last executing test programs: 9.028278414s ago: executing program 2 (id=45): r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) ioctl$SG_IO(r0, 0x2285, &(0x7f00000005c0)={0x53, 0xfffffffffffffffc, 0x6, 0x4, @scatter={0x0, 0x0, 0x0}, &(0x7f00000008c0)="939e00000000", 0x0, 0xffffffff, 0x40, 0x2, 0x0}) r1 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x10000000004e20, 0xfffffffe, @loopback, 0x6}, 0x1c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000240)={0xffffffffffffffff, 0x58, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0xfffffe78) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000400)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @mcast2, 0x5, 0x6, 0x0, 0x100, 0xff, 0xc0000082, r2}) ioctl$BSG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000580)) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r3, 0x800455c9, 0x0) syz_emit_ethernet(0x83, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaf9ff030486dd601b8b97004d88c19e9ace5ffb2e9fc603"], 0x0) r4 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) r7 = syz_open_dev$loop(&(0x7f0000000080), 0x45ffff7, 0x162800) ioctl$LOOP_CONFIGURE(r7, 0x4c0a, &(0x7f0000001ac0)={r6, 0x0, {0x0, 0x0, 0x0, 0x1, 0x200001, 0x0, 0x0, 0x0, 0x14, "339f020bbe82b38b000000000000000000070d0ec0c1b4e9b1c4369d03540250ceaac394b1b3d741dd17c1c500", "a9103939c787a16c1ca43f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d2", "24431a1e77a68e174efff100000000000010e200"}}) r8 = dup(r7) read$FUSE(r8, &(0x7f0000003c40)={0x2020}, 0xffffff0a) write$binfmt_misc(r5, &(0x7f0000000680)="3f7d67eff117da64e2f36ab8cc2ef2f7054c8e34fdcd8ace9de9bdf0241c7937517e1e8cb67ff9be103231daf025cec44b0229e0c3dbf25bae204db6fc4034a40fd36aea12461e6374f189beaaeea987d1dcfb330b6bf408237be278a756447928071ce3b07883e028e86dc6649b", 0x6e) ioctl$LOOP_CONFIGURE(r4, 0x4c0a, &(0x7f00000002c0)={r5, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x14, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0xc, &(0x7f0000000400)="001ca73e", 0x4) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x9, 0x0, &(0x7f00000001c0)) r9 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000105509147200ed0000000109022400010000000009040000030300000009210000000122050009058103"], 0x0) syz_usb_control_io(r9, 0x0, 0x0) syz_usb_control_io(r9, &(0x7f0000000100)={0x2c, &(0x7f0000000280)=ANY=[@ANYBLOB="200617"], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000040)={'syztnl1\x00', 0x0}) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x28c81, 0x0) r10 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r10, 0xffffffffffffffff, 0x0) 7.464192174s ago: executing program 2 (id=51): ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f0000000100)={0x1a, 0x29, 0x8, 0x1b, 0x3, 0x4000d4a, 0x0, 0x16a, 0x1}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) r1 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000640)='\xf0\x891\xb8R\xe6\x8d\x12\xe5\xe3+\xcd24\x01\x80\x1a\xc9A\x93\xb1@\xbf\x89K\xd0\x86\xd9\x86\x18\xc4:\xc3\xe0\xac\xed~\x97\a\xbe\xfb\v1d\xbe\xa1\xc1N\xd2p\xf0\xc6\xf3\x8eD\x1b\xc7q\x99?9\xf1\xe6\f\xa9\x90\xec:\x037\xe8\x0f\rX6\xf2\x88\x8d\r\xd2\xfc+\x19\x9a}\x9c\xd9\x1a\xef\xf1\x16d>ah\xa2\xa7\x02U\x06\xe1\xe1PY\x90\x17\xf0p\x01*!I\xd3$\xd00C\x88*NA\xc3\x95`\xb2\xf1\xb1\xed\x91\xe4\x87\xcf_9\x1eIpAfN\x99\xa9\v)\x98p\xea[\xc5&D\xe7\xf3\xba/\xcd\xdb\x9dz\xb2\xbf\xc6\xea?\x13(\x15\xc1\tm\xe7t,[\x14|bM\xfa\xeb\x91\xb0\xdfAR\xf3\xe2', &(0x7f0000000300)='\x01\x0e!5\xd8\xf2\x92\x97\x86\xf9\xa8\xe7;\xdff3\x83\xb1a\xc9\xe1\x90\x10@\x1chOK\x98\xae\xd6>\xbaN\x1d_N\xcbdIP2$\xbc\xc9\x89\xb5\n\x90-i%\xe2\x94\fH\xf1\xed\r\b\x17\x81>\t\xc30-\xe2\xb3\xb00x0}) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001040)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r6, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_CE_THRESHOLD={0x8, 0x5, 0x4}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r5, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x30, 0x1410, 0x200, 0x70bd29, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x3}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x40084}, 0x4088094) r7 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r7, &(0x7f00000005c0)="bad330fbc9b55400040000ea0756a85d86dd", 0x12, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r6, 0x1, 0xd8, 0x6, @multicast}, 0x14) r8 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r8, &(0x7f0000000540)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a066f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0effeffe809005300fff5dd00000004000100080c1000000000", 0x53}], 0x1) socket$netlink(0x10, 0x3, 0x0) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), r8) sendmsg$NL80211_CMD_DEL_PMKSA(r4, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000480)=ANY=[@ANYBLOB="7c94ff00", @ANYRES16=r9, @ANYBLOB="000429bd70000d0000003500000008001f016bffffff08001f01040000000a00340001010101010100000a00340002020202020200001400fe004e4f86715e62e58f243f219b7eb6e89b1400fe00ea6f37a5259614b13d69804fcbd17c111400fe00d58fd392fea8425658e5c2304ca6b07308001f01050000000a0034000202020202020000050020014e000000"], 0x6f}}, 0x80) r10 = syz_open_dev$loop(&(0x7f00000000c0), 0x4, 0x28801) ioctl$BLKSECDISCARD(r10, 0x127d, &(0x7f0000000100)=0x1000000000000003) bpf$MAP_CREATE(0xb00000000000014, &(0x7f0000000040)=ANY=[@ANYRES64, @ANYRES32=0x0, @ANYRESHEX, @ANYBLOB="4821953d955a2d6eae260196551bed2c3c568a"], 0x48) 7.021035752s ago: executing program 2 (id=54): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x81, 0x0, 0x9, 0xfffffffffffffffd, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f00006d3000/0x4000)=nil, 0x4000, 0x66) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) syz_clone3(&(0x7f0000001240)={0x2d000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)={0x54, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11, 0x1, 0x0, 0x1}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xffff}]}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x84}, 0x0) io_uring_enter(0xffffffffffffffff, 0x92, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4044001}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000540)={0x14, 0x0, 0x2, 0x101, 0x0, 0x0, {0xa}}, 0x14}}, 0x0) syz_io_uring_setup(0x23c, &(0x7f0000000740)={0x0, 0x1c2c, 0x10100, 0x2, 0x113}, &(0x7f0000000500)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd, 0x0, 0x0, 0x0, {0x609}, 0x1}) fcntl$getownex(r3, 0x10, &(0x7f0000000200)={0x0, 0x0}) sched_getattr(r8, &(0x7f00000002c0)={0x38}, 0x38, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="4800000005000100070000000900020073797a3100000000040007800c0003006899dd127d697000050005000a000020050004000100000028a5e83d427fa9eddc090bc1818f8e970de9565a40539445cd26b86066d5cb513cba77141657f87c35e07a11edcc2e07e79347b52f2ee96535c5"], 0x48}, 0x1, 0x0, 0x0, 0x4004000}, 0x40080) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, 0x4, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) 5.483812512s ago: executing program 2 (id=55): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x81, 0x0, 0x9, 0xfffffffffffffffd, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f00006d3000/0x4000)=nil, 0x4000, 0x66) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) syz_clone3(&(0x7f0000001240)={0x2d000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)={0x5c, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11, 0x1, 0x0, 0x1}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xffff}]}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x84}, 0x0) io_uring_enter(0xffffffffffffffff, 0x92, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4044001}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r5, 0x0, 0x0) syz_io_uring_setup(0x23c, &(0x7f0000000740)={0x0, 0x1c2c, 0x10100, 0x2, 0x113}, &(0x7f0000000500)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd, 0x0, 0x0, 0x0, {0x609}, 0x1}) fcntl$getownex(r3, 0x10, &(0x7f0000000200)={0x0, 0x0}) sched_getattr(r8, &(0x7f00000002c0)={0x38}, 0x38, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="4800000005000100070000000900020073797a3100000000040007800c0003006899dd127d697000050005000a000020050004000100000028a5e83d427fa9eddc090bc1818f8e970de9565a40539445cd26b86066d5cb513cba77141657f87c35e07a11edcc2e07e79347b52f2ee96535c5"], 0x48}, 0x1, 0x0, 0x0, 0x4004000}, 0x40080) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, 0x4, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) 4.488775164s ago: executing program 0 (id=59): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) openat$tcp_congestion(0xffffff9c, &(0x7f0000002000), 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$netlink(0x10, 0x3, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x101e01, 0x0) r2 = openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000140)=0x15) openat$dsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r3, &(0x7f0000000000)={0x20000002}) ioctl$RTC_PIE_OFF(r2, 0x7006) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) 4.488496045s ago: executing program 3 (id=60): ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f0000000100)={0x1a, 0x29, 0x8, 0x1b, 0x3, 0x4000d4a, 0x0, 0x16a, 0x1}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) r1 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000640)='\xf0\x891\xb8R\xe6\x8d\x12\xe5\xe3+\xcd24\x01\x80\x1a\xc9A\x93\xb1@\xbf\x89K\xd0\x86\xd9\x86\x18\xc4:\xc3\xe0\xac\xed~\x97\a\xbe\xfb\v1d\xbe\xa1\xc1N\xd2p\xf0\xc6\xf3\x8eD\x1b\xc7q\x99?9\xf1\xe6\f\xa9\x90\xec:\x037\xe8\x0f\rX6\xf2\x88\x8d\r\xd2\xfc+\x19\x9a}\x9c\xd9\x1a\xef\xf1\x16d>ah\xa2\xa7\x02U\x06\xe1\xe1PY\x90\x17\xf0p\x01*!I\xd3$\xd00C\x88*NA\xc3\x95`\xb2\xf1\xb1\xed\x91\xe4\x87\xcf_9\x1eIpAfN\x99\xa9\v)\x98p\xea[\xc5&D\xe7\xf3\xba/\xcd\xdb\x9dz\xb2\xbf\xc6\xea?