last executing test programs: 13.695981904s ago: executing program 1 (id=176): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x8) getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r1, 0x0, 0x0) r3 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) 12.80879419s ago: executing program 1 (id=177): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x80383, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) socket$netlink(0x10, 0x3, 0xb) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xb, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r3, 0xffffffffffffffff, 0x0) 12.567109831s ago: executing program 2 (id=178): socket$inet6(0xa, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) inotify_init1(0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000040), 0x401, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r0) syz_open_procfs(0x0, &(0x7f0000000100)='mountinfo\x00') r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f00000001c0)=ANY=[@ANYRES32=r1], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000001, 0x12, r1, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_GETKMSGREDIRECT(r2, 0x541c, &(0x7f0000000000)) 12.319942253s ago: executing program 2 (id=180): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={0x0, 0x0, 0x1a, 0x0, 0x1}, 0x28) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) getegid() statx(0xffffffffffffff9c, 0x0, 0x0, 0x1, 0x0) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) read$FUSE(r1, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) close(r0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x130}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x6c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c0001800600010058c6000014000000110001"], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a2c0000000e0a3f0200000000000000000a0000000900010073797a31000000000900020073797a310000000014000000110001"], 0x54}, 0x1, 0x0, 0x0, 0x4000850}, 0x40000c0) 11.790674104s ago: executing program 2 (id=181): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) exit(0xef1) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000003, 0x4031, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) mremap(&(0x7f00005a7000/0x2000)=nil, 0x2000, 0x4000, 0x3, &(0x7f00004fe000/0x4000)=nil) mremap(&(0x7f0000498000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000721000/0x4000)=nil) mremap(&(0x7f00007b2000/0x4000)=nil, 0x4000, 0x3000, 0x3, &(0x7f0000968000/0x3000)=nil) mremap(&(0x7f000046b000/0x3000)=nil, 0x3000, 0x1000, 0x3, &(0x7f0000769000/0x1000)=nil) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='maps\x00') r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TCSBRKP(r3, 0x5425, 0x0) read$FUSE(r2, &(0x7f0000005200)={0x2020}, 0x2020) 11.385584309s ago: executing program 3 (id=182): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x7, 0x3000003, 0x401d031, 0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x10c}, 0x1, 0x0, 0x0, 0x4811}, 0x48080) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet(0x2, 0x3, 0x4) socket$inet_sctp(0x2, 0x5, 0x84) getrlimit(0xc, &(0x7f0000000140)) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002f80)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x18}}], 0x1, 0x0) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) write$P9_RSTATu(r2, &(0x7f00000002c0)={0x29f, 0x7d, 0x2, {{0x500, 0xc, 0x0, 0x5000000, {0x96346fe8a85d25a7, 0x0, 0xa}, 0x61400000, 0x0, 0xe5e0, 0x5, 0x1b, '\x04nodev{evoo~\x05E\xc6\x00\x05\b\x007\xd9:\x8b\x92\x00\x00\x00', 0x9b, 'pJ\x86\xce\xc6\x02\x00}\xfag>\xff\xeb\t\xb55\x1f[\xde\x05@\x00\x00\x00\x00\x18{\x82\x00\xb5\x00\x00+Y_\xcb\x14\x03\xf1\x96\xa5\x1c\xd5\x15z\xdc\x81\x03\xb4\x94\xe1\x8f}_\xb9\xb6\x18\xcf\xf1\xe7.\x9f\xde\xec\xd8\xfd\xdeU\xc9\x1e\xe45\xd2\b\xf4\xa6\xe1\xa9\xb0\xd3\x85\b\x012\t2c\xa2\xe4\x1eb\xec-t\x98\b\x16\xbcv\xf3\xdaQ\x968\xdc\xb7\x88d\x86\xc8x\x9f\xaa\x06\xfe\x8c\x168X\x83\x92b\x01y\xcc\xb5\x8fu \xcc\xc5\xd3\xb0\nJ\xfa\xf9RZ\xe1?U\x9d\x88\xe88#<\xc6\xec\x97\xb2\xc6\x00P', 0x37, '\xcf\xc3m\a\xc5\x00\xf0L\xd8_*p\xf5\xe9\x93\x0e^\x98\x9c\xd5\xefMQ\xf6\r\xa7X,J\x05\xc8\xf8(\xf6\x8d\xc1wM]\xe2\xe8 \x86#\x81\xf6hm\xd1\xbb\x8f\xd7\x00\x00\x00', 0x3e, '\xf8\xf6i\xfbqm\xcf1^\xca\xf3\x85@\x9a\xc6[\x94\bg\x8c<;\x9e\x1dR\xc3l\xde{\xa4\xa4\x00\xb4\xb0w\xdct\x00\x00\x00\x00\x00\x00\x00\x00\a\xec!\xca\xbf\xf2\x0f\x9c\x00\x89\xf9\x06\x00\x00\x00\x00\x00'}, 0x12c, 'odev/n\xb1{#\x00\xf9\xda\xa5\xee#&n\xcf\x85\xfe\xa6^B\xd9y\xa3\xfd\xe5\xf4u\xda\xf0;\x13r\xd9{\xad\xc7\tZ\xfdv\xfeO\x04A\xf7\xf7t\x1e\xac\x03\x00\x00\xec\xff\x00\x00\xdb\xa0\xc2\xf7\xf0\x9f\xf5<~M\x1a\xd6n-\a\x01\x98\x01\x9f0\x11\x84G\xaa\x9at\xf5\x16\x85\xf5\x06\xae\x89H\x06\x87\x82g\xd5\xa1)\x8dy,J7\xf2\xe1\xcb\xbd$\x82\x92\x9a\r\x89r\xb5\xcfs.\xa5\xb0\xd7#\x85\x9d\xba?\x93\xae\xd3\xb4.\xe7\xca\xc0}\xe0\x9d\x1dh\xa6\x033\xa8\x82F}+1\xaa\xcd\xf9\x18\x85I\xb1\x12]lL\x9b\x18\xc2\xfbV\xc5}}\xc6&\xe49\a\x96\xa1\xebH\'Fi\xab\x13\xf8\xb1\x1d\x14`Y\xf3\x10\xe2cMY?\xece\xd5)\xf3\x82\x06fd\xdf$NL\x90W\np\x04\x9f9\x9f\x06\x1fu\xb7y|\xe1\xfe\x11\xea\x91\x96\t\xd5\x1aA\xdd=\xe3\x04\xbd|~\xd0\xa4V\xf0\xae\x12Qa\x05\xc9\xce\x88}\xf5\xa6\xe0\xb6\xa7}Yl\xf8\x8b\xa6\xe5\xc69|}P!\xd7\x98\x95(\xfd\x179\xe1\xc2\xd8\x7f\xff\x00'/300}}, 0x29f) setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000400), 0x0) sendmmsg$inet(r1, &(0x7f0000000f40), 0x0, 0x0) 5.887897784s ago: executing program 3 (id=185): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xe51de000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl(0xffffffffffffffff, 0xc138fd07, &(0x7f0000000480)="040000000000000000000000380100"/25) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) msgctl$MSG_STAT_ANY(0x0, 0xd, 0xfffffffffffffffe) mlock2(&(0x7f0000627000/0x3000)=nil, 0x3000, 0x0) mlock(&(0x7f0000626000/0x5000)=nil, 0x5000) 5.28470335s ago: executing program 2 (id=186): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0xc, 0x0, 0x0}) ioctl$IOMMU_VFIO_IOAS$SET(r0, 0x3b88, &(0x7f00000000c0)={0xc, r1}) ioctl$IOMMU_VFIO_IOAS$GET(r0, 0x3b88, &(0x7f0000000100)={0xc}) ioctl$IOMMU_VFIO_IOAS$CLEAR(r0, 0x3b88, &(0x7f0000000140)={0xc}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r0, 0x3b82, &(0x7f0000000180)={0x20, r1, 0x0, 0x0, &(0x7f00000001c0)}) ioctl$IOMMU_VFIO_IOAS$SET(r0, 0x3b88, &(0x7f0000000200)={0xc, r1}) ioctl$IOMMU_VFIO_GET_API_VERSION(r0, 0x3b64) ioctl$IOMMU_VFIO_SET_IOMMU(r0, 0x3b66, 0x3) ioctl$IOMMU_VFIO_CHECK_EXTENSION(r0, 0x3b65, 0x9) ioctl$IOMMU_VFIO_IOMMU_GET_INFO(r0, 0x3b70, &(0x7f0000000240)={0x70, 0x0, 0x0, 0x0, {}, {{}, 0x0, 0x0, [{}]}}) ioctl$IOMMU_VFIO_IOMMU_MAP_DMA(r0, 0x3b71, &(0x7f0000000280)={0x20, 0x0, &(0x7f00000002c0)='LLLLLLLLLLLLLLLLLLLLLLLLLLLL', 0x1c, 0x1c}) ioctl$IOMMU_VFIO_IOMMU_UNMAP_DMA(r0, 0x3b72, &(0x7f0000000300)={0x18, 0x0, 0x1c, 0x1c}) ioctl$IOMMU_IOAS_UNMAP$ALL(r0, 0x3b86, &(0x7f0000000340)={0x18, r1}) ioctl$IOMMU_DESTROY$ioas(r0, 0x3b80, &(0x7f0000000380)={0x8, r1}) close(r0) 5.011978378s ago: executing program 2 (id=187): r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_connect$midi(0x1, 0x0, 0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0xc07}}]}) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000004c0)={0x84, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 4.682479077s ago: executing program 3 (id=188): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) recvmsg(r0, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f0000000200)=""/133, 0x85}], 0x1}, 0x2) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$tun(r1, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) writev(r0, &(0x7f0000000e00)=[{&(0x7f0000000dc0)='?*', 0x2}], 0x1) writev(r0, &(0x7f0000001540)=[{&(0x7f0000000e80)="58ddb007a47a8b1f458ab677d557ca50006fcb5d15966b46ca64f7e76268cd64007095adfef77465b69ec03139854d6f07d5f9bd01000046035ef7049f48fcc7321c34faca94ff08f59edaf2ab55eedcc278df823564618627217a527b971bdfa0afd948a6cdb9e05ccaef35c22047246a7b97a8e1b645e51c47b296c759c8dfd56beb8fa15c800ad060ab378a269557bc053d9be903", 0x96}, {&(0x7f0000000300)="2ea63d218bc1023b2e6eceeb92d548803a43d4dddc2433c76650030c188f490311ff86da69fab1539139f6dda31739c2bb4412dd471137e2a53496c5f7707e01ccfb826f2eb96895230862e11d56", 0x4e}], 0x2) recvfrom(r0, &(0x7f0000001040)=""/230, 0xe6, 0x10000, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) 4.674679228s ago: executing program 1 (id=189): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x804e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_MCE_KILL(0x21, 0x1, 0x1) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x6) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r3, 0x0, 0x0) accept4$bt_l2cap(r3, 0x0, 0x0, 0x800) syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e130100c9", @ANYBLOB=' '], 0x16) ioctl$XFS_IOC_FREE_EOFBLOCKS(0xffffffffffffffff, 0x8080583a, &(0x7f0000000300)={0x9, 0x3, 0x35a, 0x10, 0x200, 0x0, 0x3}) 4.403942265s ago: executing program 0 (id=190): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x41, 0x0) r1 = dup(r0) write$P9_RSTATFS(r1, &(0x7f0000000180)={0x43, 0x9, 0x1, {0x569142f7, 0x0, 0x7fff, 0x5, 0x1, 0x5, 0x7, 0x200, 0x6}}, 