last executing test programs: 1m31.002232817s ago: executing program 2 (id=60): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private1, 0x9}]}, 0x0) syz_mount_image$erofs(&(0x7f0000000180), &(0x7f0000000140)='./file0\x00', 0x1000801, &(0x7f0000000000)=ANY=[@ANYRES16=0x0, @ANYRES32=0x0, @ANYRESDEC], 0x0, 0x1cc, &(0x7f00000006c0)="$eJzsmD/v0kAYx793LeVPjImLg4smkogJlLaocXHAV2AC/tskUglawEAHIHEgLi6+DN+CA5ODm5urDmpi4iCjk8OZa4/25J8yEIm/55Pw9Nu7567PPTTfoSAI4sTy5fOPTy9vXm+WAZxCEVk1/s1Ic7iW/zGnxIdXb/unn81X92N7Pt8E8KZuIFT3QgihzxfVtQme6NvguKz0XTDYSj8Axx2lfTDcV/qxpgd5JQLffjgI2o+6ge/I4MrgyVBbrW8xY2gDkEcXxu/1jybTJ60g8IerIiOWz1mb2lf8oX/mos5xQ+uf/L/uvXg+k/fL3jha/1xwuErXwNBY9gRZ2LadtkQ7/zkz3d/4m/MfgzhT2ZVT3r3857+p2VKNPZYe/oeCaSN5KaRpJSNnF/N366u+HrKwC4c9MpRnr029LxzwXU39U9rLJc2fTJiJf1TD3tPqaDKtdHutjt/x+55Xu+ZccZyrXjUyojju8L9c5E8Fbf/MllyLWRi3wnDojoFw6Cb3Xhw1x228HnyP1vDI/zhKF+M95KtixVa5EaZ+PLpKVTK2Fk8QBEEQBEEQBEEQBEEQBLEX58Gir6BCCKY+iG7CuxVl/woAAP//vphcsA==") mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000180)={0x0, 0x5}, 0x8) 1m30.632452125s ago: executing program 2 (id=63): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r1, 0x0) recvmmsg(r1, &(0x7f00000004c0), 0xf02, 0xf0, 0x0) 1m28.021865858s ago: executing program 2 (id=66): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$xdp(0x2c, 0x3, 0x0) socket$can_raw(0x1d, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) setregid(0xffffffffffffffff, 0x0) getuid() ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r2, 0xc018937b, &(0x7f00000003c0)={{0x1, 0x1, 0x18, r0, {0xee01, 0xee00}}, './file0\x00'}) shmctl$IPC_SET(0xffffffffffffffff, 0x1, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newtaction={0x14, 0x1e, 0x109, 0x70bd26, 0x25dfdc01}, 0x14}, 0x1, 0x2b1e}, 0x8058) 1m26.796939636s ago: executing program 2 (id=71): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) io_uring_enter(0xffffffffffffffff, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x89fb, &(0x7f0000000340)={'bond0\x00', @random="00009e0c1100"}) 1m26.615149584s ago: executing program 2 (id=74): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) timerfd_settime(0xffffffffffffffff, 0x3, 0x0, 0x0) read$msr(r1, &(0x7f0000000780)=""/102400, 0x19000) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) ptrace(0x10, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000440)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) ioctl(r2, 0x40104d04, &(0x7f0000000900)) 1m21.582271492s ago: executing program 2 (id=84): move_pages(0x0, 0x90249c01dd736e4b, &(0x7f0000000000)=[&(0x7f0000ffd000/0x3000)=nil], 0x0, &(0x7f0000000040), 0x0) mlockall(0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) mlock2(&(0x7f0000549000/0x1000)=nil, 0x1000, 0x0) 1m5.382144379s ago: executing program 32 (id=84): move_pages(0x0, 0x90249c01dd736e4b, &(0x7f0000000000)=[&(0x7f0000ffd000/0x3000)=nil], 0x0, &(0x7f0000000040), 0x0) mlockall(0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) mlock2(&(0x7f0000549000/0x1000)=nil, 0x1000, 0x0) 8.747816967s ago: executing program 3 (id=254): r0 = socket$netlink(0x10, 0x3, 0x10) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="340000001a00010028bd70000000000002"], 0x34}, 0x1, 0x0, 0x0, 0x10da68d0c1344d55}, 0xea5bc50b419997fe) 8.602443014s ago: executing program 3 (id=256): syz_io_uring_setup(0x82e, 0x0, &(0x7f0000000100), &(0x7f0000000080), &(0x7f0000000000)) pipe(0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000ac0), r0) sendmsg$NLBL_CALIPSO_C_REMOVE(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40005}, 0x8000) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{0x0}, {0x0}], 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/nullb/nullb1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1/zoned\x00', 0x1, 0x0) write(r2, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1/memory_backed\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='1', 0x1) 8.375496074s ago: executing program 3 (id=260): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000001c0)={0x0, 0x0}) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000140)={0x1, 0x0, [{0x40000001, 0x7fff, 0x4, 0x31237648, 0x6, 0x2, 0x80}]}) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID(r3, 0x4068aea3, &(0x7f00000000c0)={0xc7, 0x0, 0x1}) syz_kvm_setup_syzos_vm$x86(r4, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$x86(r2, &(0x7f0000000080)={0x0, &(0x7f0000000040)=[@wrmsr={0x65, 0x20, {0x400000b5, 0x3f}}], 0x20}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 7.566893753s ago: executing program 1 (id=262): r0 = openat$loop_ctrl(0xffffff9c, &(0x7f0000000100), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) syz_open_dev$loop(0x0, 0x6b, 0x901) setitimer(0x3, &(0x7f0000000040)={{}, {0x0, 0xea60}}, &(0x7f0000000380)) r2 = socket$inet6(0xa, 0x802, 0x0) r3 = socket$vsock_stream(0x28, 0x1, 0x0) r4 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r4, 0x0, 0x0) writev(r4, &(0x7f0000000080)=[{&(0x7f0000000480)="2399", 0x2}], 0x1) r5 = accept4$unix(r3, 0x0, 0x0, 0x0) recvmmsg(r5, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000003380)}}], 0x1, 0x2, 0x0) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x3}, 0x31) sendmmsg$inet6(r2, &(0x7f0000002940), 0x40000000000017d, 0x888) timer_create(0x3, 0x0, &(0x7f0000044000)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r0, 0x4c80, &(0x7f0000000600)={0x0, 0x0, "05d3000028000000000083eb29e46b4bfb57461914278705b6a55ba904cefb1f00536dfdc9ce9c12d1207f8a35d1dad7ed0fc16b2ccd00000000000000080000000c0996d78e489e96651d35ca509de7cf52e7578e9ce37700000000000032936e283ae72a84cc5a72f07fef2fec1463729b336e892b5aadc70f51cb7e5925747f779254377a6a42493fb7026e77fb899a2072631f76cd0a59b17031b431163758724ac0df2d95b9c3fbccef0111f1fc6db466c73268e04c38df1f6bf2cc88aa6126229c332b887eb8e67112000631988ad55f281047000000000000000003000000000100", "2fc7eecad58f368bf3ba45a6f7874bf0f0a2e2d039d23b33645c7a714b200d1ec427e16f2d87c3a7f0a258b1856e10dbfadd1f9f5b294c68af413bb746e6b0803177028065618aa080c2ca8efe18fbb6c85459e9ff5c1aa9c17498a05220b09c2d859832bf5ae846009f6a415023b9a7110bda56f514841bf04e54bf592d28107037e86729ff5789dd40d9180160cf72a92609650dc97d806d75465c3cbabb3e8f59afcd807086dc9a87048f229a1c8b183c2077b18922f8dcade6cbf835b715887e9a20c69f14468fb321e017c8a2361f5300617d2ff15e5e2df6b8fa425461dc9c997020beed571b01b0ae899a7a21fe7f9dce8b2ff0374cde255fe2cd3444fa236242d0a976de3ceed2abb0bcb9e4580db4bf248fa20f27dc7c9a953b420f032e6fe0de2a657b7903f0a3d4d67908255b1ac3274313a683ad8a328816336d20dbfdc9f262073dade576891220dd05e0cb6e97bb433637adb6f42c3a040a0089d9a86b42dffeba614460c184bd405cf3749fad5a47609eeb5c48f0222ea459597a0fa855c9d6d789ed17235c6cbf62757d54c99a03b777b7af6058a33b32aa49973625747e0ff1d3c4898a1ea7e68807d9be2b9ca09de22790441964131b1e6dbf633f06c23ddb02736a741396cb1c3dbe49eabdad6f662ee642be86560e24bf2578bc93119d19b446587a8455b445e1cbcb86848331888a8a8adb0836628a73c9c41f8501ae67caa0165fca251674fcfd5f78415a4497519f0d4a79ba166a55721c4db05be7155ae7bca92f4fff5cdcf2d581d2da972ee240355984210e5927904ee74bd15da96d23e0b5bb07ce1adf2683032e8ae4dd9dd6f5bd841ef30ccdce954426f1cf29f2f35decb485f4faa36caae23e7d136317dbb6ace192dc0484d5e3cc341dee5041430dcd5f320a9f3679196bd2a2348619c4a55e090cecf0da78fdba2b25a3373a813d5e719ef2fbfea38035828e28d1666b64dbabce44140e9f0c7e8685e69d8192d1953c1dba2c2a471658538ade2e295732c4a23ca63b54252673ea15374da608ff431e56c9b74bc88b858511910a8ff6a294354093449e90994cf70a60cb108e19ad7625c27bc7934076a8a8fa8a14b06b0e94813a9ff3961e251856a0d34b728025121cf045be55d3997ca1ba4643509fb7eb84b1dbf97663f63fbf32b32f92eebff4ff420cd8c45fda163c09aa879283c282ef4bc93d416854ada56921cc6f82a67a3d024c1a828eb8d4c901f6066f8df327f694f828124d880da4f98c66087f8a825b9b01609f980a0f48c471fdcb7696e493a02a7b34420ccddae0e26b8f4db77ee712ccbc480fb8fe625d51ee2ead77637b9f7bd4a70fc21581498915c72ce999eb2a3888ad4c66c5e623d2f9c983f4c3e17714a63af06c222a62671b407a8f30619f1cb8a9efc177a18ceefc0760a27f5001124e81eeff04950364cf1881c03c1cc99b1e5dbc36ec94ed875c54a87dc18143303b2ad34738e683fdfe7e257fa5609e785e3c81dcd387bccfba8d31077b2140b06a361167ab1abb6e8c9b6e7b8918c992a7c4fce8797048bc3eba6ef7f65789b6d59ce4e4dcc5a3d44b9ef24de8996347c79cbaaaaef13dbac1dab9fb6090a757be36cf3e15bcde5bddc318bd42265371ebfe941f63a5d2dbcd9c6103ab91b5c292ae86e4dc6df13194dd81319db2ad7f51fe377196b2b87db9614cd1d572f3df9b518d36aacd8c4f454c1a61fd587642e87e8a4d4029e46064cc730e7b75efae0e6b798184b33365160696e327ce80ad8ec0a5c20e57b07b2cc19f849b1c527994b6631ae61bd9c6703966d141714bffb6cfb7708e2c6669cf33f42c8e8130d73a2bdb42bbd3316e1a2deae59b7bbe6e77518326d11714ac543143c8bc4c9cf39d84b06bf10ad463d7b9d14f5d44d98c78f5bc96793c254a652e300065a0e568234110f4f3d93b584b5767e41cb9d2514a16138d8dd650b885b6ac87ce233957dee5c1d2004fc5882d41ffcc1751d565ad92d04ce0cf0221ac7d7a0441f4024ce74ff4d3df9559026ebb5b5602ee9e8d87f189b8f6e61879c417a00321e87ceac1b952e51700d384ed3b07c70fd8be0d61290b6100abc393bfd33f425892509e55350797f139b64b68e357f66a1776504ea67689ca482534308c9c7b76c7f9fbe1d1cc739dee391c0b7a781d6bade90ec2a46f617d436cc7f51eb1c94de092ccf1d7b57c31fc1c8e18b9bab9858792a129dfa62b379d22aec6129065a867bda550337e30edcfc0732a5b69559c8d45270d7df9d06b385c51a05e57280d66f5c02c7ca1f463e6ef6d1d2e3b04c6df77fd88e06197acf4d5287660e90d7b1d5d4b7410d44e36aa3652e86d9b97935fc19459bd1e7f155e497