last executing test programs: 19.485906343s ago: executing program 1 (id=31): openat$tun(0xffffffffffffff9c, 0x0, 0x82c03, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r0) r1 = socket(0x400000000010, 0x3, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r2, 0xc0305710, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x5, 0x8000, 0x8f, 0x1, 0x7}, 0xe3, 0x1, 0x1, 0x7, 0xff7, 0x19, 0x1, 0x10, 0x7, 0x7, {0x6, 0xfff, 0x10, 0xffff, 0x69f, 0x8}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40004}, 0x80) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000280)='./proc\x00', &(0x7f00000002c0)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./export\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0) write(r4, &(0x7f0000000440)='nfsd 127.0.0.1 2147483647 client1\n', 0x22) r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./proc/net/rpc/nfsd.export/channel\x00', 0x1, 0x0) write(r5, &(0x7f0000000540)='client1 ./export 2147483647 139264 65534 65534 1\n', 0x31) 18.861014533s ago: executing program 1 (id=33): r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000000)={0x18, 0x0, {0x3, @empty, 'ip6gre0\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r0, 0x80047437, &(0x7f0000000040)) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f00000000c0)) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl(r2, 0x40047438, &(0x7f0000000040)) ioctl$PPPIOCCONNECT(r2, 0x4004743a, &(0x7f00000000c0)) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000000)={0x18, 0x0, {0x1, @empty, 'veth0_virt_wifi\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r3, 0x80047437, &(0x7f0000000040)) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl(r4, 0x40047438, &(0x7f0000000040)) ioctl$PPPIOCCONNECT(r4, 0x4004743a, &(0x7f00000000c0)) close(0x3) 18.10408308s ago: executing program 2 (id=35): socket$nl_netfilter(0x10, 0x3, 0xc) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x82, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r2, 0xc004500a, &(0x7f0000000240)=0x3) ioctl$SNDCTL_DSP_SPEED(r2, 0xc0045002, &(0x7f0000000340)=0x8) read$dsp(r2, &(0x7f0000000280)=""/79, 0x4f) 18.036924273s ago: executing program 1 (id=36): socket$inet6(0xa, 0x80003, 0xff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r1, 0x0, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) mq_open(0x0, 0x40, 0x0, &(0x7f0000000bc0)={0x0, 0x8, 0x9, 0x239d1b6c}) syz_emit_ethernet(0x0, 0x0, 0x0) 17.207156523s ago: executing program 2 (id=37): sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000003c0)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_CPUID(r3, 0x4008ae8a, &(0x7f0000000340)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0xffffffffffffffc6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ff}, 0x94) ioctl$KVM_RUN(r3, 0xae80, 0x0) 16.155886634s ago: executing program 1 (id=38): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x2008000, 0x0, 0xfffffffffffffe93, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r4, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x30, r5, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xff8e}]}, 0x30}}, 0x20000000) 16.03439577s ago: executing program 3 (id=39): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$key(0xf, 0x3, 0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000002a0000000100000000000001040000002000000105000000010000040400000013000000010000000000000017000000020000040800000021000000010000000000000025000000020000002000000000696e74006270665f7370696e5f6c6f636b0076616c006d61705f76616c756500636e74006c6f63"], 0x0, 0x8e}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x2, 0x4, 0x8, 0x1, 0x0, 0x0, 0x0, '\x00', 0x0, r3, 0x1, 0x3}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x3, 0x10, &(0x7f0000000400)=ANY=[], &(0x7f0000000500)='GPL\x00', 0x7, 0x1000, &(0x7f0000001000)=""/4096, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 14.878693837s ago: executing program 3 (id=40): socket$nl_generic(0x10, 0x3, 0x10) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x84000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) process_vm_writev(r2, &(0x7f00000006c0)=[{&(0x7f0000000440)=""/215, 0xd7}], 0x1, &(0x7f0000000ac0)=[{&(0x7f0000000700)=""/87, 0x57}, {0x0}, {0x0}], 0x3, 0x0) 13.276096755s ago: executing program 3 (id=42): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$sndpcmp(&(0x7f0000000b00), 0x0, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$SNDRV_PCM_IOCTL_REWIND(r3, 0x40084146, &(0x7f0000000140)=0x32) 13.207073188s ago: executing program 2 (id=43): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/asound/seq/clients\x00', 0x0, 0x0) syz_usb_connect$midi(0x4, 0x0, 0x0, 0x0) readv(r4, &(0x7f00000038c0)=[{&(0x7f0000000380)=""/4103, 0x1007}], 0x1) 10.018990193s ago: executing program 2 (id=44): socket$nl_route(0x10, 0x3, 0x0) setpriority(0x1, 0x0, 0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$rds(0x15, 0x5, 0x0) bind$rds(r3, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r3, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000780)=[@rdma_args={0x48, 0x114, 0x1, {{}, {0x0, 0x2c}, &(0x7f00000006c0)=[{&(0x7f0000000100)=""/44, 0x410200}], 0x1, 0xf5}}], 0x48}, 0x0) 9.976308005s ago: executing program 0 (id=45): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) rename(0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000200)={0x2, 0x4e21, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000)=0x40, 0x4) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f00000002c0)=[@mss={0x2, 0x2}, @window={0x3, 0x7, 0x7}, @mss={0x2, 0x8}, @mss={0x2, 0x7}, @sack_perm, @timestamp, @timestamp, @sack_perm], 0x8) writev(r1, &(0x7f00000005c0)=[{&(0x7f0000000400)="b4d90cff", 0x4}], 0x1) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r1, &(0x7f00000004c0)='<', 0xfdef, 0x805, 0x0, 0x0) 8.139528615s ago: executing program 0 (id=46): socket$nl_netfilter(0x10, 0x3, 0xc) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x82, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r2, 0xc004500a, &(0x7f0000000240)=0x3) ioctl$SNDCTL_DSP_SPEED(r2, 0xc0045002, &(0x7f0000000340)=0x8) read$dsp(r2, &(0x7f0000000280)=""/79, 0x4f) 8.139403975s ago: executing program 1 (id=47): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x2008000, 0x0, 