last executing test programs: 25.565923348s ago: executing program 0 (id=16): recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) ioctl$USBDEVFS_DISCONNECT_CLAIM(r0, 0x8108551b, 0x0) ioctl$USBDEVFS_ALLOW_SUSPEND(r0, 0x5522) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) sendmmsg(r4, &(0x7f0000004f80), 0x0, 0x587f20aa2bc1cbd7) mq_open(&(0x7f00000000c0)='${$\x00', 0x840, 0x0, 0x0) r5 = syz_io_uring_setup(0x9e, &(0x7f0000000640)={0x0, 0xec25, 0x0, 0x0, 0x2fb}, &(0x7f0000000140)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, 0x0, 0x0) getpeername$l2tp(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @local}, 0x0) io_uring_enter(r5, 0x847ba, 0x0, 0xe, 0x0, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000100), 0xffffffffffffffff) mount$tmpfs(0x0, &(0x7f0000000540)='./cgroup\x00', &(0x7f0000000580), 0x0, &(0x7f0000000000)={[{@mpol={'mpol', 0x3d, {'interleave', '=relative', @val={0x3a, [0x30, 0x2d, 0x39]}}}}]}) ioctl$USBDEVFS_SETINTERFACE(r0, 0x80045510, &(0x7f0000000000)) 22.907695489s ago: executing program 1 (id=18): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$packet(0x11, 0x2, 0x300) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) sendto$packet(r4, &(0x7f0000000080)="a99c383d33c9c607b1b9d49688a883", 0xf, 0x0, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x14) recvmmsg(r3, &(0x7f0000000480)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=""/11, 0x17}}], 0x400000000000179, 0x10022, 0x0) 21.568059515s ago: executing program 3 (id=19): r0 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x80000, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0) fsopen(&(0x7f0000000380)='btrfs\x00', 0x1) socket$kcm(0x2, 0x200000000000001, 0x0) r4 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000900)=[{0x0}], 0x1}, 0x0) r5 = socket$inet6(0xa, 0x1, 0x0) sendto$inet6(r5, 0x0, 0x0, 0xfffffeffffff7ffe, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) syz_open_procfs(0x0, 0x0) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x121003, 0x0) ioctl$FS_IOC_SETFLAGS(r6, 0x40081271, &(0x7f0000000980)=0x4000) mount(&(0x7f0000000140)=@nullb, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000040)='nilfs2\x00', 0x208000, 0x0) 20.401662101s ago: executing program 2 (id=20): r0 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x80000, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0) r4 = fsopen(&(0x7f0000000380)='btrfs\x00', 0x1) socket$kcm(0x2, 0x200000000000001, 0x0) r5 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000900)=[{0x0}], 0x1}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) 20.396971512s ago: executing program 4 (id=21): r0 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x80000, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0) r4 = fsopen(&(0x7f0000000380)='btrfs\x00', 0x1) socket$kcm(0x2, 0x200000000000001, 0x0) r5 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000900)=[{0x0}], 0x1}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0xfffffeffffff7ffe, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) syz_open_procfs(0x0, 0x0) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x121003, 0x0) ioctl$FS_IOC_SETFLAGS(r6, 0x40081271, &(0x7f0000000980)=0x4000) mount(&(0x7f0000000140)=@nullb, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000040)='nilfs2\x00', 0x208000, 0x0) 18.969811955s ago: executing program 0 (id=22): ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, &(0x7f0000000040)) syz_emit_ethernet(0x3e, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mount$bind(0x0, 0x0, 0x0, 0x100000, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x40000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="ae", 0x1, 0xffffffffffffffff) keyctl$read(0x2, r3, &(0x7f00000003c0)=""/4096, 0x1000) 17.66575181s ago: executing program 3 (id=23): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x141080) openat$audio(0xffffffffffffff9c, 0x0, 0x80002, 0x0) 16.327773495s ago: executing program 2 (id=24): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x0) pwrite64(r1, &(0x7f0000000140)='2', 0xfdef, 0xfecc) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x141080) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r5, 0x40045532, &(0x7f0000000200)=0x5) r6 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100), 0x80002, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r6, 0xc0045006, &(0x7f0000000700)=0x31) r7 = accept4(r0, 0x0, 0x0, 0x0) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@newsa={0xf0, 0x10, 0x413, 0x70bd26, 0x0, {{@in6=@loopback, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x20, 0x7, 0x4e24, 0x0, 0xa, 0x20, 0xa0, 0x1d}, {@in6=@private1, 0x0, 0x32}, @in=@multicast2, {0x4, 0x7, 0x0, 0x40000000000004, 0xffffffffffffffff, 0xff, 0x7f}, {0x0, 0xffffffffffffffff, 0x2}, {0xf6, 0x4, 0x8}, 0x0, 0x3501, 0xa, 0x1, 0xfe}}, 0xf0}}, 0x40844) sendmsg$nl_route_sched_retired(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000012100), 0xe078}}, 0x0) 16.274921613s ago: executing program 4 (id=25): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioprio_set$uid(0x3, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SET_MM(0x23, 0xa, &(0x7f00002d5000/0x2000)=nil) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='environ\x00') preadv(r3, 0x0, 0x0, 0xc002a0, 0x0) 15.028327611s ago: executing program 0 (id=26): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x11, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000ffffffff000000000000000085000000a8000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB], &(0x7f0000000b00)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 15.027914378s ago: executing program 1 (id=27): connect$inet6(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) flistxattr(r1, 0x0, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x42000773) 15.020959719s ago: executing program 3 (id=28): r0 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x80000, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0) fsopen(&(0x7f0000000380)='btrfs\x00', 0x1) socket$kcm(0x2, 0x200000000000001, 0x0) r4 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000900)=[{0x0}], 0x1}, 0x0) socket$inet6(0xa, 0x1, 0x0) syz_open_procfs(0x0, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x121003, 0x0) mount(&(0x7f0000000140)=@nullb, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000040)='nilfs2\x00', 0x208000, 0x0) 13.765499109s ago: executing program 4 (id=29): syz_open_dev$tty1(0xc, 0x4, 0x1) socket$inet(0x2, 0x1, 0x100) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) tkill(0x0, 0xb) syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42f82, 0x0) ioctl$SNDCTL_DSP_SPEED(r4, 0xc0045002, &(0x7f0000000180)) write$dsp(r4, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) 13.02465174s ago: executing program 2 (id=30): r0 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x80000, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0) r3 = fsopen(&(0x7f0000000380)='btrfs\x00', 0x1) socket$kcm(0x2, 0x200000000000001, 0x0) r4 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000900)=[{0x0}], 0x1}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r5 = socket$inet6(0xa, 0x1, 0x0) sendto$inet6(r5, 0x0, 0x0, 0xfffffeffffff7ffe, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) syz_open_procfs(0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40081271, &(0x7f0000000980)=0x4000) mount(&(0x7f0000000140)=@nullb, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000040)='nilfs2\x00', 0x208000, 0x0) 12.349968642s ago: executing program 1 (id=31): prlimit64(0x0, 0xe, &(0x7f0000000440)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x44, &(0x7f0000000000)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x36, 0x0, 0x0, 