last executing test programs: 1.209622101s ago: executing program 2 (id=15): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x0) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="000000006eac5602d617e0082c06c00a7c5ca7ff3c64c759e06bee0c001acae2450d2dd12997e8f0a33d634d1f94fff40a4de97f56a1d746bdb14d551fdaa937a37a87c4d37ecaabe6a218f0b6645630b0c96d152db3f5ef9ec468677cf1f81da35f2338a822cf3a9eab7add187a7679c8eae158b440d5e0d44e556b1e470da2159f2969a4ccc90d4d402837517652243168f79bc03079bfb4b2fdfec53833614e6e6aa152b1e88c07d1c171c8c99b1a6ecc", @ANYRES16=r1, @ANYBLOB="02002abd7000fddbdf250100000004000300"], 0x18}, 0x1, 0x0, 0x0, 0x20004854}, 0x40) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000340), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_MODIFY(r2, &(0x7f0000000400)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, r3, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file2\x00', 0x14c) capset(&(0x7f00000000c0)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x0, 0x0, 0x0, 0x2}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x50) mount$overlay(0x0, &(0x7f0000000100)='./file2\x00', &(0x7f0000000000), 0x0, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}, {@userxattr}], [], 0x2c}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000580)={'syztnl2\x00', &(0x7f0000000440)={'syztnl2\x00', 0x0, 0x700, 0x40, 0x8, 0x21687331, {{0x3e, 0x4, 0x3, 0x2, 0xf8, 0x65, 0x0, 0x8, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0x3a}, @loopback, {[@lsrr={0x83, 0x1f, 0x2b, [@multicast2, @empty, @local, @remote, @multicast2, @remote, @private=0xa010102]}, @cipso={0x86, 0x18, 0x3, [{0x7, 0x6, "5832f108"}, {0x2, 0xc, "c99e6610c50c1a009c00"}]}, @noop, @generic={0x83, 0x3, "eb"}, @timestamp_addr={0x44, 0x24, 0x9, 0x1, 0x4, [{@loopback, 0xc81}, {@broadcast, 0x7}, {@multicast2}, {@broadcast, 0xc000}]}, @rr={0x7, 0x27, 0x46, [@initdev={0xac, 0x1e, 0x1, 0x0}, @empty, @dev={0xac, 0x14, 0x14, 0x33}, @multicast2, @multicast2, @local, @multicast2, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @cipso={0x86, 0x5d, 0x0, [{0x6, 0xa, "202891ee4bdfcf07"}, {0x5, 0x5, "125aea"}, {0x2, 0x5, 'SU.'}, {0x7, 0x9, "76a02d12180ecc"}, {0x1, 0xb, "51dd8078940c6e9404"}, {0x6, 0xc, "17195b042bf098ebf396"}, {0x1, 0x3, "c6"}, {0x5, 0xa, "8934952346afa23c"}, {0x5, 0xf, "c7e9266d1ec4be11a66cb30539"}, {0x7, 0x7, "221b8afb76"}]}]}}}}}) r5 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000005c0)=0xffffffffffffffff, 0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@base={0x4, 0x4, 0x3, 0x3, 0x504, 0xffffffffffffffff, 0xe1, '\x00', r4, r5, 0x4, 0x2, 0x4}, 0x50) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="28000000020000071a0001000c000c400100000000000007000000"], 0x28}}, 0x0) 1.205718164s ago: executing program 2 (id=17): r0 = socket$nl_rdma(0x10, 0x3, 0x14) recvmmsg(r0, &(0x7f0000000ec0)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x12022, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x77, 0x8000) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r1, 0x4004550c, 0x0) ioctl$sock_SIOCADDDLCI(r0, 0x8980, &(0x7f0000000000)={'team0\x00', 0x2}) 650.185381ms ago: executing program 3 (id=20): bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4}, 0x50) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) listns(&(0x7f00000010c0)={0x20, 0x0, 0x10001, 0x8000000}, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f0000000280)="36f22e64652ef04119a40962b1000066ba6100ec0f32410f01dd0066b802008ed00f22a40f2326c4832d0f8d0d0000006f45cf8f497c80590ac7442406000000000f011c24c463796269fa09", 0x4c}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 500.084704ms ago: executing program 3 (id=21): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r0, 0x0, 0xd2, &(0x7f00000000c0)={@rand_addr=0x64010102, @empty=0xe00003a4, 0x0, "8a79348df081496d0420922f45a71c1daa8b610468cd140526c41efcd3a4a422", 0x3, 0x1, 0x85, 0x2}, 0x3c) setsockopt$MRT_ADD_MFC_PROXY(r0, 0x0, 0xd2, &(0x7f00000000c0)={@multicast1=0x1c101002, @empty=0xe00003a4, 0x0, "8a79348df081496d0420922f45a71c1daa8b610468cd140526c41efcd3a4a422", 0x3, 0x1, 0x85}, 0x3c) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net/syz1\x00', 0x200002, 0x0) openat$cgroup_pressure(r1, &(0x7f0000000100)='memory.pressure\x00', 0x2, 0x0) setsockopt$MRT_ADD_MFC_PROXY(r0, 0x0, 0xd2, &(0x7f00000000c0)={@multicast1=0x1c101003, @empty=0xe00003a4, 0x0, "8a79348df081496d0420922f45a71c1daa8b610468cd140526c41efcd3a4a422", 0x3, 0x1, 0x85}, 0x3c) setsockopt$MRT_ADD_MFC_PROXY(r0, 0x0, 0xd2, &(0x7f00000000c0)={@multicast1=0x1c101004, @empty=0xe00003a4, 0x0, "8a79348df081496d0420922f45a71c1daa8b610468cd140526c41efcd3a4a422", 0x3, 0x1, 0x85}, 0x3c) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000000040), 0x4) setsockopt$MRT_ADD_MFC_PROXY(r0, 0x0, 0xd2, &(0x7f0000000000)={@multicast1=0x1c101007, @empty=0xe00003a4, 0x0, "8a79348df081496d0420922f45a71c1daa8b610468cd140526c41efcd3a4a422", 0x3, 0x1, 0x85}, 0x3c) 499.855995ms ago: executing program 3 (id=22): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x4) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newqdisc={0x170, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x138, 0x2, {{0x3, [0x0, 0x0, 0xc], 0x2, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0xffff, 0x0, 0x8, 0x0, 0xfffa, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x3, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}, [@TCA_MQPRIO_MIN_RATE64={0x7c, 0x3, 0x0, 0x1, [{0xc, 0x3, 0x5}, {0xc}, {0xc, 0x3, 0x20066}, {0xc, 0x3, 0xd}, {0xc, 0x3, 0xb}, {0xc, 0x3, 0x5}, {0xc, 0x3, 0x7f}, {0xc, 0x3, 0x3}, {0xc, 0x3, 0x1}, {0xc, 0x3, 0x1}]}, @TCA_MQPRIO_MIN_RATE64={0x64, 0x3, 0x0, 0x1, [{0xc, 0x3, 0x5}, {0xc}, {0xc, 0x3, 0x7ff}, {0xc, 0x3, 0x4}, {0xc, 0x3, 0x4}, {0xc, 0x3, 0x100000000}, {0xc, 0x3, 0x81}, {0xc, 0x3, 0x1}]}]}}}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x4}]}, 0x170}}, 0x20000000) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000500)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x0, 0xd000}) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa0f7f"], 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 358.261085ms ago: executing program 1 (id=23): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000018c0)=ANY=[@ANYBLOB="0e00000024000000040000000200000000000000", @ANYRES32=0x1, @ANYBLOB="0000000100000800"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x6, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r1, 0x2000012, 0xe, 0x0, &(0x7f0000000000)="63ec90c97b265715fe27cd9359a4", 0x0, 0xe68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xd}, 0x50) 357.910145ms ago: executing program 1 (id=24): r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x88040, 0x0) fcntl$setlease(r0, 0x400, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYRESOCT=r1, @ANYRESDEC=r1, @ANYRES8=r0], 0x60}}, 0x24000800) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x288040, 0x0) fcntl$getflags(r2, 0x401) 290.176947ms ago: executing program 1 (id=25): r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x303780, 0x0) openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000040)='io.pressure\x00', 0x2, 0x0) (async) r1 = openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000040)='io.pressure\x00', 0x2, 0x0) close_range(r0, r1, 0x0) ioctl$XFS_IOC_SET_RESBLKS(r0, 0xc0105872, &(0x7f0000000080)={0x6184, 0xfff}) (async) ioctl$XFS_IOC_SET_RESBLKS(r0, 0xc0105872, &(0x7f0000000080)={0x6184, 0xfff}) ioctl$NILFS_IOCTL_DELETE_CHECKPOINT(r1, 0x40086e81, &(0x7f00000000c0)=0x7fffffff) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000140)={0x2, &(0x7f0000000100)=[{0x1, 0xd6, 0x1, 0xc53}, {0x1, 0x1, 0x16, 0x400}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000180)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000200)={r3, 0x2, r0, 0x8, 0x80000}) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000280)={0x0, @in6={{0xa, 0x4e22, 0x4, @empty, 0x7bb}}, [0x6, 0xffff, 0x5, 0x5, 0x1, 0xcf, 0x7, 0x0, 0x7fffffff, 0x2, 0x3, 0x4, 0xfffffffffffffffc, 0x2, 0x1]}, &(0x7f0000000380)=0x100) setsockopt$inet_sctp_SCTP_ASSOCINFO(r4, 0x84, 0x1, &(0x7f00000003c0)={r6, 0x2, 0x2e, 0x4a, 0x5f0a, 0xfbce}, 0x14) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r2, 0xc0182101, &(0x7f0000000400)={r3, 0x2, 0x6}) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(r4, 0x89f7, &(0x7f00000004c0)={'sit0\x00', &(0x7f0000000440)={@multicast2, 0x1, 0x0, 0x70, 0x0, [{@private}, {@multicast2}, {@broadcast}, {@multicast1}, {@empty}, {@local}, {@multicast1}]}}) (async) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(r4, 0x89f7, &(0x7f00000004c0)={'sit0\x00', &(0x7f0000000440)={@multicast2, 0x1, 0x0, 0x70, 0x0, [{@private}, {@multicast2}, {@broadcast}, {@multicast1}, {@empty}, {@local}, {@multicast1}]}}) ioctl$sock_inet_udp_SIOCINQ(r4, 0x541b, &(0x7f0000000500)) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r4, 0xc018937a, &(0x7f0000000540)={{0x1, 