0xfffffffffffffe93, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) io_setup(0x3, &(0x7f0000000040)=0x0) r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) io_submit(r4, 0x1, &(0x7f0000001700)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x6, r5, 0x0, 0xb01f, 0x5601}]) 6.954475142s ago: executing program 3 (id=48): bind$alg(0xffffffffffffffff, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-avx\x00'}, 0x58) socket$inet6_udp(0xa, 0x2, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f00000008c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000300)=ANY=[@ANYBLOB], 0x28}}, 0x8000) r0 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) bind$netlink(r3, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) getsockname$packet(r3, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r2, &(0x7f0000024c80)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000024d40)=ANY=[@ANYBLOB="4400000010000d042abd7000077bf70000000000", @ANYRES32=r4, @ANYBLOB="01000000000000002400128009000100626f6e640000000014000280050001000600000008000b00", @ANYRES32=r1], 0x44}, 0x1, 0x0, 0x0, 0x40040}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x1, 0x803, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)=@newlink={0x3c, 0x10, 0x401, 0x70bd25, 0x0, {0x0, 0x0, 0x0, 0x0, 0x40018}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x3c}}, 0x0) 6.783109541s ago: executing program 0 (id=49): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x3}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) open_tree(0xffffffffffffffff, &(0x7f00000019c0)='./file0/file0\x00', 0x1001) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f00000000c0), 0x28a40, 0x0) ioctl$PTP_EXTTS_REQUEST2(r3, 0xc0403d11, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x40000, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0xe, &(0x7f0000000740)={[{@journal_ioprio={'journal_ioprio', 0x3d, 0x1}}, {@noquota}, {@auto_da_alloc_val={'auto_da_alloc', 0x3d, 0xeb0}}, {@noquota}, {@nombcache}, {@noload}, {@lazytime}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x8000}}, {@barrier_val={'barrier', 0x3d, 0x1}}, {@data_err_abort}, {@mblk_io_submit}]}, 0x3, 0x440, &(0x7f0000000280)="$eJzs28tvG8UfAPDv2kn66+uXUJVHH0CgIMoradJSeuACAokDSEhwKMeQpFWo26AmSLSKICBUjqgSJy6IIxJ/ASe4IOCExBXuqFKFcmnhZLT2bmI7thunTlzqz0dad2Z33Jmvd8ee2ckG0LdG05ckYk9E/B4Rw9VsfYHR6j83V5am/15Zmk6iXH7zr6RS7sbK0nReNH/f7jwzEFH4NIlDTepduHT53FSpNHsxy48vnn9vfOHS5Wfnzk+dnT07e2Hy1KkTxyeePzn5XFfiTOO6cfDD+cMHXn376uvTp6++8/O3SR5/QxxdMtru4OPlcper6629NelkoIcNoSPFajeNwUr/H45irJ284Xjlk542DthS5XK5fF/rw8tl4C6WRK9bAPRG/kOfzn/zbZuGHneE6y9WJ0Bp3DezrXpkIApZmcGG+W03jUbE6eV/vkq32Jr7EAAAdb5Pxz/PNBv/FaL2vtD/szWUkYi4JyL2RcTJiNgfEfdGVMreHxEPdFh/4yLJ+vFP4dqmAtugdPz3Qra2VT/+y0d/MVLMcnsr8Q8mZ+ZKs8eyz+RoDO5I8xNt6vjh5d8+b3WsdvyXbmn9+Vgwa8e1gR3175mZWpy6nZhrXf844uBAs/iT1ZWAJCIORMTBTdYx99Q3h1sdu3X8bXRhnan8dcQT1fO/HA3x55L265Pj/4vS7LHx/KpY75dfr7zRqv7bir8L0vO/q+n1vxr/SFK7XrvQyf/+5ZPp65U/Pms5p9ns9T+UvFW374OpxcWLExFDyWvVRtfun2woN7lWPo3/6JHm/X9frH0ShyIivYgfjIiHIuLhrO2PRMSjEXGkzafw00uPvbv5+LdWGv9MR+d/LTEUjXuaJ4rnfvyurtKRTuJPz/+JSupotmcj338baVenVzMAAAD8VxUiYk8khbHVdKEwNlb9G/79satQml9YfPrM/PsXZqrPCIzEYCG/0zVccz90IpvW5/nJhvzx7L7xF8WdlfzY9HxpptfBQ5/b3aL/p/4s9rp1wJbzvBb0L/0f+pf+D/1L/4f+1aT/7+xFO4Dt1+z3/6MetAPYfg3937If9BHzf+hfm+n/vjPg7tC2Lw9tXzuAbbWwM279kLyExLpEFO6IZkhsUaLX30wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADd8W8AAAD//58P56I=") 5.35821995s ago: executing program 3 (id=50): socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() syz_open_dev$tty1(0xc, 0x4, 0x1) sched_setscheduler(r0, 0x2, &(0x7f0000000480)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xfc409000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x698d, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r3, 0xc1105517, &(0x7f0000000140)={{0x8, 0x0, 0x81, 0xfffffffe, 'syz0\x00', 0xf5}, 0x3, 0x200, 0x3e, 0x0, 0x1, 0xfff, 'syz1\x00', &(0x7f0000000640)=['syz0\x00\x9cB\xd1}\xb7\xe2\xde\xb0\xc0\xab\x18]\xe5\xa1\x1anK\xadL\xe0\x00\xfd\xbc\xf2\x89\x8f\xe5)\xa8\xdeuYD\x14\x84\x01\xd3e?\xde/\x80y]\xa6\xb4^\xa66_\xb2RR\r\xc2\xa6\xb2\xa23\x1e\x880$\x87\xcdb\xa1\xf1\x19\x00d\xf1}\"\x9f#\x9a\xd2T\xfc\x84\xce\x8cW[AQ\xc4R\xec\xef7o\x03\x90\x8c\x01O\x89\xb7\r\x90\xd1\xde\xa6`\xbe\x93\xe96\xeei8\x8b~b+\x02\xbfy\x96\xb3\xc2E{=8\b\b\xc5\v\xeac\x98\xd8\x95\xd3\x1f\x03\x00\x9d\x8f\xeb\x16 \xa0u\xad\xc2\xd4UH\x82\xbb\xe5\xd9\x19\xb7P\xfc\xf2\x02{\xba&\x0f/\xb2d\aC\xd0Q\x9e\xb2\x16\xea\xfe\x06\x92`\xda:\xe3\xb0'], 0xbe}) 5.127254871s ago: executing program 0 (id=51): socketpair(0x26, 0x100000005, 0x0, &(0x7f00000002c0)) r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000180)={@loopback={0x200000000000000}, 0x800, 0x0, 0x3, 0x1}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x380000, @loopback}, 0x1c) syz_emit_ethernet(0x0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x24000044) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000000)='3', 0x4e) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x1, 0x0) fcntl$getown(r1, 0x9) madvise(0xffffffffffffffff, 0x0, 0xb) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657930820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, 0xffffffffffffffff) 4.247598483s ago: executing program 3 (id=52): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, &(0x7f0000000400)='\x00') mkdir(&(0x7f0000000500)='./config/usb_gadget/g1\x00', 0x1ff) mkdir(0x0, 0x1ff) mkdir(&(0x7f0000000700)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ff) mkdir(&(0x7f0000000d00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0x1ff) syz_mount_image$ext4(&(0x7f0000000540)='ext4\x00', &(0x7f0000000580)='./file0\x00', 0x0, &(0x7f00000000c0)={[{@jqfmt_vfsv1}, {@errors_remount}]}, 0x1, 