0x81, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x9, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x65, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}, "00186371ae9b"}}}}}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x6, 0x3, &(0x7f0000000280)=ANY=[@ANYBLOB="180000"], 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0xffffffffffffff6b, &(0x7f0000000000)="ff", 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x48) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r4, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r4, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendmmsg$inet(r4, &(0x7f0000000d00)=[{{0x0, 0x0, &(0x7f0000002c00)=[{&(0x7f0000001500)="06", 0x1}, {&(0x7f0000002800)="cf", 0x1}, {&(0x7f0000000380)="08e0", 0x2}, {&(0x7f0000000180)="8a", 0x1}, {&(0x7f0000000700)="af278d5dce87b01dcbd67184e298d36f", 0x10}], 0x5}}, {{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000003000)="e1", 0x1}, {&(0x7f00000010c0)="fa", 0x1}, {&(0x7f00000004c0)="d8ace0ee77", 0x5}, {&(0x7f0000001600)="f2", 0x1}, {&(0x7f0000000500)="ffe2", 0x2}, {&(0x7f00000006c0)="7940e900e0", 0x5}, {&(0x7f0000000100)="f00998", 0x3}], 0x7}}, {{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000880)="87", 0x1}, {&(0x7f00000005c0)="1121f722fe", 0x5}, {&(0x7f0000000280)="e3a00a47e0", 0x5}, {&(0x7f0000000240)="b09c9e4239984af70cca74c668", 0xd}], 0x4}}], 0x3, 0x4000000) setsockopt$sock_int(r4, 0x1, 0x20, &(0x7f0000000000)=0x7fffffff, 0x4) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, 0x0, 0x0) 11.309760481s ago: executing program 0 (id=32): sendmsg$sock(0xffffffffffffffff, 0x0, 0x240408c0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = socket$kcm(0x11, 0x200000000000002, 0x300) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{}, {0x10040002}]}, 0x94) recvmsg$unix(r1, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0x12, &(0x7f00000008c0)=r2, 0x4) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000002380)=ANY=[@ANYBLOB="b702000006000000bfa300000000000007030000407effff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000496cf2827fb43a431ca7ebfcd0cd00006ed3d09a6175037958e271b60dedf8937f02008b6d83923dd29c034055d47dafe6c8dc3d5d78c07f34e4d5b3185b310efd4989147a00000000f110026e6d2ef831ab7ea0c34f17e3adeef3bb622003b538dfd8e012e71f6420b90adddff61b5b0a341a2d7cbdb90000bdb2ca76050000003a14817ac61e4dd11183a13477bf7e060e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132658555cf476619f28d9961b626c57c2691208171656d60a17e3c1c4b751ca532e6ea09c346df3d7cb4ebd31a08b32808b80200000000000000334d83239d1d2e9ff10ff2d27080e71113610e10c358e8327e7050b6c860dac12233f9a1fb9c2aec61ce63a38d316ef49b66d6e42fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a5f3d74ca891c4594e8a4399e01eadd3964663e88535c133f7130856f75643619f567d2e24f29e5dad9326edb697a6ea0182babc18cefd07e002cab5ebfcaad34732181feb215139f15eadddcb0c7cbe31fbae7c34d5ac5e7e64c21add9191eadd6e1795ad6a0f7f8cd3fccbdc3dec04b25dfc17975238345d4f71af35910b158e56657b7218baaa7cbf781c0a99bd50499ccff0f000000000000c7beba3da8223fe5308e4e2833baace04f4087c4f0da0d9a88f9dbb593ddeb3f0932a4d0175b889b8eccf707882042e716df9b57b290c661d4e85031086e97bcc5ca0e221a0e34323c129102b7b7a643e82e88a1940b3c02ed9c92d6f64b1282dc519b00159830d7617001154c46bd3ca96318c570f0721fc7aa2a580900000000000000b4f22cdf550ef091a78098534f0d973058594119d06d5ea9a8d085734000000000000000c12346e47ad97f4ead7cf754a52e4b2d0f22d428bd705414888700a30e2366c6a06b3367a389ca39059787790017b0689a1f3db9c24db65c1e00015c1d573dab18fd0600885f1ea8f2fd299fc3cdafda323e9c7080397bc49d70c060d57bc88fbe09baa058b040360ab9261503d2f363fb099408885afc2bf9a4f8c3506b669e889f5e4be1b8e0d634ebc1057b7e98186fc5141bd670dba6f43279f73db9dec75070cd9ab0fd969169ef6d2857b6bf955012cf7fe50d133da86e0477e42b98a6cc999dc21c3ef408e633dfa35f14d6e734837d365e63845f3c1092f8e34fc7eac9e8af3904ea0f3698cd9492794b82649b50d726bff873339c4cad4ead1348474250eda2c8067ab730c1d85969b95a2a5687f2ed690000522a0b7426000000000000000000000000000000000000000093fc7a82b98f99d9dedf7ba17f5f0b6d15e552fbd21f7eecff10243a43af03eea84c4304a5d3f93c02000000000000000043e1ed82b9aa0ae92a499984a009000000937523f5292d12659906005cde64f903c3415c458a2b32c2318f0858f19c6def80e1481e8e1c0098fc3f38b7a57211adb15d824cfdcf229628c0de49860a44286fe0e257cfa4ce50f3d10763d442824414a73c06837fe08de62f8710ca977960b74d0000ce73da6022a8671d1a3575b4e18c28c73203bf134686dd65808452cb6b76fcb134252c78de9b240de7b4cd015a77f76bb6470c05fc980b3d8f3f964f432a4bf6cddd6222c2da006b6fdb9c8468ae1d986a893b9519444d16a6dfa92c04331a6698507048fab5ae402acd05fe621f22712dfd09004770b4278fa14547d8ce3c21188e5e4e2baacd98e8e451d6aaaf090000006ed1d9018000008dd952595d78e9583bf4ea5de36099e3cddcb24ebb6eddb9e87c9ece87a42c0000abdf0100000001000000aea1b6eca5a883702b0bf3aeebb225895db90e237157a34e9f447237ea5b391bddd1290f7ce987a0e36b8e71b1779bbe95ffa9c3e0f6ba66e4d48e75253e3d633811e4b3220616aafbe7a3a18375ae593eb58fd500426286472466823cb8e1800aaaa0d9463c0c4ea5541a55df6eeffec0b66482228816cdfccb98374c644eea45de7867a0efbad0ab2bc33b350440a90b791b2b33f74a112a3b91b40bed8db2df8633207f8387e04ca52ab0f3f7b058b13523b896800b992972d9609551c27a5916ea16069c5bf55b98d926d3c27e7945b2999600000000f857bc1332d200194f658b930780603134ae6b7f5092772bd5d880dbe21b790c475b14b7fe4fe002dffd651faa79bb0cee0cdac23c3218f2ddaa6f7ba04b696a30d313bed30ba8f35569a9b07ee7308da09c01a4b827aa17bc2213fc1572b0204dd456b11a454d1f3f14179974aae624ea59500f5e048b2780666de81a040663c57f49af25be909984aea1b81f33426f86b4b941c08dfe2bc8ec246ec1aae120c42405e428923f3a83d9ba5c373f5e8a54120b451e2806370f1ed60c9fd5d9af4d16cb0f413c324da52d4bd2e01d3ac2d578d72e2d63322dfc9245ce3e3a097fb82f4e3b61a57094616020f72f1c55ee3d325c7496a7c2f10cfea516ae436751227378f00ca0f1f6c1dcf879700dd90b96a330f92bff736c83ca53e7f02b734d1a9292896f5d7f244bfab4946c7042e88206f641eafcc5b4ba7a7880533cdeac995d1caf6936f356ecf07a0084e7adc2dc12417997b03087c7b3b44b06f6158a2a18ce0e56ffbeb22f40521dd9972583d413098aa80db98ef324a2bfb7961c07b47521973cf0bb6f5530f6216b447b35d6e06b72b22b29de42bb1bc8ce0a0e3500000000000000000000000000b92eb197e4149627920000008000000000801792756f90b37f0858efc387f559203f314a4b0ed750fa72e5948ac3fe5921c14ef578d413e7b2a9e2f87f7b44949fe14c00000000000047030c09f62d444b4981db81799776eeb444000000009705fa8b56779bc876ad4f8d8c8e50815c4c3b27487996c09121caf47f76158362c74904f89cbc588aae84567a83571ff72bb65c082b5a8dee145ff221159aed2768edc05a3167d84205d5af86553c21e1f023a51c0e179fccfbc201982e3ddcaa45613899d19082453b180ca0c525b8d3cfaf7d0bcddeb5d5c7166038f276a92941393ba5e51f77172822bd903d9f8b436656771774ed88daab0d0cfdd1bf4d30ab566e1a4cb3ad66d830e10f7c1de13218aea21e7def613204c2b7c1ad48b01c208f4032e93408000000000000e96db049b92fc32ee34fe7a3419c8fbf03d61c159dc5864e030000a2c55b614d622b8de966c97e1940026f96db3c78ca18c9f08d1c47edf1a4d7298109f31b6078711ee72eacab84213bf50000000000000000000000000000001217887d0452aa6d26e4614d511710abeec84b78c027c160ba375dfa55a49b832ce4dfb91122193d514ed992c07f8cd6d897b314907e15642da228dbc03429e6e0e7ac118ed351c3b0c44bf5d8b58be573f8333aa8cc2ec5b5e305b3dee2562d415b4b9ed530797f55f9fe8510423409629a09000000000000009a35d9ca93e4b4591679547b8de8af1782451f7b8e1de508f1e9e525210d62bc850f8035040ad9e562be58797515b737bfb21d35ac560f99dbd18dad5e6345a464955e8141d75b6177e4fa176a020b0000000000006e76f0294fee7d19a0f327f8796d77b6e24b8df4bb438b527d10e657d49b844198ea9f93c4fd6fd2daa9bd87fd1e02ecc8075dca1280c201043257e9bd3c9a7aa150eb1711632b76d4dc0555d4bfcfd057980136d6e9000003b24fa300ef90bfe4ad364256937796f941c2faad94785f48777941f0cd3dba54ab6a5d5e91e90ac9ae994c3d4108b2fe7eca9413ac9bc138c74800487eb19c48db3f79be964808f109b5e36fc7fdd41def361427b6b9c118e5c9a0a1d5ca24886e33a7f81b2188ec75a5fc9302e3695bdcc9ab11201ef940569c995c21eeaefe2e8fc02e0433dc7371d1f72124ba263e554c30fdd7cd8c2da1e8706417da9ad8916551a1182fac08603dfc2f2279ba161c13984cd753b54a85e6f3010975e9ff51318b09fa13e2d38ce013aab41524c298c3719e31bcb1f102