bee58013f9cbef97b669b3d8fbd77a286a50b86aa11e4376e44275297bcdcb252ad8ca4742a6cd66563c4ba6318b765899d853043877b6400d654ba955fa6376857b6307d443168211dde06a156d8908269ab033c9de9546b3cc41583e7cae7038720d909fed58b52f7bc7aba12b1be3a2e23474af919426326556cf37d584c4e905f8d84604fdb192f0993b213107fae21c323d69f3113d2f5d6371a49a40b98030868c824ff0916556044bc32ce80497c46c01e254e2accfd01aeabf18c545b907cd5fd0b00a82c42e644690ad1099dc3ec5e0df8c5d783ec93e6712857137eee4d06762fa12233d1ba4e7bc597d970a434ce615ffe432f6289bd297f7973f29e8460391c44cab29f2e21f639e7aea6c0c7e57a35585573b88ce6a2beed7807278b73a9eb21d82a477f7f9eef24c1cf0b7fddee8b3dfa633cb37c3f1ac53f34acd6dc0e29494d644f9bdce8d65e734fa52d1cdd0f147d48f02000b31fd0dcd2766cf8ea8b92bd340195c6833e4320eaf125ad61fa8772ac380f363fd2b3b5df23aa0e08034cfe5963fada592e851f5b274e6defae6cb1dbc5f29c52855352d8417262780ba7c8040cac21a0fda09a76af7a58b66f9a89d35f7a957548cf49f7117542a2f0f2c1c8bb371eba256aaac009798a97a27a62256fafad3988bb9b577eb00c06d28a91c85aa20f176e44e52b37a8068bfec1434c1277e68619e8459f83359976c81ca49462e1b9abf83fed9d4e08d9fdc6626bd73099ff8c2e95384e0517eff3e02a1882ef5a804989ad5a9536628f3989631f610ba9172c92c44c372ff48d590be9896e741001b3ea511727a1476d706debdea7216e1bf2461fda61a7bc6db99c098fe4f32eafbe2ac15782ddfd1609cec300015b542c835ff195cd779699d8ced1edd571f3734ef6373c526553ee9684674cd5ae1e8f390065ed761257cbb120168dcebacc94f22a15d6bc8444afff61601305c9212f086ae5a322968983568bfaed808fd935a8260709781a58bf3cbc3256e81d272a9c1271b93a1f97feebe77e94912e0361c149076abd1aa186ac38e65d879e92bc58bc7adde9339f712b8a07d798ad573318559a31c1e64354bfc5f3e9a195118cab384d9b7d192305e5fe6e8eaebd7403095e3833fb3a6425e7b8b7ae0515d5cba8a19c2b49e33cd9bedbac96f01c5a24ddc36b35f16cfd55ec584f18ecf7313a812d5d44b6ac02808ab4389e7ed6426454d9f4c69a288d36a211f27c4770cad16daba3c97e0d51a7012ba7ee4881daf21ca720c0a14d54852516c8342989ed328d13366be829416218e0d2cc9c708a06669873b4a7a32e35dbc59d5f7eeebb7fb3c307e84c287c2e3a921e94149a90a56e4c8bcf954844eb7edefea72690c518075cdce72c222961c388ba8cb9e2f881582131cce0898c86ab2f7c1a925301eb6a33bf33baf957f18d648b55e0c613db371343cc7ce89f91423629e644b286bba4d8b4cbb116e30da5f7a4bba8606093fe5d6bad8bc5f98fb1ac476bf8724a8008a725ed3aed86c763f2eac7d77f1ef9a96702e13ec5080bb82606741e08fde37aceb1dd32c11afa92be85ff46ec2010ce17d5cf92e91243ccb1070000002a746ca1f1135b1b0638ffe19c8b31644a08f9f1990685e0f458f096daae910e9f36a83a8ba01dde2b5d0d3097b1cf03be7aee0a8c7c4c8672d45c6310e7d2e5558143ad9e79a9751b8ac54a3e86fdfd9320ef69c7130460e259462be21db94fcbd3181903130f3f982f4c8011bfe62bd5903ad8713281be0fa8de38553ea6c3e566152518bd80fbeb5863f0de7c7cf26606b48b63c89d9f9c798816e7e1e1dbb3946a1048ebf383f117ac9bf565a277086fd9cc0250dd22cf1d2c3cf58fa227f4f2c201be2df79230b6a95333f3a3ded0d11f9b647da9b4cb70fa02631552df57b7a6009b1b36d8f7c9f2fc7ac53912f29e79fdb57acecd431adf2dca1c0e7d31d7ff38ce7b3089416d9ab4f7474f1b68141228d4350ad7541676caf115e6c4eeecc706e0268c2eda740cce7a22e1090fb0216608a13c50316ee056414d0dfce99ab3f9c4619df20d7e0c254c3e9a9717f140b1a4ecdba1ca5ce3bb252083a69bb107338184f55d064c912745aa81588de2299fb9f77201c5ded7cbf572b64c0d6d300344226355d1a4cb8088e43780e01e190e9b877ba14431d115296e31c2cc0266c0df82da2530ac1e094cdfee42fcfdb8ee5d03c251d24d5b0fefafa7b9c2a2e73a814e768d57a5429372dce6266dc547a4c93a05dece1e7601a658d4855843db66ba8ecae9cd1703d66a3aff1be2be77c0ce96772d570c73f88d028eb8716dcb5e49792b39f1a5a4275a4f83d8ae2ea8883bbfaa42050392da86d7a4a22835553cd2fdcd0cca630ad003c4a15ae0b7a7cee875b5a08f0ef70d86187054260001c9698419bf1569b1802439cd3fe320d9272b853e7b34a322a5fbade5cd3ad0e1c4b07d111981494215d3b82c2fe8a7697052a3b7b1ef3fb22d5e33e57c8d422b5e3dc9cf1a5df5401559c56610f44a4e409b12aa82bf661c17a2bb76e469583531f782b55da4eabbb68cb39bf32844398fe0ffb79e4c95e3e3c3ed3e9ac304cf1980b7cde8fcf76966cca196748e4ad7a02debd6ccc4a3e9b8adaa7dc668a76cbd137b2e6fbc673900000100000000009bf5ed16d5f5818535802fa7627a7d352f4216ba3f84481394c0500b7aea67e838d5dd0422eeb940ad42546e1f3c2cd85c53abbaada51b5571323d7ea53d436c2d349befca87909c1dc2a23d2db53ecc272b80896b65fa0cad8854e6b36e052ecbe677024b9614a180fc54c20fac7ed4d16e7ba17a368f0a00a036d23ae4b19ad3d99642ff054850233b60e706a4f575e49234acc76211a5bace9b8417eb6d986dab4bc6b8b510ee0477f6b8738f00709b7f35aac1730017c0037e5c40404d145b527a29500fab1e3c00"}) r6 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r6) 5.764645808s ago: executing program 3 (id=266): r0 = syz_open_dev$video4linux(&(0x7f0000000040), 0x8e3, 0x88800) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r0, 0xc040564a, &(0x7f0000000200)={0x0, 0x0, 0x3008, 0x4, 0x0, 0x7b0, 0x3}) listen(0xffffffffffffffff, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) listen(r4, 0xda8d) accept$inet(r4, 0x0, 0x0) r5 = add_key$keyring(0x0, &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) r6 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000140)={'syz', 0x2}, &(0x7f0000000180)={0x2, 0x0, @d}, 0x18, r5) keyctl$chown(0x4, r6, 0x0, 0x0) 5.70797235s ago: executing program 0 (id=268): syz_io_uring_setup(0x82e, 0x0, &(0x7f0000000100), &(0x7f0000000080), &(0x7f0000000000)) pipe(0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000ac0), r0) sendmsg$NLBL_CALIPSO_C_REMOVE(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40005}, 0x8000) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)}, {0x0}], 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/nullb/nullb1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1/zoned\x00', 0x1, 0x0) write(r2, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1/memory_backed\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='1', 0x1) 5.671849752s ago: executing program 1 (id=269): r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, 0x0, 0x0) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) 4.616683902s ago: executing program 3 (id=270): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) pipe2(&(0x7f00000000c0)={0xffffffffffffffff}, 0xdecb0e7b592b9954) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000280)={r1, 0x58, &(0x7f0000000200)}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) socket$vsock_stream(0x28, 0x1, 0x0) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000080)}], 0x1) shutdown(0xffffffffffffffff, 0x1) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x8, 0x94, 0x7fff0000}]}) close_range(r4, 0xffffffffffffffff, 0x0) 4.606223832s ago: executing program 0 (id=271): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001640), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000001680)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL(r0, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000001700)={&(0x7f0000000780)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010027bd7000fedbdf25380000000800", @ANYRES32=r2], 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x14058854) 4.595910283s ago: executing program 1 (id=272): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) prctl$PR_MCE_KILL(0x35, 0x0, 0x10) 3.425816718s ago: executing program 3 (id=274): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/target/core/rd_mcp_0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='rd_pages=64\n', 0xc) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='1\n', 0x2) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/usb_gadget/naa.6001405c935d7912\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/nexus\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='naa.6001405c935d7912\n', 0x16) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/lun/lun_0\x00', 0x1ff) symlinkat(&(0x7f0000000480)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/lun/lun_0/virtual_scsi_port\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/enable\x00', 0x1, 0x0) write(r3, &(0x7f0000000540)='1\n', 0x2) close(r3) mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/configs/c.1/tcm.usb0\x00') write(0xffffffffffffffff, &(0x7f0000000680)='dummy_udc.0\n', 0xc) close(0xffffffffffffffff) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000740)={0x53, 0xffffffffffffffff, 0x10, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000780)="8f000000000000000000000000010000", 0x0, 0x3e8, 0x0, 0x0, 0x0}) r4 = syz_open_dev$sg(&(0x7f0000000700), 0x0, 0x2) ioctl$SG_IO(r4, 0x2285, &(0x7f0000000740)={0x53, 0xffffffffffffffff, 0xd, 0x0, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000780)="8f00"/13, 0x0, 0x3e8, 0x0, 0x0, 0x0}) 3.120393013s ago: executing program 0 (id=276): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0xc}) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) 2.917292792s ago: executing program 0 (id=278): r0 = syz_open_dev$video4linux(&(0x7f0000000040), 0x8e3, 0x88800) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r0, 0xc040564a, &(0x7f0000000200)={0x0, 0x0, 0x3008, 0x4, 0x0, 0x7b0, 0x3}) listen(0xffffffffffffffff, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet_sctp(0x2, 0x1, 0x84) listen(r4, 0xda8d) accept$inet(r4, 0x0, 0x0) r5 = add_key$keyring(0x0, &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) r6 = add_key$fscrypt_provisioning(&(0x7f00000000c0), &(0x7f0000000140)={'syz', 0x2}, &(0x7f0000000180)={0x2, 0x0, @d}, 0x18, r5) keyctl$chown(0x4, r6, 0x0, 0x0) 2.75569782s ago: executing program 4 (id=279): syz_io_uring_setup(0x82e, 