last executing test programs: 35.064806401s ago: executing program 1 (id=2): r0 = memfd_create(&(0x7f0000000040)='\x02A\xbb\xcc\x96\x0e\x00\x00\x00\x00\x00\x00', 0x6) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3000002, 0x11, r0, 0x0) ioctl$F2FS_IOC_GET_COMPRESS_OPTION(0xffffffffffffffff, 0x8002f515, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r2 = socket$inet6_icmp(0xa, 0x2, 0x3a) sendmsg$inet6(r2, &(0x7f0000000880)={&(0x7f0000000080)={0xa, 0x4e21, 0x2, @private2, 0x49}, 0x1c, &(0x7f0000000100)=[{&(0x7f0000000040)="8000e8beec9dbc13", 0x8}], 0x1, &(0x7f0000000280)=ANY=[], 0x30}, 0x4004000) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0) write(r3, &(0x7f0000000100)='slave-24c02 0x1', 0xf) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r4, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r4, &(0x7f0000000040)={0x50, 0x0, r5, {0x7, 0x1f, 0x1, 0x80000, 0x0, 0x9, 0x0, 0xfffffffe, 0x0, 0x0, 0x10, 0xc0e}}, 0x50) syz_fuse_handle_req(r4, &(0x7f00000041c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x0, 0x0, {0x0, 0x1a}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x80101, 0x101) r7 = dup2(r6, r4) fdatasync(r7) ftruncate(r0, 0x8000000) 32.091963906s ago: executing program 1 (id=21): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r3, 0x29, 0x4, 0x0, 0x0) 31.651442452s ago: executing program 3 (id=22): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r3, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) connect$inet6(r3, &(0x7f0000000240)={0xa, 0x6e23, 0x2, @mcast1, 0x9}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000001840), 0x3b, 0x0) (fail_nth: 2) 28.653896634s ago: executing program 1 (id=24): r0 = socket$inet_sctp(0x2, 0x1, 0x84) bpf$MAP_CREATE(0x0, 0x0, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x8) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000100)) r5 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000280)=@IORING_OP_POLL_ADD={0x6, 0x40, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {0x4110}, 0x1}) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r6 = userfaultfd(0x80801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x4}) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r6, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000199000/0x800000)=nil, 0x800000, 0x0, 0xf4ffffff}) syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x3, 0x200, 0x1, 0x40055}, &(0x7f00000000c0), &(0x7f0000000140), &(0x7f0000000080)) r7 = socket$inet(0x2, 0xa, 0x3) getsockopt$sock_buf(r7, 0x1, 0x3b, 0x0, &(0x7f0000000100)) syz_open_dev$usbfs(&(0x7f0000000000), 0x5, 0x20600) sendto$inet(r0, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r0, 0xda90) 27.234403878s ago: executing program 3 (id=25): r0 = socket$inet_sctp(0x2, 0x1, 0x84) bpf$MAP_CREATE(0x0, 0x0, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x8) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000100)) r5 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000280)=@IORING_OP_POLL_ADD={0x6, 0x40, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {0x4110}, 0x1}) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r6 = userfaultfd(0x80801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x4}) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r6, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000199000/0x800000)=nil, 0x800000, 0x0, 0xf4ffffff}) syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x3, 0x200, 0x1, 0x40055}, &(0x7f00000000c0), &(0x7f0000000140), &(0x7f0000000080)) r7 = socket$inet(0x2, 0xa, 0x3) getsockopt$sock_buf(r7, 0x1, 0x3b, 0x0, &(0x7f0000000100)) syz_open_dev$usbfs(&(0x7f0000000000), 0x5, 0x20600) sendto$inet(r0, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r0, 0xda90) 26.971766486s ago: executing program 0 (id=26): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r3, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) connect$inet6(r3, &(0x7f0000000240)={0xa, 0x6e23, 0x2, @mcast1, 0x9}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000001840), 0x3b, 0x0) 26.947221527s ago: executing program 1 (id=27): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_LOG_BASE(r0, 0x4008af04, &(0x7f0000000740)=0xffffffffffffffff) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000001c0)={0x0, 0x0, 0x0, &(0x7f0000000480)=""/53, 0x0, 0xd000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)) socket$alg(0x26, 0x5, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$VHOST_RESET_OWNER(r0, 0xaf02, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sched_setattr(0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180), 0x6143c2, 0x3f00) syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$USBDEVFS_GET_SPEED(r3, 0x551f) bind$inet(r3, &(0x7f0000000100)={0x2, 0x4e23, @multicast2}, 0x10) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000200)='memory.swap.events\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = fsopen(&(0x7f00000002c0)='ceph\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f00000008c0)='test_dummy_encryption', &(0x7f0000000240)='v2\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\xd8\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000880)='test_dummy_encryption', &(0x7f0000000080)='v2\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, 0x0, 0xc000) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) pwritev2(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x3) socket$nl_route(0x10, 0x3, 0x0) 23.801088867s ago: executing program 0 (id=31): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r0 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) setsockopt$inet6_opts(r0, 0x29, 0x37, &(0x7f0000000000)=ANY=[@ANYBLOB="000204"], 0x18) connect$inet6(r0, &(0x7f0000000240)={0xa, 0x6e23, 0x2, @mcast1, 0x9}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000001840), 0x3b, 0x0) 23.748527865s ago: executing program 3 (id=32): r0 = socket(0x10, 0x3, 0x0) r1 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x44}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r2, 0xc0a85320, &(0x7f00000005c0)={{0x80}, 'port0\x00', 0x62, 0x802, 0x0, 0x8000008, 0x3, 0x4, 0x1, 0x0, 0x7cce8c743ee810df, 0xfc}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x600) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r3, 0x40505330, &(0x7f0000000bc0)={0x800100, 0x0, 0x0, 0x724b, 0x8000000, 0x55a}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r2, 0x4058534c, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff4000/0xa000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r4 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0x2bb}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff}) setsockopt$sock_attach_bpf(r5, 0x1, 0x3d, &(0x7f0000000040), 0x8) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000002c0)={'wlan0\x00'}) sendmsg$NL80211_CMD_FRAME(r6, 0x0, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000bc0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYRES16=r7, @ANYRES8=r1], 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) 21.832653359s ago: executing program 0 (id=35): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000000000200304306000000000000109022400010000000009040000010300000009210000000122020009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\"\v'], 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)=ANY=[@ANYBLOB="00140d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00M'], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000b00)={0x84, &(0x7f0000000080)=ANY=[@ANYBLOB="200e06"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$I2C(&(0x7f00000001c0), 0x78b5, 0x80) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000040)={&(0x7f0000000600)=[{0xcf, 0xc000, 0x0, 0x0}], 0x1}) 17.504096649s ago: executing program 3 (id=39): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) getsockopt$bt_BT_POWER(r1, 0x112, 0x9, &(0x7f0000000e40)=0x61, &(0x7f0000000e80)=0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x47, &(0x7f0000000200)=0x7) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x10000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_ABORT_SCAN(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)={0x1c, 0x0, 0xd9b2794f6a139537, 0x0, 0xe7030000, {{}, {@val={0x8, 0x3, r6}, @void}}}, 0x1c}}, 0x0) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r1, 0xc0385868, &(0x7f0000000400)={r5, &(0x7f0000000180)='\x00', 0x440, &(0x7f0000000240)={@_ha_fsid={[0x40ad, 0xfff]}, {0xf1c, 0x9, 0x9, 0x3a}}, 0x2, &(0x7f0000000380)={@_ha_fsid}, &(0x7f00000003c0)=0xd}) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) r7 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/strings/0x409/product\x00', 0x2, 0x0) write(r7, &(0x7f0000000340)='Test Gadg', 0x9) 17.140776072s ago: executing program 0 (id=41): ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={0x0}) ioctl$DRM_IOCTL_SET_SAREA_CTX(0xffffffffffffffff, 0x4010641c, &(0x7f0000000940)={r0, &(0x7f0000000840)=""/218}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) pwrite64(r1, 0x0, 0x0, 0x1000) pwrite64(r1, &(0x7f0000001010)="1000000000000000", 0x8, 0x1080) pwrite64(r1, &(0x7f0000001018)='\n\x00\x00\x00\x00\x00\x00\x00', 0x8, 0x1088) pwrite64(r1, &(0x7f0000001020)='\b\x00\x00\x00\x00\x00\x00\x00', 0x8, 0x1090) r2 = memfd_create(&(0x7f0000000440)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\x13\xda\xf9\xcd7el\xb7\xe6\b\x00\x00\x00\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x9a\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00uKs\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xe6\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x141<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7r\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\xb7>j0S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ\x00'/1136, 0xc) ioctl$FS_IOC_RESVSP(r2, 0x40305828, &(0x7f0000000080)={0x0, 0x0, 0x1, 0x7}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2000003, 0x12, r2, 0x0) io_setup(0xf5, &(0x7f0000000180)) pwrite64(r1, &(0x7f0000001028)='(O+', 0x3, 0x10d8) pwrite64(r1, &(0x7f000000102c)='bitm', 0x4, 0x2000) pwrite64(r1, &(0x7f0000001030)="04000000", 0x4, 0x2004) pwrite64(r1, &(0x7f0000001034)="00020000", 0x4, 0x2034) pwrite64(r1, &(0x7f0000001038)="01000000", 0x4, 0x2038) pwrite64(r1, &(0x7f000000103c)='\x00\x00\x00\x00', 0x4, 0x203c) fsync(r1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r3, &(0x7f0000000400)='md0\x00', 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0) write(r4, &(0x7f0000000600)='1.2\x00', 0x4) openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) 15.224280986s ago: executing program 3 (id=42): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) ptrace$pokeuser(0x6, r0, 0x400000000000, 0x9) getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) r3 = socket$tipc(0x1e, 