0x1, 0x18, r5, {0x8}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r4, 0xc018937a, &(0x7f0000000540)={{0x1, 0x1, 0x18, r5, {0x8}}, './file0\x00'}) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000005c0), r5) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r7, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x14, r8, 0x4, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, ["", "", "", ""]}, 0x14}}, 0x4040) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r7, 0xc0502100, &(0x7f00000006c0)) r9 = openat(r7, &(0x7f0000000740)='./file0\x00', 0x100, 0x9) ioctl$DMA_HEAP_IOCTL_ALLOC(r7, 0xc0184800, &(0x7f0000000780)={0x10000, r1, 0x1}) (async) ioctl$DMA_HEAP_IOCTL_ALLOC(r7, 0xc0184800, &(0x7f0000000780)={0x10000, r1, 0x1}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0xdfe, &(0x7f00000007c0)) (async) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0xdfe, &(0x7f00000007c0)) ioctl$BTRFS_IOC_START_SYNC(r5, 0x80089418, &(0x7f0000000800)) ioctl$DRM_IOCTL_GEM_OPEN(r4, 0xc010640b, &(0x7f0000000840)={0x0, 0x0}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r5, 0xc00c642d, &(0x7f0000000880)={r10, 0x80000}) (async) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r5, 0xc00c642d, &(0x7f0000000880)={r10, 0x80000, 0xffffffffffffffff}) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r9, 0xc0189372, &(0x7f00000008c0)={{0x1, 0x1, 0x18, r11, {0xa75}}, './file0\x00'}) (async) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r9, 0xc0189372, &(0x7f00000008c0)={{0x1, 0x1, 0x18, r11, {0xa75}}, './file0\x00'}) write$cgroup_pressure(r12, &(0x7f0000000900)={'some', 0x20, 0x2}, 0x2f) sendmsg$BATADV_CMD_GET_HARDIF(r9, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x24, 0x0, 0x2, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000004) (async) sendmsg$BATADV_CMD_GET_HARDIF(r9, &(0x7f0000000a00)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x24, 0x0, 0x2, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000004) ioctl$DRM_IOCTL_MODE_GET_LEASE(r11, 0xc01064c8, &(0x7f0000000a80)={0x6, 0x0, &(0x7f0000000a40)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_OBJ_SETPROPERTY(r4, 0xc01864ba, &(0x7f0000000ac0)={0x6, 0x0, r13, 0xb0b0b0b0}) ioctl$XFS_IOC_FSCOUNTS(0xffffffffffffffff, 0x80205871, &(0x7f0000000b00)) (async) ioctl$XFS_IOC_FSCOUNTS(0xffffffffffffffff, 0x80205871, &(0x7f0000000b00)) 289.77496ms ago: executing program 3 (id=26): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)="68000000020905040000000000000000020000000900010073797a3000000000140002800600010000020000050002000000002c0004800800010000000001200002800c000100706f6c69637930000800020000000002080003000000001e000000000000000000", 0x68}], 0x1}, 0x44) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0xe403}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_BC_QUEUE_LEN={0x8, 0x7, 0xda3}]}}}]}, 0x3c}}, 0x0) r3 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=@getchain={0x5c, 0x66, 0x8, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r4, {0x7, 0xffff}, {0xe, 0xfff1}, {0xffe0, 0x5}}, [{0x8, 0xb, 0x8}, {0x8, 0xb, 0xfffffffc}, {0x8, 0xb, 0xfff}, {0x8, 0xb, 0x9}, {0x8, 0xb, 0x40}, {0x8, 0xb, 0x20000004}, {0x8, 0xb, 0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x44084}, 0x20040004) 289.179363ms ago: executing program 2 (id=27): r0 = syz_open_dev$mtd(&(0x7f0000000000), 0x0, 0x2) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000540)=ANY=[], 0x2c}}, 0x0) lsm_get_self_attr(0x66, &(0x7f0000000340)={0x0, 0x0, 0x94, 0x74, ""/116}, &(0x7f0000000300)=0x94, 0x1) r1 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x0) ioctl$FE_GET_PROPERTY(r1, 0x80106f53, &(0x7f0000000040)={0x4, &(0x7f00000000c0)=[{0x1b, '\x00', @data=0xfffffffd, 0x5}, {0x34, '\x00', @buffer={"1a1ce1ba1b4997c3c5d8630dd694a849230c0000000000eb00", 0x20}, 0x6447}, {0x37, '\x00', @st={0x4, [{0x0, @svalue=0x1}, {0x1, @uvalue=0x400}, {0x1, @uvalue=0x2}, {0x2, @svalue=0x1}]}, 0x9b10}, {0x9, '\x00', @st={0x4, [{0x2, @uvalue=0x1eac}, {0x3, @svalue=0x2}, {0x1, @uvalue=0x10000}, {0x1, @svalue}]}, 0x2}]}) mount(0x0, &(0x7f00000000c0)='./tracing\x00', 0x0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) ioctl$MEMWRITEOOB64(r0, 0xc0184d15, &(0x7f0000000140)={0x3, 0x0, 0x0, 0x0}) r2 = socket(0x10, 0x3, 0x0) connect$netlink(r2, &(0x7f0000000280)=@proc={0x10, 0x0, 0x1, 0x10000}, 0xc) sendmsg$nl_route_sched(r2, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000bc0)=@newtaction={0x18, 0x31, 0x829, 0x0, 0x0, {0x0, 0x0, 0x2}, [{0x4}]}, 0x18}}, 0x0) sendmsg$NL80211_CMD_DEL_STATION(r2, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x20, 0x0, 0x10, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0xa, 0x13, [{0x1, 0x1}, {0x6, 0x1}, {0x36, 0x1}, {0x6c}, {0x1}, {0x60, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4008010}, 0x20000000) syz_open_dev$mtd(&(0x7f0000000000), 0x0, 0x2) (async) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000540)=ANY=[], 0x2c}}, 0x0) (async) lsm_get_self_attr(0x66, &(0x7f0000000340)={0x0, 0x0, 0x94, 0x74, ""/116}, &(0x7f0000000300)=0x94, 0x1) (async) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x0) (async) ioctl$FE_GET_PROPERTY(r1, 0x80106f53, &(0x7f0000000040)={0x4, &(0x7f00000000c0)=[{0x1b, '\x00', @data=0xfffffffd, 0x5}, {0x34, '\x00', @buffer={"1a1ce1ba1b4997c3c5d8630dd694a849230c0000000000eb00", 0x20}, 0x6447}, {0x37, '\x00', @st={0x4, [{0x0, @svalue=0x1}, {0x1, @uvalue=0x400}, {0x1, @uvalue=0x2}, {0x2, @svalue=0x1}]}, 0x9b10}, {0x9, '\x00', @st={0x4, [{0x2, @uvalue=0x1eac}, {0x3, @svalue=0x2}, {0x1, @uvalue=0x10000}, {0x1, @svalue}]}, 0x2}]}) (async) mount(0x0, &(0x7f00000000c0)='./tracing\x00', 0x0, 0x0, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) (async) ioctl$MEMWRITEOOB64(r0, 0xc0184d15, &(0x7f0000000140)={0x3, 0x0, 0x0, 0x0}) (async) socket(0x10, 0x3, 0x0) (async) connect$netlink(r2, &(0x7f0000000280)=@proc={0x10, 0x0, 0x1, 0x10000}, 0xc) (async) sendmsg$nl_route_sched(r2, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000bc0)=@newtaction={0x18, 0x31, 0x829, 0x0, 0x0, {0x0, 0x0, 0x2}, [{0x4}]}, 0x18}}, 0x0) (async) sendmsg$NL80211_CMD_DEL_STATION(r2, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x20, 0x0, 0x10, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0xa, 0x13, [{0x1, 0x1}, {0x6, 0x1}, {0x36, 0x1}, {0x6c}, {0x1}, {0x60, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4008010}, 0x20000000) (async) 288.249074ms ago: executing program 0 (id=28): r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) setsockopt$sock_int(r0, 0x1, 0x0, &(0x7f0000000080), 0x4) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001a80)=[{&(0x7f0000000200)="2abd09f90d00d589551407cd47716c95d9bfc291df42ca67fe85b8a109d56cad4de282382ae9b46cb362510456b8a914fa8f2ef56424c3897737d74dee0e1c029016306ac55d9a41815936b6526589e2c0209d0c2588d4d7212244dcb092c7ceef4cad80d572c65897deb9bde29927", 0x6f}, {&(0x7f00000002c0)="61dd2a1affa639b752d1f90000000000000000", 0x13}, {&(0x7f0000000900)="8e744e94e879bd2811315a3896e4e16eacb34bdf050fb2f2016348735ecc8243e30b1d2e4c5854472deadcaaf46f8d7e597ae8c91f75c01e188151d7f32ec1b164acfffa4d12adfe76f2bc612b7627673aff60c419f2df0919359506c3ec9a985b46f2a2051a423a2ce8713a6bd6375052fee24ce1bcffdd9b1c399a2109d1650a742c8965cfee1e30e541a32a6809ad66ec865c75a6f10bb4e2ffbcd58886257698bfd5fe428941e1e09fbe2d5146039789b4130ac40a59ddf6b03bb95b16a5e1e8515d670e375a61de426cfb2afa4fdc46560e7137903357b0734648ee31140354977c91099a2ec4f0aaba9bc60589e59e5213c4ca92a9f8701ca7355d112e6fd6e816b9c585007c78af5f2d2a3d1c71c82ca0669fdab2feac19e085901d3b3f3edd033f0826f26969cf6443598c4da0071a67bdfb27b7e0e6d611368ea0e9389eb95d57a9adb5452b355c4326a50fd4f3f238b59375e4d2633a10cf93945795b3f10a7ac3374498499f17d48e9a824745a3673aa20d33e4462131885338f83294b872606b5618b66840e59b26206826143fef27db81175502aac0fbe8da8de68506b3c27d2d3b2902d00a7189b67b1b2dda6eb5a93cbb824597e857e27056d7ea07604462e0cdd1354da7bf4acfb813404370633d19c1f988a5b99f050f3071b14dd24273f365313efca7b8679682626cbeff4610599c8cb9b5fe7ce6bd85688bfcc83b9a705e707fbdc45c8a39a3c72329fcbfe430fe1e25ea6122a5b996656336d31a698cc5c8aab385b963dc206d32ec257dd0c1f0144f2d754787617a0dedfdf6aeb874c261c1c39d45aa3f953828f4cacbf648dfb9c10e7e7f61f034842288dab273bc86162d9cd0f4b002410ae092f6192cb539a7e1bcfee356d17d8d6573efbf8fea3b1dc1f115a016d292731a5ed7e7218a6f9a084034135cd78514250f8d02d4d9f8091263d5372350158d464a20a5a1874771bf0893f60b2212c20dd0df88f8e368a3f37f03be8f33c254b936e81c43407bea0acf6eb091afda2d3fc9a840525b4aa63a2bd021a8b3751cf70ec378337ea74731fbd2303f8d0c1b2241bd41d0523a7d2b77e34fc3ea550e1d9e068c45f44d5420ba7620732f1b8c1980910bf63f92dc6092e68b1cf496dcbb71a70baa9de3753cf0fc73ea77df7504ae7d2f18ff85e0bf0ac83b4c1046185f00c1c141616c327e69f9fa56d9af6c203ead8f50f6c55769213ba9bd7e62fcb1c3ee798d26bb332f0d226112eb417fe7e4d2ff401f1ea3774500576fa47185a8cd30ebe646ca21f4d227a440ff0b312c77b58095d6cf9acf64835ab86cab78075ec52078b9ab5c43223369cb7ae5c87e51c4e3dde51f9110d7dc21908d6a5765740b82962bc8afc4240756f78865560d2b9754725cf6e42aef6b95d1f9d6ef6c2ff084c169b14c50fb27b8fc36", 