eaeee69a19e006bcdb1acc2664efa949a1a07bb3d7848d5e1381fbe63c522053a3bb32eb6345e10f7a12bf84e0e196a00833f464dd2f6547f14ebf137fce33efeb813211f31ff24d7dbb00f2574ccda59b3ea068fc2a18c37ee579f5a9ecc47da73684bcadd209ae5bbb7147df74d027d8d0adcdb54182c9de8053fc8b1b9d19c16c53d34db6e26f6a88d449f6abf3010100007e206a758a3f02816b4e097cfa3d46e45e7949c5b10691d49b9693a798a330a1ccb32d49772e80862df36dc0156b3f72cd85083f8e96ca1697457ec722766bd46ee2424975a38149bd57e5c0eb4087fc243e7e51b0aca9f0ab0668d7f2ee9ad9f267d8804417aa7e36a64d489bb84a1483fd3c3ecb024060002858cbb1f7708f5b41fca2fee7c03b1f862ce88dc313d913e041dd7583a1ac41c466757c5dd07ea2c5d62a000000000000000019a4e9a9c2cbc906f97fd6eb71b18d09a5df123ebbdb2827b43aed6a29e9942e402c1ae52e9cb98f3019d364fc21ea12023db91ced3c2f06550cef8a79ed39091e4776001187d0ab2f82478431d36470cc008d745ce8fd64c9aa64da230bb080945a557081b767beb75b1ea856a55c71b8fda672289aa6088630d48ac8039f19fec3acbcc5944a4e6fd44af8f10110db730a8d0d41b4ea36f9510f843a471963bd4621b9e43f08d341bb69df430ac6398c1b28bdd33b69b4b86d7c5f30cf728294e8ea1861ce50c367498945285f73c94d91210652eb4f3077cab6be2a3512eddbcb63d091d69fb1b26c8ada9a9f9355aea34fe55fd0d3011cb83ac03268dc66dd108a4e9944241e1d4ba69212ee0e7526e72c19346d08d3c3c82cb987f1bd2fd9ce2c88082ea23abbf23c6bd43fc9f9f8ea7656e25d3d73cd056b1f782de1fe349fc33546558366ed99940c0fda039272d277a3576d4e0469779d711e10b6bf040f7274fd9577c1c33326d2e60ee611ae226ef00e2944fb727832dc8dad36a6072aacfc4bcefb808ab7b3b95e0f60616320b2a9e1f8fac812daac9983639b35184803b7d192ce1f226e97fa23c37ff95d067a54a8b412644cad9ecc251fbe418a81aaf00cc8d15758ff0eb885a40630396ba76b8fadc09e62ef70c8a0121e7e8322cb8bc0f50ad33a17143a29c14eca0e214d1257e4dd1b6244e31b888d8f3fa03208d3e9a4826a98f31995509015ebdc89f2f3106e54d5898d3758b9bfc9e4924e9cedf7f8fd584e7185703cc5f23741ffb480b5a87cd7efcceb409d354bdab211ebd50affffffff000000003a59a0f952153c2efd10e72ec9ee5fa2a00f9637851ddb81d059f9a363c4ada68dd25f19ee9e4841ac047c1b35ad6f9d54cf4939ce78a55a04e655d7746a3989c6f33b02f8497aacb6bfca7456111900000000000000000048d35af24acb66fdd4d1fb150138f0ee6abfc7049c94346868ed76d3a5df7335184386a5c532d425f1a098ff93efd05e5dd8b765121fbdfe5ef44f6472b939c31883f45889142e82086c2448da60d7a40774d71c2da2e7f6d4fe5d36923213cc7b7d71a1c90006e8f8d84953f284b0eb4366beff5df5595827dcd736e8cfab28cfa416e83c06213ca7fd21af56e3de1d80e77060447e20a8b317a4c06e24e99239824d08abf670a685bc46c8168bee4cfc30cc6d0dc030a592925bad3e0f805f0d4b2b600dc3f0c4c6f75bb4e49982f4198ac90ab77c5572c956d415858bad5ee117b3e5f1507bbd0d7a30388865deb11106a932"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002300)={r3, 0x18000000000002a0, 0xf, 0x0, &(0x7f0000000140)="b9ff0300600d698cff9e14f008004d", 0x0, 0xe00, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 9.884934711s ago: executing program 3 (id=33): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) r2 = openat$adsp1(0xffffffffffffff9c, 0x0, 0xa0201, 0x0) write$dsp(r2, &(0x7f0000000140)="a52876830a60", 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newsa={0xf0, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in=@rand_addr=0x64010101, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in=@rand_addr=0x64010102, 0x4d4, 0x6c}, @in=@dev={0xac, 0x14, 0x14, 0x3f}, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0x2, 0x1, 0x0, 0x20}}, 0xf0}, 0x1, 0x0, 0x0, 0x10008801}, 0x0) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r3, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/78, 0x0}) r4 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udplite(0x2, 0x2, 0x88) sendmsg$FOU_CMD_ADD(r4, 0x0, 0x0) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000001680)) r5 = eventfd2(0x1, 0x1) ioctl$VHOST_SET_VRING_ERR(r3, 0x4008af22, &(0x7f00000001c0)={0x0, r5}) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000240)={0x0, 0x0, 0x0, &(0x7f0000001ac0)=""/191, 0x0, 0xffff1000}) ioctl$VHOST_SET_VRING_KICK(r3, 0x4008af20, &(0x7f0000000000)={0x0, r5}) ioctl$VHOST_VSOCK_SET_RUNNING(r3, 0x4004af61, &(0x7f00000000c0)=0x1) 9.877474746s ago: executing program 1 (id=34): r0 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x80000, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0) r4 = fsopen(&(0x7f0000000380)='btrfs\x00', 0x1) socket$kcm(0x2, 0x200000000000001, 0x0) r5 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000900)=[{0x0}], 0x1}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) 9.875818368s ago: executing program 4 (id=35): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) open_by_handle_at(0xffffffffffffffff, 0x0, 0x1) mlock2(&(0x7f0000627000/0x3000)=nil, 0x3000, 0x0) mlock(&(0x7f0000626000/0x5000)=nil, 0x5000) r3 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x40800) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r3, 0xc058534f, &(0x7f0000002380)={{0x0, 0x1}, 0x0, 0x0, 0x2, {0x4, 0x1}, 0x3, 0x800}) mkdirat(0xffffffffffffff9c, 0x0, 0x195) socket$inet6_sctp(0xa, 0x5, 0x84) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x2, 0x2, 0x0, 0x2, 0xd, 0x0, 0x0, 0x0, [@sadb_key={0x2, 0x8, 0x8, 0x0, "fd"}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x5, 0x0, 0xa0000000}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xff}}}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @empty}}, @sadb_x_nat_t_type={0x1}]}, 0x68}, 0x1, 0x7}, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) r6 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r6, 0x4601, &(0x7f0000000100)={0x400, 0x300, 0xf0, 0x4b0, 0xbbba, 0x2, 0x4b1e214daee7d038, 0x0, {}, {0x2, 0x2}, {0x0, 0x3, 0x20}, {0x1, 0x5}, 0x0, 0x3f0, 0x0, 0x458, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x7, 0x20, 0x3, 0xb}) r7 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r7, 0x11b, 0x6, &(0x7f0000000000)=0x40000000, 0x4) write$binfmt_aout(r5, &(0x7f0000000140)=ANY=[], 0xff2e) timer_settime(0x0, 0x1, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000200)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x2, 0x0, 0x60d3, 0x4}) 6.63931857s ago: executing program 2 (id=36): ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, &(0x7f0000000040)) syz_emit_ethernet(0x3e, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mount$bind(0x0, 0x0, 0x0, 0x100000, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x40000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="ae", 0x1, 0xffffffffffffffff) keyctl$read(0x2, r3, &(0x7f00000003c0)=""/4096, 0x1000) 6.486583043s ago: executing program 1 (id=37): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0}) r2 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x800, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0x3}) socket$inet_sctp(0x2, 0x5, 0x84) socket$inet6_tcp(0xa, 0x1, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280), 0x80a02, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$tty1(0xc, 0x4, 0x2) syz_open_dev$sg(0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x20000000000, 0xfffffffffffffffd, 0x0, 0x0, 0x1000001000, 0x49}, 0x0, 0x0, 0x0, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) r5 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x68000000) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x4e, 0x0, &(0x7f0000000440)="97713b46fbaa2b1044f2d408ffca802db4d770eb9874f493e0ef367e4bde497c403b450c72ff35a1e107fa5c8d3cbb1fa61229a00ecd207d9e6f2a208bf148e6bc56955cb5330000000000000000"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0xc, 0x0, &(0x7f00000004c0)=[@free_buffer={0x40086303, r5}], 0x0, 0x0, 0x0}) 5.39015068s ago: executing program 2 (id=38): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x141080) openat$audio(0xffffffffffffff9c, 0x0, 0x80002, 0x0) 4.310391504s ago: executing program 3 (id=39): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioprio_set$uid(0x3, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SET_MM(0x23, 