\x13(\x15\xc1\tm\xe7t,[\x14|bM\xfa\xeb\x91\xb0\xdfAR\xf3\xe2', &(0x7f0000000300)='\x01\x0e!5\xd8\xf2\x92\x97\x86\xf9\xa8\xe7;\xdff3\x83\xb1a\xc9\xe1\x90\x10@\x1chOK\x98\xae\xd6>\xbaN\x1d_N\xcbdIP2$\xbc\xc9\x89\xb5\n\x90-i%\xe2\x94\fH\xf1\xed\r\b\x17\x81>\t\xc30-\xe2\xb3\xb00x0}) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001040)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r6, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_CE_THRESHOLD={0x8, 0x5, 0x4}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r5, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x30, 0x1410, 0x200, 0x70bd29, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x3}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x40084}, 0x4088094) r7 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r7, &(0x7f00000005c0)="bad330fbc9b55400040000ea0756a85d86dd", 0x12, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r6, 0x1, 0xd8, 0x6, @multicast}, 0x14) r8 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r8, &(0x7f0000000540)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a066f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0effeffe809005300fff5dd00000004000100080c1000000000", 0x53}], 0x1) socket$netlink(0x10, 0x3, 0x0) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), r8) sendmsg$NL80211_CMD_DEL_PMKSA(r4, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000480)=ANY=[@ANYBLOB="7c94ff00", @ANYRES16=r9, @ANYBLOB="000429bd70000d0000003500000008001f016bffffff08001f01040000000a00340001010101010100000a00340002020202020200001400fe004e4f86715e62e58f243f219b7eb6e89b1400fe00ea6f37a5259614b13d69804fcbd17c111400fe00d58fd392fea8425658e5c2304ca6b07308001f01050000000a0034000202020202020000050020014e000000"], 0x6f}}, 0x80) r10 = syz_open_dev$loop(&(0x7f00000000c0), 0x4, 0x28801) ioctl$BLKSECDISCARD(r10, 0x127d, &(0x7f0000000100)=0x1000000000000003) bpf$MAP_CREATE(0xb00000000000014, &(0x7f0000000040)=ANY=[@ANYRES64, @ANYRES32=0x0, @ANYRESHEX, @ANYBLOB="4821953d955a2d6eae260196551bed2c3c568a"], 0x48) 4.459670313s ago: executing program 2 (id=61): r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) ioctl$SG_IO(r0, 0x2285, &(0x7f00000005c0)={0x53, 0xfffffffffffffffc, 0x6, 0x4, @scatter={0x0, 0x0, 0x0}, &(0x7f00000008c0)="939e00000000", 0x0, 0xffffffff, 0x40, 0x2, 0x0}) r1 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x10000000004e20, 0xfffffffe, @loopback, 0x6}, 0x1c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000240)={0xffffffffffffffff, 0x58, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0xfffffe78) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000400)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @mcast2, 0x5, 0x6, 0x0, 0x100, 0xff, 0xc0000082, r2}) ioctl$BSG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000580)) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r3, 0x800455c9, 0x0) syz_emit_ethernet(0x83, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaf9ff030486dd601b8b97004d88c19e9ace5ffb2e9fc603dd282100000002ff02000000000000"], 0x0) r4 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) r7 = syz_open_dev$loop(&(0x7f0000000080), 0x45ffff7, 0x162800) ioctl$LOOP_CONFIGURE(r7, 0x4c0a, &(0x7f0000001ac0)={r6, 0x0, {0x0, 0x0, 0x0, 0x1, 0x200001, 0x0, 0x0, 0x0, 0x14, "339f020bbe82b38b000000000000000000070d0ec0c1b4e9b1c4369d03540250ceaac394b1b3d741dd17c1c500", "a9103939c787a16c1ca43f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d2", "24431a1e77a68e174efff100000000000010e200"}}) r8 = dup(r7) read$FUSE(r8, &(0x7f0000003c40)={0x2020}, 0xffffff0a) write$binfmt_misc(r5, &(0x7f0000000680)="3f7d67eff117da64e2f36ab8cc2ef2f7054c8e34fdcd8ace9de9bdf0241c7937517e1e8cb67ff9be103231daf025cec44b0229e0c3dbf25bae204db6fc4034a40fd36aea12461e6374f189beaaeea987d1dcfb330b6bf408237be278a756447928071ce3b07883e028e86dc6649b", 0x6e) ioctl$LOOP_CONFIGURE(r4, 0x4c0a, &(0x7f00000002c0)={r5, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x14, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0xc, &(0x7f0000000400)="001ca73e", 0x4) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x9, 0x0, &(0x7f00000001c0)) r9 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000105509147200ed0000000109022400010000000009040000030300000009210000000122050009058103"], 0x0) syz_usb_control_io(r9, 0x0, 0x0) syz_usb_control_io(r9, &(0x7f0000000100)={0x2c, &(0x7f0000000280)=ANY=[@ANYBLOB="200617"], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000040)={'syztnl1\x00', 0x0}) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x28c81, 0x0) r10 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r10, 0xffffffffffffffff, 0x0) 3.41878781s ago: executing program 0 (id=62): ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f0000000100)={0x1a, 0x29, 0x8, 0x1b, 0x3, 0x4000d4a, 0x0, 0x16a, 0x1}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) r1 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000640)='\xf0\x891\xb8R\xe6\x8d\x12\xe5\xe3+\xcd24\x01\x80\x1a\xc9A\x93\xb1@\xbf\x89K\xd0\x86\xd9\x86\x18\xc4:\xc3\xe0\xac\xed~\x97\a\xbe\xfb\v1d\xbe\xa1\xc1N\xd2p\xf0\xc6\xf3\x8eD\x1b\xc7q\x99?9\xf1\xe6\f\xa9\x90\xec:\x037\xe8\x0f\rX6\xf2\x88\x8d\r\xd2\xfc+\x19\x9a}\x9c\xd9\x1a\xef\xf1\x16d>ah\xa2\xa7\x02U\x06\xe1\xe1PY\x90\x17\xf0p\x01*!I\xd3$\xd00C\x88*NA\xc3\x95`\xb2\xf1\xb1\xed\x91\xe4\x87\xcf_9\x1eIpAfN\x99\xa9\v)\x98p\xea[\xc5&D\xe7\xf3\xba/\xcd\xdb\x9dz\xb2\xbf\xc6\xea?\x13(\x15\xc1\tm\xe7t,[\x14|bM\xfa\xeb\x91\xb0\xdfAR\xf3\xe2', &(0x7f0000000300)='\x01\x0e!5\xd8\xf2\x92\x97\x86\xf9\xa8\xe7;\xdff3\x83\xb1a\xc9\xe1\x90\x10@\x1chOK\x98\xae\xd6>\xbaN\x1d_N\xcbdIP2$\xbc\xc9\x89\xb5\n\x90-i%\xe2\x94\fH\xf1\xed\r\b\x17\x81>\t\xc30-\xe2\xb3\xb00x0}) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001040)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r6, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_CE_THRESHOLD={0x8, 0x5, 0x4}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r5, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x30, 0x1410, 0x200, 0x70bd29, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x3}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x40084}, 0x4088094) r7 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r7, &(0x7f00000005c0)="bad330fbc9b55400040000ea0756a85d86dd", 0x12, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r6, 0x1, 0xd8, 0x6, @multicast}, 0x14) r8 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r8, &(0x7f0000000540)=[{&(0x7f0000000080)}], 0x1) socket$netlink(0x10, 0x3, 0x0) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), r8) sendmsg$NL80211_CMD_DEL_PMKSA(r4, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000480)=ANY=[@ANYBLOB="7c94ff00", @ANYRES16=r9, @ANYBLOB="000429bd70000d0000003500000008001f016bffffff08001f01040000000a00340001010101010100000a00340002020202020200001400fe004e4f86715e62e58f243f219b7eb6e89b1400fe00ea6f37a5259614b13d69804fcbd17c111400fe00d58fd392fea8425658e5c2304ca6b07308001f01050000000a0034000202020202020000050020014e000000"], 0x6f}}, 0x80) r10 = syz_open_dev$loop(&(0x7f00000000c0), 0x4, 0x28801) ioctl$BLKSECDISCARD(r10, 0x127d, &(0x7f0000000100)=0x1000000000000003) bpf$MAP_CREATE(0xb00000000000014, &(0x7f0000000040)=ANY=[@ANYRES64, @ANYRES32=0x0, @ANYRESHEX, @ANYBLOB="4821953d955a2d6eae260196551bed2c3c568a"], 0x48) 3.418419039s ago: executing program 3 (id=64): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x81, 0x0, 0x9, 0xfffffffffffffffd, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f00006d3000/0x4000)=nil, 0x4000, 0x66) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) syz_clone3(&(0x7f0000001240)={0x2d000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)={0x5c, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11, 0x1, 0x0, 0x1}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xffff}]}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x84}, 0x0) io_uring_enter(0xffffffffffffffff, 0x92, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4044001}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r5, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) syz_io_uring_setup(0x23c, &(0x7f0000000740)={0x0, 0x1c2c, 0x10100, 0x2, 0x113}, &(0x7f0000000500)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd, 0x0, 0x0, 0x0, {0x609}, 0x1}) fcntl$getownex(r3, 0x10, &(0x7f0000000200)={0x0, 0x0}) sched_getattr(r8, &(0x7f00000002c0)={0x38}, 0x38, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="4800000005000100070000000900020073797a3100000000040007800c0003006899dd127d697000050005000a000020050004000100000028a5e83d427fa9eddc090bc1818f8e970de9565a40539445cd26b86066d5cb513cba77141657f87c35e07a11edcc2e07e79347b52f2ee96535c5"], 0x48}, 0x1, 0x0, 0x0, 0x4004000}, 0x40080) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, 0x4, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) 3.182811064s ago: executing program 1 (id=65): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x81, 0x0, 0x9, 0xfffffffffffffffd, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f00006d3000/0x4000)=nil, 0x4000, 0x66) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) syz_clone3(&(0x7f0000001240)={0x2d000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)={0x5c, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11, 0x1, 0x0, 0x1}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xffff}]}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x84}, 0x0) io_uring_enter(0xffffffffffffffff, 0x92, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4044001}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000540)={0x14, 0x0, 0x2, 0x101, 0x0, 0x0, {0xa}}, 0x14}}, 0x0) syz_io_uring_setup(0x23c, 0x0, &(0x7f0000000500)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd, 0x0, 0x0, 0x0, {0x609}, 0x1}) fcntl$getownex(r3, 0x10, &(0x7f0000000200)={0x0, 0x0}) sched_getattr(r8, &(0x7f00000002c0)={0x38}, 0x38, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="4800000005000100070000000900020073797a3100000000040007800c0003006899dd127d697000050005000a000020050004000100000028a5e83d427fa9eddc090bc1818f8e970de9565a40539445cd26b86066d5cb513cba77141657f87c35e07a11edcc2e07e79347b52f2ee96535c5"], 0x48}, 0x1, 0x0, 0x0, 0x4004000}, 0x40080) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, 0x4, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) 2.825554904s ago: executing program 0 (id=66): ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f0000000100)={0x1a, 0x29, 0x8, 0x1b, 0x3, 0x4000d4a, 0x0, 0x16a, 0x1}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) r1 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000640)='\xf0\x891\xb8R\xe6\x8d\x12\xe5\xe3+\xcd24\x01\x80\x1a\xc9A\x93\xb1@\xbf\x89K\xd0\x86\xd9\x86\x18\xc4:\xc3\xe0\xac\xed~\x97\a\xbe\xfb\v1d\xbe\xa1\xc1N\xd2p\xf0\xc6\xf3\x8eD\x1b\xc7q\x99?9\xf1\xe6\f\xa9\x90\xec:\x037\xe8\x0f\rX6\xf2\x88\x8d\r\xd2\xfc+\x19\x9a}\x9c\xd9\x1a\xef\xf1\x16d>ah\xa2\xa7\x02U\x06\xe1\xe1PY\x90\x17\xf0p\x01*!I\xd3$\xd00C\x88*NA\xc3\x95`\xb2\xf1\xb1\xed\x91\xe4\x87\xcf_9\x1eIpAfN\x99\xa9\v)\x98p\xea[\xc5&D\xe7\xf3\xba/\xcd\xdb\x9dz\xb2\xbf\xc6\xea?