0x43) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000dc0)={0x0, 0x4, 0x0, 0x0, 0x1b, "0062ba7d820700000000000000000000096304"}) r2 = syz_open_pts(r0, 0x80) dup3(r2, r0, 0x80000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff3000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r3 = io_uring_setup(0x4fee, &(0x7f0000000040)={0x0, 0xe5c2, 0xc000, 0x20000a, 0xc9}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x800, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x1}, {0xd}, {0xe, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x40005}, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x4b, &(0x7f0000000000)=0x6, 0x4) r4 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) io_uring_enter(r3, 0x2219, 0x7721, 0x16, 0x0, 0x0) ioctl$TCSETSW2(r0, 0x402c542c, &(0x7f0000000000)={0x40001000, 0x8002, 0x5, 0xf7ffffff, 0x5, "73893a000062f0fd00000000000000710de6eb", 0x10000000, 0xda97}) read(r0, &(0x7f00000002c0)=""/228, 0xe4) 4.053781579s ago: executing program 0 (id=191): socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_tcp(0xa, 0x1, 0x0) close(0x3) socket$key(0xf, 0x3, 0x2) socket$inet(0x2, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x400000000000004) socket$xdp(0x2c, 0x3, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x9}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x6, 0x4, 0x1, 0x0, r0}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r1) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000001400000008000a00fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000600fc000000080011000700000008000e00800000000800", @ANYRES64=r1], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x80) 3.972971086s ago: executing program 0 (id=192): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$uinput_user_dev(r4, &(0x7f0000000a00)={'syz1\x00', {0x9, 0x207, 0x5, 0x4}, 0x3f, [0x9, 0x2, 0x18, 0x2, 0x2, 0x400, 0x80000000, 0x0, 0xfffffc01, 0x0, 0x6, 0x1, 0xfffffffd, 0x39, 0x747d5e13, 0x7ff, 0xfffffb9a, 0xfffffffe, 0x1, 0xfffffffb, 0x2004, 0x3, 0x0, 0x1, 0x482, 0x4800, 0x300000, 0x3, 0xe, 0x400, 0x1, 0x10002, 0x1ff, 0x8000, 0x0, 0x3, 0x0, 0x3, 0xa, 0x8da7, 0x2, 0x200, 0xffffffff, 0x5, 0xe, 0x4, 0x2, 0x6f, 0x240, 0x9, 0x1, 0x4199d, 0x6, 0x2, 0xfffffff6, 0xffffffff, 0x4, 0x40000006, 0x1000, 0x5, 0x3d, 0x8, 0xa, 0x5], [0x7, 0x2, 0xf, 0x8000, 0xfffffffd, 0x3, 0x3, 0x25, 0x6, 0xff7ffffc, 0x8, 0x7fff, 0x72c, 0x5, 0x3, 0x8, 0x10000, 0x400, 0x7ffd, 0x3, 0x3, 0xf, 0x5, 0x0, 0xa, 0x4, 0x1, 0x3ff, 0x0, 0xfffffffe, 0x8, 0x1000003, 0x10, 0xfffffff9, 0xfffffffd, 0x7, 0x1, 0xffff7fff, 0x6, 0x2000008, 0x7fd, 0xfdff, 0x2, 0x96, 0xfffffff9, 0x2, 0xffffffff, 0x5, 0x401, 0xe, 0x3, 0x5, 0x9, 0xe, 0x5, 0x7, 0x6, 0x2, 0x1, 0x1, 0x8, 0x7ff, 0x1, 0x3], [0x401, 0x8000e584, 0x9806, 0xcd3, 0xb, 0x1f, 0x404, 0x4, 0x4008, 0x8, 0x7, 0x9, 0x1e88, 0x5, 0x80000001, 0x2dc000, 0x8, 0x1000, 0x63dd7e7f, 0x10, 0x4, 0xffff, 0x0, 0x1000, 0x80040101, 0x5, 0x4, 0x7, 0x200003, 0x100, 0x5, 0x80, 0x9, 0x8001, 0x10000, 0x10000000, 0x3, 0x400004, 0x3, 0x4d7e, 0x3, 0x1000000b, 0x3, 0xbf23, 0x6, 0x9, 0x7, 0x0, 0x5, 0xe, 0x6, 0x100fdfd, 0x93, 0x9, 0x4, 0xea, 0x9, 0x20000005, 0x3, 0x80, 0x0, 0x7d, 0x3fd, 0x5], [0x108f, 0xffff, 0x3, 0x0, 0x88, 0x2, 0x4000000, 0x4, 0x5, 0x2, 0x763, 0xb, 0x406, 0x1, 0x5, 0x1000, 0x7f, 0x31d2, 0x3fa6, 0x5, 0x0, 0x5, 0x8000, 0x4, 0x9ac, 0x4, 0x3, 0x2, 0x0, 0x284c, 0x3b, 0x20000001, 0x5, 0x5, 0xa80a, 0x65f413f9, 0x8, 0x20008, 0x8a5, 0x8a, 0x46, 0x409, 0x5, 0x4, 0xc, 0xe, 0x4, 0xffffffff, 0x7, 0xffff8a33, 0xfffffff8, 0xf, 0x3, 0x200, 0x4007, 0xd4, 0xfffbfffd, 0x80a, 0xe, 0x101, 0x4, 0xf, 0x136, 0x6]}, 0x45c) ioctl$UI_DEV_CREATE(r4, 0x5501) 2.951234371s ago: executing program 0 (id=193): r0 = io_uring_setup(0x180d, &(0x7f0000000140)={0x0, 0x4178, 0x400, 0x8001002, 0x3d7}) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = dup(r1) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x10006, @loopback, 0x3}], 0x1c) sendmsg$inet6(r1, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) r3 = dup(r1) sendmmsg$inet(r2, &(0x7f0000004b80)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000180)="93", 0x1}], 0x1}}], 0x1, 0x4) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r2, &(0x7f0000000640)={0xb, 0x10, 0xfa00, {0x0, 0xffffffffffffffff, 0x100}}, 0x18) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000000)='bond_slave_1\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x8003, 0xbffc, 0xe652, 0x2, 0x4, 0x8, 0xff}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000a40)={0x0, @in6={{0xa, 0x4e24, 0x5, @loopback, 0x5}}, 0x4, 0x1, 0xf06, 0x0, 0xac, 0x7d, 0x5}, 0x9c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000140)=@newtaction={0x14, 0x30, 0x1, 0x70bd2b, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x2000c800}, 0x2400c800) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e60, 0xfffffff2, @empty, 0x3}}, 0x1000000, 0x31, 0xffff1896, 0x3, 0x6, 0x8, 0x1b}, 0x9c) close_range(r0, 0xffffffffffffffff, 0x0) 2.759800511s ago: executing program 3 (id=194): setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x2481, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) getpeername$packet(r4, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000001800010d00000000000000850a000000000000000500000014000500200100000000000000000100000000001c00090008000000", @ANYRES32=r7], 0x4c}}, 0x0) ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f0000000240)={@remote, @ipv4={'\x00', '\xff\xff', @empty}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20c200a2, r5}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c0000001900110100000000000000000a"], 0x1c}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) 2.643692185s ago: executing program 1 (id=195): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$tcp_mem(0xffffffffffffff9c, 0x0, 0x8, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getpeername$unix(r3, &(0x7f0000000440), &(0x7f00000004c0)=0x6e) dup3(0xffffffffffffffff, r0, 0x0) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) read$FUSE(r4, 0x0, 0x0) 2.415343193s ago: executing program 3 (id=196): openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@newlink={0x28, 0x10, 0x1, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x40810, 0x1}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x24040051}, 0x4c840) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000002080)=[{{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}, 0x7aaf804d}, {{0x0, 0x0, 0x0}, 0xd}], 0x3, 0x12002, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0xa, 0x4e21, 0x80000, @loopback, 0x3}, 0x1c, 0x0}, 0x44060) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1.671998359s ago: executing program 1 (id=197): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x3, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_skbprio={{0xc}, {0x8, 0x2, 0x7fff}}]}, 0x38}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0x3}, {}, {0x8, 0xfff1}}}, 0x24}}, 0x40004) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffdf, {0x0, 0x0, 0x0, r7, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x24000084) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=@newqdisc={0x30, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r10, {0x10}, {}, {0xa, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x40098}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), r4) 1.420132352s ago: executing program 0 (id=198): socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, 0x0, 0x0) fsetxattr$security_capability(r3, &(0x7f0000000140), &(0x7f0000000180)=@v3={0x3000000, [{0x0, 0x9}, {0x2, 0x1}]}, 0x18, 0x1) r4 = syz_open_dev$sndctrl(&(0x7f0000000080), 0xfffffffffffffffa, 0x101000) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r4, 0xc4c85512, &(0x7f0000000a40)={{0x2, 0x0, 0x40, 0x5, 'syz0\x00', 0x10000003}, 0x0, [0x3, 0x8800000, 0xfffffffffffffffe, 0x0, 0xff, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0xffffffffffffff52, 0x53ad, 0x1, 0x8000000000000000, 0x8, 0x0, 0x4000000000000, 0xfffffffffffffffe, 0xfffffffffffffff7, 0x0, 0xfffffffffffffff5, 0x0, 0x0, 0x3, 0x7, 0xc, 0x9, 0x2, 0x0, 0x7fffffff, 0x6, 0x3, 0xfffffffffffffffd, 0x80000000002, 0x0, 0x4000000000000, 0xfffffffffffffffe, 0x0, 0xfffffffffffffffa, 0x6, 0x6, 0x2, 0x3, 0x61, 0x9, 0xfffffffffffffc, 0x8, 0xfffffffffffffffe, 0x80000001, 0x0, 0x1ffffffffffe, 0x1, 0xfffffffffffffff8, 0x0, 0x1, 0xbd1, 0x8000000000000000, 0xfffff7fffff7fffc, 0x0, 0x0, 0x7, 0x0, 0x3ff, 0x7, 0x9, 0x200, 0x9, 0x5, 0xffff, 0xfffffffffffffff8, 0x2, 0x0, 0x0, 0x10001, 0xebc, 0x0, 0x0, 0x74c, 0x6, 0x6, 0x400000000067, 0x7, 0x10000000, 0x7fffffff, 0x401, 0xfffffffffffffffe, 0x1, 0x76e, 0x0, 0x4, 0x5, 0x7, 0x0, 0xa7ea, 0x0, 0xf32, 0x9, 0x2001, 0x0, 0x4000000000000000, 0x0, 0xa562, 0x0, 0x80000005, 0x7, 0x0, 0x5, 0x8, 0x1, 0xfffffffffffffffd, 0x2, 0xfffffffffffffffe, 0x0, 0x2, 0xffffffffffffffff, 0x0, 0x0, 0x101, 0x0, 0x7, 0x4, 0x1553, 0x40, 0x0, 0x1, 0x0, 0xf65]}) openat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x10000, 0x0) 1.363963733s ago: executing program 1 (id=199): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) syz_usb_connect(0x0, 