0xa, &(0x7f00002d5000/0x2000)=nil) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='environ\x00') preadv(r3, 0x0, 0x0, 0xc002a0, 0x0) 3.736556425s ago: executing program 0 (id=40): r0 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x80000, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0) r4 = fsopen(&(0x7f0000000380)='btrfs\x00', 0x1) socket$kcm(0x2, 0x200000000000001, 0x0) r5 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000900)=[{0x0}], 0x1}, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r6 = socket$inet6(0xa, 0x1, 0x0) sendto$inet6(r6, 0x0, 0x0, 0xfffffeffffff7ffe, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) syz_open_procfs(0x0, 0x0) mount(&(0x7f0000000140)=@nullb, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000040)='nilfs2\x00', 0x208000, 0x0) 2.687044539s ago: executing program 4 (id=41): setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f00000000c0)='veth1_to_team\x00', 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x804, &(0x7f0000000080)={0x2, 0x4e22, @multicast1}, 0x10) recvfrom(0xffffffffffffffff, 0x0, 0x14, 0x40018020, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_open_dev$sndmidi(0x0, 0x2, 0x141102) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x2a, 0xa9}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) ioctl$INOTIFY_IOC_SETNEXTWD(0xffffffffffffffff, 0x541b, 0xfffffffffffffffa) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) connect$netrom(0xffffffffffffffff, &(0x7f0000000380)={{0x6, @rose, 0x1}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}, 0x48) r3 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) bind$netrom(r3, &(0x7f00000004c0)={{0x6, @rose, 0x1}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 2.536792494s ago: executing program 2 (id=42): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x701203, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0xd, 0x2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2000c061}, 0x4008000) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 2.515753873s ago: executing program 3 (id=43): sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) getpid() recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xf}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000140)={0x2, 0x4e22, @loopback}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB, @ANYRES16=r4, @ANYBLOB="0100000000000000000001000000280001801400040000000000000000000000ffffac1414aa060001000a0080000800060003"], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x38, r6, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1=0xac1414aa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}]}]}, 0x38}}, 0x0) 2.140541992s ago: executing program 1 (id=44): r0 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x80000, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0) fsopen(&(0x7f0000000380)='btrfs\x00', 0x1) socket$kcm(0x2, 0x200000000000001, 0x0) r4 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000900)=[{0x0}], 0x1}, 0x0) socket$inet6(0xa, 0x1, 0x0) syz_open_procfs(0x0, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x121003, 0x0) mount(&(0x7f0000000140)=@nullb, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000040)='nilfs2\x00', 0x208000, 0x0) 1.24004243s ago: executing program 0 (id=45): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="020000000400000008000000"], 0x48) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=@base={0x2, 0x4, 0x8, 0xf}, 0x50) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000500)={r4}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0x19, &(0x7f0000000300)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r4}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r6}, 0x2c, {'wfdno', 0x3d, r5}, 0x2c, {[{@version_9p2000}]}}) write$P9_RVERSION(r7, &(0x7f0000000080)=ANY=[], 0x15) 0s ago: executing program 4 (id=46): prlimit64(0x0, 0xe, &(0x7f0000000440)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x44, &(0x7f0000000000)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x36, 0x0, 0x0, 0x81, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x9, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x65, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}, "00186371ae9b"}}}}}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x6, 0x3, &(0x7f0000000280)=ANY=[@ANYBLOB="180000"], 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0xffffffffffffff6b, &(0x7f0000000000)="ff", 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x48) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r4, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r4, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendmmsg$inet(r4, &(0x7f0000000d00)=[{{0x0, 0x0, &(0x7f0000002c00)=[{&(0x7f0000001500)="06", 0x1}, {&(0x7f0000002800)="cf", 0x1}, {&(0x7f0000000380)="08e0", 0x2}, {&(0x7f0000000180)="8a", 0x1}, {&(0x7f0000000700)="af278d5dce87b01dcbd67184e298d36f", 0x10}], 0x5}}, {{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000003000)="e1", 0x1}, {&(0x7f00000010c0)="fa", 0x1}, {&(0x7f00000004c0)="d8ace0ee77", 0x5}, {&(0x7f0000001600)="f2", 0x1}, {&(0x7f0000000500)="ffe2", 0x2}, {&(0x7f00000006c0)="7940e900e0", 0x5}, {&(0x7f0000000100)="f0099820", 0x4}], 0x7}}, {{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000880)="87", 0x1}, {&(0x7f00000005c0)="1121f722fe", 0x5}, {&(0x7f0000000280)="e3a00a47e0", 0x5}, {&(0x7f0000000240)="b09c9e4239984af70cca74c668", 0xd}], 0x4}}], 0x3, 0x4000000) setsockopt$sock_int(r4, 0x1, 0x20, &(0x7f0000000000)=0x7fffffff, 0x4) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.206' (ED25519) to the list of known hosts. [ 80.919153][ T5788] cgroup: Unknown subsys name 'net' [ 81.170243][ T5788] cgroup: Unknown subsys name 'cpuset' [ 81.235036][ T5788] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 83.102674][ T5788] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 85.339321][ T5803] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 85.361722][ T5803] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 85.362968][ T5803] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 85.380080][ T5803] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 85.381962][ T5803] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 85.455722][ T5121] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 85.460199][ T5121] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 85.461007][ T5121] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 85.508626][ T5121] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 85.509581][ T5121] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 85.552118][ T5121] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 85.564920][ T5121] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 85.565876][ T5121] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 85.569466][ T5121] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 85.570272][ T5121] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 85.616743][ T5803] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 85.618399][ T5803] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 85.619820][ T5805] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 85.621004][ T5805] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 85.622567][ T5805] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 85.649447][ T5805] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 85.658003][ T5805] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 85.662930][ T5805] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 85.667160][ T5805] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 85.668052][ T5805] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 86.362837][ T5800] chnl_net:caif_netlink_parms(): no params data found [ 86.601787][ T5804] chnl_net:caif_netlink_parms(): no