560a7b71ec62b7fc00f9791ca681a9c6a7ce361711567222ccd1b1274fc485451b6728401e580cd65e1a2caa2234c7b39fcc8a70ffe488adb858c0169e83ddb76d0876e93e0136227116c7564c52a37d9cfc1fd4de9732276e83c1fddbb764f49a47ccc3773f38858c4c8e9d5fa1e4dc8a795b1fdc5d48816b1d79d46f9c2f511e6782ef4b86c8b22c35375c925ef685e0cbc829486e0cb730d70c91ba649151f464c357a0d569ac4fffee7e2f1aed2c21246473de84d34bfb94b216b47eb27920c7c9a18ff5948a8fa396711cd4ba426e61535ac9006c67bd8495a91a48b5ca056cc592a4f0e33fda8824f26c79b2511f119f9483b6b3f80b1ddcfa3147e1a88222c998354ea310be3d8dda51720c3c36f2702ab8ec9fea41ed90663133526f9e60ec95ca34de274fcbbfbf0fd044a9232293d56a4a7972d2eda66ea02461dc3bc505ce708151f06af4327b53da6a304a85658d471685ac5bd038a34b14fa7c167be6a9b68ce14bbfbfc65ff35899cd7a11e5c4ecdc29bf2e02bce2f9103d07701baa5e653e52556f0f12722c52b7e68d58b86c6499ee5a68f3989c6eaa8db1268c5762580b9d7713651da5180aa121e19ac4aa793ce6e559e70a5fc92b812aef5d5e9d998f7bd6078d660067a6daa5bc88a85d6cb7c98bd1bcd6ed808c1032936fbf6157fd6aa34302b41e96cf6bc6af38d7cf843d991b41fe1f91fff57e0fdf0c0690f913e8bfe3d286e5c31608f08bc592cfac44980d1486ee6c4d62c84539438a07b7d6dfaa58fb9dba7065872aa71ebe3a4be91f6de0804a0a63fc8c62a2a67e2fc1c94873b2a5593bbe3d6fe315064df4bbe34cc313ce96786499b5b04ac5f751e00f029695c4fcdf24e4eb923a4c82f80038afae2d70e7062478ada524a252042cf9b287d95aacdf17c0c3ccc3fa8c9a32eddc0aae2f25a0f5fa1a24ff0431f67d9acc5f713059e4ff02281abd366136098a230bfae562e95c7cff3b69ae6e4be9a1b26331e8846a01adf80ba43a7d3aead200e6f37161c5ac96f7f91d3f77e3e42569f5b11919793c7701f0fe6b88f7df64b49b7a5f947e732811602b72808894fdd9e91b207c3eacdd119f34438fd515dc5fe444a5e94b64858f39c8556722b530df17a0bb080b4107a536b68cae5308144e9d2eee94b803362f8c876cb1632b2f28f9e61572b684164dab84324b01d675b153919faf9a839fd5f205deae83436f040b00a198f7ea60d5ecb2bae0a04e7fe94484262b2e12775479f326d24d3cee5fff79dd2fe6e66921c0d7c877cc4ea67c85658fb95cf3899d0f91d9c90d1b84ee46fee0aa798b602a64aa5481790d0347283fa9d3a4f9e97e3e86a3e017b2ead5e2bbc1455641e63a795d5f735b281360e075eedb8d8a3ea578175e88d2694d277fe615e38e28548d8541c5abec8dc27fd2f959a57813ba38288d55dde1037cdbc80087f4ac792459f2faf01cf9b57be333d02580355a2e07f0ec82e1196491a25761baa640e23f3b3bb260b2d3da8ecca0d477988887514a489665fe064072c7919fe30d3b777efcdec55f2c3590c44a6ae805a762abf2262ca79ad34415cf35a526187562a09c9051b7a89e5ad7db6c1891ef0de65aa2b60f303cc2a8871e2a424021e0ab9399920b98b1611e364c4c307fb3d783e372dbc47755f83995971a2f3acebb678a636ca205efce84f06857f20595690f033110752a91a661780f99dcfd2c790899d57bb87b19abf0405288f353a2c769ceef8b6f2bbf53a044da9b4a3b22cdf34e5e0b7972a3e8bbc03557d59f0bc6e97842797c8973cc29775a21f103533e948a3bd4f56eee9bd76b3678d6bd63714129786fb3a1593c06ab67ef152c648f81e35239bc3b59cdcbfb7578a5c8d37042e7da28487b3a5496f944748db9ede0c50f995248a42f6dcd6b051e31e13461806398df184155d7c1336aad658b6434544fcd816a60277fe91075a38a4b1f53d9f82fc668b72ecb539ba6f31cc399fa4efdffe96c9bde9fcaccd5ab5920e4d9e3e1b32629784a249c4d5f363255f26a6baa311e6ff6b257cebf56faabbeda694f0760557270b46301e3f4736893ae8d436fe92dc3201b41f4e151541e03285a9b7ffe5f7eef4d56d8de904202c08399bdc2e0b06337938b9246c16000c9f47fb17ceb5d9d434ba10440ae7c46c639754249a2b723c11aecc92cce72519ae6f8288e087a6b995ef64eb231193497f2b9c32763f1cd0314a4641a1c5864f3f7e219b088ca510ab43c271922e56ebbbc51a897655f6a1e2716e25979177dd76f66048f37b1df9e7200614a46cd1ec9e5d0daa4bd9bca086e5f9d4d16ae7d8b1b999e8257ce7dfd4140d48ac2dd1534f1603619236b88c969f2a5d25857c7845c12719038387fc289e4e04d84674b3c3e105152de91eb78a48fb55097ba1e37fd55165dd05db5fac9f67d9de4fc20c4344d09dba7b21d1b0f0f4aed500d05579184d7f625e85e0fe2b3d9031b93943fe3c3ee2511f9e830406b8d151ad0c1b6a8077d20aeb527b92fdd113960e09adf856c0a24e98d637d11c0a17ca89081ec2f4888736a17e1b5778c64d8b69b7f8e13ef91fe09b0e575354f36a14b247ce76f5c88a2b2c31d7c66b4f93ea5569387b1eb3067bc024d04f3700c6c60f8747a72a5d9eb10d1e8edda409e3c7b6a2ac11603e040542d20be3a596b97c31d8a724b36fa5304713d2344650af53c3bcae21a9d7ce0bc13f9d7bb1d3c49f378a5e8b5344810316be6b32df0fbea56e611a57511221ae270ec9f20574fe56bc6587f9dbe73ea21f6d3315065c32ffdfd45726c51a4d3df3acded6ab316e3416f4730181e3539a200793be6629ae1d06cd09f41d072d7df82742cafbd80aebe64c48909d7a5a15b3b623254dca8dc4b4d26b42103b1ae4f0eabea00fe8c68341caf6538c4636a8a5c0e17e023b495e00134206972b871a13d47fd076c6dc62cd4ae97d8af6f804d88a032dc0e1dc6f35df500711d1f7963260aa0f7f90bbaaeb620880773581bb5595588b607b0aad8b7cebdffb4ff7c9234a2f3daa36d5cbedd0511c93e81e8bacfb67fa4890bacb107b57d3c0e6e5e44d18451d7a87f175d913fb2c4244e05bb1d2eae03d2365f3f6224524a5ddbbd7fab8a0dda005a6501d4cd710b89a059ccc21f6e9f919196b27a903e4078633175fbff4190edb2e9de7b88511c0ad40ca24d281f2e4f3de9b066a438905e2758952ad9d32e8c34f33997f12cb1c370bb105f450e01800b0515f9a102995b2a843336b406c21a3d4096697524193761820bf4f975e08e9c715454d0d3a232a01b2c97671d272b0104a2f558c5b54168de69ff4d3ab0e07f7969c104926bc6d4817a35b8f09e591338a7b504ad17ee4dbe2e9adf2a7e19326cab3985a5e411a8319918c667595784594b6a93fdf68838699473fa2a703f7c13f82e5b28f16b3c9ba9a034fbceeb2a56d13def14c9b4b11121524deb16d0e7247de118e19df49c0a180822221e003e9757a3dca7081448ec8f5889544e684cc5df2ca5d374fbd9f486fd7049b80b3964b43cfcdb754adb77a2b31f43a69be2ef15995d92ee98eb90109c14d32c6a893152565f597ce87e68c48bedf7d42a769be95b4d664dd3de532bfcee7555516566db6e693eb11d455c7b1678147c854a2b3ddbebe175be1b30ccc9e264390771ddd0ab84f8f1d76c421ba5c35d7fb21cd1618384aaa628194850de1bece8319f2dee3e4a1e6a11682fbcec781ddd47356e75ce6935b0c99c8cccda74e0290a7166794aaebe7a577c229da730b69b1dfd646a7f8afd70aef9d9a6dc710196edf5a8e896b623d860eb8a1459d300f9dcb21da4d63e5031e92e24372c0345e4128b85da9e792064f61041636d80d829debb174f2661cc6c0790eb21325c6407abb4fba2e43e6f1206e494b44d6d24c2c3b7ea6c69aa28e9d3a910492704f6fc25a34070454c21c73caea6ad3f4a28b562c9b8a386b899b75895ee144e89b8082e8f8860a6cc58ffee3dab254b5b8e06f6f827d16bacb9b7244ecb487a5808f22f6f18a6b63d07ec49cabd7df4d900a376e1223484e425572930017cf578f1e9b4b5567952a0466e16e33997a5ec2d7cf346a5278f30e37984959b6670e34a380a87dbd7faf2726d125b9881c650656eb57bd5cb5a2e40f11a72a8ba04b457e19c129059b345304ee97d53d8e40731e216676f69fd2921eaace265cfdd4a716a1d1559c2b983464e8f974cbf1656815f167f36cf60446d321d37b96a39d4ea2fae37f671e32458549461356f1b6cdc9373cfad29fe1d3fca4ea29e34f9393c1ffd1a89285b7e63dd9ae4da7297021bc7d34a21218936ea265346b6aedf516828f3fa116c702dc0be00452546ada2c82044f46eb5068a4144d9e2c498a5850399305bac54de4711f4829bf17e67bdfe94e50e84a1f4592ba0d7d9db4992c8057b3ca8438883de510dc591f48d5afd5d1c60409ea1b6c8fe1a4c7a0f26861b318ee25a221380cdf200bed100a1de856fcf8235c5b7c3ec683078531852642a896cd0835c71504320285d6c9e4e8d522419fe7d8413ee6deb686821de31e4d0ff637144459da40b833342dcaf4237fb17c8af8b8b183bef341fdb0c642723f67f8bc08ce8716e1ebeb4ae3fc550aae06ff82d1292760cd095074e7e1801d01d03ba991cb843e021e5a0b5c8b6e8180a3318c20acf5f56aba04d0bbf2c0675dce63e536924cfaab99be036a4aa143fa78b36e40b4947ce4c89c85eeb66579301aa73d5409752f3759c58396ea70205ca57d7412ac805ff0720e5ada2d518836eba2448258ec9fe2620584f7e871a93bb8d6834f54bda412d95b993a3a6431712f57babe8b1456e1fc8ec57e79f5a8", 0x1000}, {&(0x7f00000017c0)="8770a3b8dc03a75164f7a298b09e7879f3e9adc8be4dbc8b1fb35d10d2b74ddf05e0", 0x22}], 0x3, &(0x7f0000001800)=ANY=[@ANYBLOB="180000000000000007000022890b3dac1e0601e00000020010000000000000000200000004000000100000000000000001000000100000002400000000000000070000008317047f000001ac141424e0000002ac1e01016401010000"], 0x5c}}], 0x2, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000018c0), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000001900)={0x8, 0x100008b}, 0x0) r6 = syz_open_dev$sndmidi(&(0x7f0000001980), 0x2, 0x143102) writev(r6, &(0x7f00000019c0)=[{&(0x7f0000001a00)="94", 0xf000}, {0x0}], 0x2) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, 0x0, 0x0) r8 = syz_open_dev$evdev(&(0x7f0000001a40), 0x1bbc, 0x801) write$evdev(r8, &(0x7f0000001a80)=[{{}, 0x0, 0x1, 0x3}], 0x5b) ioctl$EVIOCSCLOCKID(r8, 0x400445a0, &(0x7f0000001ac0)=0x7) sendto$inet6(r3, &(0x7f0000001b00)="8b", 0x1, 0x20000000, &(0x7f0000001b40)={0xa, 0x0, 0x3, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x1}, 0x1c) 6.53401943s ago: executing program 5 (id=498): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, &(0x7f0000000040)={0x82, 0x401, 0xfffffffc, 0x717e387b, 0x40, "1ae34e0626788a22b2fb12dab240794233a5bd", 0x4, 0x2}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000140)=0x15) ioctl$TCSETS(r2, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400004, 0x14, "3eccd8000000000000000010000000040100"}) ioctl$TCSETS(r2, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400000, 0x14, "3eccd8000000000000000010000000040100"}) ioctl$DRM_IOCTL_WAIT_VBLANK(0xffffffffffffffff, 0xc018643a, &(0x7f0000000140)={0x1}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r3, &(0x7f0000000500)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000540)=ANY=[@ANYBLOB="50000000030601080000000000006b000000000a050001000700000005000100070000000900299d73797a32000000001500097d169100000900020073797a31000000000900020073797a31000000009e83aab211cf97310576cb08cd8894d7f7044fc9b099434be750ab4476"], 0x50}, 0x1, 0x0, 0x0, 0x8000}, 0x8004) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(0xffffffffffffffff, 0xc01864b0, &(0x7f0000000680)={0x0, 0x0, 0xd, 0x0, 0x3}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x58) listen(r4, 0x5) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000000)={0x2001, 0x0, 0x1}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={0x3b, r7, 0x1, 0x70bd29, 0x25dfdbfd, {{}, {}, {0x14, 0x19, {0x4, 0x1, 0xfffffffc, 0x2000000}}}}, 0xfd10}, 0x1, 0x0, 0x0, 0x4080}, 0x20001000) 5.007403337s ago: executing program 3 (id=501): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000280)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) openat$nci(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) 4.964609998s ago: executing program 5 (id=502): open(0x0, 0x80242, 0x8) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x143942, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000a00)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000a40)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f0000000a80)={@val={0x0, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x2, 0xb, 0x0, 0x0, 0x0, 0x4, {[@window={0xa, 0x3}, @timestamp={0x5, 0x2}, @generic={0x0, 0x2, "d58838068b91"}]}}}}}}, 0x4e) 4.92000391s ago: executing program 0 (id=503): r0 = memfd_create(&(0x7f0000000880)='[\v\xdbX\xae[5\xa9\x90\xffc\x1f\x1a\xa9\xfd\xfa\xad\xd1m\x13}\xe1\xdf4f!\xd5d\xe7\xe2\x7f\x9b\xd5R\x10\xf3\xb6\xffT\xbf\xd1\xc8\x85\b\x00\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5>j\x87\x04\x11y\xa1\xc8\x9f\x9etiHv\xef\x1a\xedS\xd6\x91%||/c\x87\x94Y\xa0\x8e\x03\x00\x00\x00\x00\x00\x00\x003:\x99\x1e\xac`\x00\x00\x00\x00m\xeaB\xf0K\x00\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80', 0x1) execveat(r0, &(0x7f0000000940)='\x00', 0x0, 0x0, 0x1000) 4.775681223s ago: executing program 3 (id=506): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) sendmsg$NL80211_CMD_NEW_MPATH(r0, &(0x7f0000000280)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x2004c890}, 0x8000) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'bridge_slave_0\x00', 0x0}) r3 = socket(0x10, 0x80002, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r2, @ANYBLOB="00000000100000001c001a80080002802d07420008000200", @ANYBLOB="358749"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0) write(r0, &(0x7f0000000480)="2400000011005f0414f9f40700090400810000000d0000000000000008000f0001000000", 0x24) socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)={0x1c, 0x1, 0x4, 0x1, 0x0, 0x0, {0x2}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x1c}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000680)='./trace\x00', &(0x7f00000006c0)='tracefs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000740)='bRequestType=0 bRequest=6 wValue=12544 wIndex=0 wLength=0', 0x39) 4.578136898s ago: executing program 0 (id=509): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000c40), 0x2, 0x0) write$nci(r0, 0x0, 0x5) 4.415229271s ago: executing program 2 (id=512): openat$ttynull(0xffffffffffffff9c, &(0x7f00000001c0), 0x82084, 0x0) syz_extract_tcp_res(0x0, 0x6, 0x5) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) syz_io_uring_setup(0xc5, &(0x7f0000000300)={0x0, 0x10f211, 0x4, 0x2002, 0x40001c, 0x0, r0}, &(0x7f00000007c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r2, 0x0, 0x0, 0x14) shutdown(r2, 0x1) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)="d8000000180081054e81f782db4cb904021d0800fe00fe05e8fe55a10a0015000600142603600e1208000f007f370301a8001600a40002400f000100035c0461c1d67f6f94007134cf6edb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090014d6d9", 0x6c}], 0x1}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a68000000060a09040000000000000000020000003c000480380001800b00010074617267657400002800028008000240000000000b0001005443504d535300000d000300ac1a91d256ebf87b310000000900010073797a30000000000900020073797a3200000000140000001100000000000000000000000a000000499a2117467615c89d8c58537b96dd1b7077a78e246e75d3c9fee704f8f394eb3930dfd27a225bea77455e8ee32c5147afca2223f6f1e102af7761434802fda41b189e6fd84eef80084e3ab0fe3d32b2b46a"], 0x90}}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x2004095) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f0000000240)={0x2, 0xb007}, 0x4) r5 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r5, &(0x7f0000000040), 0x10) setsockopt$PNPIPE_ENCAP(r5, 0x113, 0x1, &(0x7f0000000140)=0x1, 0x4) 4.239839766s ago: executing program 5 (id=514): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, &(0x7f0000000040)={0x82, 0x401, 0xfffffffc, 0x717e387b, 0x40, "1ae34e0626788a22b2fb12dab240794233a5bd", 0x4, 0x2}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000140)=0x15) ioctl$TCSETS(r2, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400004, 0x14, "3eccd8000000000000000010000000040100"}) ioctl$TCSETS(r2, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400000, 0x14, "3eccd8000000000000000010000000040100"}) ioctl$DRM_IOCTL_WAIT_VBLANK(0xffffffffffffffff, 0xc018643a, &(0x7f0000000140)={0x1}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r3, &(0x7f0000000500)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000540)=ANY=[@ANYBLOB="50000000030601080000000000006b000000000a050001000700000005000100070000000900299d73797a32000000001500097d169100000900020073797a31000000000900020073797a31000000009e83aab211cf97310576cb08cd8894d7f7044fc9b099434be750ab4476"], 0x50}, 0x1, 0x0, 0x0, 0x8000}, 0x8004) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(0xffffffffffffffff, 0xc01864b0, &(0x7f0000000680)={0x0, 0x0, 0xd, 0x0, 0x3}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x58) listen(r4, 0x5) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000000)={0x2001, 0x0, 0x1}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={0x3b, r7, 0x1, 0x70bd29, 0x25dfdbfd, {{}, {}, {0x14, 0x19, {0x4, 0x1, 0xfffffffc, 0x2000000}}}}, 0xfd10}, 0x1, 0x0, 0x0, 0x4080}, 0x20001000) 4.201030077s ago: executing program 0 (id=515): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000600), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000340)=0x2) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f00000006c0)=0x4) pwritev(r0, &(0x7f0000000700)=[{&(0x7f0000000740)="00214500002c00000000400600000a0000010a0000020050005000000001000000015310030900000000", 0x2a}], 0x1, 0x0, 0x1) pwritev(r0, &(0x7f0000000780)=[{&(0x7f00000007c0)="002145000014000b0000400600000a0000010a00000200500050000000020000ffff601003e80000000001010101", 0x2e}], 0x1, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000004c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=ANY=[@ANYBLOB="600000001000ffff26bd7000eedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="350c040009000000240012800b0001006d6163736563000014000280060002404e200000050006000100000008000500", @ANYRES32=r2, @ANYBLOB="0a000100ffffffffffff000008000a00", @ANYRES32=r2], 0x60}, 0x1, 0x0, 0x0, 0x28001}, 0x80) 3.434731195s ago: executing program 3 (id=516): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x405}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @log={{0x8}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_LOG_LEVEL={0x8, 0x5, 0x1, 0x0, 0x7fff}, @NFTA_LOG_PREFIX={0xc, 0x2, 0x1, 0x0, 'payload\x00'}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x7c}, 0x1, 0x0, 0x0, 0x8890}, 0x24000000) 2.44386122s ago: executing program 2 (id=517): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000280)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/thread-self/fail-nth\x00', 0x2, 0x10b) openat$nci(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) 2.396949051s ago: executing program 5 (id=518): bpf$MAP_CREATE(0x0, 0x0, 0x50) r0 = socket(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000080)={'wg2\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000240)={0xffffffffffffffff, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)=@ipv6_newnexthop={0x40, 0x68, 0x1, 0x0, 0x25dfdbfe, {0x2}, [@NHA_ENCAP={0x18, 0x8, 0x0, 0x1, @SEG6_LOCAL_BPF={0x14, 0x8, 0x0, 0x1, @SEG6_LOCAL_BPF_PROG_NAME={0xd, 0x2, '/dev/kvm\x00'}}}, @NHA_OIF={0x8, 0x5, r1}, @NHA_ENCAP_TYPE={0x6, 0x7, 0x2}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 2.349198202s ago: executing program 3 (id=519): r0 = memfd_create(&(0x7f0000000880)='[\v\xdbX\xae[5\xa9\x90\xffc\x1f\x1a\xa9\xfd\xfa\xad\xd1m\x13}\xe1\xdf4f!