0x24, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x2, &(0x7f0000000000)=0x80000000000003) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x0, &(0x7f00000000c0)}) ustat(0x801, 0x0) 59.728238ms ago: executing program 0 (id=200): socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_icmp(0x2, 0x2, 0x1) socket$nl_generic(0x11, 0x3, 0x10) epoll_create(0x9569) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000340), 0x40080) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) recvmmsg(r0, &(0x7f0000003340)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000003040)=""/243, 0xf3}, 0x1}, {{0x0, 0x0, 0x0, 0x0, &(0x7f00000032c0)=""/71, 0x47}, 0x7f}], 0x2, 0x40000002, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000680), 0x901800, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000040)={0x3, 0x2, 0x3000, 0x1000, &(0x7f0000feb000/0x1000)=nil}) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xa, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="7b87f20f", @ANYRES64=r4], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) syz_kvm_setup_cpu$x86(r3, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x6, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 56.719688ms ago: executing program 2 (id=201): r0 = syz_open_procfs(0x0, 0x0) syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r1 = creat(0x0, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r1, 0xc0502100, 0x0) setsockopt$RXRPC_SECURITY_KEYRING(r0, 0x110, 0x2, &(0x7f0000000040)='\'{\x00', 0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x2) r2 = socket(0xa, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000000)={0x11, @loopback, 0x0, 0x4, 'lblcr\x00', 0x32, 0x0, 0xf}, 0x2c) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000020000000900010073797a300000000040000000030a09020000000000000000020000000900010073797a30000000000900030073797a3200000000140004800800014000000000080002400000000014000000110001"], 0x88}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a14000000020a010100000000000000000000000920000000080a010100000000000000000a0000020900010073797a31"], 0x84}, 0x1, 0x0, 0x0, 0x10}, 0x4000014) 0s ago: executing program 3 (id=202): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) close(r0) r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/usb_gadget/naa.6001405c935d7912\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/nexus\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='naa.6001405c935d7912\n', 0x16) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'veth1_vlan\x00', @multicast}) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.110' (ED25519) to the list of known hosts. [ 67.366851][ T5762] cgroup: Unknown subsys name 'net' [ 67.499333][ T5762] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 68.896053][ T5762] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 70.704352][ T5775] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 70.712575][ T5775] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 70.723001][ T5777] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 70.730762][ T5777] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 70.754494][ T5777] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 70.774057][ T5777] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 70.793751][ T5777] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 70.801861][ T5779] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 70.809685][ T5779] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 70.818934][ T5779] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 70.826889][ T5779] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 70.834530][ T5779] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 70.870407][ T5777] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 70.878523][ T5087] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 70.887572][ T5777] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 70.895302][ T5777] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 70.902413][ T5087] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 70.911331][ T5777] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 70.921684][ T5087] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 70.929677][ T5777] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 70.929842][ T5087] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 70.943999][ T5777] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 70.944768][ T5087] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 70.958734][ T5087] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 71.183653][ T5773] chnl_net:caif_netlink_parms(): no params data found [ 71.305738][ T5773] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.313438][ T5773] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.321684][ T5773] bridge_slave_0: entered allmulticast mode [ 71.328500][ T5773] bridge_slave_0: entered promiscuous mode [ 71.354001][ T5773] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.361116][ T5773] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.369191][ T5773] bridge_slave_1: entered allmulticast mode [ 71.375978][ T5773] bridge_slave_1: entered promiscuous mode [ 71.433392][ T5773] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 71.450819][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.457579][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.463011][ T5773] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 71.483026][ T5780] chnl_net:caif_netlink_parms(): no params data found [ 71.554710][ T5776] chnl_net:caif_netlink_parms(): no params data found [ 71.580921][ T5773] team0: Port device team_slave_0 added [ 71.594533][ T5773] team0: Port device team_slave_1 added [ 71.635644][ T5781] chnl_net:caif_netlink_parms(): no params data found [ 71.652997][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 71.660034][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 71.686172][ T5773] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.732429][ T5773] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.739455][ T5773] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 71.765525][ T5773] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.818075][ T5780] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.825341][ T5780] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.832437][ T5780] bridge_slave_0: entered allmulticast mode [ 71.839228][ T5780] bridge_slave_0: entered promiscuous mode [ 71.871109][ T5780] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.878256][ T5780] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.887434][ T5780] bridge_slave_1: entered allmulticast mode [ 71.894265][ T5780] bridge_slave_1: entered promiscuous mode [ 71.913930][ T5773] hsr_slave_0: entered promiscuous mode [ 71.920047][ T5773] hsr_slave_1: entered promiscuous mode [ 71.944640][ T5776] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.951818][ T5776] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.959304][ T5776] bridge_slave_0: entered allmulticast mode [ 71.966096][ T5776] bridge_slave_0: entered promiscuous mode [ 71.990915][ T5780] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.009909][ T5776] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.017143][ T5776] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.024518][ T5776] bridge_slave_1: entered allmulticast mode [ 72.031113][ T5776] bridge_slave_1: entered promiscuous mode [ 72.049856][ T5780] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.059294][ T5781] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.066779][ T5781] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.073972][ T5781] bridge_slave_0: entered allmulticast mode [ 72.080724][ T5781] bridge_slave_0: entered promiscuous mode [ 72.114807][ T5781] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.121939][ T5781] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.129392][ T5781] bridge_slave_1: entered allmulticast mode [ 72.136229][ T5781] bridge_slave_1: entered promiscuous mode [ 72.144703][ T5776] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.178287][ T5776] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.203008][ T5780] team0: Port device team_slave_0 added [ 72.243758][ T5780] team0: Port device team_slave_1 added [ 72.251424][ T5781] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.263799][ T5781] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.281202][ T5776] team0: Port device team_slave_0 added [ 72.312332][ T5780] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 72.319393][ T5780] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.348042][ T5780] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 72.367497][ T5776] team0: Port device team_slave_1 added [ 72.381031][ T5780] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 72.388038][ T5780] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.414035][ T5780] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 72.441004][ T5781] team0: Port device team_slave_0 added [ 72.479356][ T5781] team0: Port device