params data found [ 86.685999][ T5807] chnl_net:caif_netlink_parms(): no params data found [ 86.746843][ T5810] chnl_net:caif_netlink_parms(): no params data found [ 86.812225][ T5812] chnl_net:caif_netlink_parms(): no params data found [ 86.825889][ T5800] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.826969][ T5800] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.827350][ T5800] bridge_slave_0: entered allmulticast mode [ 86.829059][ T5800] bridge_slave_0: entered promiscuous mode [ 86.894052][ T5800] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.894237][ T5800] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.894382][ T5800] bridge_slave_1: entered allmulticast mode [ 86.895962][ T5800] bridge_slave_1: entered promiscuous mode [ 87.053297][ T31] cfg80211: failed to load regulatory.db [ 87.088025][ T5800] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.088273][ T5804] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.088415][ T5804] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.088588][ T5804] bridge_slave_0: entered allmulticast mode [ 87.090499][ T5804] bridge_slave_0: entered promiscuous mode [ 87.159966][ T5800] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.160213][ T5804] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.160356][ T5804] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.160532][ T5804] bridge_slave_1: entered allmulticast mode [ 87.163970][ T5804] bridge_slave_1: entered promiscuous mode [ 87.218004][ T5807] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.218162][ T5807] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.218347][ T5807] bridge_slave_0: entered allmulticast mode [ 87.221731][ T5807] bridge_slave_0: entered promiscuous mode [ 87.360822][ T5807] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.360981][ T5807] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.361172][ T5807] bridge_slave_1: entered allmulticast mode [ 87.367259][ T5807] bridge_slave_1: entered promiscuous mode [ 87.437086][ T5810] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.437235][ T5810] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.437770][ T5810] bridge_slave_0: entered allmulticast mode [ 87.443016][ T5810] bridge_slave_0: entered promiscuous mode [ 87.497548][ T5800] team0: Port device team_slave_0 added [ 87.503119][ T5804] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.503424][ T5810] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.503566][ T5810] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.503745][ T5810] bridge_slave_1: entered allmulticast mode [ 87.507930][ T5810] bridge_slave_1: entered promiscuous mode [ 87.525671][ T5805] Bluetooth: hci0: command tx timeout [ 87.552004][ T5812] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.552114][ T5812] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.552272][ T5812] bridge_slave_0: entered allmulticast mode [ 87.553910][ T5812] bridge_slave_0: entered promiscuous mode [ 87.560553][ T5800] team0: Port device team_slave_1 added [ 87.589242][ T5807] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.592015][ T5804] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.592353][ T5812] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.592466][ T5812] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.592578][ T5812] bridge_slave_1: entered allmulticast mode [ 87.595097][ T5812] bridge_slave_1: entered promiscuous mode [ 87.605692][ T5805] Bluetooth: hci1: command tx timeout [ 87.661621][ T5807] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.694248][ T5805] Bluetooth: hci2: command tx timeout [ 87.710880][ T5810] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.755966][ T5800] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.755979][ T5800] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.756006][ T5800] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.760097][ T5810] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.764424][ T5805] Bluetooth: hci4: command tx timeout [ 87.774239][ T5805] Bluetooth: hci3: command tx timeout [ 87.840719][ T5804] team0: Port device team_slave_0 added [ 87.851199][ T5812] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.852192][ T5800] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.852207][ T5800] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.852234][ T5800] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.906373][ T5807] team0: Port device team_slave_0 added [ 87.910242][ T5804] team0: Port device team_slave_1 added [ 87.913918][ T5812] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.946447][ T5807] team0: Port device team_slave_1 added [ 87.980624][ T5810] team0: Port device team_slave_0 added [ 88.025707][ T5810] team0: Port device team_slave_1 added [ 88.042247][ T5804] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.042264][ T5804] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.042287][ T5804] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.046761][ T5812] team0: Port device team_slave_0 added [ 88.090120][ T5807] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.090137][ T5807] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.090162][ T5807] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.093278][ T5812] team0: Port device team_slave_1 added [ 88.152743][ T5807] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.152759][ T5807] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.152775][ T5807] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.171221][ T5800] hsr_slave_0: entered promiscuous mode [ 88.174885][ T5800] hsr_slave_1: entered promiscuous mode [ 88.178173][ T5804] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.178188][ T5804] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.178213][ T5804] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.179702][ T5810] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.179714][ T5810] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.179738][ T5810] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.227068][ T5810] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.227085][ T5810] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.227110][ T5810] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.230096][ T5812] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.230112][ T5812] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.230137][ T5812] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.239088][ T5812] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.239104][ T5812] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 88.239129][ T5812] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.850925][ T5804] hsr_slave_0: entered promiscuous mode [ 88.851825][ T5804] hsr_slave_1: entered promiscuous mode [ 88.852574][ T5804] debugfs: 'hsr0' already exists in 'hsr' [ 88.852661][ T5804] Cannot create hsr debugfs directory [ 88.900850][ T5807] hsr_slave_0: entered promiscuous mode [ 88.901753][ T5807] hsr_slave_1: entered promiscuous mode [ 88.902369][ T5807] debugfs: 'hsr0' already exists in 'hsr' [ 88.902395][ T5807] Cannot create hsr debugfs directory [ 88.961739][ T5810] hsr_slave_0: entered promiscuous mode [ 88.962571][ T5810] hsr_slave_1: entered promiscuous mode [ 88.963215][ T5810] debugfs: 'hsr0' already exists in 'hsr' [ 88.963233][ T5810] Cannot create hsr debugfs directory [ 88.992312][ T5812] hsr_slave_0: entered promiscuous mode [ 88.993244][ T5812] hsr_slave_1: entered promiscuous mode [ 88.993832][ T5812] debugfs: 'hsr0' already exists in 'hsr' [ 88.993851][ T5812] Cannot create hsr debugfs directory [ 89.604769][ T5805] Bluetooth: hci0: command tx timeout [ 89.694511][ T5805] Bluetooth: hci1: command tx timeout [ 