0x52f, &(0x7f00000005c0)="$eJzs3M9rXFsdAPDvvZPEvLynfU+eom5e8AnvVXHyC8G6akVXWlEsiLgosZ2kIZNMmkygCS7S/8CFXYkL127qQkFQLIiCS11Ixf9ALKW0Lgq1kXtnbjqdHy9Jm8yU3s8Hztxz7rntOXe+OTP3nNzcAErrbPaSRLwVEX+KiDOt4jPTrZRtbi3cvpalJPb3v38/yY/bW7h9rTi0+HdvZi9pxGRE/P1CEj9Oetvd2tldXazXa5vt8kxzbWNma2f3yytri8u15dr63FcWFmZnz83PfvXEzvVXT771r1/f/fryzZ/+7Q8/aP7nR0mcz887us7jpEyn0+33ZDw+31X3zZNubEQqETEWEZ/q2JeMjbBDHEsRv/F8/J+JSggelMV+rpX/X0/te1nlxMFhwGsmMbihpIpv+mz+W6ShXoAwUvcutCaAe+21nVsH8R+LNN9O5nPDqYfJczPDpGvO/6KmI+LG3T//JktxSuswDLZ3MyI+02/8J/na2Nv5Kl4W/0pP/N9vb7P0YWvJLz/mC8dof7q7P+I/VC8T/7Md8a92xP+Lx2hf/AEAAIbjzoWImO03/0uzaWHEwfzv+fWfbG746RNo3/xvtIr1v1s963/pwfpfZcD63/4R2/jhpScDD+1c/8tS1n6xFsjpu3cz4nN941/EezKPdXf8s5+NmSO2cb35jb8MqhP/0dr/ZcQH0T/+heSj78+cWVqp12Zbr33bePfnt783qH3xH61s/E/1xn8ii/phn/+99wv1953zf70/qK4z/r9/8rvf9sY//fdEcin/YZxo77mx2GxuzkVMJN/u3T9/zDegZIr3qHgPs/h/+H7/7/9P5tvi8793/f9pe5vtf9y+hzTLP2hfNWZ1jyJi54/XB97ufHj8OU1Z/K8O+Pwvxn+/7/9s33+P2MY/ln7xk0F14g8AAAAAAAAALy/N7+VN0upBPk2r1dYz/N6NqbTe2Gp+aamxvX412n8POp4Wd3qdaZWTrDyX55+V57vKCxHxTkT8rPJGXq5eadSvjvrkoeTe7Br/jyqt8Q+UhEd+QnkZ/1Bexj+Ul/EP5fUi43/iFPoBDJ/vfygv4x/Ky/iH8jL+obyMfygv4x9K6bsXL2Zpv3ju53pjeWX12sa5+dnq2vaV6pXG5kZ1udFYzv9iZ+3w/6/eaGzMzcf2jZlmbas5s7Wze3mtsb3evJw/N/pybXwI5wQczTvv3flnEhF7X3sjT9Hxq31jFV5vlVF3ABiZo0z9J4fQD2D4XOMDySH1A68B6iffF2A40lF3ABiZDz5r/R/Kyvo/lJdb/6C8XOMD1v+hfKz/Q3lt7eyuLtbrtU2ZVzBTXJW9Kv2ROa3M2KvRjY7MiD+YAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOFFbO7uri/V6bfMUM6M+R6C/qYdjcamjnETE0/Z2LCIeR8R4RFT2Ih5ExGRWtxfxqCsPAAAAAAAAjJ7f0gNA+byVpyStRkSa59O0Wo34eES8HePJ0kq9NhsRn4iIu5Xxj2XluVF3GjgR/w8AAP//PjQTbw==") mkdir(&(0x7f0000000e00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u/360p\x00', 0x1ff) mkdir(&(0x7f0000000f00)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000200), 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f0, &(0x7f0000001040)={'ip_vti0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x2000, 0x200da5d85240a79d, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x4, 0x14, 0x68, 0x0, 0x80, 0x2b, 0x0, @empty, @empty}}}}) symlink(&(0x7f0000001000)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', &(0x7f0000001100)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h/u\x00') symlink(&(0x7f0000001600)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', &(0x7f0000001700)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/ss/h\x00') 1.789043453s ago: executing program 0 (id=53): signalfd(0xffffffffffffffff, &(0x7f00000002c0)={[0x7fffffff]}, 0x8) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000d88000/0x1000)=nil, &(0x7f00007f2000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff6000/0xa000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f00008f7000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x2405a045) r0 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xcaa1, 0xc000, 0x6, 0xbe}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r2 = mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0) r3 = userfaultfd(0x80001) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000240)={{&(0x7f0000ffa000/0x3000)=nil, 0x3000}, 0x1}) syz_memcpy_off$KVM_EXIT_MMIO(r2, 0x20, &(0x7f0000000100)="64b6365de974de7a040000000000000000000000496e9000", 0x0, 0x18) 1.582403403s ago: executing program 1 (id=54): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000001400000008000200fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000900fc000000080011000700000008000e00800000000800", @ANYRES32=r0], 0x5c}, 0x1, 0x0, 0x0, 0x40800}, 0x40090) 1.570775514s ago: executing program 2 (id=55): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x2008000, 0x0, 0xfffffffffffffe93, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r4, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x30, r5, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xff8e}]}, 0x30}}, 0x20000000) 38.200748ms ago: executing program 2 (id=56): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000200)='2', 0x1}], 0x1) bind$bt_l2cap(r0, &(0x7f0000000100)={0x1f, 0x80, @any, 0x0, 0x1}, 0x10) listen(r0, 0x5) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)={0x1e0, 0x0, 0x2, 0x301, 0x0, 0x0, {0x7, 0x0, 0x10}, [@CTA_EXPECT_NAT={0x1cc, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x68, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x21}}, {0x14, 0x4, @empty}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x74b9c7924d4830a3}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x26}}, {0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0x24}}}}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x90, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x36}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x10}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private1}, {0x14, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}}}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_EXPECT_NAT_TUPLE={0x4c, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @loopback}, {0x14, 0x4, @private0}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_TUPLE={0x6c, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}}, {0x14, 0x4, @loopback}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0={0xfc, 0x0, '\x00', 0x1}}, {0x14, 0x4, @private0}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}]}]}, 0x1e0}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r3 = socket(0x10, 0x803, 0x0) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r3, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)={0x1c, 0x0, 0x4, 0x70bd27, 0x25dfdbfd}, 0x1c}, 0x1, 0x0, 0x0, 0x8880}, 0x4) recvmmsg(r3, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x42}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) 0s ago: executing program 0 (id=57): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r4, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21}}, 0x24) sendmmsg(r4, &(0x7f0000000180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[{0x18, 0x110, 0x1, "e4"}], 0x18, 0xe000}, 0x5}], 0x1, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.77' (ED25519) to the list of known hosts. [ 72.517054][ T5765] cgroup: Unknown subsys name 'net' [ 72.649165][ T5765] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 74.386596][ T5765] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 75.948661][ T5781] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 75.956954][ T5781] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 75.965713][ T5781] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 75.973650][ T5781] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 75.981852][ T5781] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 75.989792][ T5781] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 75.995241][ T5790] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 75.997243][ T5781] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 76.012427][ T5790] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 76.020218][ T5784] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 76.020250][ T5790] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 