0x5, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000005c0)=@newlink={0x50, 0x10, 0x437, 0x3, 0x3, {0x0, 0x0, 0x0, 0x0, 0x51b0b, 0x1}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GRE_LOCAL={0x14, 0x6, @remote}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0x37}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x48800}, 0x240008d0) setsockopt$TIPC_CONN_TIMEOUT(r3, 0x10f, 0x82, &(0x7f0000000080)=0x6, 0x4) sendmsg$tipc(r3, 0x0, 0x0) connect$tipc(r3, &(0x7f00000000c0)=@name, 0x10) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(r0, 0x8, &(0x7f00000002c0)=0xbc6) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', &(0x7f00000011c0)={{}, {}, [{0x2, 0x4}], {0x4, 0x4}}, 0x2c, 0x0) r5 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000140)='.pending_reads\x00', 0x1a10c1, 0x9c37611dc13d0da6) r6 = getegid() fchown(r5, 0xffffffffffffffff, r6) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="5c00000009060102"], 0x5c}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) r7 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_CLEAR_HALT(r7, 0xc0105502, &(0x7f0000000300)={0x1, 0x1}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x17, 0x3, &(0x7f0000000680)=@framed={{0x18, 0x8}}, &(0x7f00000003c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1e}, 0x94) ioctl$TCFLSH(0xffffffffffffffff, 0x540b, 0x2) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={0x0}}, 0x844) 14.936357826s ago: executing program 2 (id=44): syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r0 = socket(0x10, 0x803, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)) r1 = socket(0x1, 0x803, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r3 = socket$inet6(0xa, 0x1, 0x8010000000000084) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, 0x0, 0x8, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2c41, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) listen(r3, 0x7) writev(0xffffffffffffffff, &(0x7f0000000040)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x48}], 0x1) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000b40)=@ipv6_newaddr={0x34, 0x14, 0x9535393fea6295b5, 0x0, 0xfffffffa, {0xa, 0x40, 0x0, 0x0, r2}, [@IFA_LOCAL={0x14, 0x2, @mcast1={0xff, 0x2}}, @IFA_FLAGS={0x8, 0x8, 0x702}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x40000) r6 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=@ipv6_newaddr={0x2c, 0x14, 0x9535393fea6295a5, 0x0, 0x0, {0xa, 0x68, 0x0, 0xc8, r2}, [@IFA_LOCAL={0x14, 0x2, @mcast1={0xff, 0x2}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 13.709657815s ago: executing program 2 (id=45): ioctl$vim2m_VIDIOC_S_CTRL(0xffffffffffffffff, 0xc008561c, 0x0) r0 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @local}, 0x10) listen(r0, 0x5) r1 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @local}, 0x10) setns(0xc9, 0x0) r2 = socket(0x40000000015, 0x5, 0x0) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback={0xfec0ffffffffffff}, 0x90}, 0x1c) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x111241, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r6, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000000)={0x2c, r5, 0x801, 0x0, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_KEY={0x10, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_DEFAULT_TYPES={0x8, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}]}]}, 0x2c}}, 0x0) sendmsg$NL80211_CMD_NEW_KEY(r4, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x94, r5, 0x1, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0x400, 0x5a}}}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x2}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "57c3299e76416037229da7b5a0"}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x10, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x4}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x18, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x18, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac01}]}, 0x94}, 0x1, 0x0, 0x0, 0x4000000}, 0xc0) ioctl$IOMMU_VFIO_IOMMU_UNMAP_DMA(r3, 0x3b72, &(0x7f00000000c0)={0x4f, 0x4, 0x23e1, 0x7fff, "47113c3968c4ea0d35cb2248982709c498819c6137fa5cb1f6c88fba6e5e5914096e06cf6e579104f77c493860c846476b305033c46cfc"}) shutdown(r1, 0x0) 12.283773605s ago: executing program 0 (id=47): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x800001000088}, 0x0) getrlimit(0x2, &(0x7f0000000200)) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x25, &(0x7f0000000180)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$kcm(0x10, 0x2, 0x4) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x9, 0x0, 0x8, 0xffffffff}) sendmsg$inet(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="5c00000014006b03000000d86e6c1d0002847ea622fb564500004e23e3f58e76110165f450e71b0075e3002500028d459e37000f0000000000bf9367b47e51f60a64c9f4d4938037e786a6d0bdd700"/92, 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x8000) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r3 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$bt_hci(r3, &(0x7f0000000000)={0x27}, 0x74) sendmmsg$unix(r3, &(0x7f0000000b00)=[{{&(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e, 0x0}}, {{&(0x7f0000000e80)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000740)=[{&(0x7f0000001dc0)="bb", 0x1}, {0x0}], 0x2}}], 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f00000005c0)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x111, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r6, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_afonly={0x0}}, 0x20) 10.874405041s ago: executing program 32 (id=27): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_LOG_BASE(r0, 0x4008af04, &(0x7f0000000740)=0xffffffffffffffff) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000001c0)={0x0, 0x0, 0x0, &(0x7f0000000480)=""/53, 0x0, 0xd000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)) socket$alg(0x26, 0x5, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$VHOST_RESET_OWNER(r0, 0xaf02, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sched_setattr(0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180), 0x6143c2, 0x3f00) syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') r3 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$USBDEVFS_GET_SPEED(r3, 0x551f) bind$inet(r3, &(0x7f0000000100)={0x2, 0x4e23, @multicast2}, 0x10) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000200)='memory.swap.events\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = fsopen(&(0x7f00000002c0)='ceph\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f00000008c0)='test_dummy_encryption', &(0x7f0000000240)='v2\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\xd8\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000880)='test_dummy_encryption', &(0x7f0000000080)='v2\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, 0x0, 0xc000) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) pwritev2(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x3) socket$nl_route(0x10, 0x3, 0x0) 10.800792065s ago: executing program 4 (id=49): r0 = gettid() prlimit64(r0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) sendto(r2, 0x0, 0x0, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xe, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9}, [@generic={0x63, 0x1, 0x0, 0x1}]}, &(0x7f0000000780)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x6a, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = dup(r9) syz_ublk_setup_queues(r10, r8, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x100, 0x2103, 0x10000004, 0x0, r10}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xfffffffe, 0xaf}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf911, 0x0, 0x0, 0x1f0, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1b, 0x8200, 0x2, 0x250}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff6, 0x0, 0x0, 0x0}}, 0x0) r11 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl(r11, 0x89e1, &(0x7f00000000c0)='lapb0') 9.430010047s ago: executing program 2 (id=50): r0 = socket(0x10, 0x3, 0x0) r1 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x44}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r2, 0xc0a85320, &(0x7f00000005c0)={{0x80}, 'port0\x00', 0x62, 0x802, 0x0, 0x8000008, 0x3, 0x4, 0x1, 0x0, 0x7cce8c743ee810df, 0xfc}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x600) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r3, 0x40505330, &(0x7f0000000bc0)={0x800100, 0x0, 0x0, 0x724b, 0x8000000, 0x55a}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r2, 0x4058534c, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff4000/0xa000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r4 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0x2bb}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x50) io_uring_enter(r4, 0x2219, 0x7721, 0x16, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff}) setsockopt$sock_attach_bpf(r5, 0x1, 0x3d, &(0x7f0000000040), 0x8) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000002c0)={'wlan0\x00'}) sendmsg$NL80211_CMD_FRAME(r6, 0x0, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000bc0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYRES16=r7, @ANYRES8=r1], 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) 8.242844799s ago: executing program 4 (id=51): r0 = socket$inet_sctp(0x2, 0x1, 0x84) bpf$MAP_CREATE(0x0, 0x0, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x8) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000100)) r5 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000280)=@IORING_OP_POLL_ADD={0x6, 0x40, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {0x4110}, 0x1}) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r6 = userfaultfd(0x80801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x4}) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r6, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000199000/0x800000)=nil, 0x800000, 0x0, 0xf4ffffff}) r7 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x3, 0x200, 0x1, 0x40055}, &(0x7f00000000c0), &(0x7f0000000140), &(0x7f0000000080)) r8 = socket$inet(0x2, 0xa, 0x3) getsockopt$sock_buf(r8, 0x1, 0x3b, 0x0, &(0x7f0000000100)) io_uring_enter(r7, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r0, 0xda90) 7.782092189s ago: executing program 2 (id=52): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r4 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00'}) bind$unix(r4, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80c4}, 0x8081) r5 = socket$unix(0x1, 0x2, 0x0) ioctl$int_in(r5, 0x5421, &(0x7f0000000040)=0x5) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0) rseq(&(0x7f0000001080)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000001, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) getpid() connect$unix(r5, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r5, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) connect$unix(r4, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(0x3) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='stat\x00') syz_open_procfs(0x0, 