team_slave_1 added [ 72.511650][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 72.518652][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.544906][ T5776] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 72.557464][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 72.564555][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.590514][ T5776] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 72.628136][ T5780] hsr_slave_0: entered promiscuous mode [ 72.634610][ T5780] hsr_slave_1: entered promiscuous mode [ 72.640579][ T5780] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 72.648362][ T5780] Cannot create hsr debugfs directory [ 72.671710][ T5781] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 72.679041][ T5781] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.705022][ T5781] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 72.718110][ T5781] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 72.725765][ T5781] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 72.751823][ T5781] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 72.804219][ T5779] Bluetooth: hci0: command tx timeout [ 72.841641][ T5781] hsr_slave_0: entered promiscuous mode [ 72.847835][ T5781] hsr_slave_1: entered promiscuous mode [ 72.854091][ T5781] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 72.861646][ T5781] Cannot create hsr debugfs directory [ 72.883736][ T5779] Bluetooth: hci1: command tx timeout [ 72.912904][ T5776] hsr_slave_0: entered promiscuous mode [ 72.919277][ T5776] hsr_slave_1: entered promiscuous mode [ 72.925845][ T5776] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 72.933401][ T5776] Cannot create hsr debugfs directory [ 72.963602][ T5779] Bluetooth: hci2: command tx timeout [ 73.043970][ T5779] Bluetooth: hci3: command tx timeout [ 73.103227][ T5773] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 73.120264][ T5773] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 73.148468][ T5773] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 73.159310][ T5773] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 73.259562][ T5780] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 73.296568][ T5780] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 73.307613][ T5780] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 73.332399][ T5780] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 73.395131][ T5776] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 73.406270][ T5776] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 73.425461][ T5776] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 73.437899][ T5776] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 73.531367][ T5781] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 73.543059][ T5781] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 73.569079][ T5781] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 73.578792][ T5781] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 73.612713][ T5773] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.685798][ T5773] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.707219][ T5780] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.719389][ T42] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.726688][ T42] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.752589][ T42] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.759678][ T42] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.800915][ T5781] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.810440][ T5776] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.842665][ T5780] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.870673][ T5776] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.887338][ T5781] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.899388][ T1321] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.906585][ T1321] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.926526][ T1321] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.933686][ T1321] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.943868][ T1321] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.950949][ T1321] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.961508][ T1321] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.968598][ T1321] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.988771][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.995917][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.017243][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.024383][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 74.409884][ T5773] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.507723][ T5773] veth0_vlan: entered promiscuous mode [ 74.546881][ T5773] veth1_vlan: entered promiscuous mode [ 74.599241][ T5780] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.629420][ T5781] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.640433][ T5776] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.671557][ T5773] veth0_macvtap: entered promiscuous mode [ 74.683467][ T5773] veth1_macvtap: entered promiscuous mode [ 74.733856][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.760155][ T5780] veth0_vlan: entered promiscuous mode [ 74.770330][ T5773] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.790545][ T5773] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.799718][ T5773] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.809799][ T5773] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.818870][ T5773] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.845071][ T5781] veth0_vlan: entered promiscuous mode [ 74.866708][ T5780] veth1_vlan: entered promiscuous mode [ 74.876444][ T5776] veth0_vlan: entered promiscuous mode [ 74.884593][ T5779] Bluetooth: hci0: command tx timeout [ 74.893410][ T5781] veth1_vlan: entered promiscuous mode [ 74.954842][ T5776] veth1_vlan: entered promiscuous mode [ 74.964385][ T5779] Bluetooth: hci1: command tx timeout [ 74.992115][ T5781] veth0_macvtap: entered promiscuous mode [ 75.002837][ T5780] veth0_macvtap: entered promiscuous mode [ 75.021123][ T5781] veth1_macvtap: entered promiscuous mode [ 75.032282][ T5780] veth1_macvtap: entered promiscuous mode [ 75.044001][ T5779] Bluetooth: hci2: command tx timeout [ 75.068499][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 75.079351][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.091155][ T5781] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.118133][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 75.128903][ T5779] Bluetooth: hci3: command tx timeout [ 75.136290][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.147996][ T5781] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.158295][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.168185][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.182630][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 75.196617][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.207217][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 75.217993][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.229687][ T5780] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 75.242191][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 75.252825][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.262949][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 75.273616][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.285328][ T5780] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 75.303434][ T5780] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.312765][ T5780] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.321534][ T5780] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.330415][ T5780] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.343165][ T5781] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.352497][ T5781] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.361618][ T5781] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.371351][ T5781] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.421932][ T5024] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.431752][ T5024] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.504899][ T5776] veth0_macvtap: entered promiscuous mode [ 75.555874][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.568666][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.600141][ T1321] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.617094][ T5776] veth1_macvtap: entered promiscuous mode [ 75.625533][ T1321] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.693227][ T4290] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 75.707185][ T4290] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 75.720066][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 75.732097][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.742406][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 75.753197][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.763264][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 