89.765339][ T5805] Bluetooth: hci2: command tx timeout [ 89.801493][ T5800] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 89.828705][ T5800] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 89.844403][ T5803] Bluetooth: hci4: command tx timeout [ 89.844522][ T5805] Bluetooth: hci3: command tx timeout [ 89.870991][ T5800] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 89.923030][ T5800] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 90.028054][ T5804] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 90.076386][ T5804] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 90.112751][ T5804] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 90.162605][ T5804] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 90.285491][ T5807] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 90.320799][ T5807] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 90.358255][ T5807] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 90.408461][ T5807] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 90.572878][ T5810] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 90.603758][ T5810] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 90.642732][ T5810] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 90.682671][ T5810] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 90.753488][ T5800] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.857216][ T5812] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 90.897635][ T5812] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 90.932506][ T5812] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 90.975823][ T5800] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.978226][ T5812] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 91.059411][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.060407][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.105328][ T58] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.105464][ T58] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.132250][ T5804] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.238410][ T5804] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.275957][ T5807] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.287992][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.288221][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.331907][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.332196][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.389162][ T5807] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.427958][ T5810] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.453492][ T58] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.453737][ T58] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.529798][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.530028][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.589098][ T5810] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.639753][ T1547] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.639996][ T1547] bridge0: port 1(bridge_slave_0) entered forwarding state [ 91.671158][ T5812] 8021q: adding VLAN 0 to HW filter on device bond0 [ 91.685778][ T5805] Bluetooth: hci0: command tx timeout [ 91.708041][ T1547] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.708235][ T1547] bridge0: port 2(bridge_slave_1) entered forwarding state [ 91.764454][ T5805] Bluetooth: hci1: command tx timeout [ 91.830392][ T5812] 8021q: adding VLAN 0 to HW filter on device team0 [ 91.844345][ T5805] Bluetooth: hci2: command tx timeout [ 91.927644][ T5803] Bluetooth: hci4: command tx timeout [ 91.927744][ T5805] Bluetooth: hci3: command tx timeout [ 91.939058][ T3939] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.939213][ T3939] bridge0: port 1(bridge_slave_0) entered forwarding state [ 92.006427][ T154] bridge0: port 2(bridge_slave_1) entered blocking state [ 92.006561][ T154] bridge0: port 2(bridge_slave_1) entered forwarding state [ 92.050122][ T5800] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.259056][ T5804] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.447640][ T5800] veth0_vlan: entered promiscuous mode [ 92.511475][ T5800] veth1_vlan: entered promiscuous mode [ 92.586831][ T5807] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.607307][ T5804] veth0_vlan: entered promiscuous mode [ 92.694448][ T5804] veth1_vlan: entered promiscuous mode [ 92.742446][ T5800] veth0_macvtap: entered promiscuous mode [ 92.776954][ T5800] veth1_macvtap: entered promiscuous mode [ 92.792879][ T5810] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.860018][ T5812] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 92.869628][ T5807] veth0_vlan: entered promiscuous mode [ 92.876674][ T5800] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.899758][ T5804] veth0_macvtap: entered promiscuous mode [ 92.928746][ T5800] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.965536][ T5804] veth1_macvtap: entered promiscuous mode [ 92.989089][ T5807] veth1_vlan: entered promiscuous mode [ 93.029995][ T3939] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.047092][ T3939] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.075031][ T3939] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.093506][ T3939] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.193520][ T5804] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.281007][ T5804] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.313594][ T5810] veth0_vlan: entered promiscuous mode [ 93.389141][ T3531] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.406696][ T3531] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.412357][ T3531] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.420822][ T3531] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.426629][ T5807] veth0_macvtap: entered promiscuous mode [ 93.435371][ T5810] veth1_vlan: entered promiscuous mode [ 93.450797][ T5807] veth1_macvtap: entered promiscuous mode [ 93.591522][ T3939] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.591547][ T3939] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.665928][ T5807] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 93.764245][ T5805] Bluetooth: hci0: command tx timeout [ 93.781706][ T5807] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 93.818751][ T5812] veth0_vlan: entered promiscuous mode [ 93.844313][ T5805] Bluetooth: hci1: command tx timeout [ 93.863328][ T1547] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.864872][ T3531] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.864892][ T3531] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.870137][ T5810] veth0_macvtap: entered promiscuous mode [ 93.872122][ T1547] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.881124][ T1547] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.887773][ T1547] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.898352][ T5812] veth1_vlan: entered promiscuous mode [ 93.906776][ T5810] veth1_macvtap: entered promiscuous mode [ 93.934234][ T5805] Bluetooth: hci2: command tx timeout [ 93.974524][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.974548][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.005021][ T5803] Bluetooth: hci4: command tx timeout [ 94.005073][ T5805] Bluetooth: hci3: command tx timeout [ 94.173292][ T5810] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 94.181122][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.181146][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.342018][ T5810] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 94.429809][ T1287] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.437539][ T5812] veth0_macvtap: entered promiscuous mode [ 94.439676][ T1287] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.440749][ T1287] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.446867][ T154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.446890][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.450132][ T1287] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 94.568986][ T5812] veth1_macvtap: entered promiscuous mode [ 95.539629][ T1547] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.539655][ T1547] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.670528][ T5812] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.719371][ T5812] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.963392][ T154] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.972205][ T154] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.975406][ T1287] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.975430][ T1287] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.978416][ T154] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.632251][ T154] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 97.353487][ T5926] tmpfs: Bad value for 'mpol' [ 98.098889][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.098914][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.524400][ T154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 99.524425][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 99.736800][ T5945] Zero length message leads to an empty skb [ 99.917393][ T5945] NILFS (nullb0): couldn't find nilfs on the device [ 101.217166][ T5949] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 101.218973][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 101.218996][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 101.508462][ T5955] 9p: Bad value for 'rfdno' [ 102.865349][ T5963] tmpfs: Bad value for 'mpol' [ 109.328497][ T5996] tmpfs: Bad value for 'mpol' [ 109.643606][ T5997] NILFS (nullb0): couldn't find nilfs on the device [ 111.103490][ T6002] NILFS (nullb0): couldn't find nilfs on the device [ 116.355185][ T6029] NILFS (nullb0): couldn't find nilfs on the device [ 119.781895][ T6048] NILFS (nullb0): couldn't find nilfs on the device [ 120.001747][ T6054] syz.4.35: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 120.002019][ T6054] CPU: 1 UID: 0 PID: 6054 Comm: syz.4.35 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 120.002046][ T6054] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 120.002060][ T6054] Call Trace: [ 120.002068][ T6054] [ 120.002079][ T6054] dump_stack_lvl+0xe8/0x150 [ 120.002117][ T6054] warn_alloc+0x263/0x3e0 [ 120.002157][ T6054] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 120.002195][ T6054] ? __pfx_warn_alloc+0x10/0x10 [ 120.002237][ T6054] ? kasan_save_track+0x4f/0x80 [ 120.002267][ T6054] ? kasan_save_track+0x3e/0x80 [ 120.002296][ T6054] ? __kasan_kmalloc+0x93/0xb0 [ 120.002326][ T6054] ? __kmalloc_cache_noprof+0x1f2/0x6b0 [ 120.002358][ T6054] ? xskq_create+0x56/0x170 [ 120.002384][ T6054] ? xsk_setsockopt+0x54c/0x990 [ 120.002406][ T6054] ? do_sock_setsockopt+0x17c/0x1b0 [ 120.002426][ T6054] ? __x64_sys_setsockopt+0x143/0x1b0 [ 120.002445][ T6054] ? do_syscall_64+0xe2/0xf80 [ 120.002480][ T6054] __vmalloc_node_range_noprof+0x132/0x1730 [ 120.002559][ T6054] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 120.002601][ T6054] ? __kasan_kmalloc+0x93/0xb0 [ 120.002640][ T6054] vmalloc_user_noprof+0xad/0xe0 [ 120.002673][ T6054] ? xskq_create+0xbf/0x170 [ 120.002702][ T6054] xskq_create+0xbf/0x170 [ 120.002734][ T6054] xsk_init_queue+0xad/0x110 [ 120.002760][ T6054] xsk_setsockopt+0x54c/0x990 [ 120.002783][ T6054] ? __pfx_xsk_setsockopt+0x10/0x10 [ 120.002822][ T6054] ? __fget_files+0x2a/0x420 [ 120.002845][ T6054] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 120.002876][ T6054] ? __pfx_xsk_setsockopt+0x10/0x10 [ 120.002903][ T6054] do_sock_setsockopt+0x17c/0x1b0 [ 120.002930][ T6054] __x64_sys_setsockopt+0x143/0x1b0 [ 120.002959][ T6054] do_syscall_64+0xe2/0xf80 [ 120.002989][ T6054] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 120.003011][ T6054] ? trace_irq_disable+0x37/0x100 [ 120.003035][ T6054] ? clear_bhb_loop+0x60/0xb0 [ 120.003063][ T6054] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 120.003086][ T6054] RIP: 0033:0x7fa0f58bacb9 [ 120.003107][ T6054] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 120.003126][ T6054] RSP: 002b:00007fa0f36b1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 120.003149][ T6054] RAX: ffffffffffffffda RBX: 00007fa0f5b36270 RCX: 00007fa0f58bacb9 [ 120.003165][ T6054] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000009 [ 120.003179][ T6054] RBP: 00007fa0f5928bf7 R08: 0000000000000004 R09: 0000000000000000 [ 120.003193][ T6054] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 120.003207][ T6054] R13: 00007fa0f5b36308 R14: 00007fa0f5b36270 R15: 00007ffef40a0e38 [ 120.003243][ T6054] [ 120.003252][ T6054] Mem-Info: [ 120.003263][ T6054] active_anon:250 inactive_anon:14554 isolated_anon:0 [ 120.003263][ T6054] active_file:5688 inactive_file:47175 isolated_file:0 [ 120.003263][ T6054] unevictable:768 dirty:186 writeback:6 [ 120.003263][ T6054] slab_reclaimable:11731 slab_unreclaimable:99356 [ 120.003263][ T6054] mapped:39100 shmem:9933 pagetables:1249 [ 120.003263][ T6054] sec_pagetables:0 bounce:0 [ 120.003263][ T6054] kernel_misc_reclaimable:0 [ 120.003263][ T6054] free:1310004 free_pcp:12124 free_cma:0 [ 120.003322][ T6054] Node 0 active_anon:1000kB inactive_anon:58216kB active_file:22552kB inactive_file:188700kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:156400kB dirty:744kB writeback:24kB shmem:38196kB kernel_stack:13280kB pagetables:4844kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 120.003373][ T6054] Node 1 active_anon:0kB inactive_anon:0kB active_file:200kB inactive_file:0kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB kernel_stack:64kB pagetables:152kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 120.003420][ T6054] Node 0 DMA free:15356kB boost:0kB min:20kB low:32kB high:44kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 120.003485][ T6054] lowmem_reserve[]: 0 2508 2509 2509 2509 [ 120.003631][ T6054] Node 0 DMA32 free:1325584kB boost:0kB min:3936kB low:6476kB high:9016kB reserved_highatomic:0KB free_highatomic:0KB active_anon:1000kB inactive_anon:58184kB active_file:22552kB inactive_file:188700kB unevictable:1536kB writepending:780kB zspages:0kB present:3129332kB managed:2569024kB mlocked:0kB bounce:0kB free_pcp:48496kB local_pcp:8324kB free_cma:0kB [ 120.003702][ T6054] lowmem_reserve[]: 0 0 0 0 0 [ 120.003740][ T6054] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:876kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 120.003799][ T6054] lowmem_reserve[]: 0 0 0 0 0 [ 120.003836][ T6054] Node 1 Normal free:3899076kB boost:0kB min:6364kB low:10472kB high:14580kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:200kB inactive_file:0kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 120.003917][ T6054] lowmem_reserve[]: 0 0 0 0 0 [ 120.003955][ T6054] Node 0 DMA: 1*4kB (U) 1*8kB (U) 1*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 1*2048kB (M) 3*4096kB (M) = 15356kB [ 120.004431][ T6054] Node 0 DMA32: 940*4kB (U) 694*8kB (U) 196*16kB (UM) 12*32kB (UE) 4*64kB (UE) 43*128kB (UM) 83*256kB (ME) 11*512kB (ME) 10*1024kB (ME) 4*2048kB (M) 308*4096kB (M) = 1325472kB [ 120.004627][ T6054] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 120.004742][ T6054] Node 1 Normal: 187*4kB (U) 43*8kB (UME) 36*16kB (UME) 218*32kB (UME) 104*64kB (UME) 26*128kB (UME) 12*256kB (UME) 5*512kB (UME) 2*1024kB (ME) 1*2048kB (E) 945*4096kB (M) = 3899076kB [ 120.004920][ T6054] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 120.004939][ T6054] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 