0x0) 6.437238404s ago: executing program 0 (id=53): setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) signalfd4(r0, &(0x7f00000000c0)={[0x7]}, 0x8, 0x80000) r1 = socket(0x10, 0x803, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0xd, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x5}, [@call={0x85, 0x0, 0x0, 0x88}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops=0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.empty_time\x00', 0x275a, 0x0) r3 = syz_open_dev$cec(&(0x7f00000000c0), 0x0, 0xa41) ioctl$CEC_ADAP_S_LOG_ADDRS(r3, 0xc05c6104, &(0x7f00000002c0)={"000000d2", 0xd, 0x5, 0x2, 0x802, 0x7fffffff, "00020000ef546300", "480bc100", "000500", "e8cc1304", ["f2e7ffffffffffef68c10012", "08ea313cab4fec00", "000000ef0800000000000024", "0000005fc8000040001000"]}) ioctl$CEC_TRANSMIT(r3, 0xc0386105, &(0x7f0000000000)={0x9, 0x6, 0x2, 0x10001, 0x1, 0xeda0, "dddcbd5de2cdb4ac8a419dd87085a817", 0x0, 0x1, 0x3, 0x3, 0x9, 0x5, 0x8}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r2, 0x0) r4 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) r5 = fsopen(&(0x7f00000000c0)='erofs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000040)='source', &(0x7f0000005fc0)='//\xf2/\x06\b/\xdf/o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0xf) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="020000000400000006000000aa0b"], 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000000)={0x0, &(0x7f00000002c0)=""/251, &(0x7f0000000940), &(0x7f0000000200), 0xa7c, r7}, 0x39) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r6, @ANYBLOB="01000000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) syz_usb_connect(0x5, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0x1, 0x803, 0x0) socket$inet6(0xa, 0x3, 0x101) r9 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r9, 0x40146f2c, &(0x7f0000000140)={0x2001, 0x1, 0x3, 0x9, 0x4}) ioctl$DVB_DEMUX_DMX_REMOVE_PID(r9, 0x40026f34, &(0x7f0000000040)=0x2001) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r10 = openat$smackfs_access(0xffffffffffffff9c, &(0x7f0000000400)='/sys/fs/smackfs/access2\x00', 0x2, 0x0) write$smackfs_access(r10, &(0x7f00000001c0)=ANY=[@ANYBLOB=' sx{rce wtl\x00'], 0xc) 5.12863437s ago: executing program 4 (id=54): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x75c5b000) io_uring_setup(0x7, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) listen(0xffffffffffffffff, 0x0) connect$unix(r0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) write$binfmt_elf64(r2, &(0x7f0000000080)=ANY=[], 0x78) sendfile(r1, r2, &(0x7f00000001c0), 0x8) fcntl$addseals(r2, 0x409, 0x8) fallocate(r2, 0x3, 0x29c00000000000, 0x3) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) close_range(r3, 0xffffffffffffffff, 0x0) 5.082374276s ago: executing program 2 (id=55): syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r0 = socket(0x10, 0x803, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)) r1 = socket(0x1, 0x803, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r3 = socket$inet6(0xa, 0x1, 0x8010000000000084) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, 0x0, 0x8, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2c41, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x14, 0x0, &(0x7f0000000040)="8c03fa92b5f384c8021b0a08ae03bcaa0db2fbc3"}) listen(r3, 0x7) writev(0xffffffffffffffff, &(0x7f0000000040)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x48}], 0x1) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000b40)=@ipv6_newaddr={0x34, 0x14, 0x9535393fea6295b5, 0x0, 0xfffffffa, {0xa, 0x40, 0x0, 0x0, r2}, [@IFA_LOCAL={0x14, 0x2, @mcast1={0xff, 0x2}}, @IFA_FLAGS={0x8, 0x8, 0x702}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x40000) r7 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=@ipv6_newaddr={0x2c, 0x14, 0x9535393fea6295a5, 0x0, 0x0, {0xa, 0x68, 0x0, 0xc8, r2}, [@IFA_LOCAL={0x14, 0x2, @mcast1={0xff, 0x2}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 4.227548797s ago: executing program 4 (id=56): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x101}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, 0x0, 0xe800) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$rds(0x15, 0x5, 0x0) bind$rds(r4, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r4, &(0x7f0000000080)={&(0x7f0000000180)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r4, 0x89e0, &(0x7f00000001c0)={r4}) 3.017611183s ago: executing program 3 (id=57): sendmsg$NFC_CMD_GET_TARGET(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0x0, 0x100, 0x70bd2b, 0x25dfdbfc, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0xc0) r0 = socket(0x10, 0x3, 0x4) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="780000001000830404000000fedbdf2500007400", @ANYRES32=r2, @ANYBLOB="0108000007500500580012800b0001006272696467650000480002800500190002000000050017"], 0x78}, 0x1, 0x0, 0x0, 0x800}, 0x4000001) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) r5 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x0) ioctl$FE_GET_PROPERTY(r5, 0x80106f53, &(0x7f0000000000)={0x2, &(0x7f0000000180)=[{0x22, '\x00', @data=0x2000a, 0x9}, {0x26, '\x00', @st={0x4, [{0x1, @uvalue=0xfffffffffffffffd}, {0x2, @svalue=0xfffffffffffffc09}, {0x1, @svalue=0x1ff}, {0x2, @svalue=0x1}]}, 0x1c}]}) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000300)={r4}) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000040)={'vcan0\x00', 0x0}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r7 = socket$inet6(0xa, 0x2, 0x0) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r8, 0x84, 0x6f, 0x0, 0x0) r9 = socket$inet_sctp(0x2, 0x1, 0x84) r10 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000740)={&(0x7f0000000040)=ANY=[@ANYRES8=r6], 0x0, 0x35}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000040)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00, 0x4f, '\x00', 0x0, 0x0, r10, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) utime(0x0, &(0x7f0000000040)={0x0, 0x100000001}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x18, 0x0, 0x0, 0x0, 0x8, 0xffffffba, 0x0, 0x40f00, 0x5, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0xd4, 0x0, 0x50}, 0x94) getsockopt$inet_sctp_SCTP_MAX_BURST(r9, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r8, 0x84, 0x85, &(0x7f0000000000)={r11, @in={{0x2, 0x0, @empty}}, 0x27c0}, 0x90) setsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000340)={r11, 0x8, 0x80000001, 0x7}, 0x10) setsockopt$sock_int(r7, 0x1, 0x29, &(0x7f0000000100)=0x9, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x0, 0x0, 0x0, 0xccd21cca, 0x0, 0x0, 0x0, 0x0, '\x00', r6, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) io_uring_register$IORING_REGISTER_ZCRX_IFQ(0xffffffffffffffff, 0x20, &(0x7f0000000440)={0x7, 0x0, 0xd37, 0x0, &(0x7f0000000380)={&(0x7f0000000340), 0x0, 0xd, 0x1, 0x3}, &(0x7f0000000400)={&(0x7f00000003c0)="703916dc4950336c0ee192283572ddbd66a2fa826890fb1a1e78fd4dcd9978183809e913b45b138302ea4aa9c5de10f3fb605dd904dfc80a28e9826c4128353d", 0x40, 0x0, 0x8, 0x100000001}, {0xffffffff, 0x3, 0x7ff}, 0xfffffffb}, 0x1) r12 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB='h'], 0x68}, 0x9}, 0x0) syz_usb_connect$cdc_ecm(0x2, 0x5c, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000090000202505a1a440000000010109024a000101000000090400401702020000052406000005240000000d240f010000000006000000200624070407000905810340000000000905820210000000000905030240"], 0x0) 2.807118985s ago: executing program 4 (id=58): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0xa27}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000280)='net/route\x00') preadv(r3, &(0x7f0000000140)=[{&(0x7f00000003c0)=""/136, 0x88}], 0x1, 0x6, 0x4) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r6, 0x6, 0x16, &(0x7f0000000140), 0x0) getsockopt$sock_int(r5, 0x1, 0xc, 0x0, &(0x7f0000000180)) mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x8, 0x32, 0xffffffffffffffff, 0x0) r7 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) r8 = syz_open_dev$sndpcmc(&(0x7f00000001a0), 0x0, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r8, 0xc2604111, &(0x7f00000001c0)={0x5, [[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0x6, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0x3], [0xffffffff, 0xffffffff, 0xfffffffe, 0xffffffff, 0xffffffff, 0xffffdfff, 0xffffffff, 0xffffffff]], '\x00', [{0xd, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x1f, 0x0, 0x0, 0x1}, {0x2, 0x1e, 0x0, 0x0, 0x1}, {0x9, 0xac44, 0x0, 0x0, 0x1}, {0x1388, 0x186a0, 0x0, 0x0, 0x1}, {0x100, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x1003, 0x0, 0x0, 0x1}, {0x2, 0x8, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1, 0x1}, {0x400, 0x1000, 0x0, 0x0, 0x1}, {0xffc, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4200, 0x0, 0x0, 0x1}]}) ioctl$FE_SET_PROPERTY(r7, 0x40106f52, &(0x7f0000000100)={0x3, &(0x7f00000002c0)=[{0x1b, '\x00', @st={0x4, [{0x3, @svalue=0x5}, {0x2, @svalue=0x7}, {0x1, @svalue=0x3}, {0x3, @svalue=0xfffffffffffffffe}]}, 0x2}, {0x2b, '\x00', @data=0x5, 0xe6}, {0x14, '\x00', @buffer={"eee71374dcf206a004631100ed51ffbae1ccbb88521c42f8c600", 0x20}, 0x4}]}) pidfd_send_signal(0xffffffffffffffff, 0x19, &(0x7f0000001fc0)={0x5, 0x546d0581, 0xc}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="21000000000000002c00128009000100626f6e64000000001c000280050021"], 0x4c}}, 0x0) 1.078797272s ago: executing program 4 (id=59): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="020000000400"], 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) io_setup(0x2, &(0x7f0000000000)) connect(r3, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$x25(0x9, 0x5, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x44004) recvmsg(0xffffffffffffffff, &(0x7f00000029c0)={0x0, 0x0, 0x0}, 0x40010120) openat$sequencer(0xffffff9c, &(0x7f0000000100), 0x8ec02, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000300)={0x0, 0x38, &(0x7f0000000180)=[@in6={0xa, 0x4e22, 0x3, @remote, 0x40}, @in6={0xa, 0x4e22, 0x0, @private1, 0x80000001}]}, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000080)=0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x3, 0x1c, &(0x7f0000001840)=@ringbuf={{0x18, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, {}, {}, [@snprintf={{}, {0x5, 0x3, 0x3, 0xa, 0x9}, {0x5}, {0x3, 0x3, 0x3, 0xa, 0xa}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}, {}, {0x15, 0x0, 0x0, 0x76}}], {{}, {0x5}, {0x28}}}, &(0x7f00000003c0)='GPL\x00', 0x7, 0x0, 0x0, 0x41100, 0x6e, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) 0s ago: executing program 