\xd5d\xe7\xe2\x7f\x9b\xd5R\x10\xf3\xb6\xffT\xbf\xd1\xc8\x85\b\x00\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5>j\x87\x04\x11y\xa1\xc8\x9f\x9etiHv\xef\x1a\xedS\xd6\x91%||/c\x87\x94Y\xa0\x8e\x03\x00\x00\x00\x00\x00\x00\x003:\x99\x1e\xac`\x00\x00\x00\x00m\xeaB\xf0K\x00\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80', 0x1) execveat(r0, &(0x7f0000000940)='\x00', 0x0, 0x0, 0x1000) 2.221483745s ago: executing program 0 (id=521): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x24}, 0x1, 0x0, 0x0, 0xc010}, 0x22000004) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r2, 0x0, 0xc810) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r3}, 0x4) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x800) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4000800) socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$VIDIOC_DV_TIMINGS_CAP(0xffffffffffffffff, 0xc0905664, &(0x7f00000004c0)={0x0, 0x0, '\x00', @bt={0xffffffff, 0x2, 0x2, 0x6, 0x4, 0x2, 0x14, 0x1}}) r4 = socket$netlink(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r5, 0x1, 0x100, 0x25dfdbfd, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x6048800) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) socket$netlink(0x10, 0x3, 0x4) syz_usb_connect(0x2, 0x2d, &(0x7f0000000a00)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e402010902"], 0x0) syz_open_procfs(0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 2.200105816s ago: executing program 2 (id=522): mkdirat(0xffffffffffffff9c, &(0x7f0000002540)='./security\x00', 0x1ff) mount(0x0, &(0x7f0000002580)='./security\x00', &(0x7f00000025c0)='securityfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000002600)='./security/apparmor/.replace\x00', 0x1, 0x0) write(r0, &(0x7f0000002640)="04080076657273696f6e00020500000004080070726f66696c6500070504002f2f6f00040600666c616773000702000000000200000000020000000008020000000002000000000200000000020000000008", 0x52) 2.107647828s ago: executing program 6 (id=523): r0 = socket(0xa, 0x3, 0xff) setsockopt$inet6_int(r0, 0x29, 0xb, 0x0, 0x0) 2.106982928s ago: executing program 3 (id=524): open(0x0, 0x80242, 0x8) bpf$BPF_PROG_QUERY(0x10, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x143942, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000a40)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f0000000a80)={@val={0x0, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x2, 0xb, 0x0, 0x0, 0x0, 0x4, {[@window={0xa, 0x3}, @timestamp={0x5, 0x2}, @generic={0x0, 0x2, "d58838068b91"}]}}}}}}, 0x4e) 2.011842581s ago: executing program 5 (id=525): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000008c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_INTERFACE(r0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000c80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000d40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000dc0)={&(0x7f0000000e00)={0x54, r3, 0x1, 0x470bd2a, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_OFFCHANNEL_TX_OK={0x4}, @NL80211_ATTR_FRAME={0x2a, 0x33, @assoc_req={{{0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1}, {0x2}, @device_a, @device_a, @initial, {0x2, 0xfff}}, 0x102, 0xab0, {0x0, 0x6, @default_ibss_ssid}, @val, @void}}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x980}]]}, 0x54}, 0x1, 0x0, 0x0, 0x20000000}, 0x8800) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000e80)={0x34, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_SOCKET_OWNER={0x4}]}, 0x34}}, 0x0) 1.992650451s ago: executing program 2 (id=526): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) getrlimit(0xb, &(0x7f0000000440)) r0 = syz_open_dev$sndmidi(&(0x7f0000000500), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdir(0x0, 0x1ff) mkdir(0x0, 0x1ff) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@nat={'nat\x00', 0x670, 0x5, 0x3d4, 0x208, 0x2d0, 0xfeffffff, 0x2d0, 0x208, 0x3a8, 0x3a8, 0xffffffff, 0x3a8, 0x3a8, 0x5, 0x0, {[{{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 'veth0_to_bond\x00', 'veth1_to_team\x00', {}, {}, 0x6}, 0x0, 0x9c, 0xc0, 0x0, {}, [@common=@inet=@tcp={{0x2c}, {[], [], 0x0, 0x0, 0x2, 0x4}}]}, @common=@inet=@TCPMSS={0x24}}, {{@ip={@multicast1, @rand_addr=0x64010100, 0xffffff00, 0xff, 'tunl0\x00', 'ip6tnl0\x00', {0xff}, {}, 0x84, 0x1, 0x9}, 0x0, 0xf0, 0x124, 0x0, {}, [@common=@set={{0x40}, {{0x0, [0x0, 0x0, 0x0, 0x1, 0x7]}}}, @common=@set={{0x40}, {{0x0, [], 0x5}}}]}, @REDIRECT={0x34, 'REDIRECT\x00', 0x0, {0x1, {0x0, @broadcast, @remote, @icmp_id}}}}, {{@ip={@loopback, @dev={0xac, 0x14, 0x14, 0x15}, 0x0, 0x0, 'lo\x00', 'ip6tnl0\x00'}, 0x0, 0x70, 0xa4}, @NETMAP={0x34, 'NETMAP\x00', 0x0, {0x1, {0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @icmp_id, @icmp_id=0x64}}}}, {{@ip={@remote, @broadcast, 0x0, 0x0, 'pim6reg0\x00', 'wlan0\x00', {}, {0xff}}, 0x0, 0x70, 0xb8}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x0, @ipv4=@remote, @ipv4=@dev}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x430) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_ADD(r1, 0x0, 0x44000) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r3, 0x8982, &(0x7f00000004c0)={0x0, 'batadv0\x00', {0x5}}) sendmsg$kcm(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000005c0)="2e00000010008188040f80ec59acbc0413a1f848130000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x40044) r4 = syz_open_procfs(0x0, &(0x7f0000000180)='io\x00') pread64(r4, &(0x7f0000000100)=""/48, 0x3c, 0x100000000004) bind$inet6(r4, &(0x7f0000000480)={0xa, 0x4e20, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x800}, 0x1c) syz_open_dev$dvb_demux(0x0, 0x0, 0x41) r5 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r5, 0x403c6f2b, &(0x7f0000001e40)={0x6, {"4772ffacff04856ec9e8776f8ee906be", "2dfad343e15ead11f40c897700", "0000b3f88813da82b4cf00"}, 0x3eaf, 0x4}) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000680)='gadgetfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./gadget/dummy_udc\x00', 0x2, 0x0) write(r6, 0x0, 0x0) 1.947914162s ago: executing program 6 (id=527): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @multicast2}, 0x10) syz_emit_ethernet(0x86, &(0x7f0000000080)={@broadcast, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010106, @local}, @redirect={0xb, 0x0, 0x0, @broadcast=0x1000000, {0x17, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @multicast2, @multicast2, {[@timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote, 0x4e20fffc}]}, @timestamp_addr={0x44, 0x3c, 0x0, 0x1, 0x3, [{@rand_addr=0x64010102}, {@remote}, {@private=0xa010101}, {@private, 0x800}, {@empty}, {@initdev={0xac, 0x1e, 0x0, 0x0}}, {@empty}]}]}}}}}}}, 0x0) 1.459890214s ago: executing program 6 (id=528): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000080)={'aio_iiro_16\x00', [0x101, 0x6, 0x3, 0x10, 0x11, 0x7, 0x79, 0x2, 0x80008, 0xffff, 0x2, 0xfffffffa, 0x7, 0x1, 0x1, 0xfd, 0xfffffffb, 0xdb, 0x3, 0xfffffff7, 0x4, 0xca9f, 0x7f, 0x200008, 0xfffffffd, 0xf39e, 0xffffffff, 0x8, 0x40, 0xfffffffd, 0x80f]}) 1.459609884s ago: executing program 3 (id=529): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, &(0x7f0000000040)={0x82, 0x401, 0xfffffffc, 0x717e387b, 0x40, "1ae34e0626788a22b2fb12dab240794233a5bd", 0x4, 0x2}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000140)=0x15) ioctl$TCSETS(r2, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400004, 0x14, "3eccd8000000000000000010000000040100"}) ioctl$TCSETS(r2, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400000, 0x14, "3eccd8000000000000000010000000040100"}) ioctl$DRM_IOCTL_WAIT_VBLANK(0xffffffffffffffff, 0xc018643a, &(0x7f0000000140)={0x1}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r3, &(0x7f0000000500)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000540)=ANY=[@ANYBLOB="50000000030601080000000000006b000000000a050001000700000005000100070000000900299d73797a32000000001500097d169100000900020073797a31000000000900020073797a31000000009e83aab211cf97310576cb08cd8894d7f7044fc9b099434be750ab4476"], 0x50}, 0x1, 0x0, 0x0, 0x8000}, 0x8004) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(0xffffffffffffffff, 0xc01864b0, &(0x7f0000000680)={0x0, 0x0, 0xd, 0x0, 0x3}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x58) listen(r4, 0x5) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000000)={0x2001, 0x0, 0x1}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={0x3b, r7, 0x1, 0x70bd29, 0x25dfdbfd, {{}, {}, {0x14, 0x19, {0x4, 0x1, 0xfffffffc, 0x2000000}}}}, 0xfd10}, 0x1, 0x0, 0x0, 0x4080}, 0x20001000) 1.416043095s ago: executing program 2 (id=530): openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket(0x10, 0x3, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FILTER(r1, 0x65, 0x1, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000140)={'vcan0\x00', 0x0}) bind$can_raw(r1, &(0x7f0000000180)={0x1d, r2}, 0x10) write(r0, &(0x7f00000001c0)="2400000011005f0414f9f4070009041f810000000e000000000000ea08000f0001000000", 0x24) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000200)={0x20, 0xff, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x2, 0x0, 0x93}, 0xe) socket(0x18, 0x5, 0x1046) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000240)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r4, &(0x7f0000000280)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) r5 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f00000002c0)=0x1, 0x4) sendmmsg$inet(r4, &(0x7f0000000340)=[{{&(0x7f0000000380)={0x2, 0x4e21, @multicast2}, 0x10, &(0x7f00000003c0)=[{&(0x7f0000000400)="7d9076e251745b28392e79af6da876e09af522f75b705097b9d19a86ed9dea7f6a8d37521489ffa14a7424e15147fc895281d638c8c7fe5a090d36c24750ee997c8c1d28827f20b08f5feb98af1f4217b0097b8a25dd08522383ca88fd45437a73dc58c95b", 0x65}], 0x1, &(0x7f0000000480)=ANY=[@ANYBLOB="0d000000000000000100000005000000bc0000000000000007000000444420a36401010100000069ac1414bb00000006ac14140b000000097f00000100010001ac14142200000008ac14142700000006ffffffff00000009000000000000000f071396ac1e00010a010100ac1414bbac1414aa071f3fe0000002ffffffffe0000002ac1414bbffffffff7f000001ac1e0101863afffffffc000e352990b021f26968033e450e010a04d6e05668e0473a000571e9a90007cafe91db730105661bf6000b79ea3c9d762b635bad440000000000000007000000862d00000000001183929bcf39565a581ff361f87ceb3a050ea02284293e76fb42ac1f6e1d0608a5f4f4f694e7070bafac1e00010000000074000000000000000700000094040100830bb4ffffffffac1e010194040100440ce8e36401010000000a1e890b86ac1e0001e0000002070b827f00000164010101890b3cffffffffac14141294040100442447830000000000000000e0000002000007ffffffffff00000000ffffffff0000000d180000000000000008000000", @ANYRES32=0x0, @ANYBLOB="4001000000000000"], 0x19c}}, {{&(0x7f0000000640)={0x2, 0x4e21, @multicast2}, 0x10, &(0x7f0000000680)=[{&(0x7f00000006c0)="d926f9efb9f83557b4a78c37cf56b61afe0ea1d3fda4a0564cde8cd67ecb9fde364742c6f3584d2a926d389f64822e6c8df5ad96da66729b560ece2d50c090d463603a9ff4294e064b85e200f53428ec77373efd838880196d609bf0827ad5d07c476ebf6d99466f325212fe925c7bef2f167916ac5620e4b04754f81e67bdf40f4faf1139f013b9ac5402989f16b4348173452ba656ba11f0e8cd80cce753643099455d5d453fc521a1616c10b21ddd6e2ed4c53c3832cffb6f771b8942f567bc6f8240", 0xc4}, {&(0x7f00000007c0)="7041b9de595446f4f34c1e8c9c5ebf91d874944344243c5996339f39b86665c2e189f8fa7e8598f5c6a139c834fad84a5b50e10059d3826cca07472c828d5fd269fc8390e92b8605fe37163937423b1e07bf304a9d6efcee1334ba34bd272997b85c451414aaeed27b0d41995108ee8fd91656e317f3942fd13543f1965c9951eeeb44db73d2d175817098ac0d0f64530a9d0143b97e3b22422c0642abe429e5dde7ec2643f876af31d9a683dd02f6f07e716a5537737fa500f82c690215c8adba3acc153de1435db7813a7c7dc6a97bdff932cd6e686e9737ecbb998c65f4b75e9946fb8e66e1fff807b3659a2a87c0647311828564e2178df49da6a26ef6a2e9b95b1948e1247a33d00fff86bb1fe2f0d6462f39621381ac7990d03ad27c5b2821b36a180cdbc4fc5adf2cc7a76bf3c22e65b9c65bf47003d2255ec96ed249cd0c5c7c92e5fb31387a52d0eddfde8908013ee073cad2a3c11760c8f9c4205f22d04883539440f917d77cd3be9bb3d4bd66283186d065dd87476296f11dbe4c897c898deea99d1ae4a099851429df58ce2688587ae082954ea86a87660545bb08b12a38120f34552050ced93f50847f31bc73c3a50e9755e5781b6c7636502183ecaa0ab9baa2ec33f6a6c34469876404c808fa66fe7218c017bbda71a714afc664db33c2a2915b0f6f2bb91d14e50e25bf34367d083bb27c3f7572d23471f6f3b7850f14e1dfd246a46db453f88fda52300e5337b09f188a8380213876cfd88f45d8dece501648031fbfbc77908d8d4c11ee3437ff6040f5959f3d8a0de73015648fd1c97979d2de31a7eb9a02a1a2443c837805d4da62eea8fc9307e4ab4ecac2df9735b9bfc5f0e0a3fc27b955f8d4b7148da88feed62cb611353a235e945eb560a7b71ec62b7fc00f9791ca681a9c6a7ce361711567222ccd1b1274fc485451b6728401e580cd65e1a2caa2234c7b39fcc8a70ffe488adb858c0169e83ddb76d0876e93e0136227116c7564c52a37d9cfc1fd4de9732276e83c1fddbb764f49a47ccc3773f38858c4c8e9d5fa1e4dc8a795b1fdc5d48816b1d79d46f9c2f511e6782ef4b86c8b22c35375c925ef685e0cbc829486e0cb730d70c91ba649151f464c357a0d569ac4fffee7e2f1aed2c21246473de84d34bfb94b216b47eb27920c7c9a18ff5948a8fa396711cd4ba426e61535ac9006c67bd8495a91a48b5ca056cc592a4f0e33fda8824f26c79b2511f119f9483b6b3f80b1ddcfa3147e1a88222c998354ea310be3d8dda51720c3c36f2702ab8ec9fea41ed90663133526f9e60ec95ca34de274fcbbfbf0fd044a9232293d56a4a7972d2eda66ea02461dc3bc505ce708151f06af4327b53da6a304a85658d471685ac5bd038a34b14fa7c167be6a9b68ce14bbfbfc65ff35899cd7a11e5c4ecdc29bf2e02bce2f9103d07701baa5e653e52556f0f12722c52b7e68d58b86c6499ee5a68f3989c6eaa8db1268c5762580b9d7713651da5180aa121e19ac4aa793ce6e559e70a5fc92b812aef5d5e9d998f7bd6078d660067a6daa5bc88a85d6cb7c98bd1bcd6ed808c1032936fbf6157fd6aa34302b41e96cf6bc6af38d7cf843d991b41fe1f91fff57e0fdf0c0690f913e8bfe3d286e5c31608f08bc592cfac44980d1486ee6c4d62c84539438a07b7d6dfaa58fb9dba7065872aa71ebe3a4be91f6de0804a0a63fc8c62a2a67e2fc1c94873b2a5593bbe3d6fe315064df4bbe34cc313ce96786499b5b04ac5f751e00f029695c4fcdf24e4eb923a4c82f80038afae2d70e7062478ada524a252042cf9b287d95aacdf17c0c3ccc3fa8c9a32eddc0aae2f25a0f5fa1a24ff0431f67d9acc5f713059e4ff02281abd366136098a230bfae562e95c7cff3b69ae6e4be9a1b26331e8846a01adf80ba43a7d3aead200e6f37161c5ac96f7f91d3f77e3e42569f5b11919793c7701f0fe6b88f7df64b49b7a5f947e732811602b72808894fdd9e91b207c3eacdd119f34438fd515dc5fe444a5e94b64858f39c8556722b530df17a0bb080b4107a536b68cae5308144e9d2eee94b803362f8c876cb1632b2f28f9e61572b684164dab84324b01d675b153919faf9a839fd5f205deae83436f040b00a198f7ea60d5ecb2bae0a04e7fe94484262b2e12775479f326d24d3cee5fff79dd2fe6e66921c0d7c877cc4ea67c85658fb95cf3899d0f91d9c90d1b84ee46fee0aa798b602a64aa5481790d0347283fa9d3a4f9e97e3e86a3e017b2ead5e2bbc1455641e63a795d5f735b281360e075eedb8d8a3ea578175e88d2694d277fe615e38e28548d8541c5abec8dc27fd2f959a57813ba38288d55dde1037cdbc80087f4ac792459f2faf01cf9b57be333d02580355a2e07f0ec82e1196491a25761baa640e23f3b3bb260b2d3da8ecca0d477988887514a489665fe064072c7919fe30d3b777efcdec55f2c3590c44a6ae805a762abf2262ca79ad34415cf35a526187562a09c9051b7a89e5ad7db6c1891ef0de65aa2b60f303cc2a8871e2a424021e0ab9399920b98b1611e364c4c307fb3d783e372dbc47755f83995971a2f3acebb678a636ca205efce84f06857f20595690f033110752a91a661780f99dcfd2c790899d57bb87b19abf0405288f353a2c769ceef8b6f2bbf53a044da9b4a3b22cdf34e5e0b7972a3e8bbc03557d59f0bc6e97842797c8973cc29775a21f103533e948a3bd4f56eee9bd76b3678d6bd63714129786fb3a1593c06ab67ef152c648f81e35239bc3b59cdcbfb7578a5c8d37042e7da28487b3a5496f944748db9ede0c50f995248a42f6dcd6b051e31e13461806398df184155d7c1336aad658b6434544fcd816a60277fe91075a38a4b1f53d9f82fc668b72ecb539ba6f31cc399fa4efdffe96c9bde9fcaccd5ab5920e4d9e3e1b32629784a249c4d5f363255f26a6baa311e6ff6b257cebf56faabbeda694f0760557270b46301e3f4736893ae8d436fe92dc3201b41f4e151541e03285a9b7ffe5f7eef4d56d8de904202c08399bdc2e0b06337938b9246c16000c9f47fb17ceb5d9d434ba10440ae7c46c639754249a2b723c11aecc92cce72519ae6f8288e087a6b995ef64eb231193497f2b9c32763f1cd0314a4641a1c5864f3f7e219b088ca510ab43c271922e56ebbbc51a897655f6a1e2716e25979177dd76f66048f37b1df9e7200614a46cd1ec9e5d0daa4bd9bca086e5f9d4d16ae7d8b1b999e8257ce7dfd4140d48ac2dd1534f1603619236b88c969f2a5d25857c7845c12719038387fc289e4e04d84674b3c3e105152de91eb78a48fb55097ba1e37fd55165dd05db5fac9f67d9de4fc20c4344d09dba7b21d1b0f0f4aed500d05579184d7f625e85e0fe2b3d9031b93943fe3c3ee2511f9e830406b8d151ad0c1b6a8077d20aeb527b92fdd113960e09adf856c0a24e98d637d11c0a17ca89081ec2f4888736a17e1b5778c64d8b69b7f8e13ef91fe09b0e575354f36a14b247ce76f5c88a2b2c31d7c66b4f93ea5569387b1eb3067bc024d04f3700c6c60f8747a72a5d9eb10d1e8edda409e3c7b6a2ac11603e040542d20be3a596b97c31d8a724b36fa5304713d2344650af53c3bcae21a9d7ce0bc13f9d7bb1d3c49f378a5e8b5344810316be6b32df0fbea56e611a57511221ae270ec9f20574fe56bc6587f9dbe73ea21f6d3315065c32ffdfd45726c51a4d3df3acded6ab316e3416f4730181e3539a200793be6629ae1d06cd09f41d072d7df82742cafbd80aebe64c48909d7a5a15b3b623254dca8dc4b4d26b42103b1ae4f0eabea00fe8c68341caf6538c4636a8a5c0e17e023b495e00134206972b871a13d47fd076c6dc62cd4ae97d8af6f804d88a032dc0e1dc6f35df500711d1f7963260aa0f7f90bbaaeb620880773581bb5595588b607b0aad8b7cebdffb4ff7c9234a2f3daa36d5cbedd0511c93e81e8bacfb67fa4890bacb107b57d3c0e6e5e44d18451d7a87f175d913fb2c4244e05bb1d2eae03d2365f3f6224524a5ddbbd7fab8a0dda005a6501d4cd710b89a059ccc21f6e9f919196b27a903e4078633175fbff4190edb2e9de7b88511c0ad40ca24d281f2e4f3de9b066a438905e2758952ad9d32e8c34f33997f12cb1c370bb105f450e01800b0515f9a102995b2a843336b406c21a3d4096697524193761820bf4f975e08e9c715454d0d3a232a01b2c97671d272b0104a2f558c5b54168de69ff4d3ab0e07f7969c104926bc6d4817a35b8f09e591338a7b504ad17ee4dbe2e9adf2a7e19326cab3985a5e411a8319918c667595784594b6a93fdf68838699473fa2a703f7c13f82e5b28f16b3c9ba9a034fbceeb2a56d13def14c9b4b11121524deb16d0e7247de118e19df49c0a180822221e003e9757a3dca7081448ec8f5889544e684cc5df2ca5d374fbd9f486fd7049b80b3964b43cfcdb754adb77a2b31f43a69be2ef15995d92ee98eb90109c14d32c6a893152565f597ce87e68c48bedf7d42a769be95b4d664dd3de532bfcee7555516566db6e693eb11d455c7b1678147c854a2b3ddbebe175be1b30ccc9e264390771ddd0ab84f8f1d76c421ba5c35d7fb21cd1618384aaa628194850de1bece8319f2dee3e4a1e6a11682fbcec781ddd47356e75ce6935b0c99c8cccda74e0290a7166794aaebe7a577c229da730b69b1dfd646a7f8afd70aef9d9a6dc710196edf5a8e896b623d860eb8a1459d300f9dcb21da4d63e5031e92e24372c0345e4128b85da9e792064f61041636d80d829debb174f2661cc6c0790eb21325c6407abb4fba2e43e6f1206e494b44d6d24c2c3b7ea6c69aa28e9d3a910492704f6fc25a34070454c21c73caea6ad3f4a28b562c9b8a386b899b75895ee144e89b8082e8f8860a6cc58ffee3dab254b5b8e06f6f827d16bacb9b7244ecb487a5808f22f6f18a6b63d07ec49cabd7df4d900a376e1223484e425572930017cf578f1e9b4b5567952a0466e16e33997a5ec2d7cf346a5278f30e37984959b6670e34a380a87dbd7faf2726d125b9881c650656eb57bd5cb5a2e40f11a72a8ba04b457e19c129059b345304ee97d53d8e40731e216676f69fd2921eaace265cfdd4a716a1d1559c2b983464e8f974cbf1656815f167f36cf60446d321d37b96a39d4ea2fae37f671e32458549461356f1b6cdc9373cfad29fe1d3fca4ea29e34f9393c1ffd1a89285b7e63dd9ae4da7297021bc7d34a21218936ea265346b6aedf516828f3fa116c702dc0be00452546ada2c82044f46eb5068a4144d9e2c498a5850399305bac54de4711f4829bf17e67bdfe94e50e84a1f4592ba0d7d9db4992c8057b3ca8438883de510dc591f48d5afd5d1c60409ea1b6c8fe1a4c7a0f26861b318ee25a221380cdf200bed100a1de856fcf8235c5b7c3ec683078531852642a896cd0835c71504320285d6c9e4e8d522419fe7d8413ee6deb686821de31e4d0ff637144459da40b833342dcaf4237fb17c8af8b8b183bef341fdb0c642723f67f8bc08ce8716e1ebeb4ae3fc550aae06ff82d1292760cd095074e7e1801d01d03ba991cb843e021e5a0b5c8b6e8180a3318c20acf5f56aba04d0bbf2c0675dce63e536924cfaab99be036a4aa143fa78b36e40b4947ce4c89c85eeb66579301aa73d5409752f3759c58396ea70205ca57d7412ac805ff0720e5ada2d518836eba2448258ec9fe2620584f7e871a93bb8d6834f54bda412d95b993a3a6431712f57babe8b1456e1fc8ec57e79f5a8", 0x1000}, {&(0x7f00000017c0)="8770a3b8dc03a75164f7a298b09e7879f3e9adc8be4dbc8b1fb35d10d2b74ddf05e0", 0x22}], 0x3, &(0x7f0000001800)=ANY=[@ANYBLOB="180000000000000007000022890b3dac1e0601e00000020010000000000000000200000004000000100000000000000001000000100000002400000000000000070000008317047f000001ac141424e0000002ac1e01016401010000"], 0x5c}}], 0x2, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000018c0), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000001900)={0x8, 0x100008b}, 0x0) r6 = syz_open_dev$sndmidi(&(0x7f0000001980), 0x2, 0x143102) writev(r6, &(0x7f00000019c0)=[{&(0x7f0000001a00)="94", 0xf000}, {0x0}], 0x2) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, 0x0, 0x0) r8 = syz_open_dev$evdev(&(0x7f0000001a40), 0x1bbc, 0x801) write$evdev(r8, &(0x7f0000001a80)=[{{}, 0x0, 0x1, 0x3}], 0x5b) ioctl$EVIOCSCLOCKID(r8, 0x400445a0, &(0x7f0000001ac0)=0x7) sendto$inet6(r3, &(0x7f0000001b00)="8b", 0x1, 0x20000000, &(0x7f0000001b40)={0xa, 0x0, 0x3, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x1}, 0x1c) 448.227709ms ago: executing program 6 (id=531): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000600), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000340)=0x2) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f00000006c0)=0x4) pwritev(r0, &(0x7f0000000700)=[{&(0x7f0000000740)="00214500002c00000000400600000a0000010a0000020050005000000001000000015310030900000000", 0x2a}], 0x1, 0x0, 0x1) pwritev(r0, &(0x7f0000000780)=[{&(0x7f00000007c0)="002145000014000b0000400600000a0000010a00000200500050000000020000ffff601003e80000000001010101", 0x2e}], 0x1, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000004c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=ANY=[@ANYBLOB="600000001000ffff26bd7000eedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="350c040009000000240012800b0001006d6163736563000014000280060002404e200000050006000100000008000500", @ANYRES32=r2, @ANYBLOB="0a000100ffffffffffff000008000a00", @ANYRES32=r2], 0x60}, 0x1, 0x0, 0x0, 0x28001}, 0x80) 209.995935ms ago: executing program 2 (id=532): bind$alg(0xffffffffffffffff, 0x0, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000500)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(aes)\x00'}, 0x58) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000880)={'ip_vti0\x00', &(0x7f00000008c0)={'syztnl0\x00', 0x0, 0x8000, 0x20, 0x0, 0x1000000, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x400, 0x0, 0x9, 0x4, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @loopback}}}}) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 151.690016ms ago: executing program 6 (id=533): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/resume', 0x149a82, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000280)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f00000190c0)={0x0, 