75.775970][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 75.786890][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 76.547833][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 76.574149][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 76.599348][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 76.609864][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 76.620419][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 76.632338][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 76.671548][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 76.688912][ T4290] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.698571][ T4290] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.721279][ T5776] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.750379][ T5776] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.762531][ T5776] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.777910][ T5776] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.832573][ T5840] process 'syz.0.1' launched './file0' with NULL argv: empty string added [ 76.964496][ T5779] Bluetooth: hci0: command tx timeout [ 77.027854][ T1328] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.045055][ T5779] Bluetooth: hci1: command tx timeout [ 77.052445][ T1328] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.174600][ T5779] Bluetooth: hci2: command tx timeout [ 77.203926][ T5779] Bluetooth: hci3: command tx timeout [ 77.758108][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.799328][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.890325][ T5852] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 77.928122][ T5853] autofs4:pid:5853:autofs_fill_super: called with bogus options [ 77.969255][ T5853] syz.1.7[5853]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 78.039671][ T5853] loop1: detected capacity change from 0 to 1024 [ 78.054719][ T5860] Bluetooth: MGMT ver 1.22 [ 78.062274][ T5860] Bluetooth: hci0: invalid length 0, exp 2 for type 9 [ 78.081305][ T5853] EXT4-fs: Ignoring removed bh option [ 78.498377][ T5853] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 79.029959][ T5869] loop3: detected capacity change from 0 to 256 [ 79.038046][ T5773] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 79.048414][ T5779] Bluetooth: hci0: command tx timeout [ 79.049318][ T5869] ======================================================= [ 79.049318][ T5869] WARNING: The mand mount option has been deprecated and [ 79.049318][ T5869] and is ignored by this kernel. Remove the mand [ 79.049318][ T5869] option from the mount to silence this warning. [ 79.049318][ T5869] ======================================================= [ 79.124593][ T5779] Bluetooth: hci1: command tx timeout [ 79.180962][ T5869] exFAT-fs (loop3): failed to load upcase table (idx : 0x00010000, chksum : 0x987a2e96, utbl_chksum : 0xe619d30d) [ 79.204195][ T5779] Bluetooth: hci2: command tx timeout [ 79.293932][ T5779] Bluetooth: hci3: command tx timeout [ 79.311018][ T5875] syzkaller0: entered promiscuous mode [ 79.316567][ T5875] syzkaller0: entered allmulticast mode [ 79.537624][ T5878] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 80.159165][ T5881] loop2: detected capacity change from 0 to 16 [ 80.288492][ T5883] loop1: detected capacity change from 0 to 128 [ 80.290122][ T5881] erofs: Unknown parameter '1844674407370955161518446744073709551615' [ 80.316778][ T5764] udevd[5764]: incorrect erofs checksum on /dev/loop2 [ 80.363743][ T5767] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 80.673149][ T28] audit: type=1400 audit(1790982355.807:2): apparmor="STATUS" operation="profile_load" profile="unconfined" name="/:o" pid=5886 comm="syz.3.16" [ 80.724813][ T5891] ip_tables: iptables: counters copy to user failed while replacing table [ 80.790667][ T5892] syz.1.14 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 81.391974][ T5896] syzkaller0: entered promiscuous mode [ 81.400249][ T5896] syzkaller0: entered allmulticast mode [ 81.657389][ T788] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 81.910955][ T788] usb 4-1: not running at top speed; connect to a high speed hub [ 81.987830][ T788] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 82.112821][ T788] usb 4-1: New USB device found, idVendor=225a, idProduct=e1d4, bcdDevice=a7.ad [ 82.283644][ T788] usb 4-1: New USB device strings: Mfr=245, Product=210, SerialNumber=0 [ 82.292033][ T788] usb 4-1: Product: syz [ 82.307159][ T788] usb 4-1: Manufacturer: syz [ 82.402948][ T788] usb 4-1: Found UVC 1.00 device syz (225a:e1d4) [ 82.611917][ T788] usb 4-1: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround. [ 82.641245][ T788] uvcvideo 4-1:1.1: Failed to query (129) UVC probe control : -71 (exp. 26). [ 82.667667][ T788] uvcvideo 4-1:1.1: Failed to initialize the device (-71). [ 82.703729][ T788] usb 4-1: USB disconnect, device number 2 [ 82.882068][ T5901] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.890721][ T5901] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.633993][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 86.043549][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 86.095503][ T28] audit: type=1326 audit(1790982360.417:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5929 comm="syz.1.25" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f4128b9e159 code=0x0 [ 86.819632][ T8] cfg80211: failed to load regulatory.db [ 86.911533][ T5901] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 86.968249][ T5901] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 86.992942][ T5935] Bluetooth: hci0: invalid length 0, exp 2 for type 10 [ 88.131675][ T5946] loop1: detected capacity change from 0 to 512 [ 88.157769][ T5946] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 88.170006][ T5901] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 88.179151][ T5901] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 88.195362][ T5901] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 88.197598][ T5946] EXT4-fs (loop1): 1 truncate cleaned up [ 88.206334][ T5901] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 88.237833][ T5946] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 88.485723][ T5939] netlink: 'syz.3.26': attribute type 1 has an invalid length. [ 88.503115][ T5942] netlink: 8 bytes leftover after parsing attributes in process `syz.3.26'. [ 88.513116][ T5942] 8021q: VLANs not supported on vxcan0 [ 89.181164][ T5773] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 89.247388][ T5955] netlink: 4 bytes leftover after parsing attributes in process `syz.0.32'. [ 90.792817][ T5951] loop2: detected capacity change from 0 to 32768 [ 90.845936][ T5951] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by syz.2.30 (5951) [ 90.930315][ T5951] BTRFS info (device loop2): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 90.964585][ T5951] BTRFS info (device loop2): using crc32c (crc32c-intel) checksum algorithm [ 91.027828][ T5951] BTRFS info (device loop2): setting nodatasum [ 91.113591][ T5951] BTRFS info (device loop2): force zlib compression, level 3 [ 91.139945][ T5951] BTRFS info (device loop2): setting incompat feature flag for COMPRESS_LZO (0x8) [ 91.172895][ T5951] BTRFS info (device loop2): use lzo compression, level 0 [ 91.197043][ T5951] BTRFS info (device loop2): turning on flush-on-commit [ 91.514189][ T5951] BTRFS info (device loop2): enabling auto defrag [ 91.831155][ T5951] BTRFS info (device loop2): max_inline at 4096 [ 91.881938][ T5951] BTRFS info (device loop2): using free space tree [ 91.926188][ T5951] workqueue: Failed to create a rescuer kthread for wq "btrfs-worker": -EINTR [ 91.928090][ T5951] workqueue: Failed to create a rescuer kthread for wq "btrfs-delalloc": -EINTR [ 91.991671][ T5976] Zero length message leads to an empty skb [ 92.007289][ T5951] workqueue: Failed to create a rescuer kthread for wq "btrfs-flush_delalloc": -EINTR [ 92.007836][ T5951] workqueue: Failed to create a rescuer kthread for wq "btrfs-cache": -EINTR [ 92.034498][ T5951] workqueue: Failed to create a rescuer kthread for wq "btrfs-fixup": -EINTR [ 92.055826][ T5951] workqueue: Failed to create a rescuer kthread for wq "btrfs-endio": -EINTR [ 92.094214][ T5951] workqueue: Failed to create a rescuer kthread for wq "btrfs-endio-meta": -EINTR [ 92.121023][ T5951] workqueue: Failed to create a rescuer kthread for wq "btrfs-rmw": -EINTR [ 92.154264][ T5951] workqueue: Failed to create a rescuer kthread for wq "btrfs-endio-write": -EINTR [ 92.184490][ T5951] workqueue: Failed to create a rescuer kthread for wq "btrfs-compressed-write": -EINTR [ 92.212895][ T5951] workqueue: Failed to create a rescuer kthread for wq "btrfs-freespace-write": -EINTR [ 92.239267][ T5951] workqueue: Failed to create a rescuer kthread for wq "btrfs-delayed-meta": -EINTR [ 92.258417][ T5951] workqueue: Failed to create a rescuer kthread for wq "btrfs-qgroup-rescan": -EINTR [ 92.295833][ T5951] BTRFS error (device loop2): open_ctree failed: -12 [ 92.392408][ T28] audit: type=1800 audit(1790982367.527:4): pid=5993 