\x13(\x15\xc1\tm\xe7t,[\x14|bM\xfa\xeb\x91\xb0\xdfAR\xf3\xe2', &(0x7f0000000300)='\x01\x0e!5\xd8\xf2\x92\x97\x86\xf9\xa8\xe7;\xdff3\x83\xb1a\xc9\xe1\x90\x10@\x1chOK\x98\xae\xd6>\xbaN\x1d_N\xcbdIP2$\xbc\xc9\x89\xb5\n\x90-i%\xe2\x94\fH\xf1\xed\r\b\x17\x81>\t\xc30-\xe2\xb3\xb00x0}) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001040)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r6, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_CE_THRESHOLD={0x8, 0x5, 0x4}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r5, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x30, 0x1410, 0x200, 0x70bd29, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x3}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x40084}, 0x4088094) r7 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r7, &(0x7f00000005c0)="bad330fbc9b55400040000ea0756a85d86dd", 0x12, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r6, 0x1, 0xd8, 0x6, @multicast}, 0x14) r8 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r8, &(0x7f0000000540)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a066f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0effeffe809005300", 0x42}], 0x1) socket$netlink(0x10, 0x3, 0x0) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), r8) sendmsg$NL80211_CMD_DEL_PMKSA(r4, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000480)=ANY=[@ANYBLOB="7c94ff00", @ANYRES16=r9, @ANYBLOB="000429bd70000d0000003500000008001f016bffffff08001f01040000000a00340001010101010100000a00340002020202020200001400fe004e4f86715e62e58f243f219b7eb6e89b1400fe00ea6f37a5259614b13d69804fcbd17c111400fe00d58fd392fea8425658e5c2304ca6b07308001f01050000000a0034000202020202020000050020014e000000"], 0x6f}}, 0x80) r10 = syz_open_dev$loop(&(0x7f00000000c0), 0x4, 0x28801) ioctl$BLKSECDISCARD(r10, 0x127d, &(0x7f0000000100)=0x1000000000000003) bpf$MAP_CREATE(0xb00000000000014, &(0x7f0000000040)=ANY=[@ANYRES64, @ANYRES32=0x0, @ANYRESHEX, @ANYBLOB="4821953d955a2d6eae260196551bed2c3c568a"], 0x48) 2.483106485s ago: executing program 2 (id=67): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0009030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000000)=""/172, 0xac) syz_usb_disconnect(0xffffffffffffffff) syz_usb_disconnect(0xffffffffffffffff) syz_usb_disconnect(0xffffffffffffffff) syz_usb_disconnect(0xffffffffffffffff) syz_usb_disconnect(r0) syz_usb_ep_write(r0, 0x0, 0x82, &(0x7f00000000c0)="cf4cac999fd31a7a927cc35347eab02d062ca9fc44a462754301277afd5df85c798350235746ac94da90c1a273935455bedc963b841e6eb594ff128e25a6b0e8ce58f1fe012a493e7970e18895b8d77125f16bbc762cf7f632f95771f804253c376d41e51118578f59f21352ca22996283e4629a8a6da7fbe94e8054313cb2101d2c") 2.46071912s ago: executing program 3 (id=68): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) openat$tcp_congestion(0xffffff9c, &(0x7f0000002000), 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$netlink(0x10, 0x3, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x101e01, 0x0) r2 = openat$nvram(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000140)=0x15) openat$dsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r3, 0x0) ioctl$RTC_PIE_OFF(r2, 0x7006) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) 2.427853058s ago: executing program 0 (id=69): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x4001}, 0xfea3) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=@RTM_GETMDB={0x17, 0x56, 0xd23}, 0x18}}, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) msgget$private(0x0, 0x209) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x101e01, 0x0) r2 = getpgid(0xffffffffffffffff) ptrace$peeksig(0x4209, r2, &(0x7f0000000000)={0x10000, 0x1, 0x3}, &(0x7f0000000500)=[{}, {}, {}]) epoll_create1(0x0) r3 = userfaultfd(0x1) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000040)) ioctl$UFFDIO_WRITEPROTECT(r3, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000800000/0x800000)=nil, 0x802000}, 0x2}) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$UFFDIO_CONTINUE(r4, 0xc020aa08, &(0x7f00000000c0)={{&(0x7f0000800000/0x800000)=nil, 0x800000}, 0x1}) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r5 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_int(r5, 0x11e, 0x1, &(0x7f0000000080)=0x5, 0x4) r6 = socket(0x10, 0x3, 0x0) openat$comedi(0xffffff9c, &(0x7f0000000140)='/dev/comedi2\x00', 0x100, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, 0x0, 0x0) setsockopt$bt_l2cap_L2CAP_CONNINFO(r6, 0x6, 0x2, &(0x7f0000000080)={0xb7a4, "adfba8"}, 0x6) epoll_create1(0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) 1.985343656s ago: executing program 1 (id=70): ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f0000000100)={0x1a, 0x29, 0x8, 0x1b, 0x3, 0x4000d4a, 0x0, 0x16a, 0x1}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) r1 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000640)='\xf0\x891\xb8R\xe6\x8d\x12\xe5\xe3+\xcd24\x01\x80\x1a\xc9A\x93\xb1@\xbf\x89K\xd0\x86\xd9\x86\x18\xc4:\xc3\xe0\xac\xed~\x97\a\xbe\xfb\v1d\xbe\xa1\xc1N\xd2p\xf0\xc6\xf3\x8eD\x1b\xc7q\x99?9\xf1\xe6\f\xa9\x90\xec:\x037\xe8\x0f\rX6\xf2\x88\x8d\r\xd2\xfc+\x19\x9a}\x9c\xd9\x1a\xef\xf1\x16d>ah\xa2\xa7\x02U\x06\xe1\xe1PY\x90\x17\xf0p\x01*!I\xd3$\xd00C\x88*NA\xc3\x95`\xb2\xf1\xb1\xed\x91\xe4\x87\xcf_9\x1eIpAfN\x99\xa9\v)\x98p\xea[\xc5&D\xe7\xf3\xba/\xcd\xdb\x9dz\xb2\xbf\xc6\xea?\x13(\x15\xc1\tm\xe7t,[\x14|bM\xfa\xeb\x91\xb0\xdfAR\xf3\xe2', &(0x7f0000000300)='\x01\x0e!5\xd8\xf2\x92\x97\x86\xf9\xa8\xe7;\xdff3\x83\xb1a\xc9\xe1\x90\x10@\x1chOK\x98\xae\xd6>\xbaN\x1d_N\xcbdIP2$\xbc\xc9\x89\xb5\n\x90-i%\xe2\x94\fH\xf1\xed\r\b\x17\x81>\t\xc30-\xe2\xb3\xb00x0}) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001040)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r6, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_CE_THRESHOLD={0x8, 0x5, 0x4}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r5, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x30, 0x1410, 0x200, 0x70bd29, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x3}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}]}, 0x30}, 0x1, 0x0, 0x0, 0x40084}, 0x4088094) r7 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r7, &(0x7f00000005c0)="bad330fbc9b55400040000ea0756a85d86dd", 0x12, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r6, 0x1, 0xd8, 0x6, @multicast}, 0x14) r8 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r8, &(0x7f0000000540)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a066f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0effeffe809005300fff5dd00000004000100080c1000000000", 0x53}], 0x1) socket$netlink(0x10, 0x3, 0x0) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), r8) sendmsg$NL80211_CMD_DEL_PMKSA(r4, &(0x7f0000000640)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000480)=ANY=[@ANYBLOB="7c94ff00", @ANYRES16=r9, @ANYBLOB="000429bd70000d0000003500000008001f016bffffff08001f01040000000a00340001010101010100000a00340002020202020200001400fe004e4f86715e62e58f243f219b7eb6e89b1400fe00ea6f37a5259614b13d69804fcbd17c111400fe00d58fd392fea8425658e5c2304ca6b07308001f01050000000a0034000202020202020000050020014e000000"], 0x6f}}, 0x80) r10 = syz_open_dev$loop(&(0x7f00000000c0), 0x4, 0x28801) ioctl$BLKSECDISCARD(r10, 0x127d, &(0x7f0000000100)=0x1000000000000003) bpf$MAP_CREATE(0xb00000000000014, &(0x7f0000000040)=ANY=[@ANYRES64, @ANYRES32=0x0, @ANYRESHEX, @ANYBLOB="4821953d955a2d6eae260196551bed2c3c568a"], 0x48) 1.964974872s ago: executing program 0 (id=71): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000003c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x4, 0x0, 0x806, 0x5, 0xffffffff}, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f0000000040)={0x28, 0x1, 0x0, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000, 0xfffffffffffffffc}) getpeername$tipc(0xffffffffffffffff, &(0x7f0000000340)=@name, &(0x7f0000000300)=0x10) r3 = open(&(0x7f0000000240)='./file0\x00', 0x284081, 0x80) fcntl$notify(r3, 0x402, 0x5) r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x103a42, 0x32) r5 = syz_open_dev$I2C(&(0x7f00000000c0), 0x0, 0x0) ioctl$I2C_SMBUS(r5, 0x720, &(0x7f0000000040)={0x0, 0x2, 0x5, 0xffffffffffffffff}) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r4, 