0x31, r2, 0x0}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r0, 0xc01864b0, &(0x7f0000000200)={0x0, r3, 0xe, 0x3, 0x1}) write$cgroup_int(r0, &(0x7f0000000040)=0x8000000001cb, 0x12) 0s ago: executing program 6 (id=534): sendmsg$NFC_CMD_VENDOR(0xffffffffffffffff, 0x0, 0x10) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1fd) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0) syz_emit_vhci(&(0x7f0000000400)=@HCI_EVENT_PKT={0x4, @hci_ev_key_refresh_complete={{0x30, 0x3}, {0x0, 0xc9}}}, 0x6) socket$inet6_sctp(0xa, 0x5, 0x84) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000440)={0xffffffffffffffff}) getpeername$packet(r0, &(0x7f0000000480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000004c0)=0x14) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, 0x0, 0x0) ioctl$CEC_S_MODE(0xffffffffffffffff, 0x40046109, &(0x7f00000008c0)=0x11) kernel console output (not intermixed with test programs): address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 72.029504][ T4190] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.040835][ T4190] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.051166][ T4191] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.053469][ T1108] Bluetooth: hci3: command 0x040f tx timeout [ 72.068736][ T4191] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.078099][ T4191] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.090892][ T4191] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.106319][ T4185] device veth0_vlan entered promiscuous mode [ 72.123668][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 72.134251][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 72.150840][ T4190] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 72.161627][ T4190] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.176533][ T4190] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.188017][ T4190] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.197473][ T4190] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.206841][ T4190] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.216135][ T4190] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.231160][ T482] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 72.240756][ T482] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 72.250731][ T482] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 72.258617][ T482] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 72.271435][ T4196] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 72.310665][ T4185] device veth1_vlan entered promiscuous mode [ 72.326289][ T482] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 72.336111][ T482] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 72.344519][ T482] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 72.354186][ T482] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 72.361998][ T482] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 72.374082][ T4189] device veth0_vlan entered promiscuous mode [ 72.435979][ T482] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 72.445458][ T482] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 72.472055][ T4189] device veth1_vlan entered promiscuous mode [ 72.486387][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 72.503215][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 72.531755][ T4185] device veth0_macvtap entered promiscuous mode [ 72.577727][ T4185] device veth1_macvtap entered promiscuous mode [ 72.610809][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 72.619044][ T482] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.629566][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 72.638320][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 72.644550][ T482] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.649359][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 72.661893][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 72.673485][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 72.681502][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 72.684355][ T482] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.697487][ T482] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.712011][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 72.721876][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 72.731774][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 72.756093][ T4196] device veth0_vlan entered promiscuous mode [ 72.770924][ T4189] device veth0_macvtap entered promiscuous mode [ 72.790241][ T4185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 72.800893][ T4185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.811472][ T4185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 72.822417][ T4185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.834058][ T4185] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.846357][ T4185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 72.860440][ T4185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.870868][ T4185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 72.881597][ T4185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.896453][ T4185] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.917128][ T4189] device veth1_macvtap entered promiscuous mode [ 72.925244][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 72.936076][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 72.944727][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 72.953961][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 72.964909][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 72.974404][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 72.993860][ T4185] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.002887][ T4185] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.012054][ T4185] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.021938][ T4185] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.046284][ T4196] device veth1_vlan entered promiscuous mode [ 73.052326][ T482] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.052354][ T482] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.079793][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.085566][ T4286] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.093404][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.112038][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.122535][ T4286] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.132070][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.142532][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.154026][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.169458][ T4189] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 73.191443][ T482] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 73.203264][ T482] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 73.211460][ T482] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 73.220423][ T482] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 73.230105][ T482] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 73.247938][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.260625][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.276668][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.287405][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.298551][ T4189] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.309491][ T4189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.326629][ T4189] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 73.354865][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 73.370350][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 73.380960][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 73.400634][ T4189] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.410672][ T4189] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.428417][ T4189] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.437571][ T4189] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.491557][ T4196] device veth0_macvtap entered promiscuous mode [ 73.522374][ T482] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 73.538701][ T482] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 73.562889][ T4196] device veth1_macvtap entered promiscuous mode [ 73.596781][ T482] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 73.613232][ T482] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 73.675683][ T4319] netlink: 'syz.4.6': attribute type 1 has an invalid length. [ 73.740328][ T482] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.756546][ T482] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.780475][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 73.793596][ T4196] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.811631][ T4196] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.822687][ T4196] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.833835][ T4196] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.845885][ T4196] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.857429][ T4196] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.867915][ T4196] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.878666][ T4196] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.896085][ T4196] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 73.907155][ T4196] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.918530][ T4196] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.928504][ T4196] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.939856][ T4196] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.950163][ T4196] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.964743][ T4196] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.976775][ T4196] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.982981][ T4198] Bluetooth: hci0: command 0x0419 tx timeout [ 73.989499][ T4196] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.005202][ T4196] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.047753][ T482] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.056452][ T4286] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 74.065686][ T4307] Bluetooth: hci2: command 0x0419 tx timeout [ 74.083436][ T482] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.091608][ T4286] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 74.105019][ T4307] Bluetooth: hci4: command 0x0419 tx timeout [ 74.115861][ T4307] Bluetooth: hci1: command 0x0419 tx timeout [ 74.123024][ T4286] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 74.131699][ T4286] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 74.142441][ T4311] Bluetooth: hci3: command 0x0419 tx timeout [ 74.155743][ T4286] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 74.166837][ T4196] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.176101][ T4196] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.185580][ T4196] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.194721][ T4196] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.291528][ T482] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.316838][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.335535][ T482] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.345078][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.374609][ T4330] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 74.391358][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 74.403524][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 74.471847][ T482] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.489377][ T482] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.507153][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 74.583236][ T482] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.591111][ T482] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.647179][ T482] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 74.813464][ T4347] FAULT_INJECTION: forcing a failure. [ 74.813464][ T4347] name failslab, interval 1, probability 0, space 0, times 1 [ 74.872722][ T4347] CPU: 0 PID: 4347 Comm: syz.4.12 Not tainted syzkaller #0 [ 74.879989][ T4347] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 74.890093][ T4347] Call Trace: [ 74.893412][ T4347] [ 74.896375][ T4347] dump_stack_lvl+0x188/0x250 [ 74.901107][ T4347] ? show_regs_print_info+0x20/0x20 [ 74.906356][ T4347] ? load_image+0x410/0x410 [ 74.910901][ T4347] ? __might_sleep+0xf0/0xf0 [ 74.915532][ T4347] ? __lock_acquire+0x7d40/0x7d40 [ 74.920600][ T4347] should_fail+0x383/0x4b0 [ 74.925066][ T4347] should_failslab+0x5/0x20 [ 74.929608][ T4347] slab_pre_alloc_hook+0x51/0xc0 [ 74.934607][ T4347] kmem_cache_alloc_trace+0x47/0x290 [ 74.939937][ T4347] ? nfc_allocate_device+0x125/0x550 [ 74.945301][ T4347] ? nci_deactivate_target+0x4f0/0x4f0 [ 74.950798][ T4347] nfc_allocate_device+0x125/0x550 [ 74.955944][ T4347] ? __init_swait_queue_head+0xa4/0x140 [ 74.961543][ T4347] nci_allocate_device+0x1d8/0x350 [ 74.966708][ T4347] virtual_ncidev_open+0x41/0xc0 [ 74.971736][ T4347] ? virtual_ncidev_ioctl+0x90/0x90 [ 74.976976][ T4347] misc_open+0x31f/0x390 [ 74.981266][ T4347] chrdev_open+0x585/0x5f0 [ 74.985722][ T4347] ? cd_forget+0x160/0x160 [ 74.990182][ T4347] ? fsnotify_perm+0x3a7/0x560 [ 74.994984][ T4347] ? cd_forget+0x160/0x160 [ 74.999461][ T4347] do_dentry_open+0x7f7/0xf90 [ 75.004263][ T4347] ? vfs_open+0x2b/0x80 [ 75.008457][ T4347] path_openat+0x2718/0x2fb0 [ 75.013108][ T4347] ? __kasan_slab_alloc+0xa9/0xc0 [ 75.018179][ T4347] ? do_filp_open+0x400/0x400 [ 75.022915][ T4347] do_filp_open+0x1df/0x400 [ 75.027469][ T4347] ? vfs_tmpfile+0x300/0x300 [ 75.032117][ T4347] ? _raw_spin_unlock+0x24/0x40 [ 75.037052][ T4347] ? alloc_fd+0x59e/0x650 [ 75.041435][ T4347] do_sys_openat2+0x14b/0x500 [ 75.046147][ T4347] ? __lock_acquire+0x7d40/0x7d40 [ 75.051216][ T4347] ? do_sys_open+0xe0/0xe0 [ 75.055666][ T4347] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 75.061707][ T4347] ? lock_chain_count+0x20/0x20 [ 75.066608][ T4347] __x64_sys_openat+0x135/0x160 [ 75.071508][ T4347] do_syscall_64+0x4c/0xa0 [ 75.075958][ T4347] ? clear_bhb_loop+0x30/0x80 [ 75.080670][ T4347] ? clear_bhb_loop+0x30/0x80 [ 75.085392][ T4347] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 75.091331][ T4347] RIP: 0033:0x7f8d97e29559 [ 75.095786][ T4347] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 75.115430][ T4347] RSP: 002b:00007f8d96081028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 75.123894][ T4347] RAX: ffffffffffffffda RBX: 00007f8d980b0fa0 RCX: 00007f8d97e29559 [ 75.132072][ T4347] RDX: 0000000000000002 RSI: 0000200000000380 RDI: ffffffffffffff9c [ 75.140076][ T4347] RBP: 00007f8d97ec0ab8 R08: 0000000000000000 R09: 0000000000000000 [ 75.148085][ T4347] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 75.156101][ T4347] R13: 00007f8d980b1038 R14: 00007f8d980b0fa0 R15: 00007fffe2987d28 [ 75.164236][ T4347] [ 75.376361][ T4358] Zero length message leads to an empty skb [ 75.420425][ T4362] netlink: 4 bytes leftover after parsing attributes in process `syz.2.15'. [ 75.728499][ T4367] tmpfs: Unknown parameter 'noswap' [ 77.412128][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #38a!!! [ 77.502144][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #20a!!! [ 77.665962][ T4380] FAULT_INJECTION: forcing a failure. [ 77.665962][ T4380] name failslab, interval 1, probability 0, space 0, times 0 [ 77.710289][ T4380] CPU: 1 PID: 4380 Comm: syz.0.18 Not tainted syzkaller #0 [ 77.717562][ T4380] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 77.727650][ T4380] Call Trace: [ 77.731176][ T4380] [ 77.734128][ T4380] dump_stack_lvl+0x188/0x250 [ 77.738843][ T4380] ? show_regs_print_info+0x20/0x20 [ 77.744138][ T4380] ? load_image+0x410/0x410 [ 77.748680][ T4380] ? __might_sleep+0xf0/0xf0 [ 77.753282][ T4380] ? __lock_acquire+0x7d40/0x7d40 [ 77.758375][ T4380] should_fail+0x383/0x4b0 [ 77.762832][ T4380] should_failslab+0x5/0x20 [ 77.767342][ T4380] slab_pre_alloc_hook+0x51/0xc0 [ 77.772300][ T4380] ? create_new_namespaces+0x34/0x700 [ 77.777679][ T4380] kmem_cache_alloc+0x3d/0x280 [ 77.782447][ T4380] create_new_namespaces+0x34/0x700 [ 77.787681][ T4380] ? __fget_files+0x402/0x470 [ 77.792382][ T4380] __se_sys_setns+0x2c8/0x15e0 [ 77.797184][ T4380] ? __x64_sys_setns+0x60/0x60 [ 77.801999][ T4380] ? lockdep_hardirqs_on+0x94/0x140 [ 77.807209][ T4380] do_syscall_64+0x4c/0xa0 [ 77.811628][ T4380] ? clear_bhb_loop+0x30/0x80 [ 77.816312][ T4380] ? clear_bhb_loop+0x30/0x80 [ 77.820995][ T4380] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 77.826895][ T4380] RIP: 0033:0x7fa7e37cc857 [ 77.831313][ T4380] Code: 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 34 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 77.850936][ T4380] RSP: 002b:00007fa7e1a22fc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000134 [ 77.859352][ T4380] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00007fa7e37cc857 [ 77.867327][ T4380] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006 [ 77.875318][ T4380] RBP: 0000000000000007 R08: 0000000000000000 R09: 0000000000000000 [ 77.883290][ T4380] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa7e1a236a8 [ 77.891263][ T4380] R13: 000000000000000e R14: 00007fa7e3a52fa0 R15: 00007ffd26a51958 [ 77.899257][ T4380] [ 78.098891][ T4393] syz.0.22 uses obsolete (PF_INET,SOCK_PACKET) [ 78.255200][ T4391] process 'syz.3.23' launched '/dev/fd/8' with NULL argv: empty string added [ 78.361539][ T4391] FAULT_INJECTION: forcing a failure. [ 78.361539][ T4391] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 78.609601][ T4391] CPU: 1 PID: 4391 Comm: syz.3.23 Not tainted syzkaller #0 [ 78.616983][ T4391] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 78.627072][ T4391] Call Trace: [ 78.630384][ T4391] [ 78.633353][ T4391] dump_stack_lvl+0x188/0x250 [ 78.638070][ T4391] ? show_regs_print_info+0x20/0x20 [ 78.643304][ T4391] ? load_image+0x410/0x410 [ 78.647872][ T4391] ? __lock_acquire+0x7d40/0x7d40 [ 78.652946][ T4391] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 78.658620][ T4391] should_fail+0x383/0x4b0 [ 78.663079][ T4391] prepare_alloc_pages+0x1e3/0x5b0 [ 78.668239][ T4391] __alloc_pages+0x11b/0x480 [ 78.672879][ T4391] ? zone_statistics+0x170/0x170 [ 78.677869][ T4391] ? up_write+0x1b6/0x410 [ 78.682267][ T4391] alloc_pages_vma+0x2bc/0x790 [ 78.687066][ T4391] handle_mm_fault+0x23be/0x4440 [ 78.692051][ T4391] ? get_page+0xe0/0xe0 [ 78.696259][ T4391] ? __schedule+0x11cb/0x4350 [ 78.700982][ T4391] ? follow_page_mask+0x272/0x12b0 [ 78.706133][ T4391] ? vma_is_secretmem+0x9/0x40 [ 78.710930][ T4391] ? check_vma_flags+0x359/0x470 [ 78.715913][ T4391] __get_user_pages+0x952/0x11e0 [ 78.720900][ T4391] ? populate_vma_page_range+0x290/0x290 [ 78.726582][ T4391] ? preempt_schedule+0xbc/0xd0 [ 78.731477][ T4391] ? __might_sleep+0xf0/0xf0 [ 78.736100][ T4391] ? read_lock_is_recursive+0x10/0x10 [ 78.741508][ T4391] ? tick_nohz_tick_stopped+0x7b/0xb0 [ 78.746921][ T4391] __get_user_pages_remote+0x1c2/0x730 [ 78.752417][ T4391] ? irq_work_queue+0xb8/0x140 [ 78.757249][ T4391] ? get_user_pages_remote+0x55/0xa0 [ 78.762571][ T4391] get_arg_page+0x11b/0x350 [ 78.767106][ T4391] ? copy_string_kernel+0x280/0x280 [ 78.772340][ T4391] ? load_image+0x410/0x410 [ 78.776882][ T4391] copy_string_kernel+0x14d/0x280 [ 78.781948][ T4391] do_execveat_common+0x360/0x6b0 [ 78.787015][ T4391] __x64_sys_execveat+0xc0/0xe0 [ 78.791930][ T4391] do_syscall_64+0x4c/0xa0 [ 78.796378][ T4391] ? clear_bhb_loop+0x30/0x80 [ 78.801087][ T4391] ? clear_bhb_loop+0x30/0x80 [ 78.805797][ T4391] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 78.811730][ T4391] RIP: 0033:0x7efc90998559 [ 78.816175][ T4391] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 78.835815][ T4391] RSP: 002b:00007efc8ebf0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000142 [ 78.844279][ T4391] RAX: ffffffffffffffda RBX: 00007efc90c1ffa0 RCX: 00007efc90998559 [ 78.852286][ T4391] RDX: 0000000000000000 RSI: 0000200000000940 RDI: 0000000000000008 [ 78.860288][ T4391] RBP: 00007efc90a2fab8 R08: 0000000000001000 R09: 0000000000000000 [ 78.868293][ T4391] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 78.876293][ T4391] R13: 00007efc90c20038 R14: 00007efc90c1ffa0 R15: 00007ffd68e08bf8 [ 78.884312][ T4391] [ 79.068460][ T4407] unsupported nlmsg_type 40 [ 79.480585][ T4434] si4713 0-0063: IRQ not configured. Using timeouts. [ 79.493405][ T4437] pit: kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 79.508663][ T4434] si4713 0-0063: Error while sending command 0x01 [ 79.528618][ T4439] syz.3.33 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 79.568153][ T4434] si4713 0-0063: Failed to probe device information. [ 79.585663][ T4434] si4713: probe of 0-0063 failed with error -5 [ 79.596496][ T4426] netlink: 24 bytes leftover after parsing attributes in process `syz.1.31'. [ 79.608738][ T4434] i2c i2c-0: new_device: Instantiated device si4713 at 0x63 [ 79.640860][ T4444] netlink: 4 bytes leftover after parsing attributes in process `syz.2.35'. [ 79.916170][ T13] asus 0005:0B05:8502.0001: No inputs registered, leaving [ 79.996294][ T13] asus 0005:0B05:8502.0001: hidraw0: BLUETOOTH HID v0.00 Mouse [syz0] on syz0 [ 80.241604][ T4307] rxe_eth0 speed is unknown, defaulting to 1000 [ 80.375274][ T4451] fido_id[4451]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 80.391674][ T26] audit: type=1326 audit(1792335754.268:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4457 comm="syz.1.39" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb859fbb559 code=0x7ffc0000 [ 80.470955][ T26] audit: type=1326 audit(1792335754.268:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4457 comm="syz.1.39" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb859fbb559 code=0x7ffc0000 [ 80.495875][ T26] audit: type=1326 audit(1792335754.268:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4457 comm="syz.1.39" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb859fbb559 code=0x7ffc0000 [ 80.519830][ T26] audit: type=1326 audit(1792335754.268:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4457 comm="syz.1.39" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fb859fbb559 code=0x7ffc0000 [ 80.545499][ T26] audit: type=1326 audit(1792335754.268:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4457 comm="syz.1.39" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb859fbb559 code=0x7ffc0000 [ 80.607242][ T26] audit: type=1326 audit(1792335754.268:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4457 comm="syz.1.39" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb859fbb559 code=0x7ffc0000 [ 80.632395][ T26] audit: type=1326 audit(1792335754.268:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4457 comm="syz.1.39" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb859fbb559 code=0x7ffc0000 [ 80.659007][ T26] audit: type=1326 audit(1792335754.268:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4457 comm="syz.1.39" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=0 compat=0 ip=0x7fb859fbb559 code=0x7ffc0000 [ 80.683787][ T26] audit: type=1326 audit(1792335754.268:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4457 comm="syz.1.39" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb859fbb559 code=0x7ffc0000 [ 80.708262][ T26] audit: type=1326 audit(1792335754.268:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4457 comm="syz.1.39" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb859fbb559 code=0x7ffc0000 [ 80.814024][ T4465] 8021q: adding VLAN 0 to HW filter on device bond1 [ 81.142271][ T4374] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 81.368886][ T4487] netlink: 24 bytes leftover after parsing attributes in process `syz.3.42'. [ 81.442222][ T4374] usb 3-1: Using ep0 maxpacket: 16 [ 81.602444][ T4374] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 81.632306][ T4374] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 81.652544][ T4374] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 81.672143][ T4374] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 81.702628][ T4374] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 81.822703][ T4374] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 81.843026][ T4374] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 81.861617][ T4374] usb 3-1: Manufacturer: syz [ 81.869369][ T4503] netlink: 4 bytes leftover after parsing attributes in process `syz.0.50'. [ 81.881997][ T4374] usb 3-1: config 0 descriptor?? [ 81.947094][ T4307] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 82.212488][ T4307] usb 5-1: Using ep0 maxpacket: 8 [ 82.362401][ T4307] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 82.401475][ T4307] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 82.542484][ T4307] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 100, changing to 10 [ 82.554361][ T4307] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24936, setting to 1024 [ 82.565981][ T4307] usb 5-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 82.575362][ T4307] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 82.634471][ T4307] hub 5-1:1.0: bad descriptor, ignoring hub [ 82.653149][ T4307] hub: probe of 5-1:1.0 failed with error -5 [ 82.681718][ T4307] cdc_wdm 5-1:1.0: skipping garbage [ 82.704070][ T4374] rc_core: IR keymap rc-hauppauge not found [ 82.710006][ T4374] Registered IR keymap rc-empty [ 82.722758][ T4374] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 82.736051][ T4307] cdc_wdm 5-1:1.0: skipping garbage [ 82.752228][ T4374] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 82.785392][ T4374] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 82.839553][ T4307] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 82.846744][ T4374] input: Conexant Hybrid TV (cx231xx) MCE IR no TX (2040:b138) as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input6 [ 82.860189][ T4307] cdc_wdm 5-1:1.0: Unknown control protocol [ 82.949311][ T4374] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 82.957657][ T4307] usb 5-1: USB disconnect, device number 2 [ 85.133858][ T4198] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 85.185620][ T4198] Bluetooth: hci3: Injecting HCI hardware error event [ 85.272738][ T4195] Bluetooth: hci3: hardware error 0x00 [ 85.928236][ T4525] netlink: 'syz.4.54': attribute type 1 has an invalid length. [ 86.152281][ T4374] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 86.183132][ T4374] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 86.212410][ T4374] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 86.242238][ T4374] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 86.272258][ T4374] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 86.302218][ T4374] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 86.332223][ T4374] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 86.362259][ T4374] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 86.392412][ T4374] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 86.434170][ T4374] mceusb 3-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 86.446713][ T4374] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 86.484237][ T4374] usb 3-1: USB disconnect, device number 2 [ 86.543691][ T1346] cfg80211: failed to load regulatory.db [ 86.792209][ T7] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 86.972183][ T4374] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 87.199669][ T7] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 87.220927][ T7] usb 5-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 87.242456][ T7] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 87.261904][ T7] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.323804][ T4538] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 87.342425][ T4374] usb 3-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 87.388178][ T4543] netlink: 4 bytes leftover after parsing attributes in process `syz.3.62'. [ 87.522500][ T4374] usb 3-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice= 0.00 [ 87.548487][ T4374] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 87.563375][ T7] usb 5-1: USB disconnect, device number 3 [ 87.587186][ T4374] usb 3-1: Product: syz [ 87.692265][ T4374] usb 3-1: Manufacturer: syz [ 87.708363][ T4549] udevd[4549]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 87.792265][ T4374] usb 3-1: SerialNumber: syz [ 88.145051][ T4374] usb 3-1: Not enough endpoints found in device, aborting! [ 88.542570][ T4562] netlink: 8 bytes leftover after parsing attributes in process `syz.4.65'. [ 89.497940][ T7] usb 3-1: USB disconnect, device number 3 [ 90.391649][ T4581] netlink: 4 bytes leftover after parsing attributes in process `syz.2.71'. [ 90.688985][ T4589] netlink: 4 bytes leftover after parsing attributes in process `syz.2.74'. [ 91.652514][ T7] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 91.682379][ T4523] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 91.902294][ T7] usb 3-1: Using ep0 maxpacket: 8 [ 92.023282][ T7] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 92.058859][ T7] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 92.072762][ T4523] usb 4-1: config index 0 descriptor too short (expected 45, got 36) [ 92.099286][ T4523] usb 4-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 92.174814][ T7] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 92.210388][ T4523] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 92.287343][ T7] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 92.379876][ T4523] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 92.392408][ T7] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 92.434101][ T4523] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 92.489283][ T7] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 92.512940][ T4523] usb 4-1: config 0 descriptor?? [ 92.525908][ T7] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 92.534794][ T4609] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 92.548211][ T4619] jffs2: notice: (4619) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 92.577629][ T4523] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 92.729107][ T4624] netlink: 4 bytes leftover after parsing attributes in process `syz.4.89'. [ 92.862248][ T7] usb 3-1: usb_control_msg returned -32 [ 92.867880][ T7] usbtmc 3-1:16.0: can't read capabilities [ 93.244048][ T4632] usbtmc 3-1:16.0: INITIATE_CLEAR returned 0 [ 93.458484][ T4274] usb 3-1: USB disconnect, device number 4 [ 94.861837][ T1324] usb 4-1: USB disconnect, device number 2 [ 96.155995][ T4660] loop3: detected capacity change from 0 to 7 [ 96.173746][ T4659] fuse: Unknown parameter '017777777777777777777770xffffffffffffffff00000000000000000000' [ 96.210860][ C0] blk_update_request: I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 96.222359][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 96.294513][ C0] blk_update_request: I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 96.305498][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 96.335200][ C0] blk_update_request: I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 96.346232][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 96.402676][ C0] blk_update_request: I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 96.413689][ C0] Buffer I/O error on dev loop3, logical block 0, async page read [ 96.421746][ C1] blk_update_request: I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 96.432723][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 96.457039][ T4665] rxe_eth0 speed is unknown, defaulting to 1000 [ 96.480768][ C1] blk_update_request: I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 96.491765][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 96.554100][ C1] blk_update_request: I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 96.565078][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 96.581448][ T4466] ldm_validate_partition_table(): Disk read failed. [ 96.619094][ C1] blk_update_request: I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 96.630084][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 96.655731][ C1] blk_update_request: I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 96.666714][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 96.676341][ C1] blk_update_request: I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 96.687390][ C1] Buffer I/O error on dev loop3, logical block 0, async page read [ 96.708138][ T4649] device syzkaller1 entered promiscuous mode [ 96.716250][ T4466] Dev loop3: unable to read RDB block 0 [ 96.723169][ T4466] loop3: unable to read partition table [ 96.745341][ T4466] loop3: partition table beyond EOD, truncated [ 96.794526][ T4660] ldm_validate_partition_table(): Disk read failed. [ 96.813555][ T4660] Dev loop3: unable to read RDB block 0 [ 96.819899][ T4660] loop3: unable to read partition table [ 96.833633][ T4660] loop3: partition table beyond EOD, truncated [ 96.840005][ T4660] loop_reread_partitions: partition scan of loop3 (úùƒå¡™‰ü¾CêjÌ–ã¢P=ý?ã}X‹ºÐ œëÜ%õ֘ȵ4FLQkÝŠ5@) failed (rc=-5) [ 96.866079][ T4673] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 96.934519][ T4662] ldm_validate_partition_table(): Disk read failed. [ 97.033574][ T4662] Dev loop3: unable to read RDB block 0 [ 97.115397][ T4662] loop3: unable to read partition table [ 97.162948][ T4662] loop3: partition table beyond EOD, truncated [ 97.174934][ T4662] loop_reread_partitions: partition scan of loop3 (úùƒå¡™‰ü¾CêjÌ–ã¢P=ý?ã}X‹ºÐ œëÜ%õ֘ȵ4FLQkÝŠ5@) failed (rc=-5) [ 97.221672][ T4665] chnl_net:caif_netlink_parms(): no params data found [ 98.325289][ T4516] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.219440][ T4311] Bluetooth: hci5: command 0x0409 tx timeout [ 99.238983][ T4516] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.292249][ T4198] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 99.358315][ T4665] bridge0: port 1(bridge_slave_0) entered blocking state [ 99.391042][ T4665] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.409608][ T4665] device bridge_slave_0 entered promiscuous mode [ 99.457944][ T4516] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 99.579884][ T4665] bridge0: port 2(bridge_slave_1) entered blocking state [ 99.616281][ T4665] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.764586][ T4665] device bridge_slave_1 entered promiscuous mode [ 99.942314][ T4198] usb 5-1: New USB device found, idVendor=057b, idProduct=0000, bcdDevice= 0.00 [ 99.951596][ T4198] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 100.043298][ T4516] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 100.586229][ T4713] input: syz1 as /devices/virtual/input/input7 [ 101.111027][ T4665] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 101.401267][ T4665] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 102.520714][ T4311] Bluetooth: hci5: command 0x041b tx timeout [ 102.535571][ T4198] usb 5-1: can't set config #32, error -71 [ 102.553488][ T4198] usb 5-1: USB disconnect, device number 4 [ 102.620178][ T4665] team0: Port device team_slave_0 added [ 102.751347][ T4665] team0: Port device team_slave_1 added [ 102.825641][ T4726] tmpfs: Unknown parameter 'noswap' [ 103.750538][ T4665] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 103.811466][ T4665] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 103.923298][ T4286] Bluetooth: hci3: Frame reassembly failed (-84) [ 103.930229][ T4714] Bluetooth: hci3: Frame reassembly failed (-84) [ 103.952394][ T4665] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 103.970886][ T4732] Bluetooth: received HCILL_WAKE_UP_IND in state 2 [ 104.027611][ T4737] netlink: 'syz.3.122': attribute type 10 has an invalid length. [ 104.049030][ T4665] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 104.064321][ T4665] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 104.117065][ T4198] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 104.142393][ T4665] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 104.397784][ T4750] block device autoloading is deprecated and will be removed. [ 104.532319][ T1108] Bluetooth: hci5: command 0x040f tx timeout [ 104.583153][ T4752] jffs2: notice: (4752) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 104.636168][ T4665] device hsr_slave_0 entered promiscuous mode [ 104.800044][ T4665] device hsr_slave_1 entered promiscuous mode [ 104.809835][ T4198] usb 5-1: unable to get BOS descriptor or descriptor too short [ 104.835736][ T4665] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 104.879344][ T4665] Cannot create hsr debugfs directory [ 104.885189][ T4198] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 104.910877][ T4198] usb 5-1: can't read configurations, error -71 [ 105.366699][ T4776] warning: checkpointing journal with EXT4_IOC_CHECKPOINT_FLAG_ZEROOUT can be slow [ 105.413183][ T4665] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 105.452486][ T4665] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 105.465535][ T4665] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 105.480384][ T4665] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 106.481229][ T4311] Bluetooth: hci3: command 0x1003 tx timeout [ 106.487690][ T4195] Bluetooth: hci3: sending frame failed (-49) [ 106.534871][ T4788] netlink: 48 bytes leftover after parsing attributes in process `syz.0.132'. [ 106.581496][ T4788] netlink: 20 bytes leftover after parsing attributes in process `syz.0.132'. [ 106.612339][ T4311] Bluetooth: hci5: command 0x0419 tx timeout [ 106.673963][ T4794] netlink: 'syz.3.133': attribute type 4 has an invalid length. [ 106.692388][ T4794] netlink: 'syz.3.133': attribute type 10 has an invalid length. [ 106.710444][ T4794] netlink: 152 bytes leftover after parsing attributes in process `syz.3.133'. [ 106.780242][ T4794] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 106.905227][ T4665] 8021q: adding VLAN 0 to HW filter on device bond0 [ 106.916786][ T4794] syz.3.133 (4794) used greatest stack depth: 20496 bytes left [ 106.978022][ T4370] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 106.978652][ T4370] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 106.983479][ T4665] 8021q: adding VLAN 0 to HW filter on device team0 [ 106.990577][ T4370] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 106.991145][ T4370] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 106.991487][ T4370] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.991554][ T4370] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.005046][ T4370] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 107.083914][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 107.084473][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 107.084820][ T4276] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.084853][ T4276] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.085792][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 107.086544][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 107.095431][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 107.097645][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 107.098541][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 107.118903][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 107.120973][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 