0x3ff}], 0x3, 0x0, 0x0, 0x4008084}, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x71, 0xffffffffffffffff, 0x46e4c000) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="60000000420001000000000000000000030100000f0000003f00010000112233445566778899aabb86dd2c00001c00002b00011100000101010102538758fe6cbdf0357065ae44132403b1fd606412c3258e2b670000b20004000280040003"], 0x60}}, 0x0) setsockopt$RDS_CONG_MONITOR(r0, 0x114, 0x6, &(0x7f0000000000)=0x1, 0x4) setxattr$incfs_id(&(0x7f00000001c0)='./cgroup\x00', &(0x7f0000000200), 0x0, 0x0, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x2800, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(r2, 0xc0189376, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x8b2}}, './cgroup\x00'}) 286.092415ms ago: executing program 1 (id=29): r0 = socket(0x10, 0x803, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x9) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="a000000010003b0e2a1a86eb2636037f00000000", @ANYRES32=r1, @ANYBLOB="0200000000008000800012000800010076746936"], 0xa0}}, 0x0) r2 = fsopen(&(0x7f0000000240)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x0) fchdir(r3) mkdir(&(0x7f00000008c0)='./bus\x00', 0x0) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x101000, 0x108) getdents64(r4, &(0x7f00000000c0)=""/55, 0x37) rename(&(0x7f0000000180)='./bus\x00', &(0x7f00000001c0)='./file0\x00') ioctl$sock_ifreq(r0, 0x8925, &(0x7f0000000040)={'veth1_to_bond\x00', @ifru_names='macvtap0\x00'}) 278.111029ms ago: executing program 0 (id=30): r0 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) ioctl$CDROM_LOCKDOOR(r0, 0x5329, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000444ff8)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x9}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r1, &(0x7f0000000480)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback, 0x50000000}, 0x1c, &(0x7f0000000680)=[{&(0x7f00000034c0)='\x00', 0x1}], 0x1}}], 0x1, 0x80) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f00000002c0)=ANY=[@ANYBLOB="12e01b3989dd", @ANYRES32=r1], 0x1000f) openat$cdrom(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) (async) ioctl$CDROM_LOCKDOOR(r0, 0x5329, 0x0) (async) socket$inet6_sctp(0xa, 0x1, 0x84) (async) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000444ff8)={0x0, 0x7}, 0x8) (async) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x9}, 0x8) (async) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) (async) sendmmsg$inet6(r1, &(0x7f0000000480)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback, 0x50000000}, 0x1c, &(0x7f0000000680)=[{&(0x7f00000034c0)='\x00', 0x1}], 0x1}}], 0x1, 0x80) (async) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f00000002c0)=ANY=[@ANYBLOB="12e01b3989dd", @ANYRES32=r1], 0x1000f) (async) 277.444888ms ago: executing program 2 (id=31): mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) symlink(&(0x7f0000000080)='.\x00', &(0x7f0000000240)='./file0\x00') chmod(&(0x7f0000000040)='./file0\x00', 0x34a) lchown(&(0x7f00000001c0)='./file0\x00', 0xee00, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x60840, 0x8) ioperm(0x1, 0xb2be, 0x163f) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r1) r2 = syz_io_uring_setup(0x5d42, &(0x7f0000000000)={0x0, 0xcdf0, 0x400, 0x2, 0x280}, &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100)) io_uring_register$IORING_UNREGISTER_EVENTFD(r2, 0x5, 0x0, 0x0) setns(0xc9, 0x0) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2688a24c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) ptrace$getregset(0x4204, r1, 0x201, &(0x7f00000001c0)={0x0, 0x300}) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x7, &(0x7f0000000140)=r0, 0x1) 209.779688ms ago: executing program 1 (id=32): r0 = mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000001, 0x12, 0xffffffffffffffff, 0x0) r1 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(0xffffffffffffffff, 0xa, 0x0, r1) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) (async) r2 = syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYRES8=r0, @ANYRESOCT=0x0, @ANYRES32=r2], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) add_key$user(&(0x7f0000000380), &(0x7f0000000080)={'syz', 0x3}, &(0x7f0000000000)="15", 0x1, 0xffffffffffffffff) (async) r3 = add_key$user(&(0x7f0000000380), &(0x7f0000000080)={'syz', 0x3}, &(0x7f0000000000)="15", 0x1, 0xffffffffffffffff) r4 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f0000000600)="2c1aa441ced9069af0020000f0e7fb5b5e846b76c753218fde00308fbfdab5bcb594a99b7a766d0073da4f8ad4334cbde266ae7eccc4c6c8d68f37792add33c7360b1fe0ebfca28ca0775863609d6da20000d149346c15741109e294d138ffd666ba75fe152e0625543a601ecc6ffbd4b96f92462337e554f78882751738e03cc7c33481bca4c9f781d9946992d9deabcf551edcc1684633585e69dce1ec4f104d425f4d8c83b18375420b2d96c3090078703f78d246c1fad986b9dbe9ee222a", 0xc0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000100)={r3, r4, r4}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'streebog512-generic\x00'}}) (async) keyctl$dh_compute(0x17, &(0x7f0000000100)={r3, r4, r4}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'streebog512-generic\x00'}}) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) (async) r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r5, &(0x7f0000000000)='3', 0x4e) (async) write(r5, &(0x7f0000000000)='3', 0x4e) syz_open_dev$usbmon(&(0x7f00000001c0), 0xb5b, 0x4880) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x4000, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(0xffffffffffffffff, &(0x7f0000000000)='3', 0x1) (async) write(0xffffffffffffffff, &(0x7f0000000000)='3', 0x1) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000d88000/0x1000)=nil, &(0x7f00007f2000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff6000/0xa000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f00008f7000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) (async) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000d88000/0x1000)=nil, &(0x7f00007f2000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff6000/0xa000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f00008f7000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r7 = io_uring_setup(0x2c3a, &(0x7f00000002c0)={0x0, 0x2150, 0x100, 0x3, 0x4b}) mount$binderfs(0x0, &(0x7f0000000040)='./binderfs\x00', &(0x7f0000000140), 0x4800, &(0x7f0000000440)=ANY=[@ANYBLOB="6d61783d30303030303030303030303030303030303030303030352c737461ad0c1d9b4a3a1a1b2fd62e0574733d676c6f62616c2c008b645dffe2f8cb0d66b8d7a193ee5d66547cd428a6f145d9da5270e64614832cbe"]) ioctl$DVB_DVR_DMX_EXPBUF(r6, 0xc00c6f3e, &(0x7f0000000200)={0x2, 0x80000, r5}) ioctl$UBLK_U_CMD_ADD_DEV(r8, 0xc0207504, &(0x7f00000004c0)={0xffffffff, 0xffff, 0x40, &(0x7f0000000280)=@any_dev={0x2, 0x143, 0x0, 0x0, 0x1000, 0xd, 0x0, 0x0, 0xa0}}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) io_uring_enter(r7, 0x577c, 0xcf78, 0x16, 0x0, 0xffffffffffffffb3) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x0, 0x0, &(0x7f0000000340)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x0, 0x0, &(0x7f0000000340)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) 209.546451ms ago: executing program 0 (id=33): r0 = fsopen(&(0x7f0000000000)='proc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x81) fchdir(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) madvise(&(0x7f0000e95000/0x4000)=nil, 0x4000, 0x12) syz_clone3(&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/serio/devices/serio1/drvctl\x00', 0x1, 0x0) write(r2, &(0x7f0000000800)='res', 0x3) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './bus'}}, {@uuid_off}]}) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000000)='./cgroup\x00', &(0x7f00000001c0)='ceph\x00', 0x208004, 0x0) 209.206044ms ago: executing program 3 (id=34): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) fcntl$notify(r1, 0x402, 0x4) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r2, 0x400448e4, &(0x7f0000000000)) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000016000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, &(0x7f0000000040)="66b8008000000f23d80f21f86635c00000700f23f866b9270900000f32660f7cca66b8000001000f23c80f21f86635040030000f23f80fc75d440f0f23bf0f01c5660f38804c490f20c06635100000000f22c0baf80c66b869f6828c66efbafc0cec", 0x62}], 0x1, 0x4a, &(0x7f0000000740)=[@cr4={0x1, 0x14450b}], 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f000000b000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, &(0x7f0000000240)="0f0d51f40f01d10fc75800f30fc73600102ed5c01dc0000000008ec0640f017400aa66b9e408000066b81f6269e766ba000000000f3036db45ef0c0cb8d09bbc8966efbafc0cedba4300ba210066ed3626f00fc70d", 0x55}], 0x1, 0x2, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 208.888073ms ago: executing program 1 (id=35): r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x4}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) sendto$packet(0xffffffffffffffff, &(0x7f0000000200)="330520000a00160006007ef52f555f2ab34eb67eabe2f3febf30f8784f997b00000080b122516dce92cc8bde1d664d697d8213", 0x33, 0x4001, 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) ioctl$TCSETAF(r1, 0x5408, &(0x7f00000000c0)={0xf642, 0x6, 0x6, 0x9dfe, 0x15}) write$binfmt_aout(r1, &(0x7f00000000c0)=ANY=[], 0xff2e) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000180)={0x0, 0x0, 0xfffffff9, 0x6, 0x16, "0062007d8200f7ffffff00"}) r2 = syz_open_pts(r1, 0x20000) r3 = dup3(r2, r1, 0x0) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000200)=0x17) ioctl$UFFDIO_CONTINUE(r0, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x66) 118.677455ms ago: executing program 0 (id=36): r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000000300)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(0xffffffffffffffff, 0xfffffffc) r1 = socket$inet(0xa, 0x801, 0x84) connect$inet(r1, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r1, 0x8) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010040000000000002034400000008000300", @ANYRES32=r5, @ANYBLOB="08002600851600000a00180000000000000000001c005a8018000180140002"], 0x4c}}, 0x0) r6 = accept4(r1, 0x0, 0x0, 0x800) sendto$inet(r6, &(0x7f00000002c0)="cc", 0x1, 0x41, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r6, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x3}, 0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r6, 0x84, 0x7c, &(0x7f0000000180)={0x0, 0x0, 0x6d4}, &(0x7f00000001c0)=0x8) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="2800000040000701feffffff02000000017c00000c00018006b4d24b9a0a00000800028004"], 0x28}, 0x1, 0x0, 0x0, 0x4048011}, 0xc800) r7 = socket$kcm(0x10, 0x2, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r8) sendmsg$NLBL_CIPSOV4_C_ADD(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000280)={0x40, r9, 0x1, 0x0, 0x0, {}, [@NLBL_CIPSOV4_A_DOI={0x8}, @NLBL_CIPSOV4_A_TAGLST={0x4}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLST={0x18, 0x8, 0x0, 0x1, [{0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x4b}]}]}]}, 0x40}}, 0x0) r10 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_ADD(r8, &(0x7f0000000480)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x3c, r10, 0x300, 0x70bd25, 0x25dfdbfb, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8011}, 0x90) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d80000001a0081044e81f782db4cb904021d08007b490d4f1e81f8d815001000ff05143a13600e12080005007a010401a80016002000034004", 0x39}], 0x1}, 0x0) write$cgroup_subtree(r7, &(0x7f0000000040)=ANY=[], 0xfe33) mount$9p_unix(&(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f00000001c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f00000000c0), 0x191008, &(0x7f0000000200)={'trans=unix,', {[{@cache_fscache}, {@cache_mmap}, {@loose}, {@cache_loose}]}}) accept4$unix(r0, &(0x7f00000003c0)=@abs, 0x0, 0x0) 118.005614ms ago: executing program 2 (id=37): openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x88800, 0x0) (async) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x88800, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000003c0)={0xc}) (async) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000080)={0x48, 0x2, r1}) r2 = syz_open_dev$loop(&(0x7f0000000280), 0xffff, 0x14f600) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r3, &(0x7f0000000040), 0xe09) (async) write$binfmt_misc(r3, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f0000000440)={r3, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x80000000700, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd00000080190000001f00", [0x0, 0x31]}}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x22802, 0x0) ioctl$FS_IOC_GETVERSION(r4, 0x80087601, &(0x7f0000000180)) (async) ioctl$FS_IOC_GETVERSION(r4, 0x80087601, &(0x7f0000000180)) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f0000000400)={0x28, 0x51549c8f4cef6f72, r1, 0x0, &(0x7f0000003000/0x1000)=nil, 0x1000, 0x7ffffffe}) (async) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f0000000400)={0x28, 0x51549c8f4cef6f72, r1, 0x0, &(0x7f0000003000/0x1000)=nil, 0x1000, 0x7ffffffe}) r5 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000000140)) syz_pidfd_open(r5, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, r6, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x26}) 117.200124ms ago: executing program 3 (id=38): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee7, 0x8031, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)='maps\x00') prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000000000/0x1000)=nil, 0x1000, &(0x7f0000000100)='maps\x00') r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha224\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x800) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e22, 0x4, @loopback, 0xffff8001}, 0x1c) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0xc0686611, &(0x7f0000000040)={0x10002, 0x0, 0x17, 0x2000, &(0x7f0000ffd000/0x2000)=nil}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = eventfd(0x201) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff) rmdir(&(0x7f0000000100)='./config/usb_gadget/g1/functions/hid.usb0\x00') ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000240)={0x27800000000, 0x0, 0x1, r5, 0x1}) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000040)={0xbf9, 0x0, 0x1, r5, 0x5}) 49.132658ms ago: executing program 2 (id=39): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000001c0)={0x1b, 0x0, 0x0, 0x10, 0x0, 0xffffffffffffffff, 0xfffff469, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x4, 0x3}, 0x50) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000001d00)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}}, {{&(0x7f0000000280)=@abs={0x0, 0x0, 0x4e24}, 0x6e, 0x0, 0x0, &(0x7f00000018c0)=ANY=[@ANYBLOB="140000000000000001000000aa377cff", @ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00'], 0x18, 0x20008880}}], 0x2, 0x4c054) (async) r3 = open(&(0x7f0000000040)='./file1\x00', 0x808400, 0x43) mkdirat(r3, &(0x7f0000000340)='./file0\x00', 0xf3) r4 = signalfd4(0xffffffffffffffff, &(0x7f0000000400)={[0x6]}, 0x8, 0x0) (async) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) (async) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) (async) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000300)=@newqdisc={0x24, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0x25dfdbfc, {0x0, 0x0, 0x0, r8, {0xffff}, {0xffff, 0xffff}, {0x2, 0x10}}}, 0x24}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r9 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000006c0)=0xffffffffffffffff, 0x4) (async, rerun: 32) r10 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000780)={0x0, 0xf, 0x10}, 0xc) (rerun: 32) r11 = openat$hpet(0xffffffffffffff9c, &(0x7f00000007c0), 0x100, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000008c0)={0x18, 0x23, &(0x7f0000000440)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x79d, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@map_val={0x18, 0xb, 0x2, 0x0, r3}, @printk={@llu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x8001}}, @generic={0x1, 0x6, 0x9, 0x1061, 0x7}, @generic={0x5, 0x4, 0x4, 0x3, 0x6}, @map_idx={0x18, 0x2, 0x5, 0x0, 0x1}, @tail_call={{0x18, 0x2, 0x1, 0x0, r4}}, @call={0x85, 0x0, 0x0, 0x67}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000580)='GPL\x00', 0x9efa, 0xcd, &(0x7f00000005c0)=""/205, 0x41000, 0x81, '\x00', r8, 0x0, r9, 0x8, &(0x7f0000000700)={0x3, 0x3}, 0x8, 0x10, &(0x7f0000000740)={0x1, 0x5, 0x4, 0x3}, 0x10, 0x0, 0x0, 0x5, &(0x7f0000000800)=[r10, r11, 0xffffffffffffffff], &(0x7f0000000840)=[{0x5, 0x1, 0xc, 0x4}, {0x5, 0x2, 0x4, 0x4}, {0x0, 0x1, 0x0, 0xf}, {0x5, 0x2, 0xa, 0x4}, {0x1, 0x1, 0x3, 0xb}], 0x10, 0x5cd}, 0x94) (async) syz_emit_ethernet(0x3e, &(0x7f0000000980)=ANY=[@ANYBLOB="aaaaaaaaaaaa0000ea07000081003000080045b4002c00000000a3069078ac1414bbac1414aa4e224001", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="bbe99a7bd46829c1c9a0219f6004000090784000050a0000"], 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) (async) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000280)={0x0, @in6={{0xa, 0xff5, 0x7, @private2, 0x400}}, [0x0, 0x0, 0x5, 0x5816, 0xd674, 0x5, 0xfffffffffffffffb, 0x2, 0x800, 0x5, 0x2, 0xd, 0x7ff, 0x1, 0xfffffffffffff422]}, &(0x7f0000000380)=0x100) (async) syz_emit_ethernet(0x46, &(0x7f0000001980)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaaaa86dd60010100001011fffe8000000000000000000000000000bbfe8000000000000000000000000000aa00000e22000e"], 0x0) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f00000003c0)={r12, 0x1d}, 0x8) (async) r13 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) (async) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f0000000100)={@private0, 