2 (id=60): r0 = gettid() prlimit64(r0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) sendto(r2, 0x0, 0x0, 0x1, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xe, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9}, [@generic={0x63, 0x1, 0x0, 0x1}]}, &(0x7f0000000780)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x6a, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r8) r9 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl(r9, 0x89e1, &(0x7f00000000c0)='lapb0') kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.65' (ED25519) to the list of known hosts. [ 87.008332][ T842] cfg80211: failed to load regulatory.db [ 89.422802][ T5576] cgroup: Unknown subsys name 'net' [ 89.645498][ T5576] cgroup: Unknown subsys name 'cpuset' [ 89.689459][ T5576] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 91.647445][ T5576] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 94.245301][ T5598] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 94.247596][ T5598] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 94.249209][ T5598] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 94.294743][ T5600] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 94.314904][ T5600] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 94.333817][ T5604] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 94.343153][ T5604] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 94.343544][ T5604] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 94.345145][ T5604] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 94.346035][ T5604] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 94.346991][ T5604] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 94.347250][ T5604] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 94.350833][ T5604] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 94.382036][ T4903] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 94.390410][ T4903] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 94.489581][ T5600] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 94.502224][ T5600] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 94.502933][ T5600] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 94.504409][ T5600] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 94.506190][ T5600] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 94.604051][ T60] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 94.610654][ T60] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 94.612362][ T60] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 94.617725][ T60] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 94.636046][ T60] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 96.409917][ T5604] Bluetooth: hci4: command tx timeout [ 96.499752][ T5604] Bluetooth: hci3: command tx timeout [ 96.569713][ T5604] Bluetooth: hci0: command tx timeout [ 96.648844][ T5604] Bluetooth: hci1: command tx timeout [ 96.729120][ T5604] Bluetooth: hci2: command tx timeout [ 97.255542][ T5593] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.256628][ T5593] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.256746][ T5593] bridge_slave_0: entered allmulticast mode [ 97.258470][ T5593] bridge_slave_0: entered promiscuous mode [ 97.289591][ T5596] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.289737][ T5596] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.289938][ T5596] bridge_slave_0: entered allmulticast mode [ 97.291581][ T5596] bridge_slave_0: entered promiscuous mode [ 97.327637][ T5593] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.327769][ T5593] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.328304][ T5593] bridge_slave_1: entered allmulticast mode [ 97.351231][ T5593] bridge_slave_1: entered promiscuous mode [ 97.353423][ T5594] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.353499][ T5594] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.353646][ T5594] bridge_slave_0: entered allmulticast mode [ 97.355292][ T5594] bridge_slave_0: entered promiscuous mode [ 97.391268][ T5596] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.391347][ T5596] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.391488][ T5596] bridge_slave_1: entered allmulticast mode [ 97.393225][ T5596] bridge_slave_1: entered promiscuous mode [ 97.442500][ T5594] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.442591][ T5594] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.442708][ T5594] bridge_slave_1: entered allmulticast mode [ 97.444500][ T5594] bridge_slave_1: entered promiscuous mode [ 97.483220][ T5595] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.483364][ T5595] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.483543][ T5595] bridge_slave_0: entered allmulticast mode [ 97.485145][ T5595] bridge_slave_0: entered promiscuous mode [ 97.551832][ T5595] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.551943][ T5595] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.552045][ T5595] bridge_slave_1: entered allmulticast mode [ 97.553665][ T5595] bridge_slave_1: entered promiscuous mode [ 97.586024][ T5593] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 97.607340][ T5596] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 97.641340][ T5593] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 97.646162][ T5594] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 97.659668][ T5596] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 97.659908][ T5592] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.660030][ T5592] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.660188][ T5592] bridge_slave_0: entered allmulticast mode [ 97.665887][ T5592] bridge_slave_0: entered promiscuous mode [ 97.713559][ T5594] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 97.730815][ T5592] bridge0: port 2(bridge_slave_1) entered blocking state [ 97.730969][ T5592] bridge0: port 2(bridge_slave_1) entered disabled state [ 97.731115][ T5592] bridge_slave_1: entered allmulticast mode [ 97.733493][ T5592] bridge_slave_1: entered promiscuous mode [ 97.737066][ T5595] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 97.810035][ T5595] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 97.812016][ T5593] team0: Port device team_slave_0 added [ 97.840131][ T5596] team0: Port device team_slave_0 added [ 97.873958][ T5593] team0: Port device team_slave_1 added [ 97.876252][ T5594] team0: Port device team_slave_0 added [ 97.878495][ T5596] team0: Port device team_slave_1 added [ 97.883348][ T5592] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 97.922329][ T5594] team0: Port device team_slave_1 added [ 97.924665][ T5592] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 97.951706][ T5595] team0: Port device team_slave_0 added [ 98.007849][ T5595] team0: Port device team_slave_1 added [ 98.016454][ T5593] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 98.016468][ T5593] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.016484][ T5593] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 98.094257][ T5596] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 98.094277][ T5596] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.094293][ T5596] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 98.117550][ T5593] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 98.117570][ T5593] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.117603][ T5593] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 98.120876][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 98.120892][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.120917][ T5594] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 98.127046][ T5592] team0: Port device team_slave_0 added [ 98.133280][ T5596] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 98.133297][ T5596] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.133322][ T5596] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 98.172091][ T5594] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 98.172111][ T5594] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.172135][ T5594] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 98.177698][ T5592] team0: Port device team_slave_1 added [ 98.200825][ T5595] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 98.200843][ T5595] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.200868][ T5595] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 98.248047][ T5595] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 98.248064][ T5595] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.248090][ T5595] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 98.317408][ T5592] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 98.317427][ T5592] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.317451][ T5592] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 98.392820][ T5592] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 98.392838][ T5592] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 98.392863][ T5592] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 98.408234][ T5593] hsr_slave_0: entered promiscuous mode [ 98.410328][ T5593] hsr_slave_1: entered promiscuous mode [ 98.490452][ T5604] Bluetooth: hci4: command tx timeout [ 98.506350][ T5594] hsr_slave_0: entered promiscuous mode [ 98.507736][ T5594] hsr_slave_1: entered promiscuous mode [ 98.512454][ T5594] debugfs: 'hsr0' already exists in 'hsr' [ 98.512569][ T5594] Cannot create hsr debugfs directory [ 98.525898][ T5596] hsr_slave_0: entered promiscuous mode [ 98.527519][ T5596] hsr_slave_1: entered promiscuous mode [ 98.528456][ T5596] debugfs: 'hsr0' already exists in 'hsr' [ 98.528488][ T5596] Cannot create hsr debugfs directory [ 98.579288][ T5604] Bluetooth: hci3: command tx timeout [ 98.597730][ T5595] hsr_slave_0: entered promiscuous mode [ 98.598565][ T5595] hsr_slave_1: entered promiscuous mode [ 98.600381][ T5595] debugfs: 'hsr0' already exists in 'hsr' [ 98.600406][ T5595] Cannot create hsr debugfs directory [ 98.648939][ T5604] Bluetooth: hci0: command tx timeout [ 98.728821][ T5604] Bluetooth: hci1: command tx timeout [ 98.808926][ T5604] Bluetooth: hci2: command tx timeout [ 99.168109][ T5592] hsr_slave_0: entered promiscuous mode [ 99.169430][ T5592] hsr_slave_1: entered promiscuous mode [ 99.170443][ T5592] debugfs: 'hsr0' already exists in 'hsr' [ 99.170469][ T5592] Cannot create hsr debugfs directory [ 99.858280][ T5593] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 99.890527][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 99.897501][ T5593] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 99.952871][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 99.956064][ T5593] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 99.986542][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 