107.133670][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 107.134247][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 107.141266][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 107.141880][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 107.160986][ T4665] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 107.480094][ T4516] device hsr_slave_0 left promiscuous mode [ 107.481909][ T4516] device hsr_slave_1 left promiscuous mode [ 107.491711][ T4516] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 107.491783][ T4516] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 107.507410][ T4516] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 107.507444][ T4516] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 107.510748][ T4516] device bridge_slave_1 left promiscuous mode [ 107.512353][ T4516] bridge0: port 2(bridge_slave_1) entered disabled state [ 107.584806][ T4516] device bridge_slave_0 left promiscuous mode [ 107.584954][ T4516] bridge0: port 1(bridge_slave_0) entered disabled state [ 107.649397][ T4516] device veth1_macvtap left promiscuous mode [ 107.649659][ T4516] device veth0_macvtap left promiscuous mode [ 107.649760][ T4516] device veth1_vlan left promiscuous mode [ 107.651167][ T4516] device veth0_vlan left promiscuous mode [ 108.964147][ T1108] Bluetooth: hci3: command 0x1001 tx timeout [ 108.970424][ T4195] Bluetooth: hci3: sending frame failed (-49) [ 109.161149][ T4516] team0 (unregistering): Port device team_slave_1 removed [ 109.230803][ T4516] team0 (unregistering): Port device team_slave_0 removed [ 109.270429][ T4516] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 109.319234][ T4516] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 109.594230][ T4516] bond0 (unregistering): Released all slaves [ 109.782337][ T1108] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 109.845432][ T4850] 9pnet_virtio: no channels available for device syz [ 109.953713][ T4665] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 109.973945][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 109.981495][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 110.163530][ T1108] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 110.194094][ T1108] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 110.240762][ T1108] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 110.261087][ T1108] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 110.298811][ T1108] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 110.311994][ T1346] nvmet: connect request for invalid subsystem testsubsys! [ 110.365372][ T4856] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "testsubsys" [ 110.442277][ T1108] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 110.451381][ T1108] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 110.502211][ T1108] usb 1-1: Product: syz [ 110.506432][ T1108] usb 1-1: Manufacturer: syz [ 110.552883][ T4714] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 110.587131][ T4714] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 110.603329][ T1108] cdc_wdm 1-1:1.0: skipping garbage [ 110.608587][ T1108] cdc_wdm 1-1:1.0: skipping garbage [ 110.646094][ T1108] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 110.652245][ T1108] cdc_wdm 1-1:1.0: Unknown control protocol [ 110.676402][ T4522] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 110.705201][ T4522] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 110.746981][ T4522] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 110.787110][ T4522] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 110.833737][ T4665] device veth0_vlan entered promiscuous mode [ 110.864568][ T4665] device veth1_vlan entered promiscuous mode [ 110.885832][ T4523] usb 1-1: USB disconnect, device number 2 [ 110.902426][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 110.909669][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 110.915777][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 110.995419][ T4522] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 110.996058][ T4522] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 111.008720][ T4665] device veth0_macvtap entered promiscuous mode [ 111.012406][ T4311] Bluetooth: hci3: command 0x1009 tx timeout [ 111.051776][ T4665] device veth1_macvtap entered promiscuous mode [ 111.084372][ T4665] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 111.084396][ T4665] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 111.084408][ T4665] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 111.084423][ T4665] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 111.084435][ T4665] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 111.084450][ T4665] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 111.084463][ T4665] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 111.084477][ T4665] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 111.085801][ T4665] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 111.086545][ T4714] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 111.087219][ T4714] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 111.087814][ T4714] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 111.088421][ T4714] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 111.108820][ T4665] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 111.108843][ T4665] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 111.108855][ T4665] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 111.108869][ T4665] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 111.108881][ T4665] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 111.108895][ T4665] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 111.108908][ T4665] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 111.108922][ T4665] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 111.110186][ T4665] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 111.129780][ T4665] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.129877][ T4665] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.129906][ T4665] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.129936][ T4665] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.138114][ T4714] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 111.138800][ T4714] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 111.293214][ T4276] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.293237][ T4276] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.293449][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 111.341632][ T4714] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.341652][ T4714] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.341842][ T4714] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 111.832283][ T1324] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 111.878238][ T4892] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 112.051744][ T1324] usb 6-1: device descriptor read/64, error -71 [ 112.055496][ T4892] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 112.142170][ T1108] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 112.179776][ T4892] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 112.324539][ T1324] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 112.326053][ T4892] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 112.502456][ T1108] usb 1-1: config 0 has no interfaces? [ 112.518288][ T1324] usb 6-1: device descriptor read/64, error -71 [ 112.529420][ T4892] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.560843][ T4892] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.599017][ T4892] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.613859][ T4892] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.645769][ T1324] usb usb6-port1: attempt power cycle [ 112.672407][ T1108] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 112.672438][ T1108] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 112.672459][ T1108] usb 1-1: Product: syz [ 112.672473][ T1108] usb 1-1: Manufacturer: syz [ 112.672487][ T1108] usb 1-1: SerialNumber: syz [ 112.674844][ T1108] usb 1-1: config 0 descriptor?? [ 112.936106][ T21] usb 1-1: USB disconnect, device number 3 [ 113.082370][ T1324] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 113.192380][ T1324] usb 6-1: device descriptor read/8, error -71 [ 113.477628][ T1324] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 113.503310][ T4925] netlink: 4 bytes leftover after parsing attributes in process `syz.3.159'. [ 113.595115][ T1324] usb 6-1: device descriptor read/8, error -71 [ 113.733186][ T1324] usb usb6-port1: unable to enumerate USB device [ 114.204480][ T4949] ======================================================= [ 114.204480][ T4949] WARNING: The mand mount option has been deprecated and [ 114.204480][ T4949] and is ignored by this kernel. Remove the mand [ 114.204480][ T4949] option from the mount to silence this warning. [ 114.204480][ T4949] ======================================================= [ 114.542313][ T4274] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 114.812331][ T4274] usb 3-1: Using ep0 maxpacket: 32 [ 114.934260][ T4985] serio: Serial port ptm0 [ 114.942725][ T4274] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 114.954002][ T4991] netlink: 4 bytes leftover after parsing attributes in process `syz.3.179'. [ 114.963239][ T4274] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 114.986753][ T4274] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 115.014274][ T4274] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 115.039227][ T4274] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 115.082534][ T4274] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 115.112327][ T4274] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 115.158339][ T4274] usb 3-1: config 0 descriptor?? [ 115.444606][ T4274] usblp 3-1:0.0: usblp0: USB Bidirectional printer dev 5 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 116.162200][ T1346] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 116.532468][ T1346] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 117.130481][ T1346] usb 4-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 117.140197][ T1346] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 117.204304][ T1346] keyspan 4-1:1.0: Keyspan 2 port adapter converter detected [ 117.216663][ T1346] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 81 [ 117.228665][ T1346] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 1 [ 117.239094][ T1346] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 84 [ 117.247383][ T1346] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 2 [ 117.261332][ T1346] usb 4-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 117.273472][ T1346] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 88 [ 117.281206][ T1346] keyspan 4-1:1.0: found no endpoint descriptor for endpoint 6 [ 117.299484][ T1346] usb 4-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 117.339725][ T1324] usb 3-1: USB disconnect, device number 5 [ 117.369807][ T1324] usblp0: removed [ 117.458085][ T5032] capability: warning: `syz.2.187' uses deprecated v2 capabilities in a way that may be insecure [ 117.497403][ T5035] 9pnet_virtio: no channels available for device syz [ 117.983401][ T5056] netlink: 4 bytes leftover after parsing attributes in process `syz.2.193'. [ 118.738052][ T5072] tmpfs: Unknown parameter 'noswap' [ 118.893163][ T4311] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 119.683484][ T5076] FAULT_INJECTION: forcing a failure. [ 119.683484][ T5076] name failslab, interval 1, probability 0, space 0, times 0 [ 119.740794][ T5076] CPU: 1 PID: 5076 Comm: syz.2.199 Not tainted syzkaller #0 [ 119.748144][ T5076] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 119.758236][ T5076] Call Trace: [ 119.761546][ T5076] [ 119.764515][ T5076] dump_stack_lvl+0x188/0x250 [ 119.769239][ T5076] ? show_regs_print_info+0x20/0x20 [ 119.774476][ T5076] ? load_image+0x410/0x410 [ 119.779022][ T5076] ? __might_sleep+0xf0/0xf0 [ 119.783648][ T5076] ? __lock_acquire+0x7d40/0x7d40 [ 119.788719][ T5076] ? lockdep_softirqs_off+0x430/0x430 [ 119.794139][ T5076] should_fail+0x383/0x4b0 [ 119.798606][ T5076] should_failslab+0x5/0x20 [ 119.803149][ T5076] slab_pre_alloc_hook+0x51/0xc0 [ 119.808129][ T5076] kmem_cache_alloc_trace+0x47/0x290 [ 119.813451][ T5076] ? mon_bin_open+0x196/0x500 [ 119.818167][ T5076] mon_bin_open+0x196/0x500 [ 119.822727][ T5076] ? do_raw_spin_unlock+0x11d/0x230 [ 119.828005][ T5076] chrdev_open+0x585/0x5f0 [ 119.832327][ T4311] usb 1-1: Using ep0 maxpacket: 8 [ 119.832459][ T5076] ? cd_forget+0x160/0x160 [ 119.841923][ T5076] ? fsnotify_perm+0x3a7/0x560 [ 119.846731][ T5076] ? cd_forget+0x160/0x160 [ 119.851196][ T5076] do_dentry_open+0x7f7/0xf90 [ 119.855946][ T5076] ? vfs_open+0x2b/0x80 [ 119.860145][ T5076] path_openat+0x2718/0x2fb0 [ 119.864815][ T5076] ? __kasan_slab_alloc+0xa9/0xc0 [ 119.869886][ T5076] ? do_filp_open+0x400/0x400 [ 119.874617][ T5076] do_filp_open+0x1df/0x400 [ 119.879159][ T5076] ? vfs_tmpfile+0x300/0x300 [ 119.883805][ T5076] ? _raw_spin_unlock+0x24/0x40 [ 119.888689][ T5076] ? alloc_fd+0x59e/0x650 [ 119.893067][ T5076] do_sys_openat2+0x14b/0x500 [ 119.897777][ T5076] ? __lock_acquire+0x7d40/0x7d40 [ 119.902840][ T5076] ? do_sys_open+0xe0/0xe0 [ 119.907292][ T5076] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 119.913317][ T5076] ? lock_chain_count+0x20/0x20 [ 119.918240][ T5076] __x64_sys_openat+0x135/0x160 [ 119.923134][ T5076] do_syscall_64+0x4c/0xa0 [ 119.927590][ T5076] ? clear_bhb_loop+0x30/0x80 [ 119.932304][ T5076] ? clear_bhb_loop+0x30/0x80 [ 119.937020][ T5076] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 119.942985][ T5076] RIP: 0033:0x7f759f77cd8e [ 119.947432][ T5076] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 119.952884][ T4311] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 119.967065][ T5076] RSP: 002b:00007f759da13b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 119.967094][ T5076] RAX: ffffffffffffffda RBX: 00007f759da146c0 RCX: 00007f759f77cd8e [ 119.967110][ T5076] RDX: 0000000000000000 RSI: 00007f759da13c00 RDI: ffffffffffffff9c [ 119.999685][ T5076] RBP: 00007f759da13c00 R08: 0000000000000000 R09: 0000000000000000 [ 120.007697][ T5076] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 120.015715][ T5076] R13: 00007f759fa44038 R14: 00007f759fa43fa0 R15: 00007ffd676634a8 [ 120.023748][ T5076] [ 120.028915][ T4311] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 120.053486][ T4311] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 120.080443][ T4277] usb 4-1: USB disconnect, device number 3 [ 120.081898][ T4311] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 120.124787][ T4311] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 120.127490][ T4277] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 120.170960][ T4311] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 120.215224][ T4277] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 120.231418][ T4311] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 120.267289][ T4277] keyspan 4-1:1.0: device disconnected [ 120.413547][ T5089] binder: 5088:5089 unknown command 1074553619 [ 120.451751][ T5089] binder: 5088:5089 ioctl c0306201 200000002a80 returned -22 [ 120.582253][ T4311] usb 1-1: usb_control_msg returned -32 [ 120.587890][ T4311] usbtmc 1-1:16.0: can't read capabilities [ 121.253072][ T5096] netlink: 964 bytes leftover after parsing attributes in process `syz.3.205'. [ 123.485001][ T4311] usb 1-1: USB disconnect, device number 4 [ 123.667480][ T5114] netlink: 4 bytes leftover after parsing attributes in process `syz.3.209'. [ 124.275368][ T5126] netlink: 68 bytes leftover after parsing attributes in process `syz.5.211'. [ 124.428195][ T5123] rxe_eth0 speed is unknown, defaulting to 1000 [ 125.438939][ T4276] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 125.580999][ T5156] deleting an unspecified loop device is not supported. [ 125.605624][ T4276] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 126.164143][ T4276] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 126.452207][ T1346] Bluetooth: hci3: command 0x0409 tx timeout [ 126.525125][ T4276] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 126.600405][ T5168] netlink: 4 bytes leftover after parsing attributes in process `syz.0.225'. [ 126.701259][ T5184] netlink: 'syz.2.230': attribute type 2 has an invalid length. [ 126.734597][ T5123] chnl_net:caif_netlink_parms(): no params data found [ 126.843803][ T5191] FAULT_INJECTION: forcing a failure. [ 126.843803][ T5191] name failslab, interval 1, probability 0, space 0, times 0 [ 126.894670][ T5191] CPU: 0 PID: 5191 Comm: syz.5.232 Not tainted syzkaller #0 [ 126.902021][ T5191] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 126.912112][ T5191] Call Trace: [ 126.915425][ T5191] [ 126.918380][ T5191] dump_stack_lvl+0x188/0x250 [ 126.923098][ T5191] ? show_regs_print_info+0x20/0x20 [ 126.928341][ T5191] ? load_image+0x410/0x410 [ 126.932884][ T5191] ? __might_sleep+0xf0/0xf0 [ 126.937542][ T5191] ? __lock_acquire+0x7d40/0x7d40 [ 126.942601][ T5191] ? mark_lock+0x94/0x320 [ 126.946966][ T5191] should_fail+0x383/0x4b0 [ 126.951429][ T5191] should_failslab+0x5/0x20 [ 126.955968][ T5191] slab_pre_alloc_hook+0x51/0xc0 [ 126.960945][ T5191] ? __kernfs_new_node+0xa8/0x6b0 [ 126.966012][ T5191] __kmalloc_track_caller+0x69/0x330 [ 126.971333][ T5191] ? __kernfs_new_node+0xa8/0x6b0 [ 126.976397][ T5191] kstrdup_const+0x51/0x90 [ 126.980846][ T5191] __kernfs_new_node+0xa8/0x6b0 [ 126.985744][ T5191] ? kernfs_new_node+0x250/0x250 [ 126.990725][ T5191] ? stack_trace_save+0xf0/0xf0 [ 126.995629][ T5191] kernfs_new_node+0x148/0x250 [ 127.000435][ T5191] kernfs_create_dir_ns+0x40/0x120 [ 127.005589][ T5191] sysfs_create_dir_ns+0x12c/0x290 [ 127.010734][ T5191] ? sysfs_warn_dup+0xa0/0xa0 [ 127.015442][ T5191] ? __mutex_lock_common+0x435/0x2400 [ 127.020852][ T5191] ? do_raw_spin_unlock+0x11d/0x230 [ 127.026088][ T5191] kobject_add_internal+0x5ba/0xcd0 [ 127.031322][ T5191] kobject_add+0x160/0x230 [ 127.035767][ T5191] ? __lock_acquire+0x7d40/0x7d40 [ 127.040828][ T5191] ? kobject_init+0x1c0/0x1c0 [ 127.045538][ T5191] ? do_raw_spin_unlock+0x11d/0x230 [ 127.050779][ T5191] ? get_device_parent+0x288/0x3e0 [ 127.055934][ T5191] device_add+0x470/0x1050 [ 127.060399][ T5191] device_create+0x266/0x300 [ 127.065025][ T5191] ? string+0x257/0x290 [ 127.069211][ T5191] ? widen_string+0x3b/0x320 [ 127.073838][ T5191] ? root_device_unregister+0xf0/0xf0 [ 127.079260][ T5191] bdi_register_va+0x93/0x6c0 [ 127.083983][ T5191] super_setup_bdi_name+0xf5/0x200 [ 127.089135][ T5191] ? fuse_fill_super_common+0x4d3/0x10a0 [ 127.094805][ T5191] ? vfs_get_tree+0x270/0x270 [ 127.099529][ T5191] ? do_raw_spin_unlock+0x11d/0x230 [ 127.104766][ T5191] fuse_fill_super_common+0x610/0x10a0 [ 127.110274][ T5191] ? up_write+0x1b6/0x410 [ 127.114648][ T5191] fuse_fill_super+0x173/0x1f0 [ 127.119448][ T5191] ? fuse_reconfigure+0xb0/0xb0 [ 127.124340][ T5191] get_tree_nodev+0xb0/0x160 [ 127.128976][ T5191] fuse_get_tree+0x2d7/0x4d0 [ 127.133612][ T5191] vfs_get_tree+0x88/0x270 [ 127.138069][ T5191] do_new_mount+0x247/0xa40 [ 127.142612][ T5191] __se_sys_mount+0x2e3/0x3d0 [ 127.147329][ T5191] ? __x64_sys_mount+0xc0/0xc0 [ 127.152128][ T5191] ? lockdep_hardirqs_on+0x94/0x140 [ 127.157362][ T5191] ? __x64_sys_mount+0x1c/0xc0 [ 127.162166][ T5191] do_syscall_64+0x4c/0xa0 [ 127.166612][ T5191] ? clear_bhb_loop+0x30/0x80 [ 127.171316][ T5191] ? clear_bhb_loop+0x30/0x80 [ 127.176028][ T5191] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 