0x0}, &(0x7f0000000140)=0x14) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x0, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x2, '\x00', r14, @cgroup_sock_addr=0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) io_uring_enter(r13, 0x2219, 0x7721, 0x16, 0x0, 0x0) 48.052313ms ago: executing program 0 (id=40): r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r1 = fcntl$dupfd(r0, 0x406, r0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) write$tun(r1, &(0x7f0000000400)=ANY=[], 0xa2) write(r0, &(0x7f0000000240)="6f5d5501f623d2ffd92cfa6da2b84017bf5fd7500da5148cab0d907871e3c06e2019f75ac2622af127d3", 0x2a) r2 = socket$netlink(0x10, 0x3, 0x0) socket$inet6(0xa, 0x80000, 0xce4) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x4b564d02, 0xec000000, 0x6}]}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r6 = getpid() sched_setscheduler(r6, 0x2, 0x0) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x208) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/kvm_intel/parameters/vmentry_l1d_flush\x00', 0x2, 0x0) read$snapshot(r7, &(0x7f0000000140)=""/58, 0x3a) sendmsg(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f00000001c0)="5500000018007f5f00fe01b2a4a2809302060000ff41fd01040400000a00120002002800000019002d4400009b84136ef75afb83de066a5900e1baac341b61130000f2ff00000100"/85, 0x55}], 0x1, 0x0, 0x0, 0x7a000000}, 0x0) 0s ago: executing program 0 (id=41): io_setup(0x8, &(0x7f0000000000)=0x0) (async) r1 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) r2 = eventfd(0x8) openat(r1, &(0x7f0000000040)='./file0\x00', 0x633000, 0x1) (async) io_cancel(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x3, 0x6, r1, &(0x7f00000001c0)="d9ab0dada9c6f1dc8b9ef93fa76b0bc4ee44204de191e3746c3bd243aaeb912685743482cc5ac7d74afd2a14cf07b8f8c5f77caf0e561adde6552b6774834c0e2cb9526b63def682f580b5a4122b4675e3a81c10ad74f0a050f22b5a13374424852b715332272bd3bf12dd7318d80ae3a7982dc44f88a9cb8f54c7bf1977b28ea9c3e438e0529bc858fe9f74edf3020000000000000030429034a0bfc42a020caa9c7f72d09e45a424bec7e2754ecd866bd775b3e44bdf69b743bfc05ccec84be248785254a6e5a6716cef8ded5a2db2fb474fa712db6c72b5c3a789c1c49cca7bee7c91d29fa3059aeda639e7e173fd4e822b54c296b990f33700000000000000", 0x101, 0x989e, 0x0, 0x3, r2}, &(0x7f0000000100)) (async) io_setup(0x226, &(0x7f0000000180)) kernel console output (not intermixed with test programs): [ 29.018294][ T43] audit: type=1400 audit(1791101588.208:113): avc: denied { write } for pid=5635 comm="sh" path="pipe:[1603]" dev="pipefs" ino=1603 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 29.018715][ T43] audit: type=1400 audit(1791101588.208:114): avc: denied { rlimitinh } for pid=5635 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 29.018745][ T43] audit: type=1400 audit(1791101588.208:115): avc: denied { siginh } for pid=5635 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '[localhost]:13680' (ED25519) to the list of known hosts. [ 30.871262][ T43] audit: type=1400 audit(1791101590.058:116): avc: denied { name_bind } for pid=5642 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 30.908398][ T43] audit: type=1400 audit(1791101590.098:117): avc: denied { execute } for pid=5643 comm="sh" name="syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 30.908913][ T43] audit: type=1400 audit(1791101590.098:118): avc: denied { execute_no_trans } for pid=5643 comm="sh" path="/syz-executor" dev="sda1" ino=2020 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 31.588959][ T43] audit: type=1400 audit(1791101590.778:119): avc: denied { write } for pid=5644 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 31.628982][ T43] audit: type=1400 audit(1791101590.818:120): avc: denied { write } for pid=5647 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 31.773645][ T43] audit: type=1400 audit(1791101590.958:121): avc: denied { write } for pid=5650 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 31.836584][ T43] audit: type=1400 audit(1791101591.018:122): avc: denied { write } for pid=5653 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.285867][ T43] audit: type=1400 audit(1791101591.468:123): avc: denied { write } for pid=5656 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.355263][ T43] audit: type=1400 audit(1791101591.538:124): avc: denied { write } for pid=5659 comm="rm" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 32.624632][ T43] audit: type=1400 audit(1791101591.808:125): avc: denied { write } for pid=5662 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1839 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 33.049850][ T5643] cgroup: Unknown subsys name 'net' [ 33.191172][ T5643] cgroup: Unknown subsys name 'cpuset' [ 33.195288][ T5643] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 33.418045][ T5688] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 34.108204][ T5643] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 37.496845][ T43] kauditd_printk_skb: 35 callbacks suppressed [ 37.496862][ T43] audit: type=1400 audit(1791101596.678:161): avc: denied { execmem } for pid=5722 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 37.745017][ T43] audit: type=1400 audit(1791101596.928:162): avc: denied { create } for pid=5726 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 37.745047][ T43] audit: type=1400 audit(1791101596.928:163): avc: denied { create } for pid=5727 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 37.745322][ T43] audit: type=1400 audit(1791101596.928:164): avc: denied { read write } for pid=5727 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 37.745348][ T43] audit: type=1400 audit(1791101596.928:165): avc: denied { read write } for pid=5726 comm="syz-executor" name="vhci" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 37.745696][ T43] audit: type=1400 audit(1791101596.928:166): avc: denied { open } for pid=5726 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 37.745721][ T43] audit: type=1400 audit(1791101596.928:167): avc: denied { open } for pid=5727 comm="syz-executor" path="/dev/vhci" dev="devtmpfs" ino=1290 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:vhost_device_t tclass=chr_file permissive=1 [ 37.756104][ T43] audit: type=1400 audit(1791101596.938:168): avc: denied { ioctl } for pid=5727 comm="syz-executor" path="socket:[1640]" dev="sockfs" ino=1640 ioctlcmd=0x48c9 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 37.773515][ T5731] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 37.782178][ T5740] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 37.782824][ T5740] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 37.784183][ T5740] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 37.785497][ T5740] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 37.786244][ T5740] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 37.787395][ T5740] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 37.788607][ T5740] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 37.789278][ T5740] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 37.789739][ T5740] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 37.790454][ T5740] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 37.790546][ T5740] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 37.791229][ T5740] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 37.792682][ T5738] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 37.794026][ T5088] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 37.795140][ T5088] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 37.795435][ T5738] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 37.796221][ T5088] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 37.803369][ T43] audit: type=1400 audit(1791101596.988:169): avc: denied { read } for pid=5727 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 37.803411][ T43] audit: type=1400 audit(1791101596.988:170): avc: denied { open } for pid=5727 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 37.803590][ T5730] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 37.815739][ T5730] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 38.408158][ T5726] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.409028][ T5726] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.409333][ T5726] bridge_slave_0: entered allmulticast mode [ 38.410600][ T5726] bridge_slave_0: entered promiscuous mode [ 38.414465][ T5726] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.414543][ T5726] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.414676][ T5726] bridge_slave_1: entered allmulticast mode [ 38.416547][ T5726] bridge_slave_1: entered promiscuous mode [ 38.423518][ T5727] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.423590][ T5727] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.423678][ T5727] bridge_slave_0: entered allmulticast mode [ 38.425191][ T5727] bridge_slave_0: entered promiscuous mode [ 38.458364][ T5727] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.458438][ T5727] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.458538][ T5727] bridge_slave_1: entered allmulticast mode [ 38.460035][ T5727] bridge_slave_1: entered promiscuous mode [ 38.462154][ T5728] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.462212][ T5728] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.462284][ T5728] bridge_slave_0: entered allmulticast mode [ 38.463507][ T5728] bridge_slave_0: entered promiscuous mode [ 38.476010][ T5726] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 38.490559][ T5728] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.490603][ T5728] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.490655][ T5728] bridge_slave_1: entered allmulticast mode [ 38.491638][ T5728] bridge_slave_1: entered promiscuous mode [ 38.500420][ T5726] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 38.526221][ T5728] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 38.537103][ T5727] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 38.539296][ T5728] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 38.541733][ T5726] team0: Port device team_slave_0 added [ 38.543222][ T5726] team0: Port device team_slave_1 added [ 38.554926][ T5727] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 38.597562][ T5727] team0: Port device team_slave_0 added [ 38.597650][ T5733] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.597710][ T5733] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.597763][ T5733] bridge_slave_0: entered allmulticast mode [ 38.598489][ T5733] bridge_slave_0: entered promiscuous mode [ 38.601153][ T5727] team0: Port device team_slave_1 added [ 38.602165][ T5728] team0: Port device team_slave_0 added [ 38.603558][ T5728] team0: Port device team_slave_1 added [ 38.604545][ T5726] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 38.604552][ T5726] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.604565][ T5726] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 38.611909][ T5733] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.611995][ T5733] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.612189][ T5733] bridge_slave_1: entered allmulticast mode [ 38.612941][ T5733] bridge_slave_1: entered promiscuous mode [ 38.627136][ T5726] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 38.627150][ T5726] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.627164][ T5726] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 38.640948][ T5733] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 38.653164][ T5728] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 38.653179][ T5728] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.653201][ T5728] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 38.654861][ T5728] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 38.654874][ T5728] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.654892][ T5728] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 38.656359][ T5733] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 38.656901][ T5727] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 38.656909][ T5727] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.656922][ T5727] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 38.675313][ T5727] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 38.675323][ T5727] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.675337][ T5727] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 38.681088][ T5733] team0: Port device team_slave_0 added [ 38.688779][ T5733] team0: Port device team_slave_1 added [ 38.721403][ T5726] hsr_slave_0: entered promiscuous mode [ 38.721868][ T5726] hsr_slave_1: entered promiscuous mode [ 38.729023][ T5733] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 38.729033][ T5733] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.729045][ T5733] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 38.750580][ T5733] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 38.750591][ T5733] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 38.750604][ T5733] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 38.753644][ T5728] hsr_slave_0: entered promiscuous mode [ 38.754204][ T5728] hsr_slave_1: entered promiscuous mode [ 38.754500][ T5728] debugfs: 'hsr0' already exists in 'hsr' [ 38.754561][ T5728] Cannot create hsr debugfs directory [ 38.763360][ T5727] hsr_slave_0: entered promiscuous mode [ 38.763885][ T5727] hsr_slave_1: entered promiscuous mode [ 38.764201][ T5727] debugfs: 'hsr0' already exists in 'hsr' [ 38.764216][ T5727] Cannot create hsr debugfs directory [ 38.789509][ T5733] hsr_slave_0: entered promiscuous mode [ 38.790053][ T5733] hsr_slave_1: entered promiscuous mode [ 38.790417][ T5733] debugfs: 'hsr0' already exists in 'hsr' [ 38.790434][ T5733] Cannot create hsr debugfs directory [ 39.090157][ T5726] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 39.096511][ T5726] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 39.099777][ T5726] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 39.105251][ T5726] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 39.106364][ T5726] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 39.110980][ T5726] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 39.117926][ T5726] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 39.120977][ T5726] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 39.164376][ T5728] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 39.168990][ T5728] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 39.169378][ T5728] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 39.174496][ T5728] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 39.177554][ T5726] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.177628][ T5726] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.177965][ T5726] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.178041][ T5726] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.181167][ T5728] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 39.184793][ T5728] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 39.192936][ T5728] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 39.196005][ T5728] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 39.249479][ T224] bridge0: port 1(bridge_slave_0) entered disabled state [ 39.253415][ T224] bridge0: port 2(bridge_slave_1) entered disabled state [ 39.267871][ T5727] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 39.270282][ T5727] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 39.270789][ T5727] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 39.273923][ T5727] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 39.278802][ T5727] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 39.281132][ T5727] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 39.290397][ T5727] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 39.294288][ T5727] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 39.349151][ T5733] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 39.351723][ T5733] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 39.354955][ T5733] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 39.359230][ T5733] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 39.363211][ T5733] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 39.369287][ T5733] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 39.373233][ T5726] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.378391][ T5733] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 39.383088][ T5733] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 39.420267][ T5726] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.442734][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.442824][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.454028][ T37] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.454112][ T37] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.500369][ T5728] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.551133][ T5727] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.554081][ T5728] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.572329][ T38] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.572421][ T38] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.585540][ T38] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.585628][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.596934][ T5727] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.598664][ T5733] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.613306][ T38] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.613390][ T38] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.621199][ T38] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.621283][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.633830][ T5733] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.656148][ T38] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.656231][ T38] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.658462][ T38] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.658507][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.837501][ T5726] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.875662][ T5726] veth0_vlan: entered promiscuous mode [ 39.877716][ T5730] Bluetooth: hci1: command tx timeout [ 39.879769][ T5726] veth1_vlan: entered promiscuous mode [ 39.886879][ T5730] Bluetooth: hci3: command tx timeout [ 39.887043][ T5730] Bluetooth: hci0: command tx timeout [ 39.887102][ T5730] Bluetooth: hci2: command tx timeout [ 39.895647][ T5726] veth0_macvtap: entered promiscuous mode [ 39.898486][ T5726] veth1_macvtap: entered promiscuous mode [ 39.906700][ T5726] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.911508][ T5726] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.915162][ T5728] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.921595][ T5727] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.956436][ T5733] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 40.005604][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.005624][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.013736][ T5727] veth0_vlan: entered promiscuous mode [ 40.018701][ T5728] veth0_vlan: entered promiscuous mode [ 40.040811][ T5728] veth1_vlan: entered promiscuous mode [ 40.041606][ T5727] veth1_vlan: entered promiscuous mode [ 40.044344][ T1163] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.044355][ T1163] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.061098][ T5733] veth0_vlan: entered promiscuous mode [ 40.073216][ T5727] veth0_macvtap: entered promiscuous mode [ 40.078959][ T5733] veth1_vlan: entered promiscuous mode [ 40.081045][ T5728] veth0_macvtap: entered promiscuous mode [ 40.082726][ T5727] veth1_macvtap: entered promiscuous mode [ 40.090532][ T5726] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 40.094515][ T5728] veth1_macvtap: entered promiscuous mode [ 40.107868][ T5728] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.113869][ T5727] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.116102][ T5728] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.123683][ T5727] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.129617][ T5733] veth0_macvtap: entered promiscuous mode [ 40.136948][ T5733] veth1_macvtap: entered promiscuous mode [ 40.147812][ T5542] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.148113][ T5542] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.187708][ T5733] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 40.196006][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.196021][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.201857][ T5733] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 40.220928][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.220939][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.243378][ T37] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.243397][ T37] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.257622][ T5805] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.257768][ T5805] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.274519][ T38] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.274534][ T38] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.302053][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.302070][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.303012][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.303535][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.303704][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.317135][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.317159][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.317176][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.317193][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.317210][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.317226][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.317243][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.317260][ T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.317277][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 40.326322][ T38] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 40.326338][ T38] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 40.418187][ T5886] team0: Device ipip0 is of different type [ 40.445767][ T5888] FAULT_INJECTION: forcing a failure. [ 40.445767][ T5888] name failslab, interval 1, probability 0, space 0, times 1 [ 40.445786][ T5888] CPU: 3 UID: 0 PID: 5888 Comm: syz.0.7 Not tainted syzkaller #0 PREEMPT(full) [ 40.445799][ T5888] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 40.445805][ T5888] Call Trace: [ 40.445809][ T5888] [ 40.445814][ T5888] dump_stack_lvl+0x100/0x190 [ 40.445835][ T5888] should_fail_ex.cold+0x5/0xa [ 40.445851][ T5888] should_failslab+0xc2/0x120 [ 40.445868][ T5888] kmem_cache_alloc_noprof+0x92/0x6a0 [ 40.445883][ T5888] ? __mt_dup+0x61e/0xce0 [ 40.445898][ T5888] __mt_dup+0x61e/0xce0 [ 40.445913][ T5888] ? __pfx___mt_dup+0x10/0x10 [ 40.445929][ T5888] ? lock_acquire+0x1d1/0x380 [ 40.445941][ T5888] ? get_mm_exe_file+0x25/0x1a0 [ 40.445961][ T5888] dup_mmap+0x3d0/0x2370 [ 40.445979][ T5888] ? do_raw_spin_lock+0x128/0x260 [ 40.446005][ T5888] ? __pfx_dup_mmap+0x10/0x10 [ 40.446021][ T5888] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 40.446033][ T5888] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 40.446046][ T5888] ? __lock_acquire+0x5c0/0x1f40 [ 40.446064][ T5888] ? lock_acquire+0x1d1/0x380 [ 40.446077][ T5888] ? copy_process+0x4816/0x8380 [ 40.446096][ T5888] copy_process+0x4821/0x8380 [ 40.446117][ T5888] ? __pfx_copy_process+0x10/0x10 [ 40.446131][ T5888] ? futex_wake+0x4ea/0x5e0 [ 40.446150][ T5888] kernel_clone+0x176/0x9d0 [ 40.446164][ T5888] ? __pfx_kernel_clone+0x10/0x10 [ 40.446184][ T5888] __do_sys_clone+0xd9/0x120 [ 40.446196][ T5888] ? __pfx___do_sys_clone+0x10/0x10 [ 40.446220][ T5888] do_syscall_64+0x123/0x790 [ 40.446233][ T5888] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 40.446244][ T5888] RIP: 0033:0x7f451099e159 [ 40.446254][ T5888] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 40.446264][ T5888] RSP: 002b:00007f451182afd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 40.446278][ T5888] RAX: ffffffffffffffda RBX: 00007f4510c25fa0 RCX: 00007f451099e159 [ 40.446330][ T5888] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020100000 [ 40.446338][ T5888] RBP: 00007f4510a3506b R08: 0000000000000000 R09: 0000000000000000 [ 40.446345][ T5888] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 40.446352][ T5888] R13: 00007f4510c26038 R14: 00007f4510c25fa0 R15: 00007ffceedb4318 [ 40.446366][ T5888] [ 40.451910][ T5889] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4'. [ 40.484967][ T5888] MTD: Attempt to mount non-MTD device "/dev/sr0" [ 40.493105][ T5888] romfs: unable to set blocksize [ 40.493105][ T5888] [ 40.494263][ T5891] kvm: apic: phys broadcast and lowest prio [ 40.530330][ T5893] Rounding down aligned max_sectors from 4294967295 to 4294967288 [ 40.638832][ T5898] netlink: 20 bytes leftover after parsing attributes in process `syz.2.10'. [ 40.640372][ T5898] xt_l2tp: v2 doesn't support IP mode [ 40.641493][ T5898] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10'. [ 40.641504][ T5898] netlink: 24 bytes leftover after parsing attributes in process `syz.2.10'. [ 40.777341][ T5911] capability: warning: `syz.2.15' uses deprecated v2 capabilities in a way that may be insecure [ 40.779166][ T5911] overlayfs: failed to create directory ./file0/work (errno: 13); mounting read-only [ 40.779182][ T5911] overlayfs: fs on '.' does not support file handles, falling back to index=off,nfs_export=off. [ 40.779287][ T5911] overlayfs: failed to set uuid (5/file2, err=-13); falling back to uuid=null. [ 40.780171][ T5911] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2 sclass=netlink_route_socket pid=5911 comm=syz.2.15 [ 40.833031][ T5917] warning: `syz.0.18' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 40.834599][ T5917] Bluetooth: MGMT ver 1.23 [ 40.834618][ T5917] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 41.678128][ T5940] netlink: 52 bytes leftover after parsing attributes in process `syz.3.26'. [ 41.697093][ T5946] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=5946 comm=syz.2.27 [ 41.699759][ T5949] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=5949 comm=syz.2.27 [ 41.700080][ T5947] Zero length message leads to an empty skb [ 41.707510][ T5951] netlink: 116 bytes leftover after parsing attributes in process `syz.1.29'. [ 41.759973][ T5962] binder: Unknown