100.007084][ T5593] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 100.024247][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 100.159925][ T5594] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 100.193216][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 100.206346][ T5594] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 100.234612][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 100.247063][ T5594] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 100.283123][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 100.305111][ T5594] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 100.344872][ T5594] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 100.501383][ T5595] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 100.546107][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 100.557280][ T5595] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 100.569267][ T5604] Bluetooth: hci4: command tx timeout [ 100.590682][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 100.594689][ T5595] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 100.623884][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 100.656250][ T5595] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 100.659379][ T5604] Bluetooth: hci3: command tx timeout [ 100.693360][ T5595] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 100.729642][ T5604] Bluetooth: hci0: command tx timeout [ 100.808807][ T5604] Bluetooth: hci1: command tx timeout [ 100.868753][ T5596] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 100.888824][ T5604] Bluetooth: hci2: command tx timeout [ 100.911917][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 100.925586][ T5596] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 100.964747][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 100.976305][ T5596] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 101.003290][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 101.034178][ T5596] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 101.061756][ T5596] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 101.224577][ T5593] 8021q: adding VLAN 0 to HW filter on device bond0 [ 101.227873][ T5592] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 101.264663][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 101.277050][ T5592] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 101.303919][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 101.307474][ T5592] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 101.332401][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 101.338628][ T5592] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 101.383627][ T5592] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 101.457385][ T5593] 8021q: adding VLAN 0 to HW filter on device team0 [ 101.481657][ T5594] 8021q: adding VLAN 0 to HW filter on device bond0 [ 101.517338][ T1013] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.518047][ T1013] bridge0: port 1(bridge_slave_0) entered forwarding state [ 101.573687][ T1013] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.573924][ T1013] bridge0: port 2(bridge_slave_1) entered forwarding state [ 101.627488][ T5594] 8021q: adding VLAN 0 to HW filter on device team0 [ 101.664197][ T5595] 8021q: adding VLAN 0 to HW filter on device bond0 [ 101.672299][ T1013] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.672515][ T1013] bridge0: port 1(bridge_slave_0) entered forwarding state [ 101.731534][ T1013] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.731644][ T1013] bridge0: port 2(bridge_slave_1) entered forwarding state [ 101.848227][ T5595] 8021q: adding VLAN 0 to HW filter on device team0 [ 101.891741][ T1499] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.891836][ T1499] bridge0: port 1(bridge_slave_0) entered forwarding state [ 101.979078][ T5596] 8021q: adding VLAN 0 to HW filter on device bond0 [ 102.003402][ T1013] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.003643][ T1013] bridge0: port 2(bridge_slave_1) entered forwarding state [ 102.164622][ T5596] 8021q: adding VLAN 0 to HW filter on device team0 [ 102.212672][ T5592] 8021q: adding VLAN 0 to HW filter on device bond0 [ 102.244488][ T1499] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.244725][ T1499] bridge0: port 1(bridge_slave_0) entered forwarding state [ 102.385391][ T1524] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.385592][ T1524] bridge0: port 2(bridge_slave_1) entered forwarding state [ 102.452756][ T5592] 8021q: adding VLAN 0 to HW filter on device team0 [ 102.536595][ T1013] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.543318][ T1013] bridge0: port 1(bridge_slave_0) entered forwarding state [ 102.650380][ T1013] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.650547][ T1013] bridge0: port 2(bridge_slave_1) entered forwarding state [ 102.662956][ T5604] Bluetooth: hci4: command tx timeout [ 102.730025][ T5604] Bluetooth: hci3: command tx timeout [ 102.808864][ T5604] Bluetooth: hci0: command tx timeout [ 102.900928][ T5604] Bluetooth: hci1: command tx timeout [ 102.968823][ T5604] Bluetooth: hci2: command tx timeout [ 103.186055][ T5593] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 103.623817][ T5593] veth0_vlan: entered promiscuous mode [ 103.701935][ T5593] veth1_vlan: entered promiscuous mode [ 104.044108][ T5593] veth0_macvtap: entered promiscuous mode [ 104.083030][ T5593] veth1_macvtap: entered promiscuous mode [ 104.145018][ T5594] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 104.270439][ T5593] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 104.349362][ T5595] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 104.356565][ T5593] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 104.826106][ T5596] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 104.883450][ T5594] veth0_vlan: entered promiscuous mode [ 105.024095][ T5592] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 105.069741][ T5594] veth1_vlan: entered promiscuous mode [ 105.191362][ T1512] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.191388][ T1512] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.335977][ T5596] veth0_vlan: entered promiscuous mode [ 105.347653][ T1444] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 105.347676][ T1444] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 105.383531][ T5594] veth0_macvtap: entered promiscuous mode [ 105.405910][ T5595] veth0_vlan: entered promiscuous mode [ 105.458511][ T5594] veth1_macvtap: entered promiscuous mode [ 105.474260][ T5596] veth1_vlan: entered promiscuous mode [ 105.484739][ T5592] veth0_vlan: entered promiscuous mode [ 105.519025][ T5595] veth1_vlan: entered promiscuous mode [ 105.552150][ T5592] veth1_vlan: entered promiscuous mode [ 105.571249][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 105.610915][ T5594] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 105.719806][ T5596] veth0_macvtap: entered promiscuous mode [ 105.732687][ T5593] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 105.866881][ T5595] veth0_macvtap: entered promiscuous mode [ 105.889494][ T5596] veth1_macvtap: entered promiscuous mode [ 105.975499][ T5595] veth1_macvtap: entered promiscuous mode [ 106.121090][ T5592] veth0_macvtap: entered promiscuous mode [ 106.240550][ T5592] veth1_macvtap: entered promiscuous mode [ 106.385974][ T5596] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 106.470215][ T5595] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 106.502256][ T1444] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 106.502281][ T1444] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 106.519528][ T5784] FAULT_INJECTION: forcing a failure. [ 106.519528][ T5784] name failslab, interval 1, probability 0, space 0, times 1 [ 106.519564][ T5784] CPU: 0 UID: 0 PID: 5784 Comm: syz.2.6 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 106.519587][ T5784] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 106.519599][ T5784] Call Trace: [ 106.519608][ T5784] [ 106.519617][ T5784] dump_stack_lvl+0xe8/0x150 [ 106.519651][ T5784] should_fail_ex+0x46b/0x600 [ 106.519682][ T5784] should_failslab+0xa8/0x100 [ 106.519714][ T5784] kmem_cache_alloc_node_noprof+0xac/0x660 [ 106.519740][ T5784] ? __alloc_skb+0x1db/0x7a0 [ 106.519768][ T5784] ? __alloc_skb+0x1db/0x7a0 [ 106.519814][ T5784] __alloc_skb+0x1db/0x7a0 [ 106.519848][ T5784] netlink_sendmsg+0x5d4/0xb40 [ 106.519873][ T5784] ? lockdep_unlock+0x5c/0xd0 [ 106.519903][ T5784] ? __pfx_netlink_sendmsg+0x10/0x10 [ 106.519928][ T5784] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 106.519966][ T5784] ? __pfx_netlink_sendmsg+0x10/0x10 [ 106.519989][ T5784] sock_sendmsg_nosec+0x13a/0x180 [ 106.520018][ T5784] ____sys_sendmsg+0x565/0x870 [ 106.520047][ T5784] ? __pfx_____sys_sendmsg+0x10/0x10 [ 106.520077][ T5784] ? import_iovec+0x73/0xa0 [ 106.520108][ T5784] ___sys_sendmsg+0x2a5/0x360 [ 106.520128][ T5784] ? __lock_acquire+0x747/0x2de0 [ 106.520157][ T5784] ? __pfx____sys_sendmsg+0x10/0x10 [ 106.520212][ T5784] ? __fget_files+0x2a/0x420 [ 106.520232][ T5784] ? __fget_files+0x3a8/0x420 [ 106.520263][ T5784] __x64_sys_sendmsg+0x1b7/0x290 [ 106.520286][ T5784] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 106.520328][ T5784] do_syscall_64+0x166/0x520 [ 106.520356][ T5784] ? trace_irq_disable+0x3b/0x140 [ 106.520381][ T5784] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.520401][ T5784] ? clear_bhb_loop+0x70/0xc0 [ 106.520426][ T5784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.520446][ T5784] RIP: 0033:0x7f56d4fee159 [ 106.520465][ T5784] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 106.520481][ T5784] RSP: 002b:00007f56d3246028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 106.520503][ T5784] RAX: ffffffffffffffda RBX: 00007f56d5275fa0 RCX: 00007f56d4fee159 [ 106.520518][ T5784] RDX: 0000000000004000 RSI: 0000200000000480 RDI: 0000000000000003 [ 106.520531][ T5784] RBP: 00007f56d3246090 R08: 0000000000000000 R09: 0000000000000000 [ 106.520543][ T5784] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 106.520555][ T5784] R13: 00007f56d5276038 R14: 00007f56d5275fa0 R15: 00007ffcd6975e08 [ 106.520586][ T5784] [ 106.520819][ T5596] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 106.620338][ T5595] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 106.638370][ T5592] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 106.950576][ T5592] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 107.052097][ T5788] FAULT_INJECTION: forcing a failure. [ 107.052097][ T5788] name failslab, interval 1, probability 0, space 0, times 0 [ 107.052163][ T5788] CPU: 0 UID: 0 PID: 5788 Comm: syz.2.7 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 