127.181958][ T5191] RIP: 0033:0x7fc988082559 [ 127.186408][ T5191] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 127.206169][ T5191] RSP: 002b:00007fc9862da028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 127.214624][ T5191] RAX: ffffffffffffffda RBX: 00007fc988309fa0 RCX: 00007fc988082559 [ 127.222632][ T5191] RDX: 00002000000004c0 RSI: 0000200000000480 RDI: 0000000000000000 [ 127.230637][ T5191] RBP: 00007fc988119ab8 R08: 0000200000000500 R09: 0000000000000000 [ 127.238636][ T5191] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 127.246634][ T5191] R13: 00007fc98830a038 R14: 00007fc988309fa0 R15: 00007ffff449bc58 [ 127.254650][ T5191] [ 127.279462][ T5191] kobject_add_internal failed for 0:46 (error: -12 parent: bdi) [ 127.543395][ T5196] netlink: 96 bytes leftover after parsing attributes in process `syz.2.233'. [ 127.593897][ T5123] bridge0: port 1(bridge_slave_0) entered blocking state [ 127.667169][ T5196] 9pnet_virtio: no channels available for device syz [ 127.679552][ T5213] Invalid ELF header magic: != ELF [ 127.758307][ T5213] overlayfs: unrecognized mount option "/" or missing value [ 128.074710][ T5123] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.268799][ T5123] device bridge_slave_0 entered promiscuous mode [ 128.317130][ T5196] FAULT_INJECTION: forcing a failure. [ 128.317130][ T5196] name failslab, interval 1, probability 0, space 0, times 0 [ 128.330363][ T5196] CPU: 1 PID: 5196 Comm: syz.2.233 Not tainted syzkaller #0 [ 128.337689][ T5196] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 128.347800][ T5196] Call Trace: [ 128.351112][ T5196] [ 128.354069][ T5196] dump_stack_lvl+0x188/0x250 [ 128.358797][ T5196] ? show_regs_print_info+0x20/0x20 [ 128.364046][ T5196] ? load_image+0x410/0x410 [ 128.368617][ T5196] should_fail+0x383/0x4b0 [ 128.373075][ T5196] should_failslab+0x5/0x20 [ 128.377610][ T5196] slab_pre_alloc_hook+0x51/0xc0 [ 128.382582][ T5196] ? __sigqueue_alloc+0x3a6/0x4b0 [ 128.387640][ T5196] kmem_cache_alloc+0x3d/0x280 [ 128.392440][ T5196] __sigqueue_alloc+0x3a6/0x4b0 [ 128.397330][ T5196] __send_signal+0x223/0xd40 [ 128.401959][ T5196] do_notify_parent+0xa90/0xc90 [ 128.406841][ T5196] ? trace_signal_generate+0x1c0/0x1c0 [ 128.412331][ T5196] ? __lock_acquire+0x7d40/0x7d40 [ 128.417408][ T5196] release_task+0x1190/0x15f0 [ 128.422152][ T5196] ? do_exit+0x14e2/0x2110 [ 128.426594][ T5196] ? delayed_put_task_struct+0x260/0x260 [ 128.432262][ T5196] ? _raw_write_lock_irq+0xb7/0xf0 [ 128.437409][ T5196] ? _raw_write_lock_irqsave+0x100/0x100 [ 128.443073][ T5196] ? _raw_write_unlock_irq+0x1f/0x40 [ 128.448389][ T5196] ? lockdep_hardirqs_on+0x94/0x140 [ 128.453623][ T5196] do_exit+0x14e2/0x2110 [ 128.457901][ T5196] ? put_task_struct+0x80/0x80 [ 128.462704][ T5196] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 128.468750][ T5196] ? _raw_spin_lock_irq+0xb7/0xf0 [ 128.473815][ T5196] do_group_exit+0x12c/0x2f0 [ 128.478452][ T5196] ? lockdep_hardirqs_on+0x94/0x140 [ 128.483683][ T5196] get_signal+0x7eb/0x12e0 [ 128.488150][ T5196] arch_do_signal_or_restart+0xe6/0x12a0 [ 128.493920][ T5196] ? futex_exit_release+0x1c0/0x1c0 [ 128.499153][ T5196] ? get_sigframe_size+0x10/0x10 [ 128.504146][ T5196] ? __context_tracking_exit+0x4c/0x80 [ 128.509641][ T5196] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 128.515664][ T5196] ? exit_to_user_mode_loop+0x3b/0x130 [ 128.521168][ T5196] exit_to_user_mode_loop+0x9e/0x130 [ 128.526467][ T5196] exit_to_user_mode_prepare+0xee/0x180 [ 128.532115][ T5196] syscall_exit_to_user_mode+0x16/0x40 [ 128.537586][ T5196] do_syscall_64+0x58/0xa0 [ 128.542038][ T5196] ? clear_bhb_loop+0x30/0x80 [ 128.546733][ T5196] ? clear_bhb_loop+0x30/0x80 [ 128.551426][ T5196] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 128.557342][ T5196] RIP: 0033:0x7f759f7bc559 [ 128.561767][ T5196] Code: Unable to access opcode bytes at RIP 0x7f759f7bc52f. [ 128.569137][ T5196] RSP: 002b:00007f759da140e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 128.577559][ T5196] RAX: fffffffffffffe00 RBX: 00007f759fa43fa8 RCX: 00007f759f7bc559 [ 128.585926][ T5196] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f759fa43fa8 [ 128.593921][ T5196] RBP: 00007f759fa43fa0 R08: 0000000000000000 R09: 0000000000000000 [ 128.601907][ T5196] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 128.609888][ T5196] R13: 00007f759fa44038 R14: 00007ffd676633c0 R15: 00007ffd676634a8 [ 128.617888][ T5196] [ 128.620994][ C0] sched: RT throttling activated [ 128.629276][ T4523] Bluetooth: hci3: command 0x041b tx timeout [ 128.725693][ T5123] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.748519][ T5123] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.767239][ T5123] device bridge_slave_1 entered promiscuous mode [ 128.800837][ T5218] netlink: 'syz.2.240': attribute type 10 has an invalid length. [ 128.905668][ T5123] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 128.964684][ T5123] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 129.057004][ T5123] team0: Port device team_slave_0 added [ 129.178394][ T5235] netlink: 4 bytes leftover after parsing attributes in process `syz.2.245'. [ 129.251405][ T5123] team0: Port device team_slave_1 added [ 129.352903][ T5247] Invalid ELF header magic: != ELF [ 129.397332][ T5247] overlayfs: unrecognized mount option "/" or missing value [ 130.206486][ T5123] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 130.222481][ T5123] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 130.279893][ T5123] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 130.304534][ T5123] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 130.311634][ T5123] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 130.422319][ T5123] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 130.604188][ T5123] device hsr_slave_0 entered promiscuous mode [ 130.638752][ T5123] device hsr_slave_1 entered promiscuous mode [ 130.664412][ T5123] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 130.679061][ T5123] Cannot create hsr debugfs directory [ 130.693083][ T4198] Bluetooth: hci3: command 0x040f tx timeout [ 130.942338][ T1108] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 131.158953][ T5123] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 131.194640][ T5123] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 131.274454][ T5123] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 131.312834][ T5123] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 131.322244][ T1108] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 131.360683][ T1108] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 131.391509][ T1108] usb 4-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 131.532527][ T1108] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice= 0.01 [ 131.546248][ T1108] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 131.586542][ T1108] usb 4-1: Product: syz [ 131.590784][ T1108] usb 4-1: Manufacturer: syz [ 131.632648][ T5271] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 131.679446][ T5123] 8021q: adding VLAN 0 to HW filter on device bond0 [ 131.704152][ T1108] garmin_gps 4-1:1.0: Garmin GPS usb/tty converter detected [ 131.722772][ T4517] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 131.750351][ T4517] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 131.765924][ T1108] usb 4-1: Garmin GPS usb/tty converter now attached to ttyUSB0 [ 131.817661][ T4276] device hsr_slave_0 left promiscuous mode [ 131.847360][ T4276] device hsr_slave_1 left promiscuous mode [ 131.880205][ T1346] usb 4-1: USB disconnect, device number 4 [ 131.902351][ T4276] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 131.921934][ T1346] garmin_gps ttyUSB0: Garmin GPS usb/tty converter now disconnected from ttyUSB0 [ 131.942928][ T4276] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 131.970892][ T1346] garmin_gps 4-1:1.0: device disconnected [ 132.030618][ T4276] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 132.054174][ T4276] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 132.097995][ T4276] device bridge_slave_1 left promiscuous mode [ 132.119502][ T4276] bridge0: port 2(bridge_slave_1) entered disabled state [ 132.150379][ T4276] device bridge_slave_0 left promiscuous mode [ 132.158265][ T4276] bridge0: port 1(bridge_slave_0) entered disabled state [ 132.202848][ T4276] device veth1_macvtap left promiscuous mode [ 132.215451][ T4276] device veth0_macvtap left promiscuous mode [ 132.221691][ T4276] device veth1_vlan left promiscuous mode [ 132.229772][ T4276] device veth0_vlan left promiscuous mode [ 132.618954][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.625923][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.664802][ T5340] 9pnet_virtio: no channels available for device syz [ 132.772954][ T4311] Bluetooth: hci3: command 0x0419 tx timeout [ 132.952463][ T1108] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 133.332603][ T1108] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 133.363295][ T1108] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 133.457447][ T1108] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 133.520529][ T1108] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 133.585776][ T1108] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 133.729658][ T5345] netlink: 16 bytes leftover after parsing attributes in process `syz.3.267'. [ 133.773580][ T1108] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 133.798457][ T1108] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 133.819469][ T4276] team0 (unregistering): Port device team_slave_1 removed [ 133.836865][ T1108] usb 6-1: Product: syz [ 133.841312][ T1108] usb 6-1: Manufacturer: syz [ 133.854538][ T4276] team0 (unregistering): Port device team_slave_0 removed [ 133.881492][ T4276] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 133.900148][ T4276] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 133.907685][ T1108] cdc_wdm 6-1:1.0: skipping garbage [ 133.925082][ T1108] cdc_wdm 6-1:1.0: skipping garbage [ 133.950277][ T1108] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 133.971078][ T1108] cdc_wdm 6-1:1.0: Unknown control protocol [ 134.112140][ T4276] bond0 (unregistering): Released all slaves [ 134.134085][ T5123] 8021q: adding VLAN 0 to HW filter on device team0 [ 134.152556][ T4714] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 134.161476][ T4714] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 134.179747][ T4714] bridge0: port 1(bridge_slave_0) entered blocking state [ 134.186980][ T4714] bridge0: port 1(bridge_slave_0) entered forwarding state [ 134.198113][ T4714] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 134.208514][ T4714] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 134.217311][ T4714] bridge0: port 2(bridge_slave_1) entered blocking state [ 134.224465][ T4714] bridge0: port 2(bridge_slave_1) entered forwarding state [ 134.233970][ T4714] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 134.245142][ T5345] lo speed is unknown, defaulting to 1000 [ 134.259711][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 134.279845][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 134.296047][ T5345] lo speed is unknown, defaulting to 1000 [ 134.309028][ T4522] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 134.330281][ T4522] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 134.346349][ T4522] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 134.359062][ T5345] lo speed is unknown, defaulting to 1000 [ 134.369504][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 134.373025][ T1108] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 134.387900][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 134.427597][ T4311] usb 6-1: USB disconnect, device number 6 [ 134.449304][ T5123] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 134.459833][ C1] cdc_wdm 6-1:1.0: Unexpected error -71 [ 134.476537][ T5123] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 134.496327][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 134.512712][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 134.530059][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 134.548701][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 134.566189][ T5355] netlink: 25 bytes leftover after parsing attributes in process `syz.0.271'. [ 134.582688][ T5355] device eql entered promiscuous mode [ 134.607970][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 134.632688][ T1108] usb 3-1: Using ep0 maxpacket: 8 [ 134.759260][ T1108] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 134.777796][ T1108] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 134.828443][ T1108] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 134.867541][ T5345] infiniband sz1: set active [ 134.889643][ T1108] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 134.900051][ T5345] infiniband sz1: added lo [ 134.934422][ T1108] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 134.970162][ T5345] infiniband sz1: Couldn't open port 1 [ 134.971132][ T1108] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 134.988712][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 135.021306][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 135.043908][ T1108] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 135.075570][ T5123] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 135.111421][ T4523] lo speed is unknown, defaulting to 1000 [ 135.173974][ T5345] RDS/IB: sz1: added [ 135.178065][ T5345] smc: adding ib device sz1 with port count 1 [ 135.238006][ T5345] smc: ib device sz1 port 1 has pnetid [ 135.263132][ T4277] lo speed is unknown, defaulting to 1000 [ 135.269770][ T5345] lo speed is unknown, defaulting to 1000 [ 135.387281][ T1108] usb 3-1: usb_control_msg returned -32 [ 135.399224][ T1108] usbtmc 3-1:16.0: can't read capabilities [ 135.723578][ T5345] lo speed is unknown, defaulting to 1000 [ 135.771657][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 135.794517][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 135.855774][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 135.875936][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 135.901742][ T5123] device veth0_vlan entered promiscuous mode [ 135.914469][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 135.936636][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 135.968041][ T5123] device veth1_vlan entered promiscuous mode [ 136.037327][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 136.069299][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 136.110232][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 136.147224][ T4519] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 136.180864][ T5123] device veth0_macvtap entered promiscuous mode [ 136.203511][ T5345] lo speed is unknown, defaulting to 1000 [ 136.219692][ T5123] device veth1_macvtap entered promiscuous mode [ 136.272265][ T5400] usbtmc 3-1:16.0: usb_control_msg returned -32 [ 136.285612][ T5123] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 136.329932][ T5123] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 136.360165][ T5123] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 136.387583][ T5123] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 136.411269][ T5123] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 136.429221][ T5123] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 136.454825][ T5123] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 136.465547][ T4274] usb 3-1: USB disconnect, device number 6 [ 136.525319][ T5123] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 136.556937][ T5123] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 136.597148][ T4522] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 136.613108][ T4522] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 136.651519][ T4522] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 136.674740][ T4522] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 136.874922][ T5123] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 136.905698][ T5123] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 136.930371][ T5123] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 136.947616][ T5123] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 136.957935][ T5123] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 136.998538][ T5123] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 137.026416][ T5123] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 137.048605][ T5123] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 137.067393][ T5123] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 137.087302][ T5345] lo speed is unknown, defaulting to 1000 [ 137.100756][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 137.133538][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 137.213440][ T5123] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 137.233694][ T5123] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 137.259735][ T5123] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 137.292237][ T5123] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 137.467087][ T154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 137.482692][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 137.544484][ T5345] lo speed is unknown, defaulting to 1000 [ 137.544729][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 137.591164][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 137.644502][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 137.658311][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 137.973833][ T5441] FAULT_INJECTION: forcing a failure. [ 137.973833][ T5441] name failslab, interval 1, probability 0, space 0, times 0 [ 137.987016][ T5441] CPU: 0 PID: 5441 Comm: syz.2.283 Not tainted syzkaller #0 [ 137.994346][ T5441] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 138.004585][ T5441] Call Trace: [ 138.007896][ T5441] [ 138.010861][ T5441] dump_stack_lvl+0x188/0x250 [ 138.015580][ T5441] ? show_regs_print_info+0x20/0x20 [ 138.020822][ T5441] ? load_image+0x410/0x410 [ 138.025365][ T5441] ? lockdep_hardirqs_on_prepare+0x7c0/0x7c0 [ 138.031390][ T5441] should_fail+0x383/0x4b0 [ 138.035854][ T5441] should_failslab+0x5/0x20 [ 138.040391][ T5441] slab_pre_alloc_hook+0x51/0xc0 [ 138.045370][ T5441] __kmalloc+0x6b/0x340 [ 138.049571][ T5441] ? hash_ipport6_add+0xd99/0x1fa0 [ 138.054718][ T5441] hash_ipport6_add+0xd99/0x1fa0 [ 138.059735][ T5441] hash_ipport6_uadt+0x770/0x9b0 [ 138.064708][ T5441] ? hash_ipport6_uadt+0x9b0/0x9b0 [ 138.069856][ T5441] ? hash_ipport6_kadt+0x480/0x480 [ 138.075030][ T5441] call_ad+0x182/0x9a0 [ 138.079153][ T5441] ? __nla_validate+0x50/0x50 [ 138.083865][ T5441] ? ip_set_ad+0x9c0/0x9c0 [ 138.088323][ T5441] ? __nla_parse+0x3c/0x50 [ 138.092774][ T5441] ip_set_ad+0x816/0x9c0 [ 138.097059][ T5441] ? ip_set_dump_done+0x2f0/0x2f0 [ 138.102505][ T5441] nfnetlink_rcv_msg+0xbf7/0x1180 [ 138.107557][ T5441] ? arch_stack_walk+0xf2/0x140 [ 138.112458][ T5441] ? nfnetlink_bind+0x280/0x280 [ 138.117392][ T5441] netlink_rcv_skb+0x1e9/0x430 [ 138.122191][ T5441] ? nfnetlink_bind+0x280/0x280 [ 138.127091][ T5441] ? netlink_ack+0xb10/0xb10 [ 138.131716][ T5441] ? bpf_lsm_capable+0x5/0x10 [ 138.136422][ T5441] ? security_capable+0x85/0xb0 [ 138.141310][ T5441] nfnetlink_rcv+0x2b4/0x2450 [ 138.146028][ T5441] ? __local_bh_enable_ip+0x136/0x1c0 [ 138.151432][ T5441] ? lockdep_hardirqs_on+0x94/0x140 [ 138.156675][ T5441] ? __local_bh_enable_ip+0x136/0x1c0 [ 138.162099][ T5441] ? _local_bh_enable+0xa0/0xa0 [ 138.167001][ T5441] ? __dev_queue_xmit+0x1b64/0x2e50 [ 138.172231][ T5441] ? nfnetlink_net_exit_batch+0xa0/0xa0 [ 138.177846][ T5441] ? dev_queue_xmit+0x20/0x20 [ 138.182585][ T5441] ? memcpy+0x3c/0x60 [ 138.186595][ T5441] ? __copy_skb_header+0x3ba/0x4f0 [ 138.191756][ T5441] ? skb_clone+0x1f1/0x350 [ 138.196222][ T5441] ? rcu_lock_release+0x5/0x20 [ 138.201042][ T5441] ? __lock_acquire+0x7d40/0x7d40 [ 138.206123][ T5441] netlink_unicast+0x78f/0x940 [ 138.210964][ T5441] netlink_sendmsg+0x8ba/0xbe0 [ 138.215784][ T5441] ? netlink_getsockopt+0x570/0x570 [ 138.221013][ T5441] ? aa_sock_msg_perm+0x94/0x150 [ 138.225995][ T5441] ? apparmor_socket_sendmsg+0x88/0x230 [ 138.231577][ T5441] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 138.236899][ T5441] ? security_socket_sendmsg+0x7c/0xa0 [ 138.242424][ T5441] ? netlink_getsockopt+0x570/0x570 [ 138.247654][ T5441] ____sys_sendmsg+0x5be/0x8f0 [ 138.252466][ T5441] ? __sys_sendmsg_sock+0x30/0x30 [ 138.257536][ T5441] ? import_iovec+0x6f/0xa0 [ 138.262082][ T5441] ___sys_sendmsg+0x236/0x2e0 [ 138.266800][ T5441] ? __sys_sendmsg+0x290/0x290 [ 138.271639][ T5441] __se_sys_sendmsg+0x1b7/0x2a0 [ 138.276528][ T5441] ? __x64_sys_sendmsg+0x80/0x80 [ 138.281494][ T5441] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 138.287526][ T5441] ? lockdep_hardirqs_on+0x94/0x140 [ 138.292773][ T5441] do_syscall_64+0x4c/0xa0 [ 138.297252][ T5441] ? clear_bhb_loop+0x30/0x80 [ 138.301988][ T5441] ? clear_bhb_loop+0x30/0x80 [ 138.306706][ T5441] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 138.312631][ T5441] RIP: 0033:0x7f759f7bc559 [ 138.317073][ T5441] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 138.336706][ T5441] RSP: 002b:00007f759da14028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 138.345163][ T5441] RAX: ffffffffffffffda RBX: 00007f759fa43fa0 RCX: 00007f759f7bc559 [ 138.353171][ T5441] RDX: 0000000000000080 RSI: 00002000000007c0 RDI: 000000000000000c [ 138.361274][ T5441] RBP: 00007f759f853ab8 R08: 0000000000000000 R09: 0000000000000000 [ 138.369275][ T5441] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 138.377285][ T5441] R13: 00007f759fa44038 R14: 00007f759fa43fa0 R15: 00007ffd676634a8 [ 138.385306][ T5441] [ 138.772491][ T5454] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -4 [ 138.783883][ T5454] platform regulatory.0: Direct firmware load for regulatory.db failed with error -4 [ 138.793465][ T5454] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 138.807779][ T5454] syz.0.284 (5454) used greatest stack depth: 20256 bytes left [ 138.815844][ T26] kauditd_printk_skb: 61 callbacks suppressed [ 138.815857][ T26] audit: type=1800 audit(1792335812.638:73): pid=5454 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.284" name="regulatory.db" dev="sda1" ino=448 res=0 errno=0 [ 139.056980][ T5459] netlink: 4 bytes leftover after parsing attributes in process `syz.3.285'. [ 139.271389][ T5464] rxe_eth0 speed is unknown, defaulting to 1000 [ 139.524716][ T4193] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 139.534997][ T4193] CPU: 1 PID: 4193 Comm: kworker/u5:3 Not tainted syzkaller #0 [ 139.542584][ T4193] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 139.552671][ T4193] Workqueue: hci3 hci_rx_work [ 139.557399][ T4193] Call Trace: [ 139.560699][ T4193] [ 139.563649][ T4193] dump_stack_lvl+0x188/0x250 [ 139.568365][ T4193] ? show_regs_print_info+0x20/0x20 [ 139.573592][ T4193] ? load_image+0x410/0x410 [ 139.578133][ T4193] sysfs_create_dir_ns+0x26a/0x290 [ 139.583277][ T4193] ? sysfs_warn_dup+0xa0/0xa0 [ 139.588014][ T4193] ? kthread+0x42e/0x520 [ 139.592289][ T4193] ? do_raw_spin_unlock+0x11d/0x230 [ 139.597524][ T4193] kobject_add_internal+0x5ba/0xcd0 [ 139.602777][ T4193] kobject_add+0x160/0x230 [ 139.607223][ T4193] ? kobject_init+0x1c0/0x1c0 [ 139.611922][ T4193] ? __raw_spin_lock_init+0x41/0x100 [ 139.617234][ T4193] ? klist_children_get+0x50/0x50 [ 139.622284][ T4193] ? get_device_parent+0x121/0x3e0 [ 139.627427][ T4193] device_add+0x470/0x1050 [ 139.631866][ T4193] ? device_initialize+0x2a5/0x4d0 [ 139.637012][ T4193] hci_conn_add_sysfs+0xd1/0x1e0 [ 139.641978][ T4193] le_conn_complete_evt+0xc55/0x14d0 [ 139.647331][ T4193] ? cs_le_create_conn+0x5e0/0x5e0 [ 139.652485][ T4193] ? __mutex_trylock_common+0x15c/0x260 [ 139.658068][ T4193] hci_le_meta_evt+0x285/0x3ca0 [ 139.662954][ T4193] ? hci_event_packet+0x363/0x1310 [ 139.668096][ T4193] ? __lock_acquire+0x7d40/0x7d40 [ 139.673164][ T4193] ? hci_remote_host_features_evt+0x240/0x240 [ 139.679261][ T4193] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 139.684928][ T4193] ? mark_lock+0x94/0x320 [ 139.689287][ T4193] ? mutex_unlock+0x10/0x10 [ 139.693824][ T4193] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 139.699862][ T4193] ? lock_chain_count+0x20/0x20 [ 139.704746][ T4193] ? __rwlock_init+0x140/0x140 [ 139.709541][ T4193] hci_event_packet+0xe0b/0x1310 [ 139.714509][ T4193] ? _raw_spin_unlock+0x40/0x40 [ 139.719384][ T4193] ? rcu_lock_release+0x20/0x20 [ 139.724271][ T4193] ? hci_send_to_monitor+0x9c/0x4a0 [ 139.729508][ T4193] hci_rx_work+0x255/0xa10 [ 139.733992][ T4193] process_one_work+0x867/0xff0 [ 139.738889][ T4193] ? worker_detach_from_pool+0x240/0x240 [ 139.744544][ T4193] ? lockdep_hardirqs_off+0x70/0x100 [ 139.749864][ T4193] ? _raw_spin_lock_irq+0xb7/0xf0 [ 139.754922][ T4193] ? _raw_spin_lock_irqsave+0x100/0x100 [ 139.760500][ T4193] ? wq_worker_running+0x97/0x170 [ 139.765558][ T4193] worker_thread+0xad7/0x12a0 [ 139.770302][ T4193] kthread+0x42e/0x520 [ 139.774401][ T4193] ? rcu_lock_release+0x20/0x20 [ 139.779283][ T4193] ? kthread_blkcg+0xd0/0xd0 [ 139.783922][ T4193] ret_from_fork+0x1f/0x30 [ 139.788378][ T4193] [ 139.791498][ C1] vkms_vblank_simulate: vblank timer overrun [ 139.918326][ T4193] kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 139.931629][ T4193] Bluetooth: hci3: failed to register connection device [ 140.828920][ T5464] lo speed is unknown, defaulting to 1000 [ 141.830663][ T5492] ima: policy update failed [ 141.865816][ T26] audit: type=1802 audit(1792335815.738:74): pid=5492 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=failed comm="syz.6.293" res=0 errno=0 [ 143.104148][ T26] audit: type=1326 audit(1792335816.978:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5516 comm="syz.3.297" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efc90998559 code=0x7ffc0000 [ 143.212286][ T26] audit: type=1326 audit(1792335817.028:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5516 comm="syz.3.297" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7efc90998559 code=0x7ffc0000 [ 143.285169][ T26] audit: type=1326 audit(1792335817.028:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5516 comm="syz.3.297" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efc90998559 code=0x7ffc0000 [ 143.382162][ T26] audit: type=1326 audit(1792335817.028:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5516 comm="syz.3.297" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efc90998559 code=0x7ffc0000 [ 143.461339][ T26] audit: type=1326 audit(1792335817.028:79): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5516 comm="syz.3.297" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=206 compat=0 ip=0x7efc90998559 code=0x7ffc0000 [ 143.519196][ T5540] netlink: 4 bytes leftover after parsing attributes in process `syz.6.305'. [ 143.592916][ T26] audit: type=1326 audit(1792335817.028:80): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5516 comm="syz.3.297" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efc90998559 code=0x7ffc0000 [ 143.858650][ T26] audit: type=1326 audit(1792335817.028:81): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5516 comm="syz.3.297" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7efc90998559 code=0x7ffc0000 [ 143.882562][ C1] vkms_vblank_simulate: vblank timer overrun [ 143.929037][ T5554] overlayfs: unrecognized mount option "smackfsroot=tmpfs" or missing value [ 143.960802][ T5554] tmpfs: Unknown parameter 'quota' [ 144.085057][ T26] audit: type=1326 audit(1792335817.028:82): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5516 comm="syz.3.297" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efc90998559 code=0x7ffc0000 [ 144.218419][ T26] audit: type=1326 audit(1792335817.058:83): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5516 comm="syz.3.297" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=208 compat=0 ip=0x7efc90998559 code=0x7ffc0000 [ 145.051391][ T26] audit: type=1326 audit(1792335817.058:84): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5516 comm="syz.3.297" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efc90998559 code=0x7ffc0000 [ 145.661789][ T5590] sctp: failed to load transform for md5: -2 [ 146.311447][ T5611] sctp: failed to load transform for md5: -2 [ 146.343059][ T5634] netlink: 4 bytes leftover after parsing attributes in process `syz.3.327'. [ 146.512106][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #302!!! [ 148.982181][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #88!!! [ 149.002103][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #8a!!! [ 149.012101][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #8a!!! [ 149.022099][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #8a!!! [ 149.032102][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #8a!!! [ 149.062112][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #8a!!! [ 149.072103][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 149.989539][ T5683] cgroup: No subsys list or none specified [ 150.028342][ T5683] device-mapper: ioctl: ioctl interface mismatch: kernel(4.45.0), user(4.50.0), cmd(3) [ 150.104551][ T5683] device-mapper: ioctl: ioctl interface mismatch: kernel(4.45.0), user(4.50.0), cmd(9) [ 150.303021][ T5690] netlink: 4 bytes leftover after parsing attributes in process `syz.5.342'. [ 150.792190][ T4277] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 150.845591][ T5712] device bridge0 entered promiscuous mode [ 150.919114][ T5712] device bridge0 left promiscuous mode [ 150.946729][ T5716] warning: checkpointing journal with EXT4_IOC_CHECKPOINT_FLAG_ZEROOUT can be slow [ 151.127110][ T5709] netlink: 'syz.6.344': attribute type 10 has an invalid length. [ 151.162402][ T4277] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 151.175216][ T4277] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 151.382456][ T4277] usb 3-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice= 1.00 [ 151.416234][ T4277] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 151.447710][ T5728] MTRR 1 not used [ 151.455010][ T4277] usb 3-1: Product: syz [ 151.590193][ T4277] usb 3-1: Manufacturer: syz [ 151.595074][ T4277] usb 3-1: SerialNumber: syz [ 151.663188][ T4277] usb 3-1: NFC: intf ffff88814c668000 id ffffffff8d963720 [ 152.384182][ T5699] jffs2: notice: (5699) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 152.583993][ T4277] nfcmrvl 3-1:1.0: NFC: registered with nci successfully [ 152.788450][ T1108] usb 3-1: USB disconnect, device number 7 [ 152.802688][ T1108] usb 3-1: NFC: intf ffff88814c668000 [ 153.104922][ T5774] netlink: 4 bytes leftover after parsing attributes in process `syz.6.362'. [ 153.270247][ T5777] overlayfs: failed to clone upperpath [ 153.282176][ T21] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 153.448130][ T5781] netlink: 'syz.0.365': attribute type 102 has an invalid length. [ 153.605279][ T5788] device bridge0 entered promiscuous mode [ 153.640364][ T5788] device bridge0 left promiscuous mode [ 153.886475][ T21] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 154.100348][ T21] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 154.442123][ T21] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 154.512218][ T21] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 154.590424][ T21] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 154.762375][ T21] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 154.804575][ T21] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 154.836830][ T21] usb 6-1: Product: syz [ 154.841047][ T21] usb 6-1: Manufacturer: syz [ 154.925757][ T21] cdc_wdm 6-1:1.0: skipping garbage [ 154.938181][ T21] cdc_wdm 6-1:1.0: skipping garbage [ 154.972853][ T21] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 155.007261][ T21] cdc_wdm 6-1:1.0: Unknown control protocol [ 155.528939][ T1346] usb 6-1: USB disconnect, device number 7 [ 155.542120][ C1] cdc_wdm 6-1:1.0: Unexpected error -71 [ 155.548125][ C1] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 155.554761][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 155.560869][ C1] cdc_wdm 6-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 155.569625][ C1] vkms_vblank_simulate: vblank timer overrun [ 156.248945][ T5837] device bridge0 entered promiscuous mode [ 156.359573][ T5837] device bridge0 left promiscuous mode [ 156.967261][ T5859] netlink: 4 bytes leftover after parsing attributes in process `syz.0.386'. [ 157.052468][ T4277] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 157.772409][ T4277] usb 7-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 157.796630][ T4277] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 157.833179][ T26] audit: type=1400 audit(1792335831.688:85): apparmor="STATUS" operation="profile_load" profile="unconfined" name="f/o" pid=5865 comm="syz.2.390" [ 157.851506][ T4277] usb 7-1: Product: syz [ 157.875192][ T4277] usb 7-1: Manufacturer: syz [ 157.895582][ T4277] usb 7-1: SerialNumber: syz [ 157.941655][ T4277] usb 7-1: config 0 descriptor?? [ 158.218577][ T4274] usb 7-1: USB disconnect, device number 2 [ 158.295069][ T5882] loop5: detected capacity change from 0 to 64 [ 158.424455][ T5882] MINIX-fs: mounting unchecked file system, running fsck is recommended [ 159.074105][ T5893] smc: removing ib device rxe0 [ 162.275175][ T5903] 9pnet_virtio: no channels available for device syz [ 162.798984][ T5920] netlink: 4 bytes leftover after parsing attributes in process `syz.3.401'. [ 163.761090][ T5935] CacheFiles: Failed to register: -95 [ 163.787037][ T5937] device bridge0 entered promiscuous mode [ 163.832449][ T5937] device bridge0 left promiscuous mode [ 163.945356][ T5945] exFAT-fs (nbd2): mounting with "discard" option, but the device does not support discard [ 163.961902][ T150] block nbd2: Attempted send on invalid socket [ 163.969988][ T150] print_req_error: 40 callbacks suppressed [ 163.970054][ T150] blk_update_request: I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 164.012666][ T5945] exFAT-fs (nbd2): unable to read boot sector [ 164.018959][ T5945] exFAT-fs (nbd2): failed to read boot sector [ 164.025823][ T5945] exFAT-fs (nbd2): failed to recognize exfat type [ 164.541036][ T5949] netlink: 12 bytes leftover after parsing attributes in process `syz.0.407'. [ 165.486278][ T5948] netlink: 4 bytes leftover after parsing attributes in process `syz.0.407'. [ 165.638447][ T5948] device bridge_slave_1 left promiscuous mode [ 165.802652][ T5948] bridge0: port 2(bridge_slave_1) entered disabled state [ 167.658310][ T5948] device bridge_slave_0 left promiscuous mode [ 167.743048][ T5948] bridge0: port 1(bridge_slave_0) entered disabled state [ 169.862525][ T5961] input: syz1 as /devices/virtual/input/input9 [ 171.404312][ T5977] snd_dummy snd_dummy.0: control 0:0:0:syz0:16384 is already present [ 173.631588][ T6010] netlink: 8 bytes leftover after parsing attributes in process `syz.3.425'. [ 173.754516][ T6012] netlink: 4 bytes leftover after parsing attributes in process `syz.5.424'. [ 174.131845][ T6012] device bridge_slave_1 left promiscuous mode [ 174.245038][ T6012] bridge0: port 2(bridge_slave_1) entered disabled state [ 174.513040][ T6012] device bridge_slave_0 left promiscuous mode [ 174.553958][ T6012] bridge0: port 1(bridge_slave_0) entered disabled state [ 174.582697][ T26] audit: type=1326 audit(1792335848.458:86): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6018 comm="syz.0.427" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa7e37cb559 code=0x7ffc0000 [ 174.632820][ T26] audit: type=1326 audit(1792335848.458:87): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6018 comm="syz.0.427" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa7e37cb559 code=0x7ffc0000 [ 174.657105][ T26] audit: type=1326 audit(1792335848.488:88): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6018 comm="syz.0.427" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa7e37cb559 code=0x7ffc0000 [ 174.702157][ T26] audit: type=1326 audit(1792335848.488:89): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6018 comm="syz.0.427" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fa7e37cb559 code=0x7ffc0000 [ 174.780129][ T26] audit: type=1326 audit(1792335848.488:90): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6018 comm="syz.0.427" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa7e37cb559 code=0x7ffc0000 [ 174.881855][ T26] audit: type=1326 audit(1792335848.488:91): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6018 comm="syz.0.427" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa7e37cb559 code=0x7ffc0000 [ 175.392718][ T26] audit: type=1326 audit(1792335848.488:92): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6018 comm="syz.0.427" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa7e37cb559 code=0x7ffc0000 [ 175.416873][ T26] audit: type=1326 audit(1792335848.498:93): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6018 comm="syz.0.427" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa7e37cb559 code=0x7ffc0000 [ 175.443764][ T26] audit: type=1326 audit(1792335848.498:94): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6018 comm="syz.0.427" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=0 compat=0 ip=0x7fa7e37cb559 code=0x7ffc0000 [ 175.467705][ T26] audit: type=1326 audit(1792335848.498:95): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6018 comm="syz.0.427" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa7e37cb559 code=0x7ffc0000 [ 178.708693][ T6051] netlink: 4 bytes leftover after parsing attributes in process `syz.6.434'. [ 178.760386][ T6056] jffs2: notice: (6056) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 178.807678][ T6053] Bluetooth: received HCILL_WAKE_UP_IND in state 2 [ 178.819358][ T4188] Bluetooth: hci2: sending frame failed (-49) [ 179.366787][ T6078] netlink: 8 bytes leftover after parsing attributes in process `syz.3.442'. [ 180.852374][ T7] Bluetooth: hci2: command 0x1003 tx timeout [ 180.858530][ T4188] Bluetooth: hci2: sending frame failed (-49) [ 181.268221][ T7] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 181.572193][ T7] usb 4-1: Using ep0 maxpacket: 8 [ 181.717773][ T7] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 181.739763][ T7] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 181.790665][ T7] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 181.830228][ T7] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 181.868544][ T7] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 181.903102][ T7] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 181.933003][ T7] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 182.094522][ T4274] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 182.252254][ T7] usb 4-1: usb_control_msg returned -32 [ 182.257908][ T7] usbtmc 4-1:16.0: can't read capabilities [ 182.354569][ T4274] usb 3-1: Using ep0 maxpacket: 32 [ 182.472316][ T4274] usb 3-1: config index 0 descriptor too short (expected 29220, got 36) [ 182.501111][ T4274] usb 3-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 182.521375][ T4274] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 182.541668][ T4274] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 182.553380][ T4274] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 182.564487][ T4274] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 182.578044][ T4274] usb 3-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 182.587566][ T4274] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 182.606105][ T4274] usb 3-1: config 0 descriptor?? [ 182.863494][ T4274] usblp 3-1:0.0: usblp1: USB Bidirectional printer dev 8 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 182.922501][ T4274] usb 4-1: USB disconnect, device number 5 [ 182.957371][ T7] Bluetooth: hci2: command 0x1001 tx timeout [ 182.967567][ T4188] Bluetooth: hci2: sending frame failed (-49) [ 183.076791][ T4312] usb 3-1: USB disconnect, device number 8 [ 183.100301][ T4312] usblp1: removed [ 183.549730][ T6151] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 183.670126][ T6151] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 183.789778][ T6151] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 183.862339][ T4311] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 183.915109][ T6151] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 184.021433][ T6151] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 184.061655][ T6151] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 184.096227][ T6151] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 184.139929][ T6151] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 184.287099][ T4311] usb 4-1: config 0 has no interfaces? [ 184.462371][ T4311] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 184.471499][ T4311] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 184.628392][ T4311] usb 4-1: Product: syz [ 184.633092][ T4311] usb 4-1: Manufacturer: syz [ 184.637735][ T4311] usb 4-1: SerialNumber: syz [ 184.647879][ T4311] usb 4-1: config 0 descriptor?? [ 185.000453][ T1346] usb 4-1: USB disconnect, device number 6 [ 185.022462][ T4311] Bluetooth: hci2: command 0x1009 tx timeout [ 185.351468][ T6080] Set syz1 is full, maxelem 65536 reached [ 185.411240][ T26] kauditd_printk_skb: 54 callbacks suppressed [ 185.411257][ T26] audit: type=1326 audit(1792335859.278:150): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6184 comm="syz.6.466" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdd0f389559 code=0x7ffc0000 [ 185.504439][ T26] audit: type=1326 audit(1792335859.328:151): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6184 comm="syz.6.466" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7fdd0f389559 code=0x7ffc0000 [ 185.568476][ T26] audit: type=1326 audit(1792335859.328:152): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6184 comm="syz.6.466" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdd0f389559 code=0x7ffc0000 [ 185.640888][ T6191] 9pnet: Insufficient options for proto=fd [ 185.647541][ T26] audit: type=1326 audit(1792335859.328:153): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6184 comm="syz.6.466" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7fdd0f389559 code=0x7ffc0000 [ 185.671572][ C1] vkms_vblank_simulate: vblank timer overrun [ 185.757194][ T26] audit: type=1326 audit(1792335859.328:154): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6184 comm="syz.6.466" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdd0f389559 code=0x7ffc0000 [ 185.812172][ T26] audit: type=1326 audit(1792335859.328:155): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6184 comm="syz.6.466" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7fdd0f389559 code=0x7ffc0000 [ 185.876255][ T26] audit: type=1326 audit(1792335859.328:156): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6184 comm="syz.6.466" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdd0f389559 code=0x7ffc0000 [ 185.900321][ C1] vkms_vblank_simulate: vblank timer overrun [ 185.931475][ T26] audit: type=1326 audit(1792335859.328:157): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6184 comm="syz.6.466" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=289 compat=0 ip=0x7fdd0f389559 code=0x7ffc0000 [ 185.965805][ T6204] 9pnet_virtio: no channels available for device syz [ 185.969547][ T26] audit: type=1326 audit(1792335859.328:158): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6184 comm="syz.6.466" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdd0f389559 code=0x7ffc0000 [ 186.043778][ T26] audit: type=1326 audit(1792335859.328:159): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6184 comm="syz.6.466" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fdd0f389559 code=0x7ffc0000 [ 186.067824][ C1] vkms_vblank_simulate: vblank timer overrun [ 186.076531][ T6204] netlink: 20 bytes leftover after parsing attributes in process `syz.3.475'. [ 186.150385][ T6205] lo speed is unknown, defaulting to 1000 [ 186.335357][ C1] Unknown status report in ack skb [ 186.428384][ T6223] netlink: 5920 bytes leftover after parsing attributes in process `syz.3.479'. [ 186.888195][ T6238] netlink: 4 bytes leftover after parsing attributes in process `syz.6.483'. [ 186.901887][ T6238] device bridge_slave_1 left promiscuous mode [ 186.913087][ T6238] bridge0: port 2(bridge_slave_1) entered disabled state [ 186.935785][ T6238] device bridge_slave_0 left promiscuous mode [ 186.949243][ T6238] bridge0: port 1(bridge_slave_0) entered disabled state [ 187.423549][ T6240] netlink: 'syz.0.477': attribute type 6 has an invalid length. [ 187.701065][ T6269] FAULT_INJECTION: forcing a failure. [ 187.701065][ T6269] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 187.771969][ T6269] CPU: 1 PID: 6269 Comm: syz.6.490 Not tainted syzkaller #0 [ 187.779328][ T6269] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 187.789443][ T6269] Call Trace: [ 187.792758][ T6269] [ 187.795717][ T6269] dump_stack_lvl+0x188/0x250 [ 187.800458][ T6269] ? show_regs_print_info+0x20/0x20 [ 187.805698][ T6269] ? load_image+0x410/0x410 [ 187.810366][ T6269] ? __lock_acquire+0x7d40/0x7d40 [ 187.815523][ T6269] should_fail+0x383/0x4b0 [ 187.819985][ T6269] prepare_alloc_pages+0x1e3/0x5b0 [ 187.825145][ T6269] __alloc_pages+0x11b/0x480 [ 187.829775][ T6269] ? zone_statistics+0x170/0x170 [ 187.834764][ T6269] ? up_write+0x1b6/0x410 [ 187.839134][ T6269] alloc_pages_vma+0x2bc/0x790 [ 187.843934][ T6269] handle_mm_fault+0x23be/0x4440 [ 187.848926][ T6269] ? get_page+0xe0/0xe0 [ 187.853128][ T6269] ? follow_page_mask+0x272/0x12b0 [ 187.858282][ T6269] ? vma_is_secretmem+0x9/0x40 [ 187.863112][ T6269] ? check_vma_flags+0x359/0x470 [ 187.868096][ T6269] __get_user_pages+0x952/0x11e0 [ 187.873099][ T6269] ? populate_vma_page_range+0x290/0x290 [ 187.878777][ T6269] ? __might_sleep+0xf0/0xf0 [ 187.883406][ T6269] ? read_lock_is_recursive+0x10/0x10 [ 187.888832][ T6269] __get_user_pages_remote+0x1c2/0x730 [ 187.894342][ T6269] ? get_user_pages_remote+0x55/0xa0 [ 187.899672][ T6269] get_arg_page+0x11b/0x350 [ 187.904219][ T6269] ? copy_string_kernel+0x280/0x280 [ 187.909444][ T6269] ? up_write+0x1b6/0x410 [ 187.913816][ T6269] copy_string_kernel+0x14d/0x280 [ 187.918883][ T6269] do_execveat_common+0x360/0x6b0 [ 187.923948][ T6269] __x64_sys_execveat+0xc0/0xe0 [ 187.928839][ T6269] do_syscall_64+0x4c/0xa0 [ 187.933289][ T6269] ? clear_bhb_loop+0x30/0x80 [ 187.938004][ T6269] ? clear_bhb_loop+0x30/0x80 [ 187.942744][ T6269] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 187.948670][ T6269] RIP: 0033:0x7fdd0f389559 [ 187.953112][ T6269] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 187.972766][ T6269] RSP: 002b:00007fdd0d5e1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000142 [ 187.981240][ T6269] RAX: ffffffffffffffda RBX: 00007fdd0f610fa0 RCX: 00007fdd0f389559 [ 187.989249][ T6269] RDX: 0000000000000000 RSI: 0000200000000940 RDI: 0000000000000008 [ 187.997253][ T6269] RBP: 00007fdd0f420ab8 R08: 0000000000001000 R09: 0000000000000000 [ 188.005285][ T6269] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 188.013292][ T6269] R13: 00007fdd0f611038 R14: 00007fdd0f610fa0 R15: 00007ffc8bf447d8 [ 188.021321][ T6269] [ 188.024547][ C1] vkms_vblank_simulate: vblank timer overrun [ 188.070093][ T6274] FAULT_INJECTION: forcing a failure. [ 188.070093][ T6274] name failslab, interval 1, probability 0, space 0, times 0 [ 188.122283][ T6274] CPU: 0 PID: 6274 Comm: syz.3.491 Not tainted syzkaller #0 [ 188.129640][ T6274] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 188.139897][ T6274] Call Trace: [ 188.143202][ T6274] [ 188.146153][ T6274] dump_stack_lvl+0x188/0x250 [ 188.150860][ T6274] ? show_regs_print_info+0x20/0x20 [ 188.156081][ T6274] ? load_image+0x410/0x410 [ 188.160605][ T6274] ? __might_sleep+0xf0/0xf0 [ 188.165212][ T6274] ? __lock_acquire+0x7d40/0x7d40 [ 188.170375][ T6274] should_fail+0x383/0x4b0 [ 188.174835][ T6274] should_failslab+0x5/0x20 [ 188.179372][ T6274] slab_pre_alloc_hook+0x51/0xc0 [ 188.184342][ T6274] __kmalloc+0x6b/0x340 [ 188.188665][ T6274] ? ops_init+0x8a/0x5f0 [ 188.193037][ T6274] ops_init+0x8a/0x5f0 [ 188.197140][ T6274] setup_net+0x39e/0xa10 [ 188.201417][ T6274] ? copy_net_ns+0x5b0/0x5b0 [ 188.206043][ T6274] ? copy_net_ns+0x324/0x5b0 [ 188.210688][ T6274] ? down_read_killable+0x1ce/0x340 [ 188.215923][ T6274] copy_net_ns+0x33e/0x5b0 [ 188.220372][ T6274] create_new_namespaces+0x3ce/0x700 [ 188.225699][ T6274] unshare_nsproxy_namespaces+0x116/0x160 [ 188.231475][ T6274] ksys_unshare+0x4f6/0x8e0 [ 188.236033][ T6274] ? __lock_acquire+0x7d40/0x7d40 [ 188.241094][ T6274] ? sighand_ctor+0x40/0x40 [ 188.245961][ T6274] ? lock_chain_count+0x20/0x20 [ 188.250838][ T6274] ? syscall_enter_from_user_mode+0x21/0x70 [ 188.256755][ T6274] __x64_sys_unshare+0x34/0x40 [ 188.261536][ T6274] do_syscall_64+0x4c/0xa0 [ 188.265981][ T6274] ? clear_bhb_loop+0x30/0x80 [ 188.270675][ T6274] ? clear_bhb_loop+0x30/0x80 [ 188.275377][ T6274] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 188.281300][ T6274] RIP: 0033:0x7efc90998559 [ 188.285733][ T6274] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 188.305356][ T6274] RSP: 002b:00007efc8ebf0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 188.313795][ T6274] RAX: ffffffffffffffda RBX: 00007efc90c1ffa0 RCX: 00007efc90998559 [ 188.321783][ T6274] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 [ 188.329774][ T6274] RBP: 00007efc90a2fab8 R08: 0000000000000000 R09: 0000000000000000 [ 188.337769][ T6274] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 188.345768][ T6274] R13: 00007efc90c20038 R14: 00007efc90c1ffa0 R15: 00007ffd68e08bf8 [ 188.353773][ T6274] [ 188.581488][ T6285] netlink: 4 bytes leftover after parsing attributes in process `syz.6.495'. [ 188.696726][ T6291] netlink: 4 bytes leftover after parsing attributes in process `syz.0.494'. [ 189.249049][ T6311] netlink: 8 bytes leftover after parsing attributes in process `syz.5.498'. [ 189.458689][ T6312] netlink: 12 bytes leftover after parsing attributes in process `syz.3.500'. [ 190.765656][ T6330] 9pnet_virtio: no channels available for device syz [ 190.927124][ T6341] netlink: 4 bytes leftover after parsing attributes in process `syz.3.506'. [ 190.962417][ T6341] device bridge_slave_1 left promiscuous mode [ 190.968722][ T6341] bridge0: port 2(bridge_slave_1) entered disabled state [ 191.012315][ T4311] Bluetooth: hci4: command 0x0406 tx timeout [ 191.022188][ T4311] Bluetooth: hci1: command 0x0406 tx timeout [ 191.089219][ T6341] device bridge_slave_0 left promiscuous mode [ 191.109940][ T6341] bridge0: port 1(bridge_slave_0) entered disabled state [ 191.529234][ T6363] netlink: 4 bytes leftover after parsing attributes in process `syz.6.513'. [ 192.301378][ T6374] netlink: 8 bytes leftover after parsing attributes in process `syz.5.514'. [ 193.510311][ T26] kauditd_printk_skb: 3 callbacks suppressed [ 193.510328][ T26] audit: type=1400 audit(1792335867.378:163): apparmor="STATUS" operation="profile_load" info="parent does not exist" error=-2 profile="unconfined" name="//o" pid=6400 comm="syz.2.522" [ 193.598359][ T6402] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 194.034917][ T6423] netlink: 'syz.2.526': attribute type 10 has an invalid length. [ 194.057947][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.064392][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.170030][ T6402] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 194.300558][ T6437] netlink: 8 bytes leftover after parsing attributes in process `syz.3.529'. [ 194.387578][ T6440] netlink: 4 bytes leftover after parsing attributes in process `syz.2.530'. [ 195.130717][ T6402] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 195.257962][ T6402] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 195.549120][ T6402] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 195.621963][ T4195] [ 195.624361][ T4195] ====================================================== [ 195.631435][ T4195] WARNING: possible circular locking dependency detected [ 195.638490][ T4195] syzkaller #0 Not tainted [ 195.642925][ T4195] ------------------------------------------------------ [ 195.646482][ T6402] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 195.649960][ T4195] kworker/u5:4/4195 is trying to acquire lock: [ 195.649972][ T4195] ffffffff8e3b4048 (rfcomm_mutex){+.+.}-{3:3}, at: rfcomm_security_cfm+0x95/0x780 [ 195.673503][ T4195] [ 195.673503][ T4195] but task is already holding lock: [ 195.680934][ T4195] ffffffff8e3946c8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_key_refresh_complete_evt+0x3d6/0x880 [ 195.691413][ T4195] [ 195.691413][ T4195] which lock already depends on the new lock. [ 195.691413][ T4195] [ 195.701870][ T4195] [ 195.701870][ T4195] the existing dependency chain (in reverse order) is: [ 195.710913][ T4195] [ 195.710913][ T4195] -> #2 (hci_cb_list_lock){+.+.}-{3:3}: [ 195.718819][ T4195] __mutex_lock_common+0x1e5/0x2400 [ 195.724572][ T4195] mutex_lock_nested+0x17/0x20 [ 195.729914][ T4195] hci_remote_features_evt+0x5d9/0xa10 [ 195.735924][ T4195] hci_event_packet+0x600/0x1310 [ 195.741416][ T4195] hci_rx_work+0x255/0xa10 [ 195.746392][ T4195] process_one_work+0x867/0xff0 [ 195.751787][ T4195] worker_thread+0xad7/0x12a0 [ 195.757014][ T4195] kthread+0x42e/0x520 [ 195.761627][ T4195] ret_from_fork+0x1f/0x30 [ 195.766596][ T4195] [ 195.766596][ T4195] -> #1 (&hdev->lock){+.+.}-{3:3}: [ 195.773923][ T4195] __mutex_lock_common+0x1e5/0x2400 [ 195.779691][ T4195] mutex_lock_nested+0x17/0x20 [ 195.785005][ T4195] l2cap_chan_connect+0xfb/0xe20 [ 195.790589][ T4195] l2cap_sock_connect+0x5a3/0x770 [ 195.796177][ T4195] kernel_connect+0x11c/0x180 [ 195.801407][ T4195] rfcomm_dlc_open+0x600/0x10c0 [ 195.806830][ T4195] rfcomm_sock_connect+0x2e9/0x600 [ 195.812492][ T4195] __sys_connect+0x3cb/0x450 [ 195.817646][ T4195] __x64_sys_connect+0x76/0x80 [ 195.822966][ T4195] do_syscall_64+0x4c/0xa0 [ 195.825508][ T6402] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 195.827928][ T4195] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 195.827956][ T4195] [ 195.827956][ T4195] -> #0 (rfcomm_mutex){+.+.}-{3:3}: [ 195.849925][ T4195] __lock_acquire+0x38f7/0x7d40 [ 195.855331][ T4195] lock_acquire+0x19f/0x400 [ 195.860414][ T4195] __mutex_lock_common+0x1e5/0x2400 [ 195.866166][ T4195] mutex_lock_nested+0x17/0x20 [ 195.871474][ T4195] rfcomm_security_cfm+0x95/0x780 [ 195.877045][ T4195] hci_key_refresh_complete_evt+0x44f/0x880 [ 195.883488][ T4195] hci_event_packet+0x5d6/0x1310 [ 195.888971][ T4195] hci_rx_work+0x255/0xa10 [ 195.893935][ T4195] process_one_work+0x867/0xff0 [ 195.899337][ T4195] worker_thread+0xad7/0x12a0 [ 195.904591][ T4195] kthread+0x42e/0x520 [ 195.909209][ T4195] ret_from_fork+0x1f/0x30 [ 195.914179][ T4195] [ 195.914179][ T4195] other info that might help us debug this: [ 195.914179][ T4195] [ 195.924428][ T4195] Chain exists of: [ 195.924428][ T4195] rfcomm_mutex --> &hdev->lock --> hci_cb_list_lock [ 195.924428][ T4195] [ 195.936969][ T4195] Possible unsafe locking scenario: [ 195.936969][ T4195] [ 195.944479][ T4195] CPU0 CPU1 [ 195.949886][ T4195] ---- ---- [ 195.955272][ T4195] lock(hci_cb_list_lock); [ 195.959816][ T4195] lock(&hdev->lock); [ 195.966429][ T4195] lock(hci_cb_list_lock); [ 195.973474][ T4195] lock(rfcomm_mutex); [ 195.977659][ T4195] [ 195.977659][ T4195] *** DEADLOCK *** [ 195.977659][ T4195] [ 195.985846][ T4195] 4 locks held by kworker/u5:4/4195: [ 195.991157][ T4195] #0: ffff88805ea2b938 ((wq_completion)hci3#2){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 [ 195.994323][ T6402] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 196.001479][ T4195] #1: ffffc90002fafd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 [ 196.020960][ T4195] #2: ffff88807bda8478 (&hdev->lock){+.+.}-{3:3}, at: hci_key_refresh_complete_evt+0x5e/0x880 [ 196.031364][ T4195] #3: ffffffff8e3946c8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_key_refresh_complete_evt+0x3d6/0x880 [ 196.042290][ T4195] [ 196.042290][ T4195] stack backtrace: [ 196.048205][ T4195] CPU: 0 PID: 4195 Comm: kworker/u5:4 Not tainted syzkaller #0 [ 196.055806][ T4195] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 196.065889][ T4195] Workqueue: hci3 hci_rx_work [ 196.070618][ T4195] Call Trace: [ 196.073926][ T4195] [ 196.077032][ T4195] dump_stack_lvl+0x188/0x250 [ 196.081745][ T4195] ? load_image+0x410/0x410 [ 196.086275][ T4195] ? show_regs_print_info+0x20/0x20 [ 196.091504][ T4195] ? print_circular_bug+0x12b/0x1a0 [ 196.096731][ T4195] check_noncircular+0x2f8/0x400 [ 196.101697][ T4195] ? print_deadlock_bug+0x5d0/0x5d0 [ 196.106920][ T4195] ? lockdep_lock+0xf1/0x1f0 [ 196.111567][ T4195] ? mark_lock+0x94/0x320 [ 196.115930][ T4195] ? _find_first_zero_bit+0xd1/0xf0 [ 196.121168][ T4195] __lock_acquire+0x38f7/0x7d40 [ 196.126066][ T4195] ? verify_lock_unused+0x140/0x140 [ 196.131496][ T4195] lock_acquire+0x19f/0x400 [ 196.136041][ T4195] ? rfcomm_security_cfm+0x95/0x780 [ 196.141283][ T4195] ? __might_sleep+0xf0/0xf0 [ 196.145900][ T4195] ? read_lock_is_recursive+0x10/0x10 [ 196.151310][ T4195] __mutex_lock_common+0x1e5/0x2400 [ 196.156538][ T4195] ? rfcomm_security_cfm+0x95/0x780 [ 196.161767][ T4195] ? rcu_lock_release+0x20/0x20 [ 196.166648][ T4195] ? __mutex_trylock_common+0x15c/0x260 [ 196.172238][ T4195] ? rfcomm_security_cfm+0x95/0x780 [ 196.177520][ T4195] ? mutex_lock_io_nested+0x60/0x60 [ 196.182758][ T4195] ? l2cap_security_cfm+0x12b4/0x1340 [ 196.188169][ T4195] ? l2cap_disconn_cfm+0xc0/0xc0 [ 196.193178][ T4195] mutex_lock_nested+0x17/0x20 [ 196.198007][ T4195] rfcomm_security_cfm+0x95/0x780 [ 196.203065][ T4195] ? mark_lock+0x94/0x320 [ 196.207450][ T4195] ? rfcomm_send_msc+0x340/0x340 [ 196.212425][ T4195] ? rfcomm_send_msc+0x340/0x340 [ 196.217389][ T4195] hci_key_refresh_complete_evt+0x44f/0x880 [ 196.223320][ T4195] hci_event_packet+0x5d6/0x1310 [ 196.228295][ T4195] ? _raw_spin_unlock+0x40/0x40 [ 196.233179][ T4195] ? rcu_lock_release+0x20/0x20 [ 196.238063][ T4195] ? hci_send_to_monitor+0x9c/0x4a0 [ 196.243290][ T4195] hci_rx_work+0x255/0xa10 [ 196.247716][ T4195] process_one_work+0x867/0xff0 [ 196.252587][ T4195] ? worker_detach_from_pool+0x240/0x240 [ 196.258222][ T4195] ? lockdep_hardirqs_off+0x70/0x100 [ 196.263536][ T4195] ? _raw_spin_lock_irq+0xb7/0xf0 [ 196.268562][ T4195] ? _raw_spin_lock_irqsave+0x100/0x100 [ 196.274127][ T4195] ? wq_worker_running+0x97/0x170 [ 196.279150][ T4195] worker_thread+0xad7/0x12a0 [ 196.283834][ T4195] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 196.289730][ T4195] kthread+0x42e/0x520 [ 196.293794][ T4195] ? rcu_lock_release+0x20/0x20 [ 196.298650][ T4195] ? kthread_blkcg+0xd0/0xd0 [ 196.303237][ T4195] ret_from_fork+0x1f/0x30 [ 196.307657][ T4195] [ 196.310777][ C0] vkms_vblank_simulate: vblank timer overrun [ 202.452146][ T4311] Bluetooth: hci3: command 0x0406 tx timeout