76.028727][ T5790] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 76.043180][ T5781] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 76.043467][ T5790] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 76.057939][ T5781] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 76.059245][ T5790] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 76.072402][ T5781] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 76.080676][ T5792] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 76.088684][ T5792] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 76.101206][ T5784] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 76.109366][ T5792] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 76.123032][ T5792] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 76.135069][ T5792] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 76.142577][ T5792] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 76.601693][ T5779] chnl_net:caif_netlink_parms(): no params data found [ 76.620262][ T5780] chnl_net:caif_netlink_parms(): no params data found [ 76.725680][ T5777] chnl_net:caif_netlink_parms(): no params data found [ 76.812705][ T5778] chnl_net:caif_netlink_parms(): no params data found [ 76.878176][ T5779] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.886109][ T5779] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.894314][ T5779] bridge_slave_0: entered allmulticast mode [ 76.901312][ T5779] bridge_slave_0: entered promiscuous mode [ 76.909855][ T5780] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.919053][ T5780] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.926781][ T5780] bridge_slave_0: entered allmulticast mode [ 76.934643][ T5780] bridge_slave_0: entered promiscuous mode [ 76.943469][ T5780] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.950603][ T5780] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.958154][ T5780] bridge_slave_1: entered allmulticast mode [ 76.965142][ T5780] bridge_slave_1: entered promiscuous mode [ 76.988888][ T5779] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.996326][ T5779] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.003822][ T5779] bridge_slave_1: entered allmulticast mode [ 77.010947][ T5779] bridge_slave_1: entered promiscuous mode [ 77.045400][ T5777] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.052665][ T5777] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.059799][ T5777] bridge_slave_0: entered allmulticast mode [ 77.067059][ T5777] bridge_slave_0: entered promiscuous mode [ 77.109978][ T5777] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.117231][ T5777] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.127118][ T5777] bridge_slave_1: entered allmulticast mode [ 77.134116][ T5777] bridge_slave_1: entered promiscuous mode [ 77.145167][ T5779] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.157544][ T5780] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.170267][ T5780] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.197538][ T5779] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.281158][ T5777] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.294490][ T5779] team0: Port device team_slave_0 added [ 77.303337][ T5780] team0: Port device team_slave_0 added [ 77.309429][ T5778] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.319348][ T5778] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.326797][ T5778] bridge_slave_0: entered allmulticast mode [ 77.334632][ T5778] bridge_slave_0: entered promiscuous mode [ 77.343670][ T5777] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.365903][ T5779] team0: Port device team_slave_1 added [ 77.373472][ T5780] team0: Port device team_slave_1 added [ 77.400079][ T5778] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.407450][ T5778] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.414933][ T5778] bridge_slave_1: entered allmulticast mode [ 77.421715][ T5778] bridge_slave_1: entered promiscuous mode [ 77.468230][ T5779] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.475569][ T5779] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.501964][ T5779] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.515982][ T5777] team0: Port device team_slave_0 added [ 77.524551][ T5778] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.544738][ T5779] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.551727][ T5779] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.578073][ T5779] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.597466][ T5777] team0: Port device team_slave_1 added [ 77.613969][ T5778] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.634913][ T5780] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.642147][ T5780] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.668218][ T5780] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.681846][ T5780] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.688933][ T5780] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.715163][ T5780] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.792330][ T5778] team0: Port device team_slave_0 added [ 77.809329][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.816418][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.842921][ T5777] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.858463][ T5780] hsr_slave_0: entered promiscuous mode [ 77.866377][ T5780] hsr_slave_1: entered promiscuous mode [ 77.875500][ T5778] team0: Port device team_slave_1 added [ 77.899355][ T5779] hsr_slave_0: entered promiscuous mode [ 77.905856][ T5779] hsr_slave_1: entered promiscuous mode [ 77.913149][ T5779] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 77.920951][ T5779] Cannot create hsr debugfs directory [ 77.927056][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.934133][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.960502][ T5777] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.031438][ T5778] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.038798][ T5778] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.065026][ T5778] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.076544][ T5787] Bluetooth: hci3: command tx timeout [ 78.084748][ T5778] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.091718][ T5778] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.118491][ T5778] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.152136][ T5787] Bluetooth: hci1: command tx timeout [ 78.152516][ T5792] Bluetooth: hci0: command tx timeout [ 78.232325][ T5792] Bluetooth: hci2: command tx timeout [ 78.261296][ T5777] hsr_slave_0: entered promiscuous mode [ 78.267632][ T5777] hsr_slave_1: entered promiscuous mode [ 78.274246][ T5777] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 78.281825][ T5777] Cannot create hsr debugfs directory [ 78.356472][ T5778] hsr_slave_0: entered promiscuous mode [ 78.363297][ T5778] hsr_slave_1: entered promiscuous mode [ 78.369429][ T5778] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 78.377755][ T5778] Cannot create hsr debugfs directory [ 78.644046][ T5779] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 78.686190][ T5779] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 78.704717][ T5779] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 78.715791][ T5779] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 78.768745][ T5780] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 78.787185][ T5780] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 78.812607][ T5780] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 78.823194][ T5780] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 78.874547][ T5777] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 78.898246][ T5777] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 78.927612][ T5777] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 78.937818][ T5777] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 79.017636][ T5778] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 79.030871][ T5778] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 79.055889][ T5778] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 79.068166][ T5778] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 79.126607][ T5779] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.201293][ T5779] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.228458][ T5780] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.241365][ T3436] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.248713][ T3436] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.264583][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.271759][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.289885][ T5777] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.321498][ T5780] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.360292][ T5777] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.397388][ T3420] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.404571][ T3420] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.421862][ T3420] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.429041][ T3420] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.464274][ T3420] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.471401][ T3420] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.481348][ T3420] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.488566][ T3420] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.540533][ T5778] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.574944][ T5778] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.643803][ T3502] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.651008][ T3502] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.664958][ T3502] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.672201][ T3502] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.907826][ T5779] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.039526][ T5779] veth0_vlan: entered promiscuous mode [ 80.069567][ T5779] veth1_vlan: entered promiscuous mode [ 80.152525][ T5792] Bluetooth: hci3: command tx timeout [ 80.166814][ T5779] veth0_macvtap: entered promiscuous mode [ 80.206355][ T5779] veth1_macvtap: entered promiscuous mode [ 80.233165][ T5792] Bluetooth: hci1: command tx timeout [ 80.238754][ T5792] Bluetooth: hci0: command tx timeout [ 80.301838][ T5779] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.313942][ T5792] Bluetooth: hci2: command tx timeout [ 80.323952][ T5779] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.343466][ T5780] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.358791][ T5777] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.379273][ T5779] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.388576][ T5779] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.398583][ T5779] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.407603][ T5779] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.435401][ T5778] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.585970][ T5778] veth0_vlan: entered promiscuous mode [ 80.599690][ T5778] veth1_vlan: entered promiscuous mode [ 80.607835][ T5777] veth0_vlan: entered promiscuous mode [ 80.635963][ T5780] veth0_vlan: entered promiscuous mode [ 80.661305][ T3436] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.674222][ T5780] veth1_vlan: entered promiscuous mode [ 80.687333][ T3436] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.730186][ T5777] veth1_vlan: entered promiscuous mode [ 80.761325][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.775319][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.815437][ T5780] veth0_macvtap: entered promiscuous mode [ 80.831042][ T5778] veth0_macvtap: entered promiscuous mode [ 80.864384][ T5778] veth1_macvtap: entered promiscuous mode [ 80.871693][ T5780] veth1_macvtap: entered promiscuous mode [ 80.895925][ T5777] veth0_macvtap: entered promiscuous mode [ 80.925736][ T5777] veth1_macvtap: entered promiscuous mode [ 80.950490][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 80.968814][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.981664][ T5780] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.006138][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.017827][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.029766][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.045874][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.068675][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.095001][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.106645][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.117315][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.127924][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.138938][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.149512][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.161361][ T5778] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.182225][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.198390][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.210490][ T5780] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.223229][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.233936][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.252191][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.265807][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.290350][ T5778] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.298460][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.309868][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.320560][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.331204][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.341246][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.364103][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.379940][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.404777][ T5780] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.418202][ T5780] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.428905][ T5780] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.444482][ T5780] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.480812][ T5778] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.527051][ T5778] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.536137][ T5778] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.545128][ T5778] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.560825][ T5777] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.570245][ T5777] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.606388][ T5777] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.615553][ T5777] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.640322][ T5845] syz.3.5[5845]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 81.682683][ T5845] loop3: detected capacity change from 0 to 256 [ 81.698658][ T5845] ======================================================= [ 81.698658][ T5845] WARNING: The mand mount option has been deprecated and [ 81.698658][ T5845] and is ignored by this kernel. Remove the mand [ 81.698658][ T5845] option from the mount to silence this warning. [ 81.698658][ T5845] ======================================================= [ 82.329027][ T5792] Bluetooth: hci3: command tx timeout [ 82.330040][ T5089] Bluetooth: hci1: command tx timeout [ 82.352680][ T5787] Bluetooth: hci0: command tx timeout [ 82.393547][ T5089] Bluetooth: hci2: command tx timeout [ 82.623653][ T3420] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.632683][ T3420] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.674690][ T3420] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.700926][ T3420] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.708660][ T2922] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.717824][ T2922] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.799774][ T3436] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 82.822847][ T3436] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.024687][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.038113][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.065598][ T3420] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.078492][ T3420] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.619228][ T5857] loop0: detected capacity change from 0 to 1024 [ 85.322450][ T5792] Bluetooth: hci1: command tx timeout [ 85.327931][ T5792] Bluetooth: hci0: command tx timeout [ 85.333860][ T5089] Bluetooth: hci3: command tx timeout [ 85.339823][ T5089] Bluetooth: hci2: command tx timeout [ 85.357816][ T5857] EXT4-fs: Ignoring removed bh option [ 86.462007][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 87.122286][ T5857] EXT4-fs (loop0): stripe (5) is not aligned with cluster size (16), stripe is disabled [ 87.190903][ T5857] EXT4-fs warning (device loop0): ext4_multi_mount_protect:398: Unable to create kmmpd thread for loop0. [ 89.371478][ T28] audit: type=1326 audit(1790070017.456:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5880 comm="syz.3.13" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fda22f9e159 code=0x0 [ 89.469515][ T5889] loop0: detected capacity change from 0 to 256 [ 90.912513][ T5896] atomic_op ffff888026cc4198 conn xmit_atomic 0000000000000000 [ 93.436509][ T971] cfg80211: failed to load regulatory.db [ 97.086578][ T5976] process 'syz.2.8' launched '/dev/fd/3' with NULL argv: empty string added [ 97.660090][ T5981] loop2: detected capacity change from 0 to 512 [ 97.722572][ T5981] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a803c198, mo2=0002] [ 97.746071][ T5981] System zones: 1-12 [ 97.781841][ T5981] EXT4-fs error (device loop2): ext4_iget_extra_inode:4752: inode #15: comm syz.2.19: corrupted in-inode xattr: e_value size too large [ 97.830981][ T5981] EXT4-fs error (device loop2): ext4_orphan_get:1413: comm syz.2.19: couldn't read orphan inode 15 (err -117) [ 97.884349][ T5981] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 98.678852][ T5994] dns_resolver: Unsupported server list version (6) [ 99.068568][ T5777] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 99.262157][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 100.853233][ T6002] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 102.216039][ T6012] gadgetfs: bound to dummy_udc driver [ 104.381949][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 105.602383][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 106.263428][ T6028] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 107.553003][ T28] audit: type=1800 audit(1790070035.746:3): pid=6044 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.30" name="attr_allow_any_host" dev="configfs" ino=8377 res=0 errno=0 [ 107.721210][ T6044] nvmet_tcp: enabling port 1 (127.0.0.1:4420) [ 107.754577][ T28] audit: type=1800 audit(1790070035.816:4): pid=6044 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.30" name="addr_trtype" dev="configfs" ino=8385 res=0 errno=0 [ 