0xc0189379, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r5, 0xc020f509, &(0x7f00000002c0)={r2, 0x1, 0x10000, 0x72c}) ftruncate(r4, 0x6000000) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r2, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x334e8b}) ioctl$IOMMU_IOAS_UNMAP$ALL(r2, 0x3b86, &(0x7f00000012c0)={0x18}) socket$nl_route(0x10, 0x3, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, &(0x7f0000000680)={0x0, 0x0, {0x0, @struct}, {0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_ethernet(0x2e, &(0x7f00000001c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa000000000000080046000020000000000011fe78ac1414ffac141416"], 0x0) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x1050) quotactl$Q_SYNC(0xffffffff80000100, 0x0, 0x0, 0x0) r6 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x40, 0x0) r7 = ioctl$LOOP_CTL_GET_FREE(r6, 0x4c82) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000600)=@broute={'broute\x00', 0x20, 0x0, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000040], 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0000000000000000000000000000000005000000000000000000000000000000000000000000004b49eaffe30000000000000000000000000000000000000000000000000000000000000000fcffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffff00"/144]}, 0xe0) ioctl$LOOP_CTL_REMOVE(r6, 0x4c81, r7) 1.645519073s ago: executing program 1 (id=72): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r1 = syz_usb_connect$cdc_ncm(0x4, 0xa7, &(0x7f0000000100)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x95, 0x2, 0x1, 0x81, 0x30, 0x1, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x8, 0x24, 0x6, 0x0, 0x1, "93ca79"}, {0x5, 0x24, 0x0, 0x7}, {0xd, 0x24, 0xf, 0x1, 0x79eb, 0xd5, 0x1, 0xe3}, {0x6, 0x24, 0x1a, 0x1, 0xa}, [@mbim_extended={0x8, 0x24, 0x1c, 0x9, 0x40, 0xffff}, @mbim={0xc, 0x24, 0x1b, 0xfff8, 0x4, 0x82, 0x7, 0x4, 0xa7}, @mbim={0xc, 0x24, 0x1b, 0x7f, 0x3, 0x7f, 0x2, 0xc, 0x1}, @obex={0x5, 0x24, 0x15, 0xcd0}, @obex={0x5, 0x24, 0x15, 0x6d}, @mbim={0xc, 0x24, 0x1b, 0xfff8, 0xfff9, 0x10, 0x0, 0x1, 0x9}]}, {{0x9, 0x5, 0x81, 0x3, 0x20, 0x10, 0x92, 0xff}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x8, 0x7f, 0x3, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x400, 0x6, 0x7, 0x4}}}}}}}]}}, &(0x7f0000000300)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x0, 0xd, 0x2, 0x9a, 0x20, 0x5}, 0x0, 0x0, 0x3, [{0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x40e}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x443}}, {0x2, &(0x7f0000000500)=@string={0x2}}]}) r2 = socket$packet(0x11, 0x3, 0x300) open_by_handle_at(0xffffffffffffffff, &(0x7f0000000040)=ANY=[@ANYBLOB="20000000f1000100", @ANYRES64=r2], 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f00000001c0)=@mangle={'mangle\x00', 0x44, 0x6, 0x458, 0x0, 0x0, 0x0, 0x0, 0xa0, 0x3c4, 0x3c4, 0x3c4, 0x3c4, 0x3c4, 0x6, 0x0, {[{{@ip={@broadcast, @rand_addr=0x64010102, 0x0, 0x0, 'geneve1\x00', 'veth1\x00'}, 0x0, 0x70, 0xa0}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0xffffffffffffffff, 0x3, 0x3}, {0x0, 0x4, 0x1}, 0x5, 0x6c83}}}, {{@uncond, 0x0, 0xc0, 0xe4, 0x0, {}, [@common=@osf={{0x50}, {'syz0\x00', 0x0, 0x2, 0x1}}]}, @unspec=@CHECKSUM={0x24}}, {{@uncond, 0x0, 0x70, 0x94}, @ECN={0x24}}, {{@ip={@empty, @broadcast, 0xff, 0xff000000, 'bridge_slave_0\x00', 'pim6reg\x00', {0xff}, {0xff}, 0x64, 0x2, 0x42}, 0x0, 0x70, 0xdc}, @common=@unspec=@NFLOG={0x6c, 'NFLOG\x00', 0x0, {0x7, 0xfffe, 0x3, 0x0, 0x0, "49b59b49863605e4dc9b877d711eb5d29721cc7c72aa00ee4c9618564126f6a9c4e53e238f6630cca9f12f156f8f2442149e456f32a6cba6d439cf905858e6d5"}}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x5, 0x6]}, {0x0, [], 0x3}}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x4b4) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200), 0x101, 0x0) ioctl$SNAPSHOT_FREE_SWAP_PAGES(r3, 0x3309) syz_usb_control_io$cdc_ncm(r1, &(0x7f00000006c0)={0xc, &(0x7f0000000a40)=ANY=[@ANYBLOB="20278b0000008b097836937f7c050000281c8705492cda024c7fa0484653dd48073e87d9e31a18566007bea6331200760d4bb06244285119e06c2d039fe3f9a7bf640e0d8992106a501ca731012253a81fc0230ffbfcfdb2fedecde35cdbc1d96948a54ac5f662239f3d7a584f60b862314086c6d86c43067ecd9096111986dbcb4b5ecf09e54af1c5c0855fd9a27812ac64187e57da25991897d7bb7544edaf0e893269b13a8651cef7864f68181dd36b"], &(0x7f0000000680)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000a00)={0x24, &(0x7f0000000700)={0x20, 0x0, 0xfb, "6d53b4151c68764a012d97f20606f85adbfa7b4d008449bae0d94d0a599055d551189856dd7522b58f538a48985716c78688d4fb87cf229ba54f169c107d1c3e0fb2c0ee6449177e00acf71e70ca81e36958fd010cbf5861f5834371c4635ccc5775fa84bfd1410ae4c4f5ee56ca144abb1d645881a07f89c9ec11a94edb3fb9967277c0ee7070b6fa88bf2dce2c969d27c25365a716f8c93039c88d9107819f42b1f37bcc5546d8e41ab0ec1e934b6ef45b5095ba48f4b32ad78389c850ff295c694a8bb0805539c6f5005f34820bf2511c04894d74d612f47eec6f821bb8d4d56835a779465e2ccd60209def3fd64870dcc44870259f9f819692"}, &(0x7f0000000840)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000880)={0x0, 0x8, 0x1, 0x9}, &(0x7f00000008c0)={0x20, 0x80, 0x1c, {0x7, 0x1, 0xfffffff8, 0xfff8, 0x8, 0xc2, 0x7, 0x7, 0x4, 0x4, 0xfffe, 0x7}}, &(0x7f0000000900)={0x20, 0x85, 0x4, 0xdf8}, &(0x7f0000000940)={0x20, 0x83, 0x2, 0x1}, &(0x7f0000000980)={0x20, 0x87, 0x2, 0x5}, &(0x7f00000009c0)={0x20, 0x89, 0x2, 0x1}}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_MPATH(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRESOCT=r4, @ANYBLOB="01002cbd7000ffdbdf2518000000", @ANYRES32=r4, @ANYRESHEX=r0], 0x58}, 0x1, 0x0, 0x0, 0x4008080}, 0x80) 1.535947619s ago: executing program 3 (id=73): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x81, 0x0, 0x9, 0xfffffffffffffffd, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f00006d3000/0x4000)=nil, 0x4000, 0x66) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) syz_clone3(&(0x7f0000001240)={0x2d000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)={0x5c, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11, 0x1, 0x0, 0x1}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xffff}]}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x84}, 0x0) io_uring_enter(0xffffffffffffffff, 0x92, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4044001}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={0x0}}, 0x0) syz_io_uring_setup(0x23c, &(0x7f0000000740)={0x0, 0x1c2c, 0x10100, 0x2, 0x113}, &(0x7f0000000500)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd, 0x0, 0x0, 0x0, {0x609}, 0x1}) fcntl$getownex(r3, 0x10, &(0x7f0000000200)={0x0, 0x0}) sched_getattr(r8, &(0x7f00000002c0)={0x38}, 0x38, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="4800000005000100070000000900020073797a3100000000040007800c0003006899dd127d697000050005000a000020050004000100000028a5e83d427fa9eddc090bc1818f8e970de9565a40539445cd26b86066d5cb513cba77141657f87c35e07a11edcc2e07e79347b52f2ee96535c5"], 0x48}, 0x1, 0x0, 0x0, 0x4004000}, 0x40080) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, 0x4, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) 1.132852993s ago: executing program 1 (id=74): r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x40, 0x0) r1 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r1) 1.034907935s ago: executing program 0 (id=75): r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x401) ioctl$SG_IO(r0, 0x2285, &(0x7f00000005c0)={0x53, 0xfffffffffffffffc, 0x6, 0x4, @scatter={0x0, 0x0, 0x0}, &(0x7f00000008c0)="939e00000000", 0x0, 0xffffffff, 0x40, 0x2, 0x0}) r1 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x10000000004e20, 0xfffffffe, @loopback, 0x6}, 0x1c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000240)={0xffffffffffffffff, 0x58, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0xfffffe78) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000400)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @mcast2, 0x5, 0x6, 0x0, 0x100, 0xff, 0xc0000082, r2}) ioctl$BSG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000580)) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r3, 0x800455c9, 0x0) syz_emit_ethernet(0x83, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaf9ff030486dd601b8b97004d88c19e9ace5ffb2e9fc603dd282100000002ff02000000000000"], 0x0) r4 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) r7 = syz_open_dev$loop(&(0x7f0000000080), 0x45ffff7, 0x162800) ioctl$LOOP_CONFIGURE(r7, 0x4c0a, &(0x7f0000001ac0)={r6, 0x0, {0x0, 0x0, 0x0, 0x1, 0x200001, 0x0, 0x0, 0x0, 0x14, "339f020bbe82b38b000000000000000000070d0ec0c1b4e9b1c4369d03540250ceaac394b1b3d741dd17c1c500", "a9103939c787a16c1ca43f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d2", "24431a1e77a68e174efff100000000000010e200"}}) r8 = dup(r7) read$FUSE(r8, &(0x7f0000003c40)={0x2020}, 0xffffff0a) write$binfmt_misc(r5, &(0x7f0000000680)="3f7d67eff117da64e2f36ab8cc2ef2f7054c8e34fdcd8ace9de9bdf0241c7937517e1e8cb67ff9be103231daf025cec44b0229e0c3dbf25bae204db6fc4034a40fd36aea12461e6374f189beaaeea987d1dcfb330b6bf408237be278a756447928071ce3b07883e028e86dc6649b", 0x6e) ioctl$LOOP_CONFIGURE(r4, 0x4c0a, &(0x7f00000002c0)={r5, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x14, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0xc, &(0x7f0000000400)="001ca73e", 0x4) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x9, 0x0, &(0x7f00000001c0)) r9 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000105509147200ed0000000109022400010000000009040000030300000009210000000122050009058103"], 0x0) syz_usb_control_io(r9, 0x0, 0x0) syz_usb_control_io(r9, &(0x7f0000000100)={0x2c, &(0x7f0000000280)=ANY=[@ANYBLOB="200617"], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000040)={'syztnl1\x00', 0x0}) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x28c81, 