120.004956][ T6054] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 120.004974][ T6054] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 120.004992][ T6054] 62793 total pagecache pages [ 120.005001][ T6054] 0 pages in swap cache [ 120.005008][ T6054] Free swap = 124996kB [ 120.005016][ T6054] Total swap = 124996kB [ 120.005025][ T6054] 2097051 pages RAM [ 120.005033][ T6054] 0 pages HighMem/MovableOnly [ 120.005040][ T6054] 422961 pages reserved [ 120.005048][ T6054] 0 pages cma reserved [ 127.152649][ T6091] NILFS (nullb0): couldn't find nilfs on the device [ 127.964154][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 127.974161][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 127.984123][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 127.994134][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 128.004120][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 128.014116][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 128.024121][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 128.034124][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 128.044116][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 128.054117][ T0] NOHZ tick-stop error: local softirq work is pending, hand[ 128.054117][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 129.725013][ C1] ------------[ cut here ]------------ [ 129.725030][ C1] refcount_t: underflow; use-after-free. [ 129.725038][ C1] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110, CPU#1: ktimers/1/29 [ 129.725087][ C1] Modules linked in: [ 129.725106][ C1] CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 129.725132][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 129.725145][ C1] RIP: 0010:refcount_warn_saturate+0xb2/0x110 [ 129.725177][ C1] Code: 24 5e a9 0a 67 48 0f b9 3a eb 4a e8 38 4e 39 fd 48 8d 3d 21 5e a9 0a 67 48 0f b9 3a eb 37 e8 25 4e 39 fd 48 8d 3d 1e 5e a9 0a <67> 48 0f b9 3a eb 24 e8 12 4e 39 fd 48 8d 3d 1b 5e a9 0a 67 48 0f [ 129.725195][ C1] RSP: 0018:ffffc90000a3f8c8 EFLAGS: 00010246 [ 129.725213][ C1] RAX: ffffffff8488113b RBX: 0000000000000003 RCX: ffff88801cae1e40 [ 129.725229][ C1] RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f316f60 [ 129.725244][ C1] RBP: 0000000000000000 R08: ffff88801cae1e40 R09: 0000000000000005 [ 129.725258][ C1] R10: 0000000000000100 R11: 0000000000000004 R12: ffffffff99695001 [ 129.725272][ C1] R13: ffff8880284e4000 R14: ffff8880284e4080 R15: ffff8880284e4070 [ 129.725288][ C1] FS: 0000000000000000(0000) GS:ffff8881268fc000(0000) knlGS:0000000000000000 [ 129.725306][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 129.725319][ C1] CR2: 00005555709e0a28 CR3: 000000000d7b4000 CR4: 00000000003526f0 [ 129.725341][ C1] Call Trace: [ 129.725349][ C1] [ 129.725359][ C1] __inet_csk_reqsk_queue_drop+0x2c3/0x340 [ 129.725401][ C1] reqsk_timer_handler+0x7c8/0xcf0 [ 129.725432][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 129.725476][ C1] call_timer_fn+0x192/0x5a0 [ 129.725505][ C1] ? __pfx_reqsk_timer_handler+0x10/0x10 [ 129.725530][ C1] ? call_timer_fn+0xd4/0x5a0 [ 129.725562][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 129.725607][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 129.725638][ C1] ? __pfx_reqsk_timer_handler+0x10/0x10 [ 129.725669][ C1] __run_timer_base+0x6a3/0x9f0 [ 129.725721][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 129.725768][ C1] ? __local_bh_disable_ip+0x3c/0x420 [ 129.725812][ C1] run_timer_softirq+0x67/0x170 [ 129.725844][ C1] handle_softirqs+0x1de/0x640 [ 129.725882][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 129.725909][ C1] run_ktimerd+0x69/0x100 [ 129.725935][ C1] smpboot_thread_fn+0x541/0xa50 [ 129.725960][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 129.725985][ C1] kthread+0x726/0x8b0 [ 129.726012][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 129.726030][ C1] ? __pfx_kthread+0x10/0x10 [ 129.726052][ C1] ? rt_spin_unlock+0x14f/0x200 [ 129.726075][ C1] ? rt_spin_unlock+0x160/0x200 [ 129.726091][ C1] ? __pfx_kthread+0x10/0x10 [ 129.726115][ C1] ret_from_fork+0x51b/0xa40 [ 129.726137][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 129.726155][ C1] ? __switch_to+0xc82/0x1410 [ 129.726176][ C1] ? __pfx_kthread+0x10/0x10 [ 129.726201][ C1] ret_from_fork_asm+0x1a/0x30 [ 129.726243][ C1] [ 129.726252][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 129.726266][ C1] CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 129.726286][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 [ 129.726295][ C1] Call Trace: [ 129.726303][ C1] [ 129.726310][ C1] vpanic+0x1e0/0x670 [ 129.726337][ C1] panic+0xc5/0xd0 [ 129.726359][ C1] ? __pfx_panic+0x10/0x10 [ 129.726391][ C1] ? ret_from_fork_asm+0x1a/0x30 [ 129.726421][ C1] __warn+0x315/0x4a0 [ 129.726443][ C1] ? refcount_warn_saturate+0xb2/0x110 [ 129.726469][ C1] ? refcount_warn_saturate+0xb2/0x110 [ 129.726494][ C1] __report_bug+0x29a/0x540 [ 129.726522][ C1] ? refcount_warn_saturate+0xb2/0x110 [ 129.726546][ C1] ? __pfx___report_bug+0x10/0x10 [ 129.726588][ C1] report_bug_entry+0x19a/0x290 [ 129.726611][ C1] ? refcount_warn_saturate+0xb2/0x110 [ 129.726632][ C1] ? refcount_warn_saturate+0xb7/0x110 [ 129.726655][ C1] handle_bug+0xca/0x200 [ 129.726681][ C1] exc_invalid_op+0x1a/0x50 [ 129.726706][ C1] asm_exc_invalid_op+0x1a/0x20 [ 129.726723][ C1] RIP: 0010:refcount_warn_saturate+0xb2/0x110 [ 129.726757][ C1] Code: 24 5e a9 0a 67 48 0f b9 3a eb 4a e8 38 4e 39 fd 48 8d 3d 21 5e a9 0a 67 48 0f b9 3a eb 37 e8 25 4e 39 fd 48 8d 3d 1e 5e a9 0a <67> 48 0f b9 3a eb 24 e8 12 4e 39 fd 48 8d 3d 1b 5e a9 0a 67 48 0f [ 129.726771][ C1] RSP: 0018:ffffc90000a3f8c8 EFLAGS: 00010246 [ 129.726786][ C1] RAX: ffffffff8488113b RBX: 0000000000000003 RCX: ffff88801cae1e40 [ 129.726799][ C1] RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f316f60 [ 129.726811][ C1] RBP: 0000000000000000 R08: ffff88801cae1e40 R09: 0000000000000005 [ 129.726822][ C1] R10: 0000000000000100 R11: 0000000000000004 R12: ffffffff99695001 [ 129.726833][ C1] R13: ffff8880284e4000 R14: ffff8880284e4080 R15: ffff8880284e4070 [ 129.726855][ C1] ? refcount_warn_saturate+0xab/0x110 [ 129.726885][ C1] ? refcount_warn_saturate+0xab/0x110 [ 129.726909][ C1] __inet_csk_reqsk_queue_drop+0x2c3/0x340 [ 129.726941][ C1] reqsk_timer_handler+0x7c8/0xcf0 [ 129.726965][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 129.726996][ C1] call_timer_fn+0x192/0x5a0 [ 129.727020][ C1] ? __pfx_reqsk_timer_handler+0x10/0x10 [ 129.727041][ C1] ? call_timer_fn+0xd4/0x5a0 [ 129.727064][ C1] ? __pfx_call_timer_fn+0x10/0x10 [ 129.727097][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 129.727118][ C1] ? __pfx_reqsk_timer_handler+0x10/0x10 [ 129.727143][ C1] __run_timer_base+0x6a3/0x9f0 [ 129.727181][ C1] ? __pfx___run_timer_base+0x10/0x10 [ 129.727212][ C1] ? __local_bh_disable_ip+0x3c/0x420 [ 129.727241][ C1] run_timer_softirq+0x67/0x170 [ 129.727267][ C1] handle_softirqs+0x1de/0x640 [ 129.727297][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 129.727319][ C1] run_ktimerd+0x69/0x100 [ 129.727343][ C1] smpboot_thread_fn+0x541/0xa50 [ 129.727369][ C1] ? smpboot_thread_fn+0x4d/0xa50 [ 129.727404][ C1] kthread+0x726/0x8b0 [ 129.727435][ C1] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 129.727460][ C1] ? __pfx_kthread+0x10/0x10 [ 129.727485][ C1] ? rt_spin_unlock+0x14f/0x200 [ 129.727508][ C1] ? rt_spin_unlock+0x160/0x200 [ 129.727526][ C1] ? __pfx_kthread+0x10/0x10 [ 129.727552][ C1] ret_from_fork+0x51b/0xa40 [ 129.727577][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 129.727598][ C1] ? __switch_to+0xc82/0x1410 [ 129.727625][ C1] ? __pfx_kthread+0x10/0x10 [ 129.727654][ C1] ret_from_fork_asm+0x1a/0x30 [ 129.727722][ C1] [ 129.728259][ C1] Kernel Offset: disabled