107.882180][ T28] audit: type=1800 audit(1790070035.816:5): pid=6044 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.30" name="addr_traddr" dev="configfs" ino=8386 res=0 errno=0 [ 108.274360][ T28] audit: type=1800 audit(1790070035.826:6): pid=6044 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.30" name="addr_trsvcid" dev="configfs" ino=8387 res=0 errno=0 [ 109.393989][ T28] audit: type=1800 audit(1790070035.836:7): pid=6044 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.30" name="addr_adrfam" dev="configfs" ino=8388 res=0 errno=0 [ 111.265515][ T6063] ptrace attach of "ci2-linux-6-6-kasan/syz-executor exec"[6064] was attempted by "ci2-linux-6-6-kasan/syz-executor exec"[6063] [ 112.062027][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 116.772289][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 118.908604][ T6095] 8021q: adding VLAN 0 to HW filter on device bond1 [ 119.014655][ T6099] bond1: (slave geneve2): making interface the new active one [ 119.091560][ T6099] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 119.228638][ T6101] loop0: detected capacity change from 0 to 512 [ 119.241557][ T6101] EXT4-fs: Ignoring removed mblk_io_submit option [ 119.313592][ T6101] EXT4-fs: Invalid want_extra_isize 32768 [ 119.766051][ T6099] syz.3.48 (6099) used greatest stack depth: 19896 bytes left [ 120.630875][ T6108] snd_aloop snd_aloop.0: control 0:129:-2:syz0:245 is already present [ 122.301945][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c2!!! [ 122.780826][ T6115] loop3: detected capacity change from 0 to 512 [ 122.789711][ T6115] EXT4-fs (loop3): bad s_min_extra_isize: 544 [ 122.879590][ T6106] FAULT_INJECTION: forcing a failure. [ 122.879590][ T6106] name failslab, interval 1, probability 0, space 0, times 1 [ 122.923882][ T6106] CPU: 1 PID: 6106 Comm: syz.0.51 Not tainted syzkaller #0 [ 122.931207][ T6106] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 122.941268][ T6106] Call Trace: [ 122.944548][ T6106] [ 122.947483][ T6106] dump_stack_lvl+0x18c/0x250 [ 122.952174][ T6106] ? show_regs_print_info+0x20/0x20 [ 122.957373][ T6106] ? load_image+0x420/0x420 [ 122.962334][ T6106] ? __might_sleep+0xe0/0xe0 [ 122.966927][ T6106] ? __lock_acquire+0x7d80/0x7d80 [ 122.971963][ T6106] should_fail_ex+0x394/0x4c0 [ 122.976648][ T6106] should_failslab+0x9/0x20 [ 122.981165][ T6106] slab_pre_alloc_hook+0x59/0x300 [ 122.986200][ T6106] ? crypto_create_tfm_node+0x77/0x380 [ 122.991662][ T6106] ? crypto_create_tfm_node+0x77/0x380 [ 122.997121][ T6106] __kmem_cache_alloc_node+0x53/0x250 [ 123.002550][ T6106] ? crypto_create_tfm_node+0x77/0x380 [ 123.008008][ T6106] __kmalloc_node+0xa6/0x240 [ 123.012604][ T6106] ? __kmem_cache_alloc_node+0x194/0x250 [ 123.018261][ T6106] crypto_create_tfm_node+0x77/0x380 [ 123.023574][ T6106] crypto_init_akcipher_ops_sig+0x5b/0xe0 [ 123.029342][ T6106] crypto_create_tfm_node+0x155/0x380 [ 123.034711][ T6106] ? crypto_alg_mod_lookup+0x1ad/0x570 [ 123.040168][ T6106] crypto_alloc_tfm_node+0x17b/0x360 [ 123.045454][ T6106] public_key_verify_signature+0x23e/0x870 [ 123.051264][ T6106] ? public_key_free+0x80/0x80 [ 123.056039][ T6106] ? asymmetric_key_generate_id+0x60/0x150 [ 123.061842][ T6106] ? asymmetric_key_id_same+0x67/0xe0 [ 123.067219][ T6106] x509_check_for_self_signed+0x31b/0x430 [ 123.073050][ T6106] x509_cert_parse+0x5a0/0x7b0 [ 123.077836][ T6106] x509_key_preparse+0x64/0x6c0 [ 123.082687][ T6106] ? down_read+0x1ac/0x2e0 [ 123.087101][ T6106] asymmetric_key_preparse+0xa9/0x140 [ 123.092479][ T6106] __key_create_or_update+0x3a6/0xa60 [ 123.097853][ T6106] ? key_create_or_update+0x60/0x60 [ 123.103047][ T6106] ? bpf_lsm_key_permission+0x9/0x10 [ 123.108335][ T6106] ? lookup_user_key+0xb66/0x1140 [ 123.113361][ T6106] ? search_process_keyrings_rcu+0x2b0/0x2b0 [ 123.119342][ T6106] key_create_or_update+0x42/0x60 [ 123.124369][ T6106] __se_sys_add_key+0x34f/0x410 [ 123.129311][ T6106] ? __x64_sys_add_key+0xc0/0xc0 [ 123.134256][ T6106] ? lockdep_hardirqs_on+0x98/0x150 [ 123.139448][ T6106] ? __x64_sys_add_key+0x20/0xc0 [ 123.144482][ T6106] do_syscall_64+0x55/0xb0 [ 123.148897][ T6106] ? clear_bhb_loop+0x40/0x90 [ 123.153580][ T6106] ? clear_bhb_loop+0x40/0x90 [ 123.158264][ T6106] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 123.164154][ T6106] RIP: 0033:0x7fc43939e159 [ 123.168572][ T6106] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 123.188194][ T6106] RSP: 002b:00007fc43a212028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 123.196610][ T6106] RAX: ffffffffffffffda RBX: 00007fc439625fa0 RCX: 00007fc43939e159 [ 123.204687][ T6106] RDX: 0000200000000200 RSI: 0000000000000000 RDI: 0000200000000000 [ 123.212655][ T6106] RBP: 00007fc43943506b R08: ffffffffffffffff R09: 0000000000000000 [ 123.220710][ T6106] R10: 0000000000000559 R11: 0000000000000246 R12: 0000000000000000 [ 123.228679][ T6106] R13: 00007fc439626038 R14: 00007fc439625fa0 R15: 00007ffdef62c5f8 [ 123.236704][ T6106] [ 125.533616][ T6115] [ 125.536016][ T6115] ====================================================== [ 125.543059][ T6115] WARNING: possible circular locking dependency detected [ 125.550100][ T6115] syzkaller #0 Not tainted [ 125.554531][ T6115] ------------------------------------------------------ [ 125.561572][ T6115] syz.3.52/6115 is trying to acquire lock: [ 125.567401][ T6115] ffffffff8ddf43f0 (gadget_subsys.su_mutex){+.+.}-{3:3}, at: uvcg_streaming_header_allow_link+0x71/0x4a0 [ 125.578776][ T6115] [ 125.578776][ T6115] but task is already holding lock: [ 125.586165][ T6115] ffff88805ec54160 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: configfs_symlink+0x47a/0xfe0 [ 125.596670][ T6115] [ 125.596670][ T6115] which lock already depends on the new lock. [ 125.596670][ T6115] [ 125.607101][ T6115] [ 125.607101][ T6115] the existing dependency chain (in reverse order) is: [ 125.616151][ T6115] [ 125.616151][ T6115] -> #3 (&sb->s_type->i_mutex_key#20){++++}-{3:3}: [ 125.624856][ T6115] down_write+0x97/0x200 [ 125.629631][ T6115] configfs_depend_item_unlocked+0x157/0x430 [ 125.636141][ T6115] usbg_make_tpg+0x1e1/0x550 [ 125.641270][ T6115] target_fabric_make_tpg+0xa4/0x6d0 [ 125.647092][ T6115] configfs_mkdir+0x515/0x9e0 [ 125.652299][ T6115] vfs_mkdir+0x2a5/0x470 [ 125.657089][ T6115] do_mkdirat+0x1dc/0x450 [ 125.661973][ T6115] __x64_sys_mkdirat+0x89/0xa0 [ 125.667312][ T6115] do_syscall_64+0x55/0xb0 [ 125.672265][ T6115] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 125.678778][ T6115] [ 125.678778][ T6115] -> #2 (tpg_instances_lock){+.