107.052189][ T5788] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 107.052202][ T5788] Call Trace: [ 107.052212][ T5788] [ 107.052221][ T5788] dump_stack_lvl+0xe8/0x150 [ 107.052261][ T5788] should_fail_ex+0x46b/0x600 [ 107.052296][ T5788] should_failslab+0xa8/0x100 [ 107.052333][ T5788] __kmalloc_cache_noprof+0xa1/0x680 [ 107.052365][ T5788] ? ip6_setup_cork+0x6f1/0xfb0 [ 107.052389][ T5788] ? ip6_setup_cork+0x6f1/0xfb0 [ 107.052421][ T5788] ip6_setup_cork+0x6f1/0xfb0 [ 107.052444][ T5788] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 107.052488][ T5788] ip6_make_skb+0x1e7/0x350 [ 107.052522][ T5788] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 107.052554][ T5788] ? __pfx_ip6_make_skb+0x10/0x10 [ 107.052594][ T5788] ? sk_dst_check+0x307/0x480 [ 107.052630][ T5788] ? ip6_sk_dst_lookup_flow+0x6f3/0xa50 [ 107.052663][ T5788] udpv6_sendmsg+0x1dfb/0x2610 [ 107.052690][ T5788] ? lockdep_hardirqs_on+0x7b/0x110 [ 107.052739][ T5788] ? __pfx_udpv6_sendmsg+0x10/0x10 [ 107.052797][ T5788] ? __asan_memset+0x22/0x50 [ 107.052833][ T5788] ? inet_send_prepare+0x5b/0x260 [ 107.052863][ T5788] ? inet6_sendmsg+0xe4/0x120 [ 107.052896][ T5788] ? __pfx_inet6_sendmsg+0x10/0x10 [ 107.052925][ T5788] sock_sendmsg_nosec+0x90/0x180 [ 107.052958][ T5788] ____sys_sendmsg+0x565/0x870 [ 107.052992][ T5788] ? __pfx_____sys_sendmsg+0x10/0x10 [ 107.053026][ T5788] ? import_iovec+0x73/0xa0 [ 107.053062][ T5788] ___sys_sendmsg+0x2a5/0x360 [ 107.053085][ T5788] ? __lock_acquire+0x747/0x2de0 [ 107.053119][ T5788] ? __pfx____sys_sendmsg+0x10/0x10 [ 107.053181][ T5788] ? __fget_files+0x2a/0x420 [ 107.053204][ T5788] ? __fget_files+0x3a8/0x420 [ 107.053239][ T5788] __sys_sendmmsg+0x279/0x4d0 [ 107.053270][ T5788] ? __pfx___sys_sendmmsg+0x10/0x10 [ 107.053339][ T5788] __x64_sys_sendmmsg+0xa0/0xc0 [ 107.053366][ T5788] do_syscall_64+0x166/0x520 [ 107.053400][ T5788] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.053423][ T5788] ? clear_bhb_loop+0x70/0xc0 [ 107.053452][ T5788] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 107.053474][ T5788] RIP: 0033:0x7f56d4fee159 [ 107.053495][ T5788] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 107.053522][ T5788] RSP: 002b:00007f56d3204028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 107.053547][ T5788] RAX: ffffffffffffffda RBX: 00007f56d5276180 RCX: 00007f56d4fee159 [ 107.053564][ T5788] RDX: 000000000000003b RSI: 0000200000001840 RDI: 0000000000000005 [ 107.053578][ T5788] RBP: 00007f56d3204090 R08: 0000000000000000 R09: 0000000000000000 [ 107.053592][ T5788] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 107.053606][ T5788] R13: 00007f56d5276218 R14: 00007f56d5276180 R15: 00007ffcd6975e08 [ 107.053642][ T5788] [ 108.256232][ T158] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 108.256259][ T158] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.145870][ T5798] Zero length message leads to an empty skb [ 109.252769][ T1948] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.252795][ T1948] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.474808][ T1948] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.476671][ T57] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.495386][ T158] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.495808][ T158] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.496198][ T158] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.496474][ T158] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 109.672529][ T1444] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.672556][ T1444] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.778859][ T57] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 109.778893][ T57] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 109.952313][ T5804] FAULT_INJECTION: forcing a failure. [ 109.952313][ T5804] name failslab, interval 1, probability 0, space 0, times 0 [ 109.952382][ T5804] CPU: 1 UID: 0 PID: 5804 Comm: syz.3.4 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 109.952408][ T5804] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 109.952421][ T5804] Call Trace: [ 109.952431][ T5804] [ 109.952440][ T5804] dump_stack_lvl+0xe8/0x150 [ 109.952480][ T5804] should_fail_ex+0x46b/0x600 [ 109.952516][ T5804] should_failslab+0xa8/0x100 [ 109.952553][ T5804] __kmalloc_cache_noprof+0xa1/0x680 [ 109.952586][ T5804] ? ip6_setup_cork+0x6f1/0xfb0 [ 109.952610][ T5804] ? ip6_setup_cork+0x6f1/0xfb0 [ 109.952641][ T5804] ip6_setup_cork+0x6f1/0xfb0 [ 109.952676][ T5804] ip6_make_skb+0x1e7/0x350 [ 109.952701][ T5804] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 109.952733][ T5804] ? __pfx_ip6_make_skb+0x10/0x10 [ 109.952774][ T5804] ? xfrm_lookup_route+0x103/0x1c0 [ 109.952800][ T5804] ? ip6_sk_dst_lookup_flow+0x856/0xa50 [ 109.952835][ T5804] udpv6_sendmsg+0x1dfb/0x2610 [ 109.952888][ T5804] ? __pfx_udpv6_sendmsg+0x10/0x10 [ 109.952947][ T5804] ? __asan_memset+0x22/0x50 [ 109.952983][ T5804] ? inet_send_prepare+0x5b/0x260 [ 109.953012][ T5804] ? inet6_sendmsg+0xe4/0x120 [ 109.953045][ T5804] ? __pfx_inet6_sendmsg+0x10/0x10 [ 109.953076][ T5804] sock_sendmsg_nosec+0x90/0x180 [ 109.953111][ T5804] ____sys_sendmsg+0x565/0x870 [ 109.953145][ T5804] ? __pfx_____sys_sendmsg+0x10/0x10 [ 109.953180][ T5804] ? import_iovec+0x73/0xa0 [ 109.953216][ T5804] ___sys_sendmsg+0x2a5/0x360 [ 109.953239][ T5804] ? __lock_acquire+0x747/0x2de0 [ 109.953273][ T5804] ? __pfx____sys_sendmsg+0x10/0x10 [ 109.953336][ T5804] ? __fget_files+0x2a/0x420 [ 109.953360][ T5804] ? __fget_files+0x3a8/0x420 [ 109.953393][ T5804] __sys_sendmmsg+0x279/0x4d0 [ 109.953424][ T5804] ? __pfx___sys_sendmmsg+0x10/0x10 [ 109.953494][ T5804] __x64_sys_sendmmsg+0xa0/0xc0 [ 109.953520][ T5804] do_syscall_64+0x166/0x520 [ 109.953555][ T5804] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.953578][ T5804] ? clear_bhb_loop+0x70/0xc0 [ 109.953606][ T5804] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 109.953629][ T5804] RIP: 0033:0x7f611471e159 [ 109.953650][ T5804] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 109.953669][ T5804] RSP: 002b:00007f6112934028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 109.953694][ T5804] RAX: ffffffffffffffda RBX: 00007f61149a6180 RCX: 00007f611471e159 [ 109.953710][ T5804] RDX: 000000000000003b RSI: 0000200000001840 RDI: 0000000000000005 [ 109.953725][ T5804] RBP: 00007f6112934090 R08: 0000000000000000 R09: 0000000000000000 [ 109.953739][ T5804] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 109.953753][ T5804] R13: 00007f61149a6218 R14: 00007f61149a6180 R15: 00007ffe71b7c118 [ 109.953788][ T5804] [ 110.898706][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 110.918717][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 110.928720][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 110.938712][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 111.226374][ T1512] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.226392][ T1512] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.426081][ T1444] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 111.426100][ T1444] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 111.491274][ T4194] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.492233][ T4194] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.492548][ T4194] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 111.492824][ T4194] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.528718][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 112.608714][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 112.628692][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 112.708697][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 112.848713][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 112.928715][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 113.393418][ T88] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.553378][ T1013] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 113.553403][ T1013] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 113.688974][ T4194] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 113.711873][ T4194] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.979206][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 114.979827][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.091467][ T158] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.091753][ T158] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.092044][ T158] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.092231][ T158] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.092470][ T158] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 115.139424][ T5820] FAULT_INJECTION: forcing a failure. [ 115.139424][ T5820] name failslab, interval 1, probability 0, space 0, times 0 [ 115.139463][ T5820] CPU: 1 UID: 0 PID: 5820 Comm: syz.2.14 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 115.139487][ T5820] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 115.139499][ T5820] Call Trace: [ 115.139508][ T5820] [ 115.139518][ T5820] dump_stack_lvl+0xe8/0x150 [ 115.139553][ T5820] should_fail_ex+0x46b/0x600 [ 115.139583][ T5820] ? sock_alloc_inode+0x2c/0x1a0 [ 115.139612][ T5820] should_failslab+0xa8/0x100 [ 115.139644][ T5820] kmem_cache_alloc_lru_noprof+0xa2/0x680 [ 115.139673][ T5820] ? sock_alloc_inode+0x2c/0x1a0 [ 115.139703][ T5820] ? __pfx_sock_alloc_inode+0x10/0x10 [ 115.139729][ T5820] sock_alloc_inode+0x2c/0x1a0 [ 115.139754][ T5820] ? __pfx_sock_alloc_inode+0x10/0x10 [ 115.139778][ T5820] alloc_inode+0x6a/0x1b0 [ 115.139811][ T5820] __sock_create+0x12d/0x9d0 [ 115.139848][ T5820] __sys_socket+0xd6/0x1b0 [ 115.139879][ T5820] __x64_sys_socket+0x7a/0x90 [ 115.139908][ T5820] do_syscall_64+0x166/0x520 [ 115.139938][ T5820] ? trace_irq_disable+0x3b/0x140 [ 115.139964][ T5820] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 115.139984][ T5820] ? clear_bhb_loop+0x70/0xc0 [ 115.140009][ T5820] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 115.140030][ T5820] RIP: 0033:0x7f56d4fee159 [ 115.140050][ T5820] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 115.140067][ T5820] RSP: 002b:00007f56d3246028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 115.140090][ T5820] RAX: ffffffffffffffda RBX: 00007f56d5275fa0 RCX: 00007f56d4fee159 [ 115.140105][ T5820] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000002 [ 115.140117][ T5820] RBP: 00007f56d508506b R08: 0000000000000000 R09: 0000000000000000 [ 115.140130][ T5820] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 115.140143][ T5820] R13: 00007f56d5276038 R14: 00007f56d5275fa0 R15: 00007ffcd6975e08 [ 115.140174][ T5820] [ 115.140326][ T5820] socket: no more sockets [ 116.003272][ T5830] block nbd4: not configured, cannot reconfigure [ 116.629760][ T5835] i2c-slave-eeprom 0-0001: i2c_slave_register: client slave flag not set. You might see address collisions [ 116.629791][ T5835] i2c-slave-eeprom 0-0001: i2c_slave_register: invalid address [ 116.631112][ T5835] i2c-slave-eeprom 0-0001: probe with driver i2c-slave-eeprom failed with error -22 [ 116.631770][ T5835] i2c i2c-0: new_device: Instantiated device slave-24c02 at 0x01 [ 116.716627][ T5837] fuse: Bad value for 'fd' [ 117.449120][ T5604] Bluetooth: hci3: command 0x0c1a tx timeout [ 117.459498][ T5819] Bluetooth: hci3: Opcode 0x0c1a failed: -110 [ 117.964521][ T5819] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 118.081854][ T5819] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 118.171128][ T5843] capability: warning: `syz.3.16' uses deprecated v2 capabilities in a way that may be insecure [ 118.172657][ T5819] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 118.172762][ T5819] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 118.255747][ T5819] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 118.326712][ T5819] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 118.326814][ T5819] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 118.392085][ T5819] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 118.431625][ T5819] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 118.431723][ T5819] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 118.494612][ T5819] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 118.531609][ T5819] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 118.531714][ T5819] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 118.588459][ T5819] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 119.476107][ T5848] mmap: syz.4.20 (5848) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 119.531099][ T5604] Bluetooth: hci3: command 0x0c1a tx timeout [ 119.802294][ T4970] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 121.005353][ T5604] Bluetooth: hci4: command 0x0c1a tx timeout [ 121.005465][ T5604] Bluetooth: hci0: command 0x0c1a tx timeout [ 121.121361][ T5859] FAULT_INJECTION: forcing a failure. [ 121.121361][ T5859] name failslab, interval 1, probability 0, space 0, times 0 [ 121.121430][ T5859] CPU: 1 UID: 0 PID: 5859 Comm: syz.3.22 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 121.121456][ T5859] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 121.121469][ T5859] Call Trace: [ 121.121479][ T5859] [ 121.121489][ T5859] dump_stack_lvl+0xe8/0x150 [ 121.121528][ T5859] should_fail_ex+0x46b/0x600 [ 121.121564][ T5859] should_failslab+0xa8/0x100 [ 121.121601][ T5859] __kmalloc_cache_noprof+0xa1/0x680 [ 121.121633][ T5859] ? ip6_setup_cork+0x6f1/0xfb0 [ 121.121656][ T5859] ? ip6_setup_cork+0x6f1/0xfb0 [ 121.121689][ T5859] ip6_setup_cork+0x6f1/0xfb0 [ 121.121733][ T5859] ip6_make_skb+0x1e7/0x350 [ 121.121759][ T5859] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 121.121790][ T5859] ? __pfx_ip6_make_skb+0x10/0x10 [ 121.121831][ T5859] ? xfrm_lookup_route+0x103/0x1c0 [ 121.121857][ T5859] ? ip6_sk_dst_lookup_flow+0x856/0xa50 [ 121.121891][ T5859] udpv6_sendmsg+0x1dfb/0x2610 [ 121.121935][ T5859] ? __pfx_udpv6_sendmsg+0x10/0x10 [ 121.122008][ T5859] ? inet6_sendmsg+0x88/0x120 [ 121.122040][ T5859] ? inet6_sendmsg+0xe4/0x120 [ 121.122071][ T5859] ? __pfx_inet6_sendmsg+0x10/0x10 [ 121.122102][ T5859] sock_sendmsg_nosec+0x90/0x180 [ 121.122135][ T5859] ____sys_sendmsg+0x565/0x870 [ 121.122169][ T5859] ? __pfx_____sys_sendmsg+0x10/0x10 [ 121.122203][ T5859] ? import_iovec+0x73/0xa0 [ 121.122238][ T5859] ___sys_sendmsg+0x2a5/0x360 [ 121.122261][ T5859] ? __lock_acquire+0x747/0x2de0 [ 121.122294][ T5859] ? __pfx____sys_sendmsg+0x10/0x10 [ 121.122358][ T5859] ? __fget_files+0x2a/0x420 [ 121.122381][ T5859] ? __fget_files+0x3a8/0x420 [ 121.122416][ T5859] __sys_sendmmsg+0x279/0x4d0 [ 121.122446][ T5859] ? __pfx___sys_sendmmsg+0x10/0x10 [ 121.122516][ T5859] __x64_sys_sendmmsg+0xa0/0xc0 [ 121.122543][ T5859] do_syscall_64+0x166/0x520 [ 121.122577][ T5859] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 121.122600][ T5859] ? clear_bhb_loop+0x70/0xc0 [ 121.122628][ T5859] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 121.122650][ T5859] RIP: 0033:0x7f611471e159 [ 121.122672][ T5859] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 121.122690][ T5859] RSP: 002b:00007f6112934028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 121.122723][ T5859] RAX: ffffffffffffffda RBX: 00007f61149a6180 RCX: 00007f611471e159 [ 121.122740][ T5859] RDX: 000000000000003b RSI: 0000200000001840 RDI: 0000000000000005 [ 121.122755][ T5859] RBP: 00007f6112934090 R08: 0000000000000000 R09: 0000000000000000 [ 121.122769][ T5859] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 121.122782][ T5859] R13: 00007f61149a6218 R14: 00007f61149a6180 R15: 00007ffe71b7c118 [ 121.122818][ T5859] [ 121.869103][ T60] Bluetooth: hci1: command 0x0c1a tx timeout [ 121.869703][ T60] Bluetooth: hci2: command 0x0c1a tx timeout [ 121.869789][ T60] Bluetooth: hci3: command 0x0c1a tx timeout [ 122.572836][ T88] IPVS: starting estimator thread 0... [ 122.758843][ T5864] IPVS: using max 8 ests per chain, 19200 per kthread [ 123.108975][ T5869] syz.1.24 uses obsolete (PF_INET,SOCK_PACKET) [ 123.737425][ T5610] Bluetooth: hci0: command 0x0c1a tx timeout [ 123.738046][ T60] Bluetooth: hci4: command 0x0c1a tx timeout [ 123.931262][ T60] Bluetooth: hci1: command 0x0c1a tx timeout [ 123.931309][ T60] Bluetooth: hci2: command 0x0c1a tx timeout [ 126.889553][ T60] Bluetooth: hci0: command 0x0c1a tx timeout [ 127.028241][ T60] Bluetooth: hci4: command 0x0c1a tx timeout [ 127.031287][ T5610] Bluetooth: hci1: command 0x0c1a tx timeout [ 127.031349][ T60] Bluetooth: hci2: command 0x0c1a tx timeout [ 131.149858][ T49] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 131.347711][ T5922] FAULT_INJECTION: forcing a failure. [ 131.347711][ T5922] name failslab, interval 1, probability 0, space 0, times 0 [ 131.347778][ T5922] CPU: 1 UID: 0 PID: 5922 Comm: syz.2.37 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 131.347805][ T5922] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 131.347818][ T5922] Call Trace: [ 131.347828][ T5922] [ 131.347838][ T5922] dump_stack_lvl+0xe8/0x150 [ 131.347879][ T5922] should_fail_ex+0x46b/0x600 [ 131.347916][ T5922] should_failslab+0xa8/0x100 [ 131.347951][ T5922] __kmalloc_noprof+0xfb/0x790 [ 131.347983][ T5922] ? tomoyo_encode+0x2ad/0x570 [ 131.348013][ T5922] ? tomoyo_encode+0x2ad/0x570 [ 131.348053][ T5922] tomoyo_encode+0x2ad/0x570 [ 131.348092][ T5922] tomoyo_realpath_from_path+0x5fa/0x640 [ 131.348138][ T5922] ? tomoyo_path_number_perm+0x219/0x5f0 [ 131.348167][ T5922] tomoyo_path_number_perm+0x246/0x5f0 [ 131.348199][ T5922] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 131.348271][ T5922] ? __pfx_from_kgid+0x10/0x10 [ 131.348314][ T5922] security_path_chown+0x139/0x340 [ 131.348336][ T5922] chown_common+0x3c0/0x640 [ 131.348369][ T5922] ? __pfx_chown_common+0x10/0x10 [ 131.348407][ T5922] ? sb_start_write+0x117/0x1d0 [ 131.348438][ T5922] ? mnt_want_write_file+0x170/0x210 [ 131.348463][ T5922] ksys_fchown+0xe9/0x160 [ 131.348490][ T5922] __x64_sys_fchown+0x7a/0x90 [ 131.348516][ T5922] do_syscall_64+0x166/0x520 [ 131.348542][ T5922] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 131.348561][ T5922] ? clear_bhb_loop+0x70/0xc0 [ 131.348582][ T5922] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 131.348599][ T5922] RIP: 0033:0x7f56d4fee159 [ 131.348616][ T5922] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 131.348635][ T5922] RSP: 002b:00007f56d3204028 EFLAGS: 00000246 ORIG_RAX: 000000000000005d [ 131.348659][ T5922] RAX: ffffffffffffffda RBX: 00007f56d5276180 RCX: 00007f56d4fee159 [ 131.348674][ T5922] RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000000000006 [ 131.348687][ T5922] RBP: 00007f56d3204090 R08: 0000000000000000 R09: 0000000000000000 [ 131.348698][ T5922] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 131.348709][ T5922] R13: 00007f56d5276218 R14: 00007f56d5276180 R15: 00007ffcd6975e08 [ 131.348738][ T5922] [ 131.349601][ T5922] ERROR: Out of memory at tomoyo_realpath_from_path. [ 131.362864][ T5922] usb usb8: usbfs: process 5922 (syz.2.37) did not claim interface 0 before use [ 132.479854][ T49] usb 1-1: Using ep0 maxpacket: 32 [ 132.499108][ T49] usb 1-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 133.502632][ T49] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 133.502673][ T49] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 133.502717][ T49] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 133.532242][ T49] usb 1-1: config 0 descriptor?? [ 133.558575][ T1329] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.559434][ T1329] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.833359][ T49] usb 1-1: can't set config #0, error -71 [ 133.912961][ T49] usb 1-1: USB disconnect, device number 2 [ 136.065577][ T5935] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 139.253748][ T5952] netlink: 16 bytes leftover after parsing attributes in process `syz.4.46'. [ 139.631131][ T5951] i2c i2c-0: dvb_frontend_start: failed to start kthread (-4) [ 139.631528][ T5952] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 139.790300][ T5948] RDS: rds_bind could not find a transport for fec0:ffff:ffff:ffff::1, load rds_tcp or rds_rdma? [ 146.360985][ T5610] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 146.402986][ T5610] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 146.410621][ T5610] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 146.417058][ T5610] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 146.421083][ T5610] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 146.982544][ T5986] usb usb8: usbfs: process 5986 (syz.3.42) did not claim interface 0 before use [ 148.765195][ T60] Bluetooth: hci5: command tx timeout [ 148.774665][ T5579] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 149.073562][ T5998] netlink: 16 bytes leftover after parsing attributes in process `syz.4.58'. [ 149.369790][ T5997] i2c i2c-0: dvb_frontend_start: failed to start kthread (-4) [ 149.782428][ T5998] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 149.790263][ T5579] usb 4-1: device descriptor read/64, error -71 [ 150.060482][ T5579] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 150.837131][ T5579] usb 4-1: device descriptor read/64, error -71 [ 150.954348][ T5579] usb usb4-port1: attempt power cycle [ 151.035619][ T60] Bluetooth: hci5: command tx timeout [ 152.673158][ T5993] ================================================================== [ 152.673176][ T5993] BUG: KASAN: slab-use-after-free in dvb_frontend_release+0x40d/0x4d0 [ 152.673214][ T5993] Read of size 