0x0) r10 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r10, 0xffffffffffffffff, 0x0) 895.434848ms ago: executing program 1 (id=76): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x81, 0x0, 0x9, 0xfffffffffffffffd, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f00006d3000/0x4000)=nil, 0x4000, 0x66) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) syz_clone3(&(0x7f0000001240)={0x2d000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)={0x5c, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11, 0x1, 0x0, 0x1}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xffff}]}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x84}, 0x0) io_uring_enter(0xffffffffffffffff, 0x92, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4044001}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={0x0}}, 0x0) syz_io_uring_setup(0x23c, &(0x7f0000000740)={0x0, 0x1c2c, 0x10100, 0x2, 0x113}, &(0x7f0000000500)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd, 0x0, 0x0, 0x0, {0x609}, 0x1}) fcntl$getownex(r3, 0x10, &(0x7f0000000200)={0x0, 0x0}) sched_getattr(r8, &(0x7f00000002c0)={0x38}, 0x38, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="4800000005000100070000000900020073797a3100000000040007800c0003006899dd127d697000050005000a000020050004000100000028a5e83d427fa9eddc090bc1818f8e970de9565a40539445cd26b86066d5cb513cba77141657f87c35e07a11edcc2e07e79347b52f2ee96535c5"], 0x48}, 0x1, 0x0, 0x0, 0x4004000}, 0x40080) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, 0x4, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) 584.488572ms ago: executing program 3 (id=77): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x6c, 0x2, 0x6, 0x201, 0x6000000, 0x0, {0x0, 0x0, 0x2}, [@IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x24, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP_TO={0xc, 0x20, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @remote}}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @rand_addr=0x64010102}}, @IPSET_ATTR_NETMASK={0x5, 0x14, 0x2}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x6c}}, 0x0) 505.359881ms ago: executing program 3 (id=78): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x81, 0x0, 0x9, 0xfffffffffffffffd, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f00006d3000/0x4000)=nil, 0x4000, 0x66) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) syz_clone3(&(0x7f0000001240)={0x2d000000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)={0x5c, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11, 0x1, 0x0, 0x1}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xffff}]}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x84}, 0x0) io_uring_enter(0xffffffffffffffff, 0x92, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4044001}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000540)={0x14, 0x0, 0x2, 0x101, 0x0, 0x0, {0xa}}, 0x14}}, 0x0) syz_io_uring_setup(0x23c, &(0x7f0000000740)={0x0, 0x1c2c, 0x10100, 0x2, 0x113}, 0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(0x0, r6, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd, 0x0, 0x0, 0x0, {0x609}, 0x1}) fcntl$getownex(r3, 0x10, &(0x7f0000000200)={0x0, 0x0}) sched_getattr(r7, &(0x7f00000002c0)={0x38}, 0x38, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="4800000005000100070000000900020073797a3100000000040007800c0003006899dd127d697000050005000a000020050004000100000028a5e83d427fa9eddc090bc1818f8e970de9565a40539445cd26b86066d5cb513cba77141657f87c35e07a11edcc2e07e79347b52f2ee96535c5"], 0x48}, 0x1, 0x0, 0x0, 0x4004000}, 0x40080) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, 0x4, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) 0s ago: executing program 1 (id=79): r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000200)=[@in6={0xa, 0x4e24, 0x4, @loopback}], 0x1c) setsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000080)=@assoc_value={0x0, 0x265}, 0x8) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f0000000480)=ANY=[@ANYBLOB="211d00000000000007e6"], 0xf0) sendto$inet6(r0, &(0x7f0000000040)="00d8", 0x20a00, 0x44004, &(0x7f0000000100)={0xa, 0x4e24, 0xb, @loopback, 0xc5f}, 0x1c) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:16229' (ED25519) to the list of known hosts. [ 72.131390][ T5847] cgroup: Unknown subsys name 'net' [ 72.280179][ T5847] cgroup: Unknown subsys name 'cpuset' [ 72.284277][ T5847] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 73.214703][ T5847] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 75.972612][ T1416] ieee802154 phy0 wpan0: encryption failed: -22 [ 75.975005][ T1416] ieee802154 phy1 wpan1: encryption failed: -22 [ 76.748772][ T5942] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 76.753356][ T5940] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 76.756212][ T5940] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 76.758279][ T5942] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 76.759056][ T5940] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 76.761190][ T5949] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 76.762678][ T5949] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 76.764382][ T5940] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 76.766526][ T5951] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 76.766608][ T5949] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 76.766801][ T5949] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 76.767462][ T5949] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 76.768079][ T5949] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 76.768560][ T5940] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 76.768688][ T5949] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 76.777997][ T5951] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 76.781297][ T5949] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 76.794163][ T5949] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 76.794784][ T5951] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 76.799734][ T5951] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 77.024695][ T5936] chnl_net:caif_netlink_parms(): no params data found [ 77.078069][ T5945] chnl_net:caif_netlink_parms(): no params data found [ 77.166573][ T5935] chnl_net:caif_netlink_parms(): no params data found [ 77.205158][ T5941] chnl_net:caif_netlink_parms(): no params data found [ 77.213557][ T5936] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.216467][ T5936] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.223071][ T5936] bridge_slave_0: entered allmulticast mode [ 77.226301][ T5936] bridge_slave_0: entered promiscuous mode [ 77.276739][ T5936] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.279801][ T5936] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.282585][ T5936] bridge_slave_1: entered allmulticast mode [ 77.285491][ T5936] bridge_slave_1: entered promiscuous mode [ 77.334953][ T5945] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.337342][ T5945] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.340476][ T5945] bridge_slave_0: entered allmulticast mode [ 77.343214][ T5945] bridge_slave_0: entered promiscuous mode [ 77.353340][ T5936] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.364194][ T5945] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.366543][ T5945] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.369879][ T5945] bridge_slave_1: entered allmulticast mode [ 77.372546][ T5945] bridge_slave_1: entered promiscuous mode [ 77.375238][ T5935] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.377715][ T5935] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.380081][ T5935] bridge_slave_0: entered allmulticast mode [ 77.382830][ T5935] bridge_slave_0: entered promiscuous mode [ 77.387180][ T5936] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.411109][ T5935] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.413530][ T5935] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.415865][ T5935] bridge_slave_1: entered allmulticast mode [ 77.419041][ T5935] bridge_slave_1: entered promiscuous mode [ 77.445003][ T5935] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.458570][ T5936] team0: Port device team_slave_0 added [ 77.461751][ T5945] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.466204][ T5936] team0: Port device team_slave_1 added [ 77.469352][ T5935] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.472471][ T5941] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.474771][ T5941] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.477372][ T5941] bridge_slave_0: entered allmulticast mode [ 77.481816][ T5941] bridge_slave_0: entered promiscuous mode [ 77.484949][ T5941] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.487372][ T5941] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.489967][ T5941] bridge_slave_1: entered allmulticast mode [ 77.492675][ T5941] bridge_slave_1: entered promiscuous mode [ 77.496682][ T5945] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.532019][ T5945] team0: Port device team_slave_0 added [ 77.545600][ T5935] team0: Port device team_slave_0 added [ 77.549236][ T5945] team0: Port device team_slave_1 added [ 77.552067][ T5936] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.554326][ T5936] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.563425][ T5936] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.568476][ T5935] team0: Port device team_slave_1 added [ 77.571025][ T5936] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.573273][ T5936] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.581697][ T5936] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.586545][ T5941] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.591302][ T5941] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.623674][ T5945] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.625955][ T5945] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.634549][ T5945] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.658171][ T5945] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.660796][ T5945] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.671196][ T5945] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.677296][ T5941] team0: Port device team_slave_0 added [ 77.679679][ T5935] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.681995][ T5935] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.690805][ T5935] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.701306][ T5935] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.703612][ T5935] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.711925][ T5935] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.717322][ T5941] team0: Port device team_slave_1 added [ 77.741155][ T5941] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.743482][ T5941] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.752292][ T5941] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.767784][ T5941] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.770956][ T5941] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.782426][ T5941] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.802521][ T5936] hsr_slave_0: entered promiscuous mode [ 77.804920][ T5936] hsr_slave_1: entered promiscuous mode [ 77.848509][ T5935] hsr_slave_0: entered promiscuous mode [ 77.850819][ T5935] hsr_slave_1: entered promiscuous mode [ 77.853036][ T5935] debugfs: 'hsr0' already exists in 'hsr' [ 77.854954][ T5935] Cannot create hsr debugfs directory [ 77.862066][ T5941] hsr_slave_0: entered promiscuous mode [ 77.865430][ T5941] hsr_slave_1: entered promiscuous mode [ 77.868476][ T5941] debugfs: 'hsr0' already exists in 'hsr' [ 77.870938][ T5941] Cannot create hsr debugfs directory [ 77.883497][ T5945] hsr_slave_0: entered promiscuous mode [ 77.885808][ T5945] hsr_slave_1: entered promiscuous mode [ 77.888278][ T5945] debugfs: 'hsr0' already exists in 'hsr' [ 77.890152][ T5945] Cannot create hsr debugfs directory [ 78.143176][ T5936] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 78.148818][ T5936] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 78.153133][ T5936] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 78.162398][ T5936] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 78.192087][ T5945] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 78.196735][ T5945] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 78.210095][ T5945] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 78.214328][ T5945] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 78.253354][ T5935] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 78.265857][ T5935] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 78.281843][ T5935] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 78.286375][ T5935] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 78.327187][ T5941] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 78.334481][ T5941] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 78.338918][ T5941] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 78.343832][ T5941] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 78.366486][ T5936] 8021q: adding VLAN 0 to HW filter on device bond0 [ 78.389636][ T5936] 8021q: adding VLAN 0 to HW filter on device team0 [ 78.402951][ T159] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.405350][ T159] bridge0: port 1(bridge_slave_0) entered forwarding state [ 78.414810][ T5945] 8021q: adding VLAN 0 to HW filter on device bond0 [ 78.424966][ T1150] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.427557][ T1150] bridge0: port 2(bridge_slave_1) entered forwarding state [ 78.465899][ T5945] 8021q: adding VLAN 0 to HW filter on device team0 [ 78.478508][ T159] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.480850][ T159] bridge0: port 1(bridge_slave_0) entered forwarding state [ 78.487984][ T5935] 8021q: adding VLAN 0 to HW filter on device bond0 [ 78.496095][ T5935] 8021q: adding VLAN 0 to HW filter on device team0 [ 78.507102][ T159] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.510388][ T159] bridge0: port 2(bridge_slave_1) entered forwarding state [ 78.526616][ T159] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.529655][ T159] bridge0: port 1(bridge_slave_0) entered forwarding state [ 78.534494][ T159] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.537513][ T159] bridge0: port 2(bridge_slave_1) entered forwarding state [ 78.545247][ T5941] 8021q: adding VLAN 0 to HW filter on device bond0 [ 78.586519][ T5941] 8021q: adding VLAN 0 to HW filter on device team0 [ 78.592977][ T5945] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 78.596873][ T5945] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 78.625895][ T61] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.628466][ T61] bridge0: port 1(bridge_slave_0) entered forwarding state [ 78.640717][ T61] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.643126][ T61] bridge0: port 2(bridge_slave_1) entered forwarding state [ 78.676522][ T5941] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 78.724820][ T5945] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 78.754611][ T5935] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 78.763175][ T5936] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 78.782487][ T5945] veth0_vlan: entered promiscuous mode [ 78.795294][ T5945] veth1_vlan: entered promiscuous mode [ 78.815295][ T5936] veth0_vlan: entered promiscuous mode [ 78.824219][ T5936] veth1_vlan: entered promiscuous mode [ 78.829289][ T5935] veth0_vlan: entered promiscuous mode [ 78.838879][ T5941] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 78.841556][ T5935] veth1_vlan: entered promiscuous mode [ 78.849110][ T5947] Bluetooth: hci2: command tx timeout [ 78.851147][ T5947] Bluetooth: hci3: command tx timeout [ 78.851267][ T5951] Bluetooth: hci1: command tx timeout [ 78.857503][ T5951] Bluetooth: hci0: command tx timeout [ 78.858841][ T5945] veth0_macvtap: entered promiscuous mode [ 78.869494][ T5945] veth1_macvtap: entered promiscuous mode [ 78.879066][ T5936] veth0_macvtap: entered promiscuous mode [ 78.889141][ T5936] veth1_macvtap: entered promiscuous mode [ 78.895552][ T5935] veth0_macvtap: entered promiscuous mode [ 78.900109][ T5941] veth0_vlan: entered promiscuous mode [ 78.908581][ T5935] veth1_macvtap: entered promiscuous mode [ 78.912583][ T5941] veth1_vlan: entered promiscuous mode [ 78.917067][ T5936] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.925758][ T5945] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.934451][ T5945] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.941504][ T5935] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.945038][ T5936] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.951211][ T5935] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.966490][ T1150] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.969940][ T1150] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.978428][ T1150] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.985933][ T1150] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.990057][ T1150] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.000336][ T1150] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.003202][ T1150] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.010859][ T1150] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.014709][ T1150] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.025194][ T1150] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.038305][ T1150] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.044095][ T5941] veth0_macvtap: entered promiscuous mode [ 79.055320][ T1150] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.074926][ T5941] veth1_macvtap: entered promiscuous mode [ 79.114173][ T61] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.116832][ T61] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.124712][ T5941] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 79.141150][ T159] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.144428][ T159] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.150478][ T5941] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 79.163121][ T159] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.165988][ T159] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.176538][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.179588][ T159] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.182446][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.184851][ T159] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.200083][ T102] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.202661][ T102] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.215332][ T159] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.221864][ T159] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.239906][ T61] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.242463][ T61] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.273377][ T159] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.275965][ T159] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.286618][ T102] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.291214][ T102] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.301445][ T5945] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 79.571840][ T6033] 9p: Bad value for 'msize' [ 79.582030][ T6033] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 79.715431][ T6037] vivid-000: disconnect [ 79.966600][ T6044] Zero length message leads to an empty skb [ 80.378023][ T6027] vivid-000: reconnect [ 80.474392][ T6046] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6'. [ 80.482787][ T6046] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6'. [ 80.927614][ T5951] Bluetooth: hci0: command tx timeout [ 80.929413][ T5951] Bluetooth: hci1: command tx timeout [ 80.931257][ T5951] Bluetooth: hci2: command tx timeout [ 80.937599][ T5951] Bluetooth: hci3: command tx timeout [ 82.029694][ T6056] 9pnet_virtio: no channels available for device syz [ 82.034406][ T6056] netlink: 'syz.1.8': attribute type 2 has an invalid length. [ 82.081557][ T6055] netlink: 'syz.0.7': attribute type 2 has an invalid length. [ 82.087831][ T6034] 9pnet_virtio: no channels available for device syz [ 82.090949][ T6034] netlink: 'syz.2.3': attribute type 2 has an invalid length. [ 82.243460][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 82.553250][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 82.648341][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 82.747650][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 82.792269][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 82.794829][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 82.953478][ T2298] libceph: connect (1)[c::]:6789 error -101 [ 82.955758][ T2298] libceph: mon0 (1)[c::]:6789 connect error [ 83.017694][ T5947] Bluetooth: hci3: command tx timeout [ 83.019942][ T5947] Bluetooth: hci2: command tx timeout [ 83.022727][ T5951] Bluetooth: hci1: command tx timeout [ 83.022783][ T5296] Bluetooth: hci0: command tx timeout [ 83.084221][ T6067] ceph: No mds server is up or the cluster is laggy [ 83.097288][ T6073] syzkaller0: entered promiscuous mode [ 83.099594][ T6073] syzkaller0: entered allmulticast mode [ 83.115008][ T2298] libceph: connect (1)[c::]:6789 error -101 [ 83.117723][ T2298] libceph: mon0 (1)[c::]:6789 connect error [ 83.273435][ T6077] ceph: No mds server is up or the cluster is laggy [ 83.281205][ T6084] syzkaller0: entered promiscuous mode [ 83.283135][ T6084] syzkaller0: entered allmulticast mode [ 84.306414][ T6103] vcan0: tx address claim with dlc 0 [ 84.309734][ T6103] netlink: 36 bytes leftover after parsing attributes in process `syz.0.16'. [ 84.346594][ T6105] netlink: 20 bytes leftover after parsing attributes in process `syz.0.17'. [ 84.350165][ T6105] netlink: 24 bytes leftover after parsing attributes in process `syz.0.17'. [ 84.387888][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 84.391554][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 84.395971][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 84.400000][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 84.658139][ T67] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 84.927011][ T6117] ref_ctr_offset mismatch. inode: 0x28 offset: 0x0 ref_ctr_offset(old): 0x0 ref_ctr_offset(new): 0x300000018 [ 85.087803][ T5951] Bluetooth: hci1: command tx timeout [ 85.089741][ T5951] Bluetooth: hci2: command tx timeout [ 85.091832][ T5296] Bluetooth: hci3: command tx timeout [ 85.097824][ T5296] Bluetooth: hci0: command tx timeout [ 86.294479][ T984] cfg80211: failed to load regulatory.db [ 86.458203][ T67] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 86.462177][ T6147] overlayfs: failed to resolve './bus': -2 [ 86.468796][ T6147] overlayfs: overlapping lowerdir path [ 86.607472][ T67] usb 5-1: Using ep0 maxpacket: 32 [ 86.612701][ T67] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 86.618092][ T67] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 86.621012][ T67] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 86.623631][ T67] usb 5-1: Product: syz [ 86.625050][ T67] usb 5-1: Manufacturer: syz [ 86.626585][ T67] usb 5-1: SerialNumber: syz [ 86.708701][ T6153] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 86.726571][ T6153] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 87.012656][ T67] usb 5-1: config 0 descriptor?? [ 87.020798][ T6127] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 87.024375][ T67] hub 5-1:0.0: bad descriptor, ignoring hub [ 87.026402][ T67] hub 5-1:0.0: probe with driver hub failed with error -5 qemu-system-x86_64: ahci: PRDT length for NCQ command (0x0) is smaller than the requested size (0x400000) [ 87.172391][ T1112] ata1.00: Read log 0x10 page 0x00 failed, Emask 0x1 [ 87.174706][ T1112] ata1: failed to read log page 10h (errno=-5) [ 87.176710][ T1112] ata1.00: NCQ disabled due to excessive errors [ 87.179425][ T1112] ata1.00: exception Emask 0x1 SAct 0x300 SErr 0x0 action 0x0 [ 87.181830][ T1112] ata1.00: irq_stat 0x41000000 [ 87.183355][ T1112] ata1.00: failed command: READ FPDMA QUEUED [ 87.185335][ T1112] ata1.00: cmd 60/00:40:0e:36:01/20:00:00:00:00/40 tag 8 ncq dma 4194304 in [ 87.185335][ T1112] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 87.191644][ T1112] ata1.00: status: { DRDY } [ 87.193119][ T1112] ata1.00: error: { ABRT } [ 87.194558][ T1112] ata1.00: failed command: READ FPDMA QUEUED [ 87.196549][ T1112] ata1.00: cmd 60/c8:48:0e:56:01/01:00:00:00:00/40 tag 9 ncq dma 233472 in [ 87.196549][ T1112] res 50/04:00:00:00:00/00:00:00:00:00/00 Emask 0x1 (device error) [ 87.202658][ T1112] ata1.00: status: { DRDY } [ 87.204179][ T1112] ata1.00: error: { ABRT } [ 87.206388][ T1112] ata1.00: configured for UDMA/100 [ 87.208727][ T1112] sd 0:0:0:0: [sda] tag#8 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s [ 87.211932][ T1112] sd 0:0:0:0: [sda] tag#8 Sense Key : Aborted Command [current] [ 87.214478][ T1112] sd 0:0:0:0: [sda] tag#8 Add. Sense: No additional sense information [ 87.217140][ T1112] sd 0:0:0:0: [sda] tag#8 CDB: Read(10) 28 00 00 01 36 0e 00 20 00 00 [ 87.220426][ T1112] I/O error, dev sda, sector 79374 op 0x0:(READ) flags 0x84700 phys_seg 65 prio class 2 [ 87.223645][ T1112] sd 0:0:0:0: [sda] tag#9 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s [ 87.226881][ T1112] sd 0:0:0:0: [sda] tag#9 Sense Key : Aborted Command [current] [ 87.229781][ T1112] sd 0:0:0:0: [sda] tag#9 Add. Sense: No additional sense information [ 87.237016][ T1112] sd 0:0:0:0: [sda] tag#9 CDB: Read(10) 28 00 00 01 56 0e 00 01 c8 00 [ 87.240014][ T1112] I/O error, dev sda, sector 87566 op 0x0:(READ) flags 0x80700 phys_seg 4 prio class 2 [ 87.243927][ T1112] ata1: EH complete [ 88.158060][ T58] usb 5-1: USB disconnect, device number 2 [ 98.438961][ T58] libceph: connect (1)[c::]:6789 error -101 [ 98.442032][ T58] libceph: mon0 (1)[c::]:6789 connect error [ 98.503205][ T6195] loop1: detected capacity change from 0 to 4096 [ 98.588014][ T6185] ceph: No mds server is up or the cluster is laggy [ 98.610455][ T6201] syzkaller0: entered promiscuous mode [ 98.612923][ T6201] syzkaller0: entered allmulticast mode [ 98.837649][ T67] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 98.987512][ T67] usb 7-1: Using ep0 maxpacket: 16 [ 98.992422][ T67] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 98.997721][ T67] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 99.007579][ T67] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 99.013009][ T67] usb 7-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 99.016117][ T67] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 99.021946][ T67] usb 7-1: config 0 descriptor?? [ 99.385998][ T6214] vivid-002: disconnect [ 99.429445][ T67] shield 0003:0955:7214.0002: unknown main item tag 0x0 [ 99.431811][ T67] shield 0003:0955:7214.0002: unknown main item tag 0x0 [ 99.434044][ T67] shield 0003:0955:7214.0002: unknown main item tag 0x0 [ 99.436297][ T67] shield 0003:0955:7214.0002: unknown main item tag 0x0 [ 99.454273][ T67] shield 0003:0955:7214.0002: unknown main item tag 0x0 [ 99.462205][ T67] input: HID 0955:7214 Haptics as /devices/virtual/input/input5 [ 99.492756][ T67] shield 0003:0955:7214.0002: Registered Thunderstrike controller [ 99.495520][ T67] shield 0003:0955:7214.0002: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.2-1/input0 [ 99.627363][ T6195] random: crng reseeded on system resumption [ 99.651696][ T67] shield 0003:0955:7214.0002: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 99.657177][ T67] shield 0003:0955:7214.0002: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 99.662387][ T67] shield 0003:0955:7214.0002: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 99.663719][ T34] usb 7-1: USB disconnect, device number 2 [ 99.667267][ T67] shield 0003:0955:7214.0002: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 100.171504][ T6210] vivid-002: reconnect [ 100.559447][ T6233] overlayfs: failed to resolve './bus': -2 [ 100.564901][ T6233] overlayfs: overlapping lowerdir path [ 100.679852][ T6241] siw: device registration error -23 [ 101.644903][ T6024] libceph: connect (1)[c::]:6789 error -101 [ 101.649738][ T6024] libceph: mon0 (1)[c::]:6789 connect error [ 101.799975][ T6245] ceph: No mds server is up or the cluster is laggy [ 101.932408][ T6024] libceph: connect (1)[c::]:6789 error -101 [ 101.935170][ T6024] libceph: mon0 (1)[c::]:6789 connect error [ 102.927994][ T6024] libceph: connect (1)[c::]:6789 error -101 [ 102.930317][ T6024] libceph: mon0 (1)[c::]:6789 connect error [ 103.157855][ T67] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 103.327518][ T67] usb 8-1: Using ep0 maxpacket: 32 [ 103.331462][ T67] usb 8-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 103.337538][ T67] usb 