0x0, &(0x7f0000000100), &(0x7f0000000080), &(0x7f0000000000)) pipe(0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000ac0), r0) sendmsg$NLBL_CALIPSO_C_REMOVE(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40005}, 0x8000) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)}, {0x0}], 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/nullb/nullb1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1/zoned\x00', 0x1, 0x0) write(r2, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1/memory_backed\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='1', 0x1) 2.618393677s ago: executing program 4 (id=280): r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000100)={0x1, 0x1}, 0x2) write$USERIO_CMD_REGISTER(r0, &(0x7f0000000200), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, 0x0, 0x0) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000140), 0x2) 1.848759843s ago: executing program 1 (id=281): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) listen(r0, 0x8) connect$inet(r1, &(0x7f0000000010)={0x2, 0x4e20, @loopback}, 0x10) r2 = accept$inet(r0, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xf, 0x4, 0x4, 0x1, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x10, 0x6, &(0x7f0000000300)=@raw=[@map_fd={0x18, 0x2, 0x1, 0x0, r3}, @generic={0xb7, 0x3}, @generic={0xb7, 0x4}, @generic={0x85, 0x0, 0x0, 0x0, 0x3c}, @generic={0x95}], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg=0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000500)={@map=r3, r4, 0x7, 0x0, 0x0, @void, @value=0x0}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000600)={r3, &(0x7f0000000640), &(0x7f0000000680)=@tcp=r2}, 0x20) sendto(r2, 0x0, 0x0, 0x20000011, 0x0, 0x0) 1.800035645s ago: executing program 0 (id=282): socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) pipe2(&(0x7f00000000c0)={0xffffffffffffffff}, 0xdecb0e7b592b9954) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000280)={r1, 0x58, &(0x7f0000000200)}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) socket$vsock_stream(0x28, 0x1, 0x0) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000080)}], 0x1) shutdown(0xffffffffffffffff, 0x1) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x8, 0x94, 0x7fff0000}]}) close_range(r4, 0xffffffffffffffff, 0x0) 622.995811ms ago: executing program 0 (id=283): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000000)="d8000000210081044e81f782db44b90402000000e8fe55a1180015000600142603600e1209000a", 0x27}], 0x1}, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0xfe33) 622.714751ms ago: executing program 4 (id=284): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ff1000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ff3000/0x1000)=nil, &(0x7f0000ff1000/0x1000)=nil, 0x0}, 0x68) io_uring_setup(0x1c6c, &(0x7f0000000040)={0x0, 0xaebb, 0xd000, 0x20000a, 0x20002f7}) mq_open(&(0x7f00005a1ffb)='eth0\x00', 0x42, 0x0, 0x0) mlock2(&(0x7f0000549000/0x1000)=nil, 0x1000, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) 456.918949ms ago: executing program 4 (id=285): sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(0xffffffffffffffff, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000000)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="010000000000000000001d0000220c000600010000000100000018002f7d080001"], 0x38}}, 0x0) r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c000000190001000000000000000000021800000000fd000000ed0008"], 0x2c}}, 0x0) sendto$inet6(r0, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) 345.706404ms ago: executing program 1 (id=286): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000800)=ANY=[@ANYBLOB="a400000010000304000300"/20, @ANYRES32=0x0, @ANYBLOB="0000000040000000740012800b000100697036746e6c00006400028005000400a000000006000f000100000014000200fe8800000000000000000000000000011400030003"], 0xa4}}, 0x400c044) 207.333601ms ago: executing program 4 (id=287): msgrcv(0x0, 0x0, 0x0, 0xd3ee73c716b4091b, 0x2000) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000001240)={{0x2, 0x0, 0xee00, 0x0, 0x0, 0x40}, 0x0, 0x0, 0xce1b, 0x7f, 0x7, 0xe55, 0x7fff, 0x101, 0x1, 0x1}) 279.291µs ago: executing program 4 (id=288): syz_io_uring_setup(0x82e, 0x0, &(0x7f0000000100), &(0x7f0000000080), &(0x7f0000000000)) pipe(0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000ac0), r0) sendmsg$NLBL_CALIPSO_C_REMOVE(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40005}, 0x8000) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)}, {0x0}], 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/nullb/nullb1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1/zoned\x00', 0x1, 0x0) write(r2, 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1/memory_backed\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='1', 0x1) 0s ago: executing program 1 (id=289): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[@ANYBLOB="4c00000010001fff000000000100000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800e00010069703665727370616e000000100002800400120006001800177b000008000a00", @ANYRES32], 0x4c}, 0x1, 0x0, 0x0, 0x40001}, 0x4000) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.16' (ED25519) to the list of known hosts. [ 75.583185][ T5764] cgroup: Unknown subsys name 'net' [ 75.721801][ T5764] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 77.369693][ T5764] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 79.882302][ T5795] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 79.891260][ T5795] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 79.899610][ T5795] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 79.907952][ T5795] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 79.912010][ T5791] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 79.916858][ T5795] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 79.929781][ T5795] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 79.949054][ T5792] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 79.960208][ T5793] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 79.969641][ T5793] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 79.977499][ T5792] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 79.985888][ T5791] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 79.993299][ T5792] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 80.001493][ T5791] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 80.009148][ T5792] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 80.016362][ T5793] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 80.017861][ T5791] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 80.027772][ T5793] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 80.032790][ T5791] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 80.040654][ T5793] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 80.046895][ T5792] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 80.054972][ T5793] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 80.062565][ T5792] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 80.077531][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 80.501028][ T5780] chnl_net:caif_netlink_parms(): no params data found [ 80.679080][ T5781] chnl_net:caif_netlink_parms(): no params data found [ 80.691278][ T5780] bridge0: port 1(bridge_slave_0) entered blocking state [ 80.699388][ T5780] bridge0: port 1(bridge_slave_0) entered disabled state [ 80.706774][ T5780] bridge_slave_0: entered allmulticast mode [ 80.714335][ T5780] bridge_slave_0: entered promiscuous mode [ 80.727357][ T5782] chnl_net:caif_netlink_parms(): no params data found [ 80.745961][ T5780] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.753196][ T5780] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.760518][ T5780] bridge_slave_1: entered allmulticast mode [ 80.768120][ T5780] bridge_slave_1: entered promiscuous mode [ 80.818123][ T5779] chnl_net:caif_netlink_parms(): no params data found [ 80.832645][ T5780] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.875202][ T5780] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.985330][ T5780] team0: Port device team_slave_0 added [ 81.005242][ T5781] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.012464][ T5781] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.019781][ T5781] bridge_slave_0: entered allmulticast mode [ 81.027201][ T5781] bridge_slave_0: entered promiscuous mode [ 81.036245][ T5781] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.043422][ T5781] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.050972][ T5781] bridge_slave_1: entered allmulticast mode [ 81.058477][ T5781] bridge_slave_1: entered promiscuous mode [ 81.067444][ T5780] team0: Port device team_slave_1 added [ 81.160382][ T5782] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.170827][ T5782] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.178329][ T5782] bridge_slave_0: entered allmulticast mode [ 81.186090][ T5782] bridge_slave_0: entered promiscuous mode [ 81.205860][ T5781] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.218853][ T5780] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.225965][ T5780] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.252082][ T5780] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.264812][ T5782] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.272001][ T5782] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.279747][ T5782] bridge_slave_1: entered allmulticast mode [ 81.286991][ T5782] bridge_slave_1: entered promiscuous mode [ 81.293842][ T5779] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.301254][ T5779] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.311957][ T5779] bridge_slave_0: entered allmulticast mode [ 81.319131][ T5779] bridge_slave_0: entered promiscuous mode [ 81.330753][ T5781] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.340610][ T5780] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.348073][ T5780] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.374477][ T5780] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.416388][ T5779] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.423636][ T5779] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.431129][ T5779] bridge_slave_1: entered allmulticast mode [ 81.438838][ T5779] bridge_slave_1: entered promiscuous mode [ 81.470047][ T5782] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.532999][ T5782] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.545794][ T5779] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.557877][ T5779] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.569871][ T5781] team0: Port device team_slave_0 added [ 81.582782][ T5780] hsr_slave_0: entered promiscuous mode [ 81.590448][ T5780] hsr_slave_1: entered promiscuous mode [ 81.610533][ T5781] team0: Port device team_slave_1 added [ 81.686229][ T5779] team0: Port device team_slave_0 added [ 81.696141][ T5782] team0: Port device team_slave_0 added [ 81.702769][ T5781] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.710161][ T5781] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.736553][ T5781] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.756305][ T5779] team0: Port device team_slave_1 added [ 81.764331][ T5782] team0: Port device team_slave_1 added [ 81.771515][ T5781] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.778712][ T5781] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.805063][ T5781] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 81.872543][ T5782] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.879765][ T5782] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.906100][ T5782] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.929933][ T5779] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.937225][ T5779] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 81.952105][ T51] Bluetooth: hci1: command tx timeout [ 81.970590][ T5779] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 81.989539][ T5779] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 81.996800][ T5779] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.022909][ T5779] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.036578][ T5782] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.043584][ T5782] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.070268][ T5782] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.104020][ T51] Bluetooth: hci0: command tx timeout [ 82.104616][ T5091] Bluetooth: hci2: command tx timeout [ 82.115935][ T5786] Bluetooth: hci3: command tx timeout [ 82.225992][ T5781] hsr_slave_0: entered promiscuous mode [ 82.235532][ T5781] hsr_slave_1: entered promiscuous mode [ 82.242039][ T5781] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 82.249982][ T5781] Cannot create hsr debugfs directory [ 82.277612][ T5782] hsr_slave_0: entered promiscuous mode [ 82.286946][ T5782] hsr_slave_1: entered promiscuous mode [ 82.293106][ T5782] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 82.300760][ T5782] Cannot create hsr debugfs directory [ 82.338708][ T5779] hsr_slave_0: entered promiscuous mode [ 82.349894][ T5779] hsr_slave_1: entered promiscuous mode [ 82.356956][ T5779] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 82.367830][ T5779] Cannot create hsr debugfs directory [ 82.604603][ T5780] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 82.670384][ T5780] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 82.681808][ T5780] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 82.720283][ T5780] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 82.818574][ T5782] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 82.836621][ T5782] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 82.847859][ T5782] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 82.859288][ T5782] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 82.965436][ T5781] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 82.977775][ T5781] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 83.004361][ T5781] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 83.046638][ T5781] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 83.110562][ T5780] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.125277][ T5779] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 83.148310][ T5779] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 83.161333][ T5779] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 83.194844][ T5779] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 83.227943][ T5780] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.259314][ T3491] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.266938][ T3491] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.294670][ T5782] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.325471][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.332674][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.349064][ T5782] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.396630][ T2997] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.404163][ T2997] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.453108][ T2956] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.460480][ T2956] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.479990][ T5781] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.525750][ T5781] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.550095][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.557362][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.589398][ T2956] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.596631][ T2956] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.681752][ T5779] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.711021][ T5782] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 83.767933][ T5779] 8021q: adding VLAN 0 to HW filter on device team0 [ 83.812815][ T2956] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.820127][ T2956] bridge0: port 1(bridge_slave_0) entered forwarding state [ 83.877371][ T2956] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.884707][ T2956] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.025093][ T5091] Bluetooth: hci1: command tx timeout [ 84.169407][ T5780] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.185078][ T5091] Bluetooth: hci2: command tx timeout [ 84.190578][ T5091] Bluetooth: hci3: command tx timeout [ 84.202202][ T5091] Bluetooth: hci0: command tx timeout [ 84.369128][ T5782] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.379360][ T5780] veth0_vlan: entered promiscuous mode [ 84.418409][ T5780] veth1_vlan: entered promiscuous mode [ 84.436524][ T5781] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.481001][ T5780] veth0_macvtap: entered promiscuous mode [ 84.515801][ T5780] veth1_macvtap: entered promiscuous mode [ 84.532822][ T5779] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 84.590255][ T5780] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 84.626587][ T5782] veth0_vlan: entered promiscuous mode [ 84.637989][ T5780] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 84.652910][ T5781] veth0_vlan: entered promiscuous mode [ 84.670597][ T5780] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.681692][ T5780] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.692705][ T5780] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.701793][ T5780] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.722236][ T5781] veth1_vlan: entered promiscuous mode [ 84.753516][ T5782] veth1_vlan: entered promiscuous mode [ 84.841366][ T5779] veth0_vlan: entered promiscuous mode [ 84.887067][ T5781] veth0_macvtap: entered promiscuous mode [ 84.917883][ T5781] veth1_macvtap: entered promiscuous mode [ 84.936482][ T70] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.965816][ T70] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.973798][ T5779] veth1_vlan: entered promiscuous mode [ 84.998930][ T5782] veth0_macvtap: entered promiscuous mode [ 85.024947][ T5782] veth1_macvtap: entered promiscuous mode [ 85.036348][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.048663][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.061122][ T5781] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.105286][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.117997][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.130750][ T5781] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.148577][ T70] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.160625][ T5779] veth0_macvtap: entered promiscuous mode [ 85.166581][ T70] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.185637][ T5782] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.198037][ T5782] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.208350][ T5782] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.220335][ T5782] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.235717][ T5782] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.252035][ T5781] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.263795][ T5781] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.272604][ T5781] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.281838][ T5781] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.310008][ T5779] veth1_macvtap: entered promiscuous mode [ 85.329598][ T5782] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.341848][ T5782] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.356034][ T5782] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 85.366986][ T5782] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.386843][ T5782] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.433860][ T5782] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.450202][ T5782] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.459876][ T5782] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.474176][ T5782] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.573331][ T5779] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.592720][ T5779] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.620499][ T5779] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.659048][ T5779] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.688065][ T5779] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 85.737423][ T5779] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 85.804880][ T5779] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 86.114567][ T5779] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 86.144471][ T51] Bluetooth: hci1: command tx timeout [ 86.154525][ T5779] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.177464][ T5779] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 86.220981][ T5779] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.250985][ T5779] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 86.301262][ T5779] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.325936][ T51] Bluetooth: hci0: command tx timeout [ 86.331572][ T51] Bluetooth: hci3: command tx timeout [ 86.339554][ T51] Bluetooth: hci2: command tx timeout [ 86.387435][ T5779] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 86.625097][ T2975] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.676923][ T2975] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.928980][ T5779] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.960232][ T5779] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.988654][ T5779] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.013667][ T5779] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.475056][ T70] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.496891][ T70] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.644852][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.652755][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.763580][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.808839][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.942271][ T70] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.952657][ T5853] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1'. [ 87.977214][ T5853] : renamed from virt_wifi0 [ 88.001037][ T70] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.112379][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.156557][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.184410][ T5091] Bluetooth: hci1: command tx timeout [ 88.380942][ T5857] syz.0.6[5857]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 88.435148][ T5091] Bluetooth: hci2: command tx timeout [ 88.440721][ T51] Bluetooth: hci3: command tx timeout [ 88.446312][ T51] Bluetooth: hci0: command tx timeout [ 88.721450][ T5857] loop0: detected capacity change from 0 to 32768 [ 88.797009][ T5857] XFS (loop0): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 88.826246][ T5863] syz.2.3 uses obsolete (PF_INET,SOCK_PACKET) [ 89.096867][ T5857] XFS (loop0): Ending clean mount [ 89.116244][ T5857] XFS (loop0): Quotacheck needed: Please wait. [ 89.870395][ T5857] XFS (loop0): Quotacheck: Done. [ 90.673354][ T5884] netlink: 'syz.2.10': attribute type 10 has an invalid length. [ 90.681414][ T5781] XFS (loop0): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 90.731525][ T5884] netlink: 2 bytes leftover after parsing attributes in process `syz.2.10'. [ 90.756669][ T5884] bond0: entered promiscuous mode [ 90.762220][ T5884] bond_slave_0: entered promiscuous mode [ 90.791655][ T5884] bond_slave_1: entered promiscuous mode [ 90.802139][ T5884] bridge0: port 3(bond0) entered blocking state [ 90.814057][ T5884] bridge0: port 3(bond0) entered disabled state [ 90.826843][ T5884] bond0: entered allmulticast mode [ 90.832199][ T5884] bond_slave_0: entered allmulticast mode [ 90.839068][ T5884] bond_slave_1: entered allmulticast mode [ 90.861582][ T5884] bridge0: port 3(bond0) entered blocking state [ 90.868328][ T5884] bridge0: port 3(bond0) entered forwarding state [ 92.701362][ T9] cfg80211: failed to load regulatory.db [ 93.315493][ T5900] MTRR 1 not used [ 96.653581][ T5925] misc userio: The device must be registered before sending interrupts [ 96.662923][ T5925] misc userio: The device must be registered before sending interrupts [ 98.043974][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 104.398211][ T5995] misc userio: The device must be registered before sending interrupts [ 104.407159][ T5995] misc userio: The device must be registered before sending interrupts [ 105.654852][ T6019] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 107.104199][ T6044] sctp: failed to load transform for md5: -2 [ 107.852212][ T6071] loop2: detected capacity change from 0 to 16 [ 107.903687][ T6071] erofs: (device loop2): mounted with root inode @ nid 36. [ 113.403918][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 113.957274][ T6115] MTRR 1 not used [ 116.533904][ C0] sched: RT throttling activated [ 118.523937][ T0] NOHZ tick-stop error: local softirq work is pending, handler #1c0!!! [ 118.934161][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 123.426582][ T6183] MTRR 1 not used [ 126.203909][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 128.403256][ T9] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 128.725915][ T9] usb 2-1: too many configurations: 9, using maximum allowed: 8 [ 128.776452][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 128.814752][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 128.878678][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 128.927336][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 128.955243][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 129.011621][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 129.065071][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 129.103926][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 129.112897][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 129.140324][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 129.151795][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 129.167664][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 129.193266][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 129.218540][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 129.254045][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 129.285499][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 129.296333][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 129.324506][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 129.350089][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 129.364822][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 129.373267][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 129.390298][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 129.411684][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 129.432258][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 129.456456][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 129.491543][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 129.528375][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 129.544844][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 129.564652][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 129.574183][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 129.607283][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 129.643962][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 129.665232][ T9] usb 2-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 129.681866][ T9] usb 2-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 129.713934][ T9] usb 2-1: Product: syz [ 129.718180][ T9] usb 2-1: Manufacturer: syz [ 129.722874][ T9] usb 2-1: SerialNumber: syz [ 129.749099][ T9] usb 2-1: config 0 descriptor?? [ 129.769126][ T9] yurex 2-1:0.0: Could not submitting URB [ 129.814419][ T9] yurex: probe of 2-1:0.0 failed with error -5 [ 130.076002][ T6214] MTRR 1 not used [ 130.140196][ T5824] usb 2-1: USB disconnect, device number 2 [ 133.248272][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.255681][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.663702][ T6231] netlink: 16178 bytes leftover after parsing attributes in process `syz.3.110'. [ 133.763475][ T6228] loop0: detected capacity change from 0 to 8192 [ 135.254400][ T6228] Dev loop0: RDB in block 1 has bad checksum [ 135.994033][ T23] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 136.130365][ T5091] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 136.142329][ T5091] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 136.151971][ T5091] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 136.168684][ T5091] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 136.176814][ T5091] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 136.185089][ T5091] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 136.204797][ T23] usb 4-1: too many configurations: 9, using maximum allowed: 8 [ 136.224023][ T23] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 136.243485][ T23] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 136.281045][ T23] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 136.300375][ T23] usb 4-1: config 0 interface 0 has no altsetting 0 [ 136.320082][ T23] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 136.347471][ T23] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 136.376250][ T23] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 136.403979][ T23] usb 4-1: config 0 interface 0 has no altsetting 0 [ 136.425147][ T23] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 136.554984][ T23] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 136.566533][ T23] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 136.576733][ T23] usb 4-1: config 0 interface 0 has no altsetting 0 [ 136.584937][ T23] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 136.613968][ T23] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 136.644252][ T23] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 136.690750][ T23] usb 4-1: config 0 interface 0 has no altsetting 0 [ 136.754176][ T23] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 136.763675][ T23] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 138.364162][ T5091] Bluetooth: hci4: command tx timeout [ 138.602187][ T989] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 138.664307][ T23] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid wMaxPacketSize 0 [ 138.674700][ T23] usb 4-1: config 0 interface 0 has no altsetting 0 [ 138.730394][ T23] usb 4-1: unable to read config index 5 descriptor/start: -71 [ 138.754052][ T23] usb 4-1: can't read configurations, error -71 [ 138.988691][ T989] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 139.177720][ T989] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 139.227519][ T6241] chnl_net:caif_netlink_parms(): no params data found [ 139.372980][ T989] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 139.692918][ T6241] bridge0: port 1(bridge_slave_0) entered blocking state [ 139.706818][ T6241] bridge0: port 1(bridge_slave_0) entered disabled state [ 139.717734][ T6241] bridge_slave_0: entered allmulticast mode [ 139.730931][ T6241] bridge_slave_0: entered promiscuous mode [ 139.741612][ T6273] netlink: 4 bytes leftover after parsing attributes in process `syz.3.123'. [ 139.751499][ T6273] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 139.874419][ T6273] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 139.901462][ T6276] MTRR 1 not used [ 139.918744][ T6241] bridge0: port 2(bridge_slave_1) entered blocking state [ 139.931150][ T6241] bridge0: port 2(bridge_slave_1) entered disabled state [ 139.942319][ T6241] bridge_slave_1: entered allmulticast mode [ 139.954200][ T6241] bridge_slave_1: entered promiscuous mode [ 140.120636][ T6241] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 140.190875][ T6241] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 140.308673][ T6241] team0: Port device team_slave_0 added [ 140.372644][ T6241] team0: Port device team_slave_1 added [ 140.424412][ T5091] Bluetooth: hci4: command tx timeout [ 142.755587][ T0] NOHZ tick-stop error: local softirq work is pending, handler #0a!!! [ 142.964204][ T5091] Bluetooth: hci4: command tx timeout [ 142.990522][ T6241] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 143.030084][ T6241] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 143.114445][ T6241] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 143.357824][ T6241] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 143.391098][ T6241] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 143.468907][ T6241] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 143.502987][ T6291] FAULT_INJECTION: forcing a failure. [ 143.502987][ T6291] name failslab, interval 1, probability 0, space 0, times 1 [ 143.553242][ T6291] CPU: 1 PID: 6291 Comm: syz.3.127 Not tainted syzkaller #0 [ 143.560626][ T6291] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 143.570761][ T6291] Call Trace: [ 143.574090][ T6291] [ 143.577064][ T6291] dump_stack_lvl+0x18c/0x250 [ 143.581825][ T6291] ? show_regs_print_info+0x20/0x20 [ 143.587088][ T6291] ? load_image+0x420/0x420 [ 143.591649][ T6291] ? __might_sleep+0xe0/0xe0 [ 143.596299][ T6291] ? __lock_acquire+0x7d80/0x7d80 [ 143.601381][ T6291] should_fail_ex+0x394/0x4c0 [ 143.606104][ T6291] should_failslab+0x9/0x20 [ 143.610662][ T6291] slab_pre_alloc_hook+0x59/0x300 [ 143.615732][ T6291] ? rcu_is_watching+0x15/0xb0 [ 143.620535][ T6291] ? kvmalloc_node+0x70/0x180 [ 143.625253][ T6291] ? kvmalloc_node+0x70/0x180 [ 143.629961][ T6291] __kmem_cache_alloc_node+0x53/0x250 [ 143.635370][ T6291] ? __mutex_lock+0x30d/0xc80 [ 143.640077][ T6291] ? kvmalloc_node+0x70/0x180 [ 143.644795][ T6291] __kmalloc_node+0xa6/0x240 [ 143.649424][ T6291] kvmalloc_node+0x70/0x180 [ 143.653960][ T6291] nf_hook_entries_grow+0x27c/0x710 [ 143.659214][ T6291] __nf_register_net_hook+0x2c9/0x910 [ 143.664628][ T6291] nf_register_net_hook+0xb2/0x190 [ 143.669783][ T6291] nf_register_net_hooks+0x44/0x1b0 [ 143.675020][ T6291] ip_vs_register_hooks+0xce/0x150 [ 143.680187][ T6291] ip_vs_add_service+0x2c9/0x1330 [ 143.685264][ T6291] do_ip_vs_set_ctl+0x8cc/0xab0 [ 143.690147][ T6291] ? ipvs_proc_est_nice+0x360/0x360 [ 143.695401][ T6291] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 143.701428][ T6291] ? trace_irq_disable+0x37/0xe0 [ 143.706412][ T6291] ? lockdep_hardirqs_on+0x98/0x150 [ 143.711639][ T6291] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 143.717327][ T6291] nf_setsockopt+0x263/0x280 [ 143.721952][ T6291] ? sock_common_recvmsg+0x190/0x190 [ 143.727275][ T6291] do_sock_setsockopt+0x175/0x1a0 [ 143.732332][ T6291] ? __fdget+0x180/0x210 [ 143.736610][ T6291] __x64_sys_setsockopt+0x182/0x200 [ 143.741843][ T6291] do_syscall_64+0x55/0xb0 [ 143.746291][ T6291] ? clear_bhb_loop+0x40/0x90 [ 143.751007][ T6291] ? clear_bhb_loop+0x40/0x90 [ 143.755718][ T6291] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 143.761659][ T6291] RIP: 0033:0x7f0588b9e159 [ 143.766104][ T6291] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 143.785742][ T6291] RSP: 002b:00007f0589a59028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 143.794215][ T6291] RAX: ffffffffffffffda RBX: 00007f0588e25fa0 RCX: 00007f0588b9e159 [ 143.802214][ T6291] RDX: 0000000000000482 RSI: 0000000000000000 RDI: 0000000000000007 [ 143.810209][ T6291] RBP: 00007f0588c3506b R08: 000000000000002c R09: 0000000000000000 [ 143.818217][ T6291] R10: 0000200000000280 R11: 0000000000000246 R12: 0000000000000000 [ 143.826223][ T6291] R13: 00007f0588e26038 R14: 00007f0588e25fa0 R15: 00007fffc1dd51a8 [ 143.834237][ T6291] [ 144.043064][ T6241] hsr_slave_0: entered promiscuous mode [ 144.090735][ T6241] hsr_slave_1: entered promiscuous mode [ 144.108812][ T6241] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 144.129032][ T6241] Cannot create hsr debugfs directory [ 145.029037][ T5091] Bluetooth: hci4: command tx timeout [ 146.683962][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 148.453944][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 151.598484][ T6241] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 151.651918][ T6241] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 151.778262][ T6241] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 151.834791][ T6241] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 151.898779][ T6354] netlink: 'syz.0.133': attribute type 3 has an invalid length. [ 151.939212][ T6354] syzkaller1: entered promiscuous mode [ 151.955197][ T6354] syzkaller1: entered allmulticast mode [ 152.099852][ T989] hsr_slave_0: left promiscuous mode [ 152.106455][ T989] hsr_slave_1: left promiscuous mode [ 152.141361][ T989] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 152.180405][ T989] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 152.203055][ T989] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 152.217967][ T989] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 152.239733][ T989] bond0: left allmulticast mode [ 152.256262][ T989] bond_slave_0: left allmulticast mode [ 152.265653][ T989] bond_slave_1: left allmulticast mode [ 152.272840][ T989] bridge0: port 3(bond0) entered disabled state [ 152.302996][ T989] bridge_slave_1: left allmulticast mode [ 152.326965][ T989] bridge_slave_1: left promiscuous mode [ 152.333222][ T989] bridge0: port 2(bridge_slave_1) entered disabled state [ 152.392661][ T989] bridge_slave_0: left allmulticast mode [ 152.449340][ T989] bridge_slave_0: left promiscuous mode [ 152.464176][ T989] bridge0: port 1(bridge_slave_0) entered disabled state [ 152.585904][ T989] veth1_macvtap: left promiscuous mode [ 152.592050][ T989] veth0_macvtap: left promiscuous mode [ 152.608194][ T989] veth1_vlan: left promiscuous mode [ 152.613905][ T989] veth0_vlan: left promiscuous mode [ 154.652983][ T6388] netlink: 16166 bytes leftover after parsing attributes in process `syz.0.143'. [ 156.582998][ T6398] netlink: 'syz.1.146': attribute type 3 has an invalid length. [ 157.101206][ T989] team0 (unregistering): Port device team_slave_1 removed [ 157.161494][ T989] team0 (unregistering): Port device team_slave_0 removed [ 157.209253][ T989] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 157.220572][ T989] bond_slave_1 (unregistering): left promiscuous mode [ 157.281921][ T989] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 157.292095][ T989] bond_slave_0 (unregistering): left promiscuous mode [ 157.729982][ T989] bond0 (unregistering): Released all slaves [ 158.577327][ T6413] ip6erspan0: entered promiscuous mode [ 158.602372][ T6401] syzkaller1: entered promiscuous mode [ 158.624693][ T6401] syzkaller1: entered allmulticast mode [ 158.679172][ T6418] MTRR 1 not used [ 160.476155][ T6241] 8021q: adding VLAN 0 to HW filter on device bond0 [ 160.584777][ T6241] 8021q: adding VLAN 0 to HW filter on device team0 [ 160.643103][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 160.650429][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 160.782087][ T3491] bridge0: port 2(bridge_slave_1) entered blocking state [ 160.789319][ T3491] bridge0: port 2(bridge_slave_1) entered forwarding state [ 161.689195][ T6241] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 162.041852][ T6453] RDS: rds_bind could not find a transport for fec0:ffff:ffff:ffff::1, load rds_tcp or rds_rdma? [ 164.262010][ T6484] netlink: 'syz.1.161': attribute type 3 has an invalid length. [ 164.294557][ T6241] veth0_vlan: entered promiscuous mode [ 164.337220][ T6241] veth1_vlan: entered promiscuous mode [ 164.353171][ T6484] syzkaller1: entered promiscuous mode [ 164.364403][ T6484] syzkaller1: entered allmulticast mode [ 164.538411][ T6241] veth0_macvtap: entered promiscuous mode [ 164.569739][ T6241] veth1_macvtap: entered promiscuous mode [ 164.612874][ T6241] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 164.633975][ T6241] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 164.673792][ T6241] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 164.684945][ T27] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 164.704308][ T6241] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 164.726088][ T6241] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 164.736803][ T6241] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 164.760688][ T6241] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 164.787961][ T6241] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 164.820024][ T6241] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 164.851496][ T6241] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 164.878912][ T6241] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 164.887562][ T27] usb 4-1: too many configurations: 9, using maximum allowed: 8 [ 164.910277][ T6241] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 164.929322][ T27] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 164.942175][ T6241] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 164.957403][ T27] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 164.972800][ T6241] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 164.988881][ T27] usb 4-1: config 0 interface 0 has no altsetting 0 [ 164.994056][ T6241] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 165.005507][ T27] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 165.018140][ T6241] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 165.022693][ T27] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 165.063309][ T6504] RDS: rds_bind could not find a transport for fec0:ffff:ffff:ffff::1, load rds_tcp or rds_rdma? [ 165.235562][ T27] usb 4-1: config 0 interface 0 has no altsetting 0 [ 165.249904][ T27] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 165.279813][ T27] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 165.487487][ T27] usb 4-1: config 0 interface 0 has no altsetting 0 [ 165.538334][ T27] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 165.989067][ T27] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 166.162467][ T70] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 166.184532][ T70] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 166.207987][ T27] usb 4-1: config 0 interface 0 has no altsetting 0 [ 167.164320][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 167.342346][ T27] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 167.364042][ T27] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 167.798296][ T27] usb 4-1: config 0 interface 0 has no altsetting 0 [ 167.924666][ T27] usb 4-1: unable to read config index 5 descriptor/all [ 167.949773][ T27] usb 4-1: can't read configurations, error -71 [ 167.960244][ T3539] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 168.014312][ T3539] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 169.128085][ T6530] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 169.176594][ T6529] Zero length message leads to an empty skb [ 169.230803][ T6529] netlink: 'syz.1.174': attribute type 3 has an invalid length. [ 169.345484][ T6529] syzkaller1: entered promiscuous mode [ 169.354023][ T6529] syzkaller1: entered allmulticast mode [ 170.134082][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 173.384140][ T172] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 173.604813][ T172] usb 4-1: too many configurations: 9, using maximum allowed: 8 [ 173.616515][ T172] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 173.625980][ T172] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 173.644895][ T172] usb 4-1: config 0 interface 0 has no altsetting 0 [ 173.657531][ T172] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 173.666629][ T172] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 173.678362][ T172] usb 4-1: config 0 interface 0 has no altsetting 0 [ 173.690425][ T172] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 173.700476][ T172] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 173.713984][ T172] usb 4-1: config 0 interface 0 has no altsetting 0 [ 173.729254][ T172] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 173.738445][ T172] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 173.749504][ T172] usb 4-1: config 0 interface 0 has no altsetting 0 [ 173.768156][ T172] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 173.777332][ T172] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 173.788453][ T172] usb 4-1: config 0 interface 0 has no altsetting 0 [ 173.798133][ T172] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 173.807563][ T172] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 173.818867][ T172] usb 4-1: config 0 interface 0 has no altsetting 0 [ 173.830484][ T172] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 173.839882][ T172] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 173.853119][ T172] usb 4-1: config 0 interface 0 has no altsetting 0 [ 173.861898][ T172] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 173.871416][ T172] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7 [ 173.882738][ T172] usb 4-1: config 0 interface 0 has no altsetting 0 [ 173.893558][ T172] usb 4-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 173.903217][ T172] usb 4-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 173.912185][ T172] usb 4-1: Product: syz [ 173.921585][ T172] usb 4-1: Manufacturer: syz [ 173.930490][ T172] usb 4-1: SerialNumber: syz [ 173.957573][ T172] usb 4-1: config 0 descriptor?? [ 173.983114][ T172] yurex 4-1:0.0: USB YUREX device now attached to Yurex #0 [ 174.199443][ T172] usb 4-1: USB disconnect, device number 6 [ 174.218219][ T172] yurex 4-1:0.0: USB YUREX #0 now disconnected [ 175.962401][ T6603] capability: warning: `syz.3.191' uses deprecated v2 capabilities in a way that may be insecure [ 176.080049][ T6601] netlink: 'syz.4.190': attribute type 3 has an invalid length. [ 176.117222][ T6601] syzkaller1: entered promiscuous mode [ 176.142129][ T6601] syzkaller1: entered allmulticast mode [ 181.605141][ T6658] netlink: 'syz.3.204': attribute type 3 has an invalid length. [ 181.725133][ T6658] syzkaller1: entered promiscuous mode [ 181.753511][ T6658] syzkaller1: entered allmulticast mode [ 183.271939][ T6692] netlink: 'syz.4.212': attribute type 1 has an invalid length. [ 183.884678][ T6715] netlink: 'syz.3.220': attribute type 3 has an invalid length. [ 183.924996][ T6715] syzkaller1: entered promiscuous mode [ 183.930556][ T6715] syzkaller1: entered allmulticast mode [ 185.535834][ T6751] ======================================================= [ 185.535834][ T6751] WARNING: The mand mount option has been deprecated and [ 185.535834][ T6751] and is ignored by this kernel. Remove the mand [ 185.535834][ T6751] option from the mount to silence this warning. [ 185.535834][ T6751] ======================================================= [ 185.595085][ T6751] overlayfs: failed to resolve './file1': -2 [ 185.697026][ T6754] loop4: detected capacity change from 0 to 164 [ 190.144250][ T6834] netlink: 'syz.0.257': attribute type 10 has an invalid length. [ 190.152087][ T6834] netlink: 168 bytes leftover after parsing attributes in process `syz.0.257'. [ 193.122931][ T6884] misc userio: Invalid payload size [ 195.236430][ T1291] ieee802154 phy0 wpan0: encryption failed: -22 [ 195.253938][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.379136][ T6907] netlink: 'syz.0.271': attribute type 72 has an invalid length. [ 195.419865][ T6907] netlink: 12 bytes leftover after parsing attributes in process `syz.0.271'. [ 196.890706][ T6924] misc userio: Invalid payload size [ 198.346308][ T6941] netlink: 71 bytes leftover after parsing attributes in process `syz.4.285'. [ 198.484047][ T6945] netlink: 16 bytes leftover after parsing attributes in process `syz.1.286'. [ 198.509089][ T6945] netlink: 40 bytes leftover after parsing attributes in process `syz.1.286'. [ 198.647919][ T6949] Rounding down aligned max_sectors from 4294967295 to 4294967288 [ 198.756725][ T6949] [ 198.759120][ T6949] ====================================================== [ 198.766149][ T6949] WARNING: possible circular locking dependency detected [ 198.773187][ T6949] syzkaller #0 Not tainted [ 198.777601][ T6949] ------------------------------------------------------ [ 198.784619][ T6949] syz.3.274/6949 is trying to acquire lock: [ 198.790509][ T6949] ffffffff8de55e88 (tpg_instances_lock){+.+.}-{3:3}, at: tcm_alloc+0x21/0x2d0 [ 198.799400][ T6949] [ 198.799400][ T6949] but task is already holding lock: [ 198.806791][ T6949] ffff88807b392398 (&gi->lock){+.+.}-{3:3}, at: config_usb_cfg_link+0x59/0x250 [ 198.815844][ T6949] [ 198.815844][ T6949] which lock already depends on the new lock. [ 198.815844][ T6949] [ 198.826412][ T6949] [ 198.826412][ T6949] the existing dependency chain (in reverse order) is: [ 198.835455][ T6949] [ 198.835455][ T6949] -> #2 (&gi->lock){+.+.}-{3:3}: [ 198.842600][ T6949] __mutex_lock+0x135/0xc80 [ 198.847646][ T6949] config_usb_cfg_link+0x59/0x250 [ 198.853220][ T6949] configfs_symlink+0x5a5/0xfe0 [ 198.858612][ T6949] vfs_symlink+0x138/0x2b0 [ 198.863566][ T6949] do_symlinkat+0x1ba/0x400 [ 198.868622][ T6949] __x64_sys_symlinkat+0x99/0xb0 [ 198.874102][ T6949] do_syscall_64+0x55/0xb0 [ 198.879066][ T6949] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 198.885504][ T6949] [ 198.885504][ T6949] -> #1 (&sb->s_type->i_mutex_key#21){++++}-{3:3}: [ 198.894248][ T6949] down_write+0x97/0x200 [ 198.899036][ T6949] configfs_depend_item_unlocked+0x157/0x430 [ 198.905566][ T6949] usbg_make_tpg+0x1e1/0x550 [ 198.910718][ T6949] target_fabric_make_tpg+0xa4/0x6d0 [ 198.916593][ T6949] configfs_mkdir+0x515/0x9e0 [ 198.921819][ T6949] vfs_mkdir+0x2a5/0x470 [ 198.926609][ T6949] do_mkdirat+0x1dc/0x450 [ 198.931481][ T6949] __x64_sys_mkdirat+0x89/0xa0 [ 198.936787][ T6949] do_syscall_64+0x55/0xb0 [ 198.941753][ T6949] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 198.948190][ T6949] [ 198.948190][ T6949] -> #0 (tpg_instances_lock){+.+.}-{3:3}: [ 198.956112][ T6949] __lock_acquire+0x37ef/0x7d80 [ 198.961509][ T6949] lock_acquire+0x19e/0x420 [ 198.966559][ T6949] __mutex_lock+0x135/0xc80 [ 198.971610][ T6949] tcm_alloc+0x21/0x2d0 [ 198.976302][ T6949] usb_get_function+0x5d/0xb0 [ 198.981520][ T6949] config_usb_cfg_link+0x148/0x250 [ 198.987186][ T6949] configfs_symlink+0x5a5/0xfe0 [ 198.992582][ T6949] vfs_symlink+0x138/0x2b0 [ 198.997544][ T6949] do_symlinkat+0x1ba/0x400 [ 199.002595][ T6949] __x64_sys_symlinkat+0x99/0xb0 [ 199.008095][ T6949] do_syscall_64+0x55/0xb0 [ 199.013053][ T6949] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 199.019498][ T6949] [ 199.019498][ T6949] other info that might help us debug this: [ 199.019498][ T6949] [ 199.029747][ T6949] Chain exists of: [ 199.029747][ T6949] tpg_instances_lock --> &sb->s_type->i_mutex_key#21 --> &gi->lock [ 199.029747][ T6949] [ 199.043611][ T6949] Possible unsafe locking scenario: [ 199.043611][ T6949] [ 199.051087][ T6949] CPU0 CPU1 [ 199.056468][ T6949] ---- ---- [ 199.061845][ T6949] lock(&gi->lock); [ 199.065781][ T6949] lock(&sb->s_type->i_mutex_key#21); [ 199.073799][ T6949] lock(&gi->lock); [ 199.080238][ T6949] lock(tpg_instances_lock); [ 199.084937][ T6949] [ 199.084937][ T6949] *** DEADLOCK *** [ 199.084937][ T6949] [ 199.093091][ T6949] 3 locks held by syz.3.274/6949: [ 199.098123][ T6949] #0: ffff888143ef2418 (sb_writers#14){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 [ 199.107411][ T6949] #1: ffff88805a2215a0 (&sb->s_type->i_mutex_key#21){++++}-{3:3}, at: configfs_symlink+0x47a/0xfe0 [ 199.118343][ T6949] #2: ffff88807b392398 (&gi->lock){+.+.}-{3:3}, at: config_usb_cfg_link+0x59/0x250 [ 199.127767][ T6949] [ 199.127767][ T6949] stack backtrace: [ 199.133676][ T6949] CPU: 1 PID: 6949 Comm: syz.3.274 Not tainted syzkaller #0 [ 199.140975][ T6949] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 199.151049][ T6949] Call Trace: [ 199.154342][ T6949] [ 199.157302][ T6949] dump_stack_lvl+0x18c/0x250 [ 199.162011][ T6949] ? load_image+0x420/0x420 [ 199.166530][ T6949] ? show_regs_print_info+0x20/0x20 [ 199.171750][ T6949] ? print_circular_bug+0x12b/0x1a0 [ 199.176985][ T6949] check_noncircular+0x2fc/0x400 [ 199.181951][ T6949] ? print_deadlock_bug+0x5d0/0x5d0 [ 199.187164][ T6949] ? lockdep_lock+0xf5/0x230 [ 199.191813][ T6949] ? _find_first_zero_bit+0xd6/0x100 [ 199.197137][ T6949] __lock_acquire+0x37ef/0x7d80 [ 199.202025][ T6949] ? verify_lock_unused+0x140/0x140 [ 199.207243][ T6949] ? __lock_acquire+0x1336/0x7d80 [ 199.212304][ T6949] ? verify_lock_unused+0x140/0x140 [ 199.217540][ T6949] lock_acquire+0x19e/0x420 [ 199.222071][ T6949] ? tcm_alloc+0x21/0x2d0 [ 199.226426][ T6949] ? __might_sleep+0xe0/0xe0 [ 199.231044][ T6949] ? read_lock_is_recursive+0x20/0x20 [ 199.236442][ T6949] ? __mutex_trylock_common+0x160/0x270 [ 199.242005][ T6949] __mutex_lock+0x135/0xc80 [ 199.246529][ T6949] ? tcm_alloc+0x21/0x2d0 [ 199.250880][ T6949] ? trace_contention_end+0x39/0xe0 [ 199.256092][ T6949] ? __mutex_lock+0x30d/0xc80 [ 199.260809][ T6949] ? tcm_alloc+0x21/0x2d0 [ 199.265157][ T6949] ? mutex_lock_nested+0x20/0x20 [ 199.270105][ T6949] ? read_lock_is_recursive+0x20/0x20 [ 199.275492][ T6949] ? config_usb_cfg_link+0x59/0x250 [ 199.280709][ T6949] ? mutex_lock_nested+0x20/0x20 [ 199.285660][ T6949] ? configfs_symlink+0x469/0xfe0 [ 199.290710][ T6949] tcm_alloc+0x21/0x2d0 [ 199.294906][ T6949] usb_get_function+0x5d/0xb0 [ 199.299601][ T6949] config_usb_cfg_link+0x148/0x250 [ 199.304753][ T6949] configfs_symlink+0x5a5/0xfe0 [ 199.309654][ T6949] ? from_kgid+0x153/0x6a0 [ 199.314106][ T6949] ? generic_permission+0x1ed/0x590 [ 199.319327][ T6949] ? detach_groups+0x370/0x370 [ 199.324117][ T6949] ? inode_permission+0xf3/0x480 [ 199.329077][ T6949] ? bpf_lsm_inode_symlink+0x9/0x10 [ 199.334293][ T6949] ? security_inode_symlink+0xb6/0x100 [ 199.339790][ T6949] vfs_symlink+0x138/0x2b0 [ 199.344254][ T6949] do_symlinkat+0x1ba/0x400 [ 199.348789][ T6949] ? vfs_symlink+0x2b0/0x2b0 [ 199.353402][ T6949] __x64_sys_symlinkat+0x99/0xb0 [ 199.358380][ T6949] do_syscall_64+0x55/0xb0 [ 199.362827][ T6949] ? clear_bhb_loop+0x40/0x90 [ 199.367537][ T6949] ? clear_bhb_loop+0x40/0x90 [ 199.372243][ T6949] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 199.378169][ T6949] RIP: 0033:0x7f0588b9e159 [ 199.382598][ T6949] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 199.402223][ T6949] RSP: 002b:00007f0589a59028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 199.410677][ T6949] RAX: ffffffffffffffda RBX: 00007f0588e25fa0 RCX: 00007f0588b9e159 [ 199.418668][ T6949] RDX: 0000200000000600 RSI: ffffffffffffff9c RDI: 00002000000005c0 [ 199.426663][ T6949] RBP: 00007f0588c3506b R08: 0000000000000000 R09: 0000000000000000 [ 199.434677][ T6949] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 199.442665][ T6949] R13: 00007f0588e26038 R14: 00007f0588e25fa0 R15: 00007fffc1dd51a8 [ 199.450682][ T6949] [ 199.766954][ T6964] netlink: 'syz.0.283': attribute type 10 has an invalid length. [ 199.785292][ T6964] netlink: 168 bytes leftover after parsing attributes in process `syz.0.283'. [ 206.914116][ T5091] Bluetooth: hci2: command 0x0406 tx timeout [ 206.914130][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 206.914143][ T5786] Bluetooth: hci0: command 0x0406 tx timeout