parameter 'sta­ ›J:/Ö.ts' [ 41.785746][ T5967] overlay: filesystem on ./bus is read-only [ 41.843758][ T5976] iommufd_mock iommufd_mock0: Adding to iommu group 9 [ 41.852853][ T5974] loop5: detected capacity change from 0 to 14 [ 41.858166][ T5974] Dev loop5: unable to read RDB block 14 [ 41.858192][ T5974] loop5: AHDI p1 p2 p3 [ 41.858253][ T5974] loop5: partition table partially beyond EOD, truncated [ 41.858915][ T5974] loop5: p1 start 1601398130 is beyond EOD, truncated [ 41.858934][ T5974] loop5: p2 start 1702059890 is beyond EOD, truncated [ 41.880419][ T5978] netlink: 'syz.0.36': attribute type 16 has an invalid length. [ 41.880441][ T5978] netlink: 'syz.0.36': attribute type 3 has an invalid length. [ 41.880452][ T5978] netlink: 'syz.0.36': attribute type 1 has an invalid length. [ 41.880464][ T5978] netlink: 112 bytes leftover after parsing attributes in process `syz.0.36'. [ 41.967800][ T64] Bluetooth: hci2: command tx timeout [ 41.967823][ T64] Bluetooth: hci0: command tx timeout [ 41.967835][ T64] Bluetooth: hci3: command tx timeout [ 41.967846][ T64] Bluetooth: hci1: command tx timeout [ 42.041589][ T5980] [ 42.042714][ T5980] ====================================================== [ 42.045746][ T5980] WARNING: possible circular locking dependency detected [ 42.048760][ T5980] syzkaller #0 Not tainted [ 42.050781][ T5980] ------------------------------------------------------ [ 42.053244][ T5980] syz.3.38/5980 is trying to acquire lock: [ 42.054782][ T6001] netlink: 20 bytes leftover after parsing attributes in process `syz.2.43'. [ 42.057776][ T5980] ffffffff903fec68 (gadget_subsys.su_mutex){+.+.}-{4:4}, at: configfs_rmdir+0x5ae/0x950 [ 42.060765][ T5980] [ 42.060765][ T5980] but task is already holding lock: [ 42.063040][ T5980] ffff888058669440 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: vfs_rmdir+0xed/0x8a0 [ 42.065995][ T5980] [ 42.065995][ T5980] which lock already depends on the new lock. [ 42.065995][ T5980] [ 42.069101][ T5980] [ 42.069101][ T5980] the existing dependency chain (in reverse order) is: [ 42.071820][ T5980] [ 42.071820][ T5980] -> #3 (&sb->s_type->i_mutex_key#24){++++}-{4:4}: [ 42.074405][ T5980] lock_acquire+0x1d1/0x380 [ 42.075928][ T5980] down_write+0x8b/0x1f0 [ 42.077373][ T5980] configfs_depend_item_unlocked+0xf3/0x6a0 [ 42.079293][ T5980] usbg_make_tpg+0x251/0x610 [ 42.080863][ T5980] target_fabric_make_tpg+0xab/0x8c0 [ 42.082679][ T5980] configfs_mkdir+0x525/0xd40 [ 42.084320][ T5980] vfs_mkdir+0x364/0x850 [ 42.085817][ T5980] filename_mkdirat+0x48b/0x5e0 [ 42.087435][ T5980] __x64_sys_mkdirat+0x89/0xc0 [ 42.089063][ T5980] do_syscall_64+0x123/0x790 [ 42.090642][ T5980] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 42.092631][ T5980] [ 42.092631][ T5980] -> #2 (tpg_instances_lock){+.+.}-{4:4}: [ 42.095051][ T5980] lock_acquire+0x1d1/0x380 [ 42.096638][ T5980] __mutex_lock+0x1a4/0x1bd0 [ 42.098243][ T5980] tcm_alloc_inst+0x5f/0x1e0 [ 42.099833][ T5980] try_get_usb_function_instance+0x136/0x1f0 [ 42.101830][ T5980] usb_get_function_instance+0x16/0x70 [ 42.103706][ T5980] function_make+0x18c/0x3f0 [ 42.105181][ T5980] configfs_mkdir+0x525/0xd40 [ 42.106763][ T5980] vfs_mkdir+0x364/0x850 [ 42.108236][ T5980] filename_mkdirat+0x48b/0x5e0 [ 42.109875][ T5980] __x64_sys_mkdirat+0x89/0xc0 [ 42.111473][ T5980] do_syscall_64+0x123/0x790 [ 42.113080][ T5980] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 42.115059][ T5980] [ 42.115059][ T5980] -> #1 (func_lock){+.+.}-{4:4}: [ 42.117257][ T5980] lock_acquire+0x1d1/0x380 [ 42.118828][ T5980] __mutex_lock+0x1a4/0x1bd0 [ 42.120435][ T5980] try_get_usb_function_instance+0x26/0x1f0 [ 42.122449][ T5980] usb_get_function_instance+0x16/0x70 [ 42.124323][ T5980] function_make+0x18c/0x3f0 [ 42.125330][ T6002] nvmet: adding nsid 1 to subsystem testsubsys [ 42.126642][ T6002] netlink: 'syz.2.43': attribute type 1 has an invalid length. [ 42.130040][ T5980] configfs_mkdir+0x525/0xd40 [ 42.131680][ T5980] vfs_mkdir+0x364/0x850 [ 42.133324][ T5980] filename_mkdirat+0x48b/0x5e0 [ 42.135035][ T5980] __x64_sys_mkdirat+0x89/0xc0 [ 42.136735][ T5980] do_syscall_64+0x123/0x790 [ 42.138348][ T5980] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 42.140367][ T5980] [ 42.140367][ T5980] -> #0 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 42.142933][ T5980] check_prev_add+0xeb/0xe60 [ 42.144521][ T5980] __lock_acquire+0x1528/0x1f40 [ 42.146170][ T5980] lock_acquire+0x1d1/0x380 [ 42.147717][ T5980] __mutex_lock+0x1a4/0x1bd0 [ 42.149298][ T5980] configfs_rmdir+0x5ae/0x950 [ 42.150918][ T5980] vfs_rmdir+0x328/0x8a0 [ 42.152412][ T5980] filename_rmdir+0x31a/0x5c0 [ 42.154020][ T5980] __x64_sys_rmdir+0x46/0x70 [ 42.155588][ T5980] do_syscall_64+0x123/0x790 [ 42.157156][ T5980] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 42.159060][ T5980] [ 42.159060][ T5980] other info that might help us debug this: [ 42.159060][ T5980] [ 42.162096][ T5980] Chain exists of: [ 42.162096][ T5980] gadget_subsys.su_mutex --> tpg_instances_lock --> &sb->s_type->i_mutex_key#24 [ 42.162096][ T5980] [ 42.166485][ T5980] Possible unsafe locking scenario: [ 42.166485][ T5980] [ 42.168705][ T5980] CPU0 CPU1 [ 42.170325][ T5980] ---- ---- [ 42.171985][ T5980] lock(&sb->s_type->i_mutex_key#24); [ 42.173659][ T5980] lock(tpg_instances_lock); [ 42.175799][ T5980] lock(&sb->s_type->i_mutex_key#24); [ 42.178116][ T5980] lock(gadget_subsys.su_mutex); [ 42.179609][ T5980] [ 42.179609][ T5980] *** DEADLOCK *** [ 42.179609][ T5980] [ 42.181974][ T5980] locks held by syz.3.38/5980: 3, last CPU#2: [ 42.183742][ T5980] #0: ffff88802484a460 (sb_writers#14){.+.+}-{0:0}, at: filename_rmdir+0x1ff/0x5c0 [ 42.186521][ T5980] #1: ffff8880585b1dc0 (&default_group_class[depth - 1]#2/1){+.+.}-{4:4}, at: filename_rmdir+0x258/0x5c0 [ 42.189830][ T5980] #2: ffff888058669440 (&sb->s_type->i_mutex_key#24){++++}-{4:4}, at: vfs_rmdir+0xed/0x8a0 [ 42.192803][ T5980] [ 42.192803][ T5980] stack backtrace: [ 42.194585][ T5980] CPU: 2 UID: 0 PID: 5980 Comm: syz.3.38 Not tainted syzkaller #0 PREEMPT(full) [ 42.197248][ T5980] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 42.200202][ T5980] Call Trace: [ 42.201245][ T5980] [ 42.202243][ T5980] dump_stack_lvl+0x100/0x190 [ 42.203681][ T5980] print_circular_bug.cold+0x178/0x1be [ 42.205358][ T5980] check_noncircular+0x146/0x160 [ 42.206881][ T5980] check_prev_add+0xeb/0xe60 [ 42.208260][ T5980] ? __bfs+0x150/0x2a0 [ 42.209457][ T5980] __lock_acquire+0x1528/0x1f40 [ 42.210898][ T5980] lock_acquire+0x1d1/0x380 [ 42.212281][ T5980] ? configfs_rmdir+0x5ae/0x950 [ 42.213795][ T5980] ? __pfx___might_resched+0x10/0x10 [ 42.215481][ T5980] ? __lock_acquire+0x5c0/0x1f40 [ 42.217023][ T5980] __mutex_lock+0x1a4/0x1bd0 [ 42.218440][ T5980] ? configfs_rmdir+0x5ae/0x950 [ 42.219929][ T5980] ? configfs_rmdir+0x5ae/0x950 [ 42.221455][ T5980] ? reacquire_held_locks+0xdd/0x1f0 [ 42.223108][ T5980] ? __pfx___mutex_lock+0x10/0x10 [ 42.224690][ T5980] ? do_raw_spin_lock+0x128/0x260 [ 42.226268][ T5980] ? find_held_lock+0x2b/0x80 [ 42.227676][ T5980] ? fast_dput+0x2fe/0x6f0 [ 42.229052][ T5980] ? do_raw_spin_unlock+0x145/0x1e0 [ 42.230657][ T5980] ? _raw_spin_unlock+0x28/0x50 [ 42.232156][ T5980] ? fast_dput+0x168/0x6f0 [ 42.233518][ T5980] ? configfs_rmdir+0x5ae/0x950 [ 42.235047][ T5980] configfs_rmdir+0x5ae/0x950 [ 42.236553][ T5980] ? __pfx_configfs_rmdir+0x10/0x10 [ 42.238192][ T5980] ? __pfx_down_write+0x10/0x10 [ 42.239719][ T5980] vfs_rmdir+0x328/0x8a0 [ 42.241073][ T5980] filename_rmdir+0x31a/0x5c0 [ 42.242590][ T5980] ? __pfx_filename_rmdir+0x10/0x10 [ 42.244250][ T5980] ? do_getname+0x191/0x390 [ 42.245781][ T5980] __x64_sys_rmdir+0x46/0x70 [ 42.247281][ T5980] do_syscall_64+0x123/0x790 [ 42.248785][ T5980] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 42.250658][ T5980] RIP: 0033:0x7f427799e159 [ 42.252115][ T5980] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 42.258108][ T5980] RSP: 002b:00007f4275bf6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 42.260734][ T5980] RAX: ffffffffffffffda RBX: 00007f4277c25fa0 RCX: 00007f427799e159 [ 42.263248][ T5980] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000100 [ 42.265747][ T5980] RBP: 00007f4277a3506b R08: 0000000000000000 R09: 0000000000000000 [ 42.268136][ T5980] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 42.270634][ T5980] R13: 00007f4277c26038 R14: 00007f4277c25fa0 R15: 00007ffcff26cb38 [ 42.273115][ T5980] [ 44.036966][ T5088] Bluetooth: hci0: command tx timeout [ 44.036994][ T5088] Bluetooth: hci2: command tx timeout [ 44.037038][ T64] Bluetooth: hci3: command tx timeout [ 44.037066][ T5730] Bluetooth: hci1: command tx timeout [ 46.117161][ T5742] Bluetooth: hci3: command tx timeout [ 46.117181][ T5742] Bluetooth: hci1: command tx timeout [ 46.117191][ T5742] Bluetooth: hci2: command tx timeout [ 46.117200][ T5742] Bluetooth: hci0: command tx timeout