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.38" name="syzkaller1" dev="sda1" ino=2043 res=0 errno=0 [ 92.459591][ T5933] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop2 scanned by udevd (5933) [ 94.034711][ T6001] syzkaller0: entered promiscuous mode [ 94.040220][ T6001] syzkaller0: entered allmulticast mode [ 94.116800][ T6010] TC_ACT_REPEAT abuse ? [ 95.344023][ T6024] kvm: pic: single mode not supported [ 95.351300][ T6024] kvm: pic: level sensitive irq not supported [ 95.369112][ T6024] kvm: pic: single mode not supported [ 95.389394][ T6024] kvm: pic: single mode not supported [ 95.402079][ T6024] kvm: pic: single mode not supported [ 95.407780][ T6024] kvm: pic: level sensitive irq not supported [ 95.423696][ T6024] kvm: pic: single mode not supported [ 95.429826][ T6024] kvm: pic: level sensitive irq not supported [ 95.707339][ T6038] FAULT_INJECTION: forcing a failure. [ 95.707339][ T6038] name failslab, interval 1, probability 0, space 0, times 1 [ 95.729037][ T6038] CPU: 1 PID: 6038 Comm: syz.1.52 Not tainted syzkaller #0 [ 95.736268][ T6038] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 95.746336][ T6038] Call Trace: [ 95.749627][ T6038] [ 95.752558][ T6038] dump_stack_lvl+0x18c/0x250 [ 95.757273][ T6038] ? show_regs_print_info+0x20/0x20 [ 95.762471][ T6038] ? load_image+0x420/0x420 [ 95.766983][ T6038] ? __might_sleep+0xe0/0xe0 [ 95.771580][ T6038] ? __lock_acquire+0x7d80/0x7d80 [ 95.776618][ T6038] should_fail_ex+0x394/0x4c0 [ 95.781299][ T6038] should_failslab+0x9/0x20 [ 95.785806][ T6038] slab_pre_alloc_hook+0x59/0x300 [ 95.790840][ T6038] kmem_cache_alloc+0x5a/0x2c0 [ 95.795616][ T6038] ? copy_signal+0x50/0x640 [ 95.800125][ T6038] copy_signal+0x50/0x640 [ 95.804456][ T6038] copy_process+0x166e/0x3da0 [ 95.809131][ T6038] ? plist_add+0x3db/0x490 [ 95.813556][ T6038] ? copy_process+0x98e/0x3da0 [ 95.818319][ T6038] ? futex_wait+0x4a7/0x5c0 [ 95.822822][ T6038] ? __pidfd_prepare+0x140/0x140 [ 95.827766][ T6038] kernel_clone+0x24b/0x8a0 [ 95.832269][ T6038] ? create_io_thread+0x190/0x190 [ 95.837302][ T6038] ? do_futex+0x2ff/0x3e0 [ 95.841637][ T6038] __x64_sys_clone+0x1b7/0x230 [ 95.846403][ T6038] ? __ia32_sys_vfork+0x140/0x140 [ 95.851435][ T6038] ? lock_chain_count+0x20/0x20 [ 95.856288][ T6038] ? lockdep_hardirqs_on+0x98/0x150 [ 95.861484][ T6038] do_syscall_64+0x55/0xb0 [ 95.865899][ T6038] ? clear_bhb_loop+0x40/0x90 [ 95.870576][ T6038] ? clear_bhb_loop+0x40/0x90 [ 95.875260][ T6038] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 95.881158][ T6038] RIP: 0033:0x7f4128b9e159 [ 95.885587][ T6038] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.905200][ T6038] RSP: 002b:00007f41299b0fd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 95.913627][ T6038] RAX: ffffffffffffffda RBX: 00007f4128e25fa0 RCX: 00007f4128b9e159 [ 95.921616][ T6038] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000011 [ 95.929594][ T6038] RBP: 00007f4128c3506b R08: 0000000000000000 R09: 0000000000000000 [ 95.937571][ T6038] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 95.945544][ T6038] R13: 00007f4128e26038 R14: 00007f4128e25fa0 R15: 00007ffe687ae6f8 [ 95.953538][ T6038] [ 96.283605][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c0!!! [ 99.201197][ T59] Bluetooth: hci4: Frame reassembly failed (-84) [ 99.238405][ T59] Bluetooth: hci4: Frame reassembly failed (-84) [ 99.490218][ T6066] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 100.327766][ T6073] netlink: 'syz.1.61': attribute type 1 has an invalid length. [ 100.355472][ T6075] loop3: detected capacity change from 0 to 256 [ 100.368035][ T6077] EXT4-fs warning (device sda1): verify_group_input:151: Cannot add at group 4 (only 8 groups) [ 100.531681][ T6073] macvtap1: entered allmulticast mode [ 101.219335][ T5779] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 101.745282][ T6096] loop2: detected capacity change from 0 to 256 [ 101.752877][ T6096] FAT-fs (loop2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 101.832051][ T6096] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 102.042744][ T6104] md/raid10:md0: not clean -- starting background reconstruction [ 102.052530][ T6104] md/raid10:md0: active with 1 out of 2 devices [ 102.071099][ T6104] md0: detected capacity change from 0 to 2048 [ 105.600901][ T6143] syzkaller0: entered promiscuous mode [ 105.613649][ T6143] syzkaller0: entered allmulticast mode [ 105.648139][ T6143] loop0: detected capacity change from 0 to 256 [ 105.960097][ T6152] unsupported nlmsg_type 40 [ 105.988991][ T6150] syzkaller0: entered promiscuous mode [ 105.997163][ T6150] syzkaller0: entered allmulticast mode [ 106.133586][ T970] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 106.342899][ T970] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 106.454966][ T970] usb 3-1: New USB device found, idVendor=2466, idProduct=8010, bcdDevice= 1.00 [ 106.591232][ T970] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 106.989094][ T28] audit: type=1326 audit(1790982385.125:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6159 comm="syz.3.90" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f858759e159 code=0x7ffc0000 [ 107.059678][ T28] audit: type=1326 audit(1790982385.155:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6159 comm="syz.3.90" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f858759e159 code=0x7ffc0000 [ 107.143797][ T28] audit: type=1326 audit(1790982385.155:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6159 comm="syz.3.90" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f858759e159 code=0x7ffc0000 [ 107.188510][ T28] audit: type=1326 audit(1790982385.155:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6159 comm="syz.3.90" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f858759e159 code=0x7ffc0000 [ 107.213225][ T6164] CIFS: Attempting to mount //127.0.0.1/share [ 107.253581][ T28] audit: type=1326 audit(1790982385.155:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6159 comm="syz.3.90" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=91 compat=0 ip=0x7f858759e159 code=0x7ffc0000 [ 107.293093][ T6166] CIFS: VFS: Invalid response size 0 for command 0 [ 107.300871][ T28] audit: type=1326 audit(1790982385.155:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6159 comm="syz.3.90" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f858759e159 code=0x7ffc0000 [ 107.306075][ T970] usb 3-1: cannot find UAC_HEADER [ 107.325370][ T28] audit: type=1326 audit(1790982385.155:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6159 comm="syz.3.90" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f858759e159 code=0x7ffc0000 [ 107.364244][ T28] audit: type=1326 audit(1790982385.155:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6159 comm="syz.3.90" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f858759e159 code=0x7ffc0000 [ 107.392712][ T28] audit: type=1326 audit(1790982385.155:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6159 comm="syz.3.90" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f858759e159 code=0x7ffc0000 [ 107.436460][ T28] audit: type=1326 audit(1790982385.155:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6159 comm="syz.3.90" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f858759e159 code=0x7ffc0000 [ 107.442914][ T6166] CIFS: VFS: \\127.0.0.1 RFC 1002 unknown response type 0x20 [ 107.500308][ T6148] warning: `syz.2.86' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 107.527905][ T970] snd-usb-audio: probe of 3-1:1.0 failed with error -22 [ 107.558898][ T6164] CIFS: VFS: cifs_mount failed w/return code = -5 [ 107.582234][ T970] usb 3-1: USB disconnect, device number 2 [ 108.078044][ T6180] syzkaller0: entered promiscuous mode [ 108.084762][ T6180] syzkaller0: entered allmulticast mode [ 108.329134][ T6186] loop1: detected capacity change from 0 to 512 [ 108.653471][ T6192] netlink: 8 bytes leftover after parsing attributes in process `syz.3.97'. [ 108.671552][ T6192] netlink: 8 bytes leftover after parsing attributes in process `syz.3.97'. [ 108.682664][ T6192] netlink: 8 bytes leftover after parsing attributes in process `syz.3.97'. [ 108.692964][ T6192] netlink: 8 bytes leftover after parsing attributes in process `syz.3.97'. [ 111.683499][ C0] sched: RT throttling activated [ 111.898895][ T6224] loop0: detected capacity change from 0 to 1024 [ 111.931444][ T788] smpboot: CPU 1 is now offline [ 111.975856][ T6224] hfsplus: unable to parse mount options [ 112.092789][ T6227] loop1: detected capacity change from 0 to 1024 [ 112.178321][ T6222] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 112.203238][ T6227] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 112.374522][ T5773] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 113.491994][ T6237] syzkaller0: entered promiscuous mode [ 113.507776][ T6237] syzkaller0: entered allmulticast mode [ 113.543402][ T6237] TC_ACT_REPEAT abuse ? [ 113.744820][ T6243] syzkaller0: entered promiscuous mode [ 113.750300][ T6243] syzkaller0: entered allmulticast mode [ 113.832993][ T6245] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 113.980130][ T6247] md: couldn't update array info. -22 [ 113.990659][ T6247] md: could not open device unknown-block(1,1). [ 114.004229][ T6247] md: md_import_device returned -16 [ 114.133717][ T788] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 114.333849][ T788] usb 3-1: Using ep0 maxpacket: 16 [ 114.360342][ T788] usb 3-1: config 1 has an invalid descriptor of length 85, skipping remainder of the config [ 114.391081][ T788] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 114.560231][ T788] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 114.582804][ T5913] IPVS: starting estimator thread 0... [ 114.588486][ T788] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 115.880588][ T788] usb 3-1: Product: syz [ 115.902436][ T788] usb 3-1: Manufacturer: syz [ 115.917306][ T788] usb 3-1: SerialNumber: syz [ 115.953810][ T6258] IPVS: using max 20 ests per chain, 48000 per kthread [ 116.035074][ T6266] tipc: Started in network mode [ 116.061523][ T6266] tipc: Node identity 6ed77bfdf73e, cluster identity 4711 [ 116.075115][ T6266] tipc: Enabled bearer , priority 0 [ 116.122707][ T6266] syzkaller0: entered promiscuous mode [ 116.132287][ T6266] syzkaller0: entered allmulticast mode [ 116.178760][ T788] usb 3-1: 0:2 : does not exist [ 116.189138][ T6266] tipc: Resetting bearer [ 116.211216][ T788] usb 3-1: 5:0: failed to get current value for ch 0 (-22) [ 116.224341][ T6270] bond0: entered promiscuous mode [ 116.237319][ T6270] bond_slave_0: entered promiscuous mode [ 116.248466][ T6270] bond_slave_1: entered promiscuous mode [ 116.296261][ T788] usb 3-1: USB disconnect, device number 3 [ 116.339459][ T6265] tipc: Resetting bearer [ 116.444497][ T6265] tipc: Disabling bearer [ 118.011089][ T6283] loop1: detected capacity change from 0 to 256 [ 118.024555][ T6285] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 119.083754][ T6292] syzkaller0: entered promiscuous mode [ 119.089289][ T6292] syzkaller0: entered allmulticast mode [ 119.411111][ T6301] syzkaller0: entered promiscuous mode [ 120.480377][ T6301] syzkaller0: entered allmulticast mode [ 122.129802][ T6309] netlink: 12 bytes leftover after parsing attributes in process `syz.3.135'. [ 122.239106][ T6312] loop0: detected capacity change from 0 to 128 [ 122.259075][ T6309] bond1: (slave ip_vti0): The slave device specified does not support setting the MAC address [ 122.282575][ T6312] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=256, location=256 [ 122.298949][ T6309] bond1: (slave ip_vti0): Error -95 calling set_mac_address [ 122.351635][ T6309] bond1 (unregistering): Released all slaves [ 122.433740][ T8] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 122.488662][ T6318] loop0: detected capacity change from 0 to 512 [ 122.531844][ T6318] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 122.550148][ T6318] System zones: 1-12 [ 122.568999][ T6318] EXT4-fs error (device loop0): ext4_xattr_inode_iget:441: inode #12: comm syz.0.138: missing EA_INODE flag [ 122.592401][ T6318] EXT4-fs error (device loop0): ext4_xattr_inode_iget:446: comm syz.0.138: error while reading EA inode 12 err=-117 [ 122.624702][ T6318] EXT4-fs (loop0): 1 orphan inode deleted [ 122.634421][ T6318] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 122.653582][ T8] usb 2-1: Using ep0 maxpacket: 32 [ 122.668193][ T8] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x8C has invalid maxpacket 1536, setting to 1024 [ 122.693627][ T8] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x8C has invalid maxpacket 1024 [ 122.865892][ T8] usb 2-1: New USB device found, idVendor=1430, idProduct=474b, bcdDevice= 0.40 [ 122.876637][ T8] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 122.894059][ T8] usb 2-1: Product: syz [ 122.898354][ T8] usb 2-1: Manufacturer: syz [ 122.902967][ T8] usb 2-1: SerialNumber: syz [ 125.682724][ T8] usb 2-1: can't set config #1, error -71 [ 125.714225][ T8] usb 2-1: USB disconnect, device number 2 [ 126.210611][ T5780] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 129.033740][ T6341] netlink: 12 bytes leftover after parsing attributes in process `syz.0.146'. [ 129.155236][ T6341] vlan2: entered allmulticast mode [ 129.173934][ T6341] bridge1: entered allmulticast mode [ 129.218922][ T6341] bridge1: port 1(erspan0) entered blocking state [ 129.246702][ T6341] bridge1: port 1(erspan0) entered disabled state [ 129.273658][ T6341] erspan0: entered allmulticast mode [ 129.282655][ T6341] erspan0: entered promiscuous mode [ 129.312344][ T6341] bridge1: port 1(erspan0) entered blocking state [ 129.318944][ T6341] bridge1: port 1(erspan0) entered forwarding state [ 129.357821][ T6344] netlink: 'syz.2.147': attribute type 4 has an invalid length. [ 129.379273][ T6349] erspan0: left allmulticast mode [ 129.393787][ T6349] erspan0: left promiscuous mode [ 129.423729][ T6349] bridge1: port 1(erspan0) entered disabled state [ 129.491944][ T6349] bridge_slave_0: left allmulticast mode [ 129.505519][ T6349] bridge_slave_0: left promiscuous mode [ 129.521895][ T6349] bridge0: port 1(bridge_slave_0) entered disabled state [ 130.459533][ T6349] bridge_slave_1: left allmulticast mode [ 130.484381][ T6349] bridge_slave_1: left promiscuous mode [ 130.505976][ T6349] bridge0: port 2(bridge_slave_1) entered disabled state [ 130.539523][ T6349] bond0: (slave bond_slave_0): Releasing backup interface [ 130.566339][ T6349] bond0: (slave bond_slave_1): Releasing backup interface [ 130.629269][ T6349] team0: Port device team_slave_0 removed [ 130.668344][ T6349] team0: Port device team_slave_1 removed [ 130.704773][ T6349] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 130.712180][ T6349] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 130.755086][ T6349] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 130.782712][ T6349] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 131.899576][ T6369] netlink: 8 bytes leftover after parsing attributes in process `syz.2.154'. [ 132.389126][ T6383] syzkaller0: entered promiscuous mode [ 132.394811][ T6383] syzkaller0: entered allmulticast mode [ 132.406693][ T6383] tc mirred to Houston: device batadv_slave_0 is down [ 132.536665][ T6386] syzkaller0: entered promiscuous mode [ 132.542354][ T6386] syzkaller0: entered allmulticast mode [ 132.561417][ T6386] netlink: 53 bytes leftover after parsing attributes in process `syz.0.159'. [ 132.698673][ T6390] hsr0: entered promiscuous mode [ 132.705156][ T6389] hsr0: left promiscuous mode [ 132.880277][ T6394] loop2: detected capacity change from 0 to 512 [ 132.889794][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.889885][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.994356][ T6394] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 133.013124][ T6394] System zones: 1-12 [ 133.928316][ T6394] EXT4-fs error (device loop2): ext4_xattr_inode_iget:441: inode #12: comm syz.2.162: missing EA_INODE flag [ 133.995206][ T6394] EXT4-fs error (device loop2): ext4_xattr_inode_iget:446: comm syz.2.162: error while reading EA inode 12 err=-117 [ 134.054025][ T6394] EXT4-fs (loop2): 1 orphan inode deleted [ 134.060473][ T6394] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 137.407798][ T5781] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 137.489433][ T6403] kvm: kvm [6402]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0x800100000080 [ 137.538866][ T6403] kvm: kvm [6402]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x80 [ 137.703814][ T6403] kvm: kvm [6402]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 140.385156][ T6422] loop2: detected capacity change from 0 to 2048 [ 140.443868][ T6422] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 141.545646][ T5781] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 142.793831][ T6444] tipc: Enabled bearer , priority 0 [ 142.842354][ T6444] syzkaller0: entered promiscuous mode [ 142.868018][ T6444] syzkaller0: entered allmulticast mode [ 142.998565][ T6444] tipc: Resetting bearer [ 143.218822][ T6441] tipc: Resetting bearer [ 143.467882][ T788] IPVS: starting estimator thread 0... [ 143.573683][ T6455] IPVS: using max 18 ests per chain, 43200 per kthread [ 143.615724][ T6441] tipc: Disabling bearer [ 143.712959][ T28] kauditd_printk_skb: 64 callbacks suppressed [ 143.712973][ T28] audit: type=1326 audit(1790982421.845:79): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6456 comm="syz.2.181" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f47c259e159 code=0x0 [ 151.099271][ T5087] Bluetooth: hci0: Invalid handle: 0x20c9 > 0x0eff [ 151.163583][ T788] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 151.365711][ T788] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 151.399324][ T788] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 152.271017][ T6541] input: syz1 as /devices/virtual/input/input5 [ 152.303647][ T788] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 152.394625][ T788] usb 3-1: config 0 descriptor?? [ 152.412729][ T788] pwc: Askey VC010 type 2 USB webcam