4 at addr ffff88802c9c5c3c by task syz.3.57/5993 [ 152.673230][ T5993] [ 152.673240][ T5993] CPU: 0 UID: 0 PID: 5993 Comm: syz.3.57 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 152.673261][ T5993] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 152.673272][ T5993] Call Trace: [ 152.673279][ T5993] [ 152.673288][ T5993] dump_stack_lvl+0xe8/0x150 [ 152.673314][ T5993] print_address_description+0x55/0x1e0 [ 152.673340][ T5993] ? dvb_frontend_release+0x40d/0x4d0 [ 152.673357][ T5993] print_report+0x58/0x70 [ 152.673378][ T5993] kasan_report+0x117/0x150 [ 152.673406][ T5993] ? dvb_frontend_release+0x40d/0x4d0 [ 152.673430][ T5993] dvb_frontend_release+0x40d/0x4d0 [ 152.673452][ T5993] ? __pfx_dvb_frontend_release+0x10/0x10 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 152.673473][ T5993] __fput+0x42a/0xa80 [ 152.673492][ T5993] task_work_run+0x1d9/0x270 [ 152.673525][ T5993] ? __pfx_task_work_run+0x10/0x10 [ 152.673548][ T5993] ? rt_spin_unlock+0x165/0x200 [ 152.673576][ T5993] do_exit+0x73a/0x2360 [ 152.673598][ T5993] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 152.673631][ T5993] ? __pfx_do_exit+0x10/0x10 [ 152.673651][ T5993] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 152.673681][ T5993] ? rt_spin_unlock+0x159/0x200 [ 152.673706][ T5993] do_group_exit+0x22d/0x2f0 [ 152.673727][ T5993] ? rt_spin_unlock+0x165/0x200 [ 152.673754][ T5993] get_signal+0x121b/0x12c0 [ 152.673796][ T5993] arch_do_signal_or_restart+0xbb/0x860 [ 152.673829][ T5993] ? __pfx_smack_file_ioctl+0x10/0x10 [ 152.673854][ T5993] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 152.673894][ T5993] exit_to_user_mode_loop+0x10e/0x770 [ 152.673923][ T5993] ? rcu_is_watching+0x16/0xb0 [ 152.673956][ T5993] do_syscall_64+0x328/0x520 [ 152.673988][ T5993] ? trace_irq_disable+0x3b/0x140 [ 152.674016][ T5993] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 152.674038][ T5993] ? clear_bhb_loop+0x70/0xc0 [ 152.674063][ T5993] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 152.674084][ T5993] RIP: 0033:0x7f611471ddeb [ 152.6741 ** replaying previous printk message ** [ 152.674104][ T5993] Code: Unable to access opcode bytes at 0x7f611471ddc1. [ 152.674116][ T5993] RSP: 002b:00007f6112973f00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 152.674141][ T5993] RAX: 0000000000000000 RBX: 000000000000000c RCX: 00007f611471ddeb [ 152.674155][ T5993] RDX: 00007f6112974fd0 RSI: 0000000080085502 RDI: 000000000000000c [ 152.674170][ T5993] RBP: 00007f6112974fd0 R08: 0000000000000040 R09: 00007f6112973fc8 [ 152.674184][ T5993] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000080085502 [ 152.674206][ T5993] R13: 0000000800000000 R14: 0000000000000012 R15: 00007f61147d39b6 [ 152.674230][ T5993] [ 152.674238][ T5993] [ 152.674244][ T5993] Allocated by task 1: [ 152.674253][ T5993] kasan_save_track+0x3e/0x80 [ 152.674280][ T5993] __kasan_kmalloc+0x93/0xb0 [ 152.674308][ T5993] __kmalloc_cache_noprof+0x3d5/0x680 [ 152.674334][ T5993] dvb_register_device+0x309/0x1dd0 [ 152.674355][ T5993] dvb_register_frontend+0x619/0x900 [ 152.674373][ T5993] vidtv_bridge_probe+0x9d5/0xf60 [ 152.674399][ T5993] platform_probe+0xf9/0x190 [ 152.674426][ T5993] really_probe+0x254/0xae0 [ 152.674443][ T5993] __driver_probe_device+0x1e8/0x360 [ 152.674468][ T5993] driver_probe_device+0x4f/0x240 [ 152.674484][ T5993] __driver_attach+0x339/0x600 [ 152.674499][ T5993] bus_for_each_dev+0x23e/0x2c0 [ 152.674519][ T5993] bus_add_driver+0x348/0x670 [ 152.674539][ T5993] driver_register+0x23a/0x320 [ 152.674556][ T5993] vidtv_bridge_init+0x3d/0x60 [ 152.674579][ T5993] do_one_initcall+0x250/0x870 [ 152.674607][ T5993] do_initcall_level+0x10a/0x1a0 [ 152.674630][ T5993] do_initcalls+0x59/0xa0 [ 152.674652][ T5993] kernel_init_freeable+0x29d/0x3e0 [ 152.674675][ T5993] kernel_init+0x22/0x1d0 [ 152.674695][ T5993] ret_from_fork+0x514/0xb70 [ 152.674713][ T5993] ret_from_fork_asm+0x1a/0x30 [ 152.674731][ T5993] [ 152.674736][ T5993] Freed by task 5993: [ 152.674746][ T5993] kasan_save_track+0x3e/0x80 [ 152.674772][ T5993] kasan_save_free_info+0x40/0x50 [ 152.674794][ T5993] __kasan_slab_free+0x5c/0x80 [ 152.674821][ T5993] kfree+0x1c5/0x6d0 [ 152.674843][ T5993] dvb_generic_release+0x123/0x1c0 [ 152.674863][ T5993] dvb_frontend_release+0x138/0x4d0 [ 152.674883][ T5993] __fput+0x42a/0xa80 [ 152.674898][ T5993] task_work_run+0x1d9/0x270 [ 152.674919][ T5993] do_exit+0x73a/0x2360 [ 152.674937][ T5993] do_group_exit+0x22d/0x2f0 [ 152.674955][ T5993] get_signal+0x121b/0x12c0 [ 152.674980][ T5993] arch_do_signal_or_restart+0xbb/0x860 [ 152.675007][ T5993] exit_to_user_mode_loop+0x10e/0x770 [ 152.675031][ T5993] do_syscall_64+0x328/0x520 [ 152.675059][ T5993] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 152.675077][ T5993] [ 152.675082][ T5993] The buggy address belongs to the object at ffff88802c9c5c00 [ 152.675082][ T5993] which belongs to the cache kmalloc-512 of size 512 [ 152.675096][ T5993] The buggy address is located 60 bytes inside of [ 152.675096][ T5993] freed 512-byte region [ffff88802c9c5c00, ffff88802c9c5e00) [ 152.675114][ T5993] [ 152.675118][ T5993] The buggy address belongs to the physical page: [ 152.675128][ T5993] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2c9c4 [ 152.675144][ T5993] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 152.675157][ T5993] flags: 0x80000000000040(head|node=0|zone=1) [ 152.675173][ T5993] page_type: f5(slab) [ 152.675197][ T5993] raw: 0080000000000040 ffff88813ffbdc80 dead000000000100 dead000000000122 [ 152.675212][ T5993] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 152.675228][ T5993] head: 0080000000000040 ffff88813ffbdc80 dead000000000100 dead000000000122 [ 152.675243][ T5993] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 152.675259][ T5993] head: 0080000000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff [ 152.675274][ T5993] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000004 [ 152.675283][ T5993] page dumped because: kasan: bad access detected [ 152.675292][ T5993] page_owner tracks the page as allocated [ 152.675299][ T5993] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 17886318752 [ 152.675339][ T5993] post_alloc_hook+0x1f9/0x250 [ 152.675359][ T5993] get_page_from_freelist+0x2591/0x2600 [ 152.675383][ T5993] __alloc_frozen_pages_noprof+0x230/0x5c0 [ 152.675406][ T5993] allocate_slab+0x7d/0x620 [ 152.675421][ T5993] refill_objects+0x2d8/0x350 [ 152.675436][ T5993] __pcs_replace_empty_main+0x339/0x690 [ 152.675451][ T5993] __kmalloc_cache_noprof+0x46f/0x680 [ 152.675472][ T5993] bus_add_driver+0x165/0x670 [ 152.675491][ T5993] driver_register+0x23a/0x320 [ 152.675507][ T5993] usb_register_driver+0x1e4/0x390 [ 152.675525][ T5993] do_one_initcall+0x250/0x870 [ 152.675548][ T5993] do_initcall_level+0x10a/0x1a0 [ 152.675566][ T5993] do_initcalls+0x59/0xa0 [ 152.675583][ T5993] kernel_init_freeable+0x29d/0x3e0 [ 152.675601][ T5993] kernel_init+0x22/0x1d0 [ 152.675618][ T5993] ret_from_fork+0x514/0xb70 [ 152.675632][ T5993] page_owner free stack trace missing [ 152.675639][ T5993] [ 152.675643][ T5993] Memory state around the buggy address: [ 152.675653][ T5993] ffff88802c9c5b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 152.675665][ T5993] ffff88802c9c5b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 152.675677][ T5993] >ffff88802c9c5c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 152.675686][ T5993] ^ [ 152.675696][ T5993] ffff88802c9c5c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 152.675708][ T5993] ffff88802c9c5d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 152.675716][ T5993] ================================================================== [ 152.900211][ T5993] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 153.458003][ T5993] CPU: 1 UID: 0 PID: 5993 Comm: syz.3.57 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 153.467664][ T5993] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 153.477726][ T5993] Call Trace: [ 153.481110][ T5993] [ 153.484049][ T5993] vpanic+0x56d/0xa60 [ 153.488045][ T5993] ? __pfx_vpanic+0x10/0x10 [ 153.492644][ T5993] ? __pfx___schedule+0x10/0x10 [ 153.497515][ T5993] panic+0xc5/0xd0 [ 153.501239][ T5993] ? __pfx_panic+0x10/0x10 [ 153.505656][ T5993] ? preempt_schedule_common+0x7f/0xd0 [ 153.511132][ T5993] ? dvb_frontend_release+0x40d/0x4d0 [ 153.516510][ T5993] check_panic_on_warn+0x89/0xb0 [ 153.521454][ T5993] ? dvb_frontend_release+0x40d/0x4d0 [ 153.526829][ T5993] end_report+0x73/0x170 [ 153.531098][ T5993] ? dvb_frontend_release+0x40d/0x4d0 [ 153.536472][ T5993] kasan_report+0x128/0x150 [ 153.540989][ T5993] ? dvb_frontend_release+0x40d/0x4d0 [ 153.546365][ T5993] dvb_frontend_release+0x40d/0x4d0 [ 153.551656][ T5993] ? __pfx_dvb_frontend_release+0x10/0x10 [ 153.557465][ T5993] __fput+0x42a/0xa80 [ 153.561465][ T5993] task_work_run+0x1d9/0x270 [ 153.566064][ T5993] ? __pfx_task_work_run+0x10/0x10 [ 153.571183][ T5993] ? rt_spin_unlock+0x165/0x200 [ 153.576230][ T5993] do_exit+0x73a/0x2360 [ 153.580598][ T5993] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 153.586434][ T5993] ? __pfx_do_exit+0x10/0x10 [ 153.591047][ T5993] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 153.596801][ T5993] ? rt_spin_unlock+0x159/0x200 [ 153.601661][ T5993] do_group_exit+0x22d/0x2f0 [ 153.606294][ T5993] ? rt_spin_unlock+0x165/0x200 [ 153.611154][ T5993] get_signal+0x121b/0x12c0 [ 153.615761][ T5993] arch_do_signal_or_restart+0xbb/0x860 [ 153.621434][ T5993] ? __pfx_smack_file_ioctl+0x10/0x10 [ 153.626826][ T5993] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 153.633112][ T5993] exit_to_user_mode_loop+0x10e/0x770 [ 153.638507][ T5993] ? rcu_is_watching+0x16/0xb0 [ 153.643289][ T5993] do_syscall_64+0x328/0x520 [ 153.647899][ T5993] ? trace_irq_disable+0x3b/0x140 [ 153.652936][ T5993] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 153.659098][ T5993] ? clear_bhb_loop+0x70/0xc0 [ 153.663783][ T5993] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 153.669684][ T5993] RIP: 0033:0x7f611471ddeb [ 153.674108][ T5993] Code: Unable to access opcode bytes at 0x7f611471ddc1. [ 153.681215][ T5993] RSP: 002b:00007f6112973f00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 153.689645][ T5993] RAX: 0000000000000000 RBX: 000000000000000c RCX: 00007f611471ddeb [ 153.697628][ T5993] RDX: 00007f6112974fd0 RSI: 0000000080085502 RDI: 000000000000000c [ 153.705605][ T5993] RBP: 00007f6112974fd0 R08: 0000000000000040 R09: 00007f6112973fc8 [ 153.713592][ T5993] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000080085502 [ 153.721772][ T5993] R13: 0000000800000000 R14: 0000000000000012 R15: 00007f61147d39b6 [ 153.729764][ T5993] [ 153.732924][ T5993] Kernel Offset: disabled [ 153.737244][ T5993] Rebooting in 86400 seconds..