+.}-{3:3}: [ 125.686732][ T6115] __mutex_lock+0x135/0xc80 [ 125.691769][ T6115] tcm_alloc_inst+0x65/0x190 [ 125.696888][ T6115] usb_get_function_instance+0xdd/0x2e0 [ 125.703030][ T6115] function_make+0x11c/0x350 [ 125.708198][ T6115] configfs_mkdir+0x515/0x9e0 [ 125.713420][ T6115] vfs_mkdir+0x2a5/0x470 [ 125.718203][ T6115] do_mkdirat+0x1dc/0x450 [ 125.723104][ T6115] __x64_sys_mkdirat+0x89/0xa0 [ 125.728417][ T6115] do_syscall_64+0x55/0xb0 [ 125.733364][ T6115] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 125.739792][ T6115] [ 125.739792][ T6115] -> #1 (func_lock){+.+.}-{3:3}: [ 125.747020][ T6115] __mutex_lock+0x135/0xc80 [ 125.752058][ T6115] usb_get_function_instance+0x2e/0x2e0 [ 125.758131][ T6115] function_make+0x11c/0x350 [ 125.763250][ T6115] configfs_mkdir+0x515/0x9e0 [ 125.768453][ T6115] vfs_mkdir+0x2a5/0x470 [ 125.773218][ T6115] do_mkdirat+0x1dc/0x450 [ 125.778073][ T6115] __x64_sys_mkdirat+0x89/0xa0 [ 125.783360][ T6115] do_syscall_64+0x55/0xb0 [ 125.788320][ T6115] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 125.794921][ T6115] [ 125.794921][ T6115] -> #0 (gadget_subsys.su_mutex){+.+.}-{3:3}: [ 125.803184][ T6115] __lock_acquire+0x37ef/0x7d80 [ 125.808596][ T6115] lock_acquire+0x19e/0x420 [ 125.813800][ T6115] __mutex_lock+0x135/0xc80 [ 125.819023][ T6115] uvcg_streaming_header_allow_link+0x71/0x4a0 [ 125.825715][ T6115] configfs_symlink+0x5a5/0xfe0 [ 125.831112][ T6115] vfs_symlink+0x138/0x2b0 [ 125.836052][ T6115] do_symlinkat+0x1ba/0x400 [ 125.841081][ T6115] __x64_sys_symlink+0x7e/0x90 [ 125.846465][ T6115] do_syscall_64+0x55/0xb0 [ 125.851410][ T6115] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 125.857848][ T6115] [ 125.857848][ T6115] other info that might help us debug this: [ 125.857848][ T6115] [ 125.868082][ T6115] Chain exists of: [ 125.868082][ T6115] gadget_subsys.su_mutex --> tpg_instances_lock --> &sb->s_type->i_mutex_key#20 [ 125.868082][ T6115] [ 125.883066][ T6115] Possible unsafe locking scenario: [ 125.883066][ T6115] [ 125.890517][ T6115] CPU0 CPU1 [ 125.895936][ T6115] ---- ---- [ 125.901326][ T6115] lock(&sb->s_type->i_mutex_key#20); [ 125.906809][ T6115] lock(tpg_instances_lock); [ 125.914019][ T6115] lock(&sb->s_type->i_mutex_key#20); [ 125.922098][ T6115] lock(gadget_subsys.su_mutex); [ 125.927215][ T6115] [ 125.927215][ T6115] *** DEADLOCK *** [ 125.927215][ T6115] [ 125.935357][ T6115] 2 locks held by syz.3.52/6115: [ 125.940301][ T6115] #0: ffff8880187cc418 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 125.949574][ T6115] #1: ffff88805ec54160 (&sb->s_type->i_mutex_key#20){++++}-{3:3}, at: configfs_symlink+0x47a/0xfe0 [ 125.960389][ T6115] [ 125.960389][ T6115] stack backtrace: [ 125.966279][ T6115] CPU: 1 PID: 6115 Comm: syz.3.52 Not tainted syzkaller #0 [ 125.973480][ T6115] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 125.983549][ T6115] Call Trace: [ 125.986842][ T6115] [ 125.989870][ T6115] dump_stack_lvl+0x18c/0x250 [ 125.994569][ T6115] ? load_image+0x420/0x420 [ 125.999081][ T6115] ? show_regs_print_info+0x20/0x20 [ 126.004291][ T6115] ? print_circular_bug+0x12b/0x1a0 [ 126.009500][ T6115] check_noncircular+0x2fc/0x400 [ 126.014449][ T6115] ? print_deadlock_bug+0x5d0/0x5d0 [ 126.019657][ T6115] ? lockdep_lock+0xf5/0x230 [ 126.024262][ T6115] ? _find_first_zero_bit+0xd6/0x100 [ 126.029553][ T6115] __lock_acquire+0x37ef/0x7d80 [ 126.034419][ T6115] ? __lock_acquire+0x357f/0x7d80 [ 126.039452][ T6115] ? verify_lock_unused+0x140/0x140 [ 126.044663][ T6115] lock_acquire+0x19e/0x420 [ 126.049174][ T6115] ? uvcg_streaming_header_allow_link+0x71/0x4a0 [ 126.055520][ T6115] ? __might_sleep+0xe0/0xe0 [ 126.060144][ T6115] ? read_lock_is_recursive+0x20/0x20 [ 126.065617][ T6115] __mutex_lock+0x135/0xc80 [ 126.070125][ T6115] ? uvcg_streaming_header_allow_link+0x71/0x4a0 [ 126.076476][ T6115] ? __might_sleep+0xe0/0xe0 [ 126.081093][ T6115] ? uvcg_streaming_header_allow_link+0x71/0x4a0 [ 126.087430][ T6115] ? read_lock_is_recursive+0x20/0x20 [ 126.092829][ T6115] ? mutex_lock_nested+0x20/0x20 [ 126.097784][ T6115] ? configfs_symlink+0x469/0xfe0 [ 126.102830][ T6115] ? make_vfsuid+0x67/0xb0 [ 126.107258][ T6115] ? generic_permission+0x1ed/0x590 [ 126.112701][ T6115] uvcg_streaming_header_allow_link+0x71/0x4a0 [ 126.118869][ T6115] ? inode_permission+0xf3/0x480 [ 126.123898][ T6115] ? bpf_lsm_inode_permission+0x9/0x10 [ 126.129392][ T6115] ? security_inode_permission+0xb0/0xf0 [ 126.135033][ T6115] configfs_symlink+0x5a5/0xfe0 [ 126.139897][ T6115] ? from_kgid+0x153/0x6a0 [ 126.144324][ T6115] ? generic_permission+0x1ed/0x590 [ 126.149614][ T6115] ? detach_groups+0x370/0x370 [ 126.154386][ T6115] ? inode_permission+0xf3/0x480 [ 126.159325][ T6115] ? bpf_lsm_inode_symlink+0x9/0x10 [ 126.164532][ T6115] ? security_inode_symlink+0xb6/0x100 [ 126.170172][ T6115] vfs_symlink+0x138/0x2b0 [ 126.174638][ T6115] do_symlinkat+0x1ba/0x400 [ 126.179155][ T6115] ? vfs_symlink+0x2b0/0x2b0 [ 126.183758][ T6115] ? getname_flags+0x20a/0x500 [ 126.188527][ T6115] __x64_sys_symlink+0x7e/0x90 [ 126.193303][ T6115] do_syscall_64+0x55/0xb0 [ 126.197738][ T6115] ? clear_bhb_loop+0x40/0x90 [ 126.202428][ T6115] ? clear_bhb_loop+0x40/0x90 [ 126.207115][ T6115] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 126.213028][ T6115] RIP: 0033:0x7fda22f9e159 [ 126.217455][ T6115] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 126.237192][ T6115] RSP: 002b:00007fda23ef4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000058 [ 126.245615][ T6115] RAX: ffffffffffffffda RBX: 00007fda23225fa0 RCX: 00007fda22f9e159 [ 126.253600][ T6115] RDX: 0000000000000000 RSI: 0000200000001100 RDI: 0000200000001000 [ 126.261575][ T6115] RBP: 00007fda2303506b R08: 0000000000000000 R09: 0000000000000000 [ 126.269813][ T6115] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 126.277794][ T6115] R13: 00007fda23226038 R14: 00007fda23225fa0 R15: 00007ffed812c388 [ 126.285801][ T6115] [ 128.276235][ T6133] syz.2.56 (6133): drop_caches: 2 [ 133.114154][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.120555][ T1290] ieee802154 phy1 wpan1: encryption failed: -22