detected. [ 152.886100][ T788] pwc: recv_control_msg error -32 req 02 val 2b00 [ 152.913169][ T788] pwc: recv_control_msg error -32 req 02 val 2700 [ 153.142671][ T788] pwc: recv_control_msg error -32 req 02 val 2c00 [ 153.160480][ T788] pwc: recv_control_msg error -32 req 04 val 1000 [ 153.178660][ T788] pwc: recv_control_msg error -32 req 04 val 1300 [ 153.197900][ T788] pwc: recv_control_msg error -32 req 04 val 1400 [ 153.214816][ T788] pwc: recv_control_msg error -32 req 02 val 2000 [ 153.234764][ T788] pwc: recv_control_msg error -32 req 02 val 2100 [ 153.254604][ T788] pwc: recv_control_msg error -32 req 04 val 1500 [ 153.273003][ T788] pwc: recv_control_msg error -32 req 02 val 2500 [ 153.293629][ T788] pwc: recv_control_msg error -32 req 02 val 2400 [ 153.312092][ T788] pwc: recv_control_msg error -32 req 02 val 2600 [ 153.362617][ T6549] kvm: kvm [6548]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0xfffff187 [ 153.393955][ T6549] kvm: kvm [6548]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc1) = 0xfffff15e [ 153.540779][ T788] pwc: recv_control_msg error -71 req 02 val 2800 [ 153.639238][ T788] pwc: recv_control_msg error -71 req 04 val 1100 [ 153.662690][ T788] pwc: recv_control_msg error -71 req 04 val 1200 [ 153.703183][ T788] pwc: Registered as video103. [ 153.741679][ T788] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input6 [ 153.815713][ T788] usb 3-1: USB disconnect, device number 4 [ 155.340718][ T788] IPVS: starting estimator thread 0... [ 155.394258][ T6570] [ 155.396610][ T6570] ====================================================== [ 155.403631][ T6570] WARNING: possible circular locking dependency detected [ 155.410633][ T6570] syzkaller #0 Not tainted [ 155.415023][ T6570] ------------------------------------------------------ [ 155.422013][ T6570] syz.3.202/6570 is trying to acquire lock: [ 155.427879][ T6570] ffff88814880d090 (&sb->s_type->i_mutex_key#25){++++}-{3:3}, at: configfs_depend_item_unlocked+0x157/0x430 [ 155.439355][ T6570] [ 155.439355][ T6570] but task is already holding lock: [ 155.446712][ T6570] ffffffff8de55e88 (tpg_instances_lock){+.+.}-{3:3}, at: usbg_make_tpg+0xf9/0x550 [ 155.455938][ T6570] [ 155.455938][ T6570] which lock already depends on the new lock. [ 155.455938][ T6570] [ 155.466324][ T6570] [ 155.466324][ T6570] the existing dependency chain (in reverse order) is: [ 155.475321][ T6570] [ 155.475321][ T6570] -> #3 (tpg_instances_lock){+.+.}-{3:3}: [ 155.483213][ T6570] __mutex_lock+0x135/0xc80 [ 155.488231][ T6570] tcm_alloc_inst+0x65/0x190 [ 155.493331][ T6570] usb_get_function_instance+0xdd/0x2e0 [ 155.499388][ T6570] function_make+0x11c/0x350 [ 155.504489][ T6570] configfs_mkdir+0x515/0x9e0 [ 155.509680][ T6570] vfs_mkdir+0x2a5/0x470 [ 155.514430][ T6570] do_mkdirat+0x1dc/0x450 [ 155.519268][ T6570] __x64_sys_mkdirat+0x89/0xa0 [ 155.524541][ T6570] do_syscall_64+0x55/0xb0 [ 155.529470][ T6570] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 155.535876][ T6570] [ 155.535876][ T6570] -> #2 (func_lock){+.+.}-{3:3}: [ 155.542989][ T6570] __mutex_lock+0x135/0xc80 [ 155.548002][ T6570] usb_get_function_instance+0x2e/0x2e0 [ 155.554058][ T6570] function_make+0x11c/0x350 [ 155.559157][ T6570] configfs_mkdir+0x515/0x9e0 [ 155.564346][ T6570] vfs_mkdir+0x2a5/0x470 [ 155.569097][ T6570] do_mkdirat+0x1dc/0x450 [ 155.573934][ T6570] __x64_sys_mkdirat+0x89/0xa0 [ 155.579209][ T6570] do_syscall_64+0x55/0xb0 [ 155.584138][ T6570] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 155.590547][ T6570] [ 155.590547][ T6570] -> #1 (gadget_subsys.su_mutex){+.+.}-{3:3}: [ 155.598790][ T6570] __mutex_lock+0x135/0xc80 [ 155.603802][ T6570] configfs_rmdir+0x63c/0x980 [ 155.609018][ T6570] vfs_rmdir+0x352/0x4b0 [ 155.613769][ T6570] do_rmdir+0x29f/0x590 [ 155.618435][ T6570] __x64_sys_rmdir+0x49/0x50 [ 155.623533][ T6570] do_syscall_64+0x55/0xb0 [ 155.628463][ T6570] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 155.634868][ T6570] [ 155.634868][ T6570] -> #0 (&sb->s_type->i_mutex_key#25){++++}-{3:3}: [ 155.643551][ T6570] __lock_acquire+0x37ef/0x7d80 [ 155.648918][ T6570] lock_acquire+0x19e/0x420 [ 155.653930][ T6570] down_write+0x97/0x200 [ 155.658680][ T6570] configfs_depend_item_unlocked+0x157/0x430 [ 155.665169][ T6570] usbg_make_tpg+0x1e1/0x550 [ 155.670275][ T6570] target_fabric_make_tpg+0xa4/0x6d0 [ 155.676076][ T6570] configfs_mkdir+0x515/0x9e0 [ 155.681262][ T6570] vfs_mkdir+0x2a5/0x470 [ 155.686012][ T6570] do_mkdirat+0x1dc/0x450 [ 155.690853][ T6570] __x64_sys_mkdirat+0x89/0xa0 [ 155.696128][ T6570] do_syscall_64+0x55/0xb0 [ 155.701059][ T6570] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 155.707469][ T6570] [ 155.707469][ T6570] other info that might help us debug this: [ 155.707469][ T6570] [ 155.717681][ T6570] Chain exists of: [ 155.717681][ T6570] &sb->s_type->i_mutex_key#25 --> func_lock --> tpg_instances_lock [ 155.717681][ T6570] [ 155.731491][ T6570] Possible unsafe locking scenario: [ 155.731491][ T6570] [ 155.738922][ T6570] CPU0 CPU1 [ 155.744272][ T6570] ---- ---- [ 155.749623][ T6570] lock(tpg_instances_lock); [ 155.754292][ T6570] lock(func_lock); [ 155.760692][ T6570] lock(tpg_instances_lock); [ 155.767874][ T6570] lock(&sb->s_type->i_mutex_key#25); [ 155.773324][ T6570] [ 155.773324][ T6570] *** DEADLOCK *** [ 155.773324][ T6570] [ 155.781450][ T6570] 4 locks held by syz.3.202/6570: [ 155.786461][ T6570] #0: ffff8881432f6418 (sb_writers#18){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 155.795692][ T6570] #1: ffff88805eb1aef0 (&sb->s_type->i_mutex_key#7/1){+.+.}-{3:3}, at: filename_create+0x20f/0x450 [ 155.806483][ T6570] #2: ffffffff8db2bdb0 (&subsys->su_mutex){+.+.}-{3:3}, at: configfs_mkdir+0x4b9/0x9e0 [ 155.816218][ T6570] #3: ffffffff8de55e88 (tpg_instances_lock){+.+.}-{3:3}, at: usbg_make_tpg+0xf9/0x550 [ 155.825869][ T6570] [ 155.825869][ T6570] stack backtrace: [ 155.831761][ T6570] CPU: 0 PID: 6570 Comm: syz.3.202 Not tainted syzkaller #0 [ 155.839031][ T6570] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 155.849076][ T6570] Call Trace: [ 155.852344][ T6570] [ 155.855264][ T6570] dump_stack_lvl+0x18c/0x250 [ 155.859935][ T6570] ? load_image+0x420/0x420 [ 155.864429][ T6570] ? show_regs_print_info+0x20/0x20 [ 155.869624][ T6570] ? print_circular_bug+0x12b/0x1a0 [ 155.874826][ T6570] check_noncircular+0x2fc/0x400 [ 155.879758][ T6570] ? print_deadlock_bug+0x5d0/0x5d0 [ 155.884952][ T6570] ? lockdep_lock+0xf5/0x230 [ 155.889532][ T6570] ? __lock_acquire+0x357f/0x7d80 [ 155.894547][ T6570] ? _find_first_zero_bit+0xd6/0x100 [ 155.899823][ T6570] __lock_acquire+0x37ef/0x7d80 [ 155.904675][ T6570] ? is_bpf_text_address+0x28f/0x2a0 [ 155.909955][ T6570] ? verify_lock_unused+0x140/0x140 [ 155.915151][ T6570] lock_acquire+0x19e/0x420 [ 155.919655][ T6570] ? configfs_depend_item_unlocked+0x157/0x430 [ 155.925801][ T6570] ? trace_raw_output_contention_end+0xd0/0xd0 [ 155.931943][ T6570] ? __might_sleep+0xe0/0xe0 [ 155.936525][ T6570] ? rcu_is_watching+0x15/0xb0 [ 155.941280][ T6570] ? read_lock_is_recursive+0x20/0x20 [ 155.946645][ T6570] ? trace_contention_end+0x39/0xe0 [ 155.951833][ T6570] ? __mutex_lock+0x30d/0xc80 [ 155.956497][ T6570] ? do_syscall_64+0x55/0xb0 [ 155.961080][ T6570] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 155.967143][ T6570] down_write+0x97/0x200 [ 155.971378][ T6570] ? configfs_depend_item_unlocked+0x157/0x430 [ 155.977521][ T6570] ? down_read_killable+0x340/0x340 [ 155.982711][ T6570] configfs_depend_item_unlocked+0x157/0x430 [ 155.988683][ T6570] usbg_make_tpg+0x1e1/0x550 [ 155.993271][ T6570] ? snprintf+0xe9/0x140 [ 155.997504][ T6570] ? configfs_mkdir+0x4b9/0x9e0 [ 156.002347][ T6570] ? usbg_drop_tport+0x20/0x20 [ 156.007106][ T6570] ? vscnprintf+0x80/0x80 [ 156.011429][ T6570] target_fabric_make_tpg+0xa4/0x6d0 [ 156.016708][ T6570] ? target_fabric_release_wwn+0xb0/0xb0 [ 156.022333][ T6570] configfs_mkdir+0x515/0x9e0 [ 156.027002][ T6570] vfs_mkdir+0x2a5/0x470 [ 156.031237][ T6570] do_mkdirat+0x1dc/0x450 [ 156.035556][ T6570] ? vfs_mkdir+0x470/0x470 [ 156.039966][ T6570] __x64_sys_mkdirat+0x89/0xa0 [ 156.044720][ T6570] do_syscall_64+0x55/0xb0 [ 156.049132][ T6570] ? clear_bhb_loop+0x40/0x90 [ 156.053801][ T6570] ? clear_bhb_loop+0x40/0x90 [ 156.058472][ T6570] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 156.064367][ T6570] RIP: 0033:0x7f858759e159 [ 156.068775][ T6570] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 156.088371][ T6570] RSP: 002b:00007f85884ec028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 156.096773][ T6570] RAX: ffffffffffffffda RBX: 00007f8587825fa0 RCX: 00007f858759e159 [ 156.104735][ T6570] RDX: 00000000000001ff RSI: 0000200000000380 RDI: ffffffffffffff9c [ 156.112694][ T6570] RBP: 00007f858763506b R08: 0000000000000000 R09: 0000000000000000 [ 156.120652][ T6570] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 156.128615][ T6570] R13: 00007f8587826038 R14: 00007f8587825fa0 R15: 00007ffe7df6bfe8 [ 156.136580][ T6570] [ 156.150641][ T6569] IPVS: using max 48 ests per chain, 115200 per kthread