8-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 103.340519][ T67] usb 8-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 103.343277][ T67] usb 8-1: Product: syz [ 103.344648][ T67] usb 8-1: Manufacturer: syz [ 103.346171][ T67] usb 8-1: SerialNumber: syz [ 103.436618][ T67] usb 8-1: config 0 descriptor?? [ 103.436791][ T6268] ref_ctr_offset mismatch. inode: 0x45 offset: 0x0 ref_ctr_offset(old): 0x0 ref_ctr_offset(new): 0x300000018 [ 103.438792][ T6254] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 103.445798][ T67] hub 8-1:0.0: bad descriptor, ignoring hub [ 103.448053][ T67] hub 8-1:0.0: probe with driver hub failed with error -5 [ 103.537353][ T6270] netlink: 20 bytes leftover after parsing attributes in process `syz.1.44'. [ 103.541542][ T6270] netlink: 24 bytes leftover after parsing attributes in process `syz.1.44'. [ 103.908881][ T67] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: None [ 104.097598][ T984] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 104.247489][ T984] usb 7-1: Using ep0 maxpacket: 16 [ 104.252632][ T984] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 104.256617][ T984] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 104.260588][ T984] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 104.268154][ T984] usb 7-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 104.272759][ T984] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 104.309303][ T984] usb 7-1: config 0 descriptor?? [ 104.389686][ T12] raw-gadget.0 gadget.3: failed to queue suspend event [ 104.457580][ T6254] raw-gadget.0 gadget.3: failed to queue resume event [ 104.488677][ T12] raw-gadget.0 gadget.3: failed to queue suspend event [ 104.536869][ T6282] vcan0: tx address claim with dlc 0 [ 104.539723][ T6282] netlink: 36 bytes leftover after parsing attributes in process `syz.1.47'. [ 104.542798][ T6274] raw-gadget.0 gadget.3: failed to queue disconnect event [ 104.718142][ T984] shield 0003:0955:7214.0003: unknown main item tag 0x0 [ 104.720590][ T984] shield 0003:0955:7214.0003: unknown main item tag 0x0 [ 104.722946][ T984] shield 0003:0955:7214.0003: unknown main item tag 0x0 [ 104.725420][ T984] shield 0003:0955:7214.0003: unknown main item tag 0x0 [ 104.727933][ T984] shield 0003:0955:7214.0003: unknown main item tag 0x0 [ 104.733238][ T984] input: HID 0955:7214 Haptics as /devices/virtual/input/input6 [ 104.749469][ T984] shield 0003:0955:7214.0003: Registered Thunderstrike controller [ 104.752950][ T984] shield 0003:0955:7214.0003: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.2-1/input0 [ 104.916647][ T6276] random: crng reseeded on system resumption [ 104.924221][ T58] usb 7-1: USB disconnect, device number 3 [ 104.924224][ T6023] shield 0003:0955:7214.0003: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 104.930424][ T6023] shield 0003:0955:7214.0003: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 104.934093][ T6023] shield 0003:0955:7214.0003: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 104.938425][ T6023] shield 0003:0955:7214.0003: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 105.447233][ T6024] libceph: connect (1)[c::]:6789 error -101 [ 105.449502][ T6024] libceph: mon0 (1)[c::]:6789 connect error [ 105.487267][ T58] libceph: connect (1)[c::]:6789 error -101 [ 105.491264][ T58] libceph: mon0 (1)[c::]:6789 connect error [ 105.598880][ T6294] ceph: No mds server is up or the cluster is laggy [ 105.607897][ T6305] syzkaller0: entered promiscuous mode [ 105.609825][ T6305] syzkaller0: entered allmulticast mode [ 105.640792][ T6298] ceph: No mds server is up or the cluster is laggy [ 105.653427][ T6307] syzkaller0: entered promiscuous mode [ 105.655503][ T6307] syzkaller0: entered allmulticast mode [ 106.190404][ T6323] siw: device registration error -23 [ 107.536835][ T829] libceph: connect (1)[c::]:6789 error -101 [ 107.539607][ T829] libceph: mon0 (1)[c::]:6789 connect error [ 107.712451][ T6334] ceph: No mds server is up or the cluster is laggy [ 107.719207][ T6343] syzkaller0: entered promiscuous mode [ 107.721023][ T6343] syzkaller0: entered allmulticast mode [ 107.807724][ T829] libceph: connect (1)[c::]:6789 error -101 [ 107.809839][ T829] libceph: mon0 (1)[c::]:6789 connect error [ 108.029867][ T6008] usb 8-1: USB disconnect, device number 2 [ 108.498817][ T6008] libceph: connect (1)[c::]:6789 error -101 [ 108.500871][ T6008] libceph: mon0 (1)[c::]:6789 connect error [ 108.652178][ T6357] ceph: No mds server is up or the cluster is laggy [ 108.664408][ T6366] syzkaller0: entered promiscuous mode [ 108.666246][ T6366] syzkaller0: entered allmulticast mode [ 108.819238][ T67] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 109.008220][ T67] usb 7-1: Using ep0 maxpacket: 16 [ 109.015199][ T67] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 109.019601][ T67] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 109.023033][ T67] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 109.027746][ T67] usb 7-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 109.031213][ T67] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 109.075168][ T67] usb 7-1: config 0 descriptor?? [ 109.483862][ T67] shield 0003:0955:7214.0004: unknown main item tag 0x0 [ 109.486243][ T67] shield 0003:0955:7214.0004: unknown main item tag 0x0 [ 109.488662][ T67] shield 0003:0955:7214.0004: unknown main item tag 0x0 [ 109.490905][ T67] shield 0003:0955:7214.0004: unknown main item tag 0x0 [ 109.493165][ T67] shield 0003:0955:7214.0004: unknown main item tag 0x0 [ 109.496659][ T67] input: HID 0955:7214 Haptics as /devices/virtual/input/input7 [ 109.505493][ T67] shield 0003:0955:7214.0004: Registered Thunderstrike controller [ 109.513628][ T67] shield 0003:0955:7214.0004: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.2-1/input0 [ 109.576857][ T67] libceph: connect (1)[c::]:6789 error -101 [ 109.580402][ T67] libceph: mon0 (1)[c::]:6789 connect error [ 109.683116][ T6361] random: crng reseeded on system resumption [ 109.699040][ T24] shield 0003:0955:7214.0004: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 109.702015][ T6023] usb 7-1: USB disconnect, device number 4 [ 109.702617][ T24] shield 0003:0955:7214.0004: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 109.708903][ T24] shield 0003:0955:7214.0004: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 109.712426][ T24] shield 0003:0955:7214.0004: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 109.747903][ T6384] syzkaller0: entered promiscuous mode [ 109.749937][ T6384] syzkaller0: entered allmulticast mode [ 109.902547][ T24] libceph: connect (1)[c::]:6789 error -101 [ 109.947786][ T24] libceph: mon0 (1)[c::]:6789 connect error [ 110.009089][ T6375] ceph: No mds server is up or the cluster is laggy [ 110.192939][ T6023] libceph: connect (1)[c::]:6789 error -101 [ 110.195043][ T6023] libceph: mon0 (1)[c::]:6789 connect error [ 110.308296][ T6394] ceph: No mds server is up or the cluster is laggy [ 110.316550][ T6400] syzkaller0: entered promiscuous mode [ 110.322669][ T6400] syzkaller0: entered allmulticast mode [ 110.938777][ T5978] libceph: connect (1)[c::]:6789 error -101 [ 110.940924][ T5978] libceph: mon0 (1)[c::]:6789 connect error [ 111.017604][ T6023] usb 7-1: new high-speed USB device number 5 using dummy_hcd [ 111.093449][ T6413] ceph: No mds server is up or the cluster is laggy [ 111.112912][ T6413] syzkaller0: entered promiscuous mode [ 111.114797][ T6413] syzkaller0: entered allmulticast mode [ 111.177482][ T6023] usb 7-1: Using ep0 maxpacket: 32 [ 111.180574][ T6023] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 111.185658][ T6023] usb 7-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 111.190420][ T6023] usb 7-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 111.193199][ T6023] usb 7-1: Product: syz [ 111.194565][ T6023] usb 7-1: Manufacturer: syz [ 111.196111][ T6023] usb 7-1: SerialNumber: syz [ 111.203796][ T6023] usb 7-1: config 0 descriptor?? [ 111.206260][ T6404] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 111.209647][ T6023] hub 7-1:0.0: bad descriptor, ignoring hub [ 111.211560][ T6023] hub 7-1:0.0: probe with driver hub failed with error -5 [ 111.272566][ T6426] random: crng reseeded on system resumption [ 112.127555][ T6023] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 112.178747][ T12] raw-gadget.0 gadget.2: failed to queue suspend event [ 112.247550][ T6404] raw-gadget.0 gadget.2: failed to queue resume event [ 112.274454][ T6429] raw-gadget.0 gadget.2: failed to queue suspend event [ 112.277759][ T6429] raw-gadget.0 gadget.2: failed to queue disconnect event [ 112.287742][ T6023] usb 5-1: Using ep0 maxpacket: 16 [ 112.293336][ T6023] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 112.297233][ T6023] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 112.305620][ T6023] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 112.309975][ T6023] usb 5-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 112.312893][ T6023] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 112.316932][ T6023] usb 5-1: config 0 descriptor?? [ 112.732874][ T6023] shield 0003:0955:7214.0005: unknown main item tag 0x0 [ 112.735324][ T6023] shield 0003:0955:7214.0005: unknown main item tag 0x0 [ 112.737969][ T6023] shield 0003:0955:7214.0005: unknown main item tag 0x0 [ 112.740383][ T6023] shield 0003:0955:7214.0005: unknown main item tag 0x0 [ 112.742765][ T6023] shield 0003:0955:7214.0005: unknown main item tag 0x0 [ 112.746523][ T6023] input: HID 0955:7214 Haptics as /devices/virtual/input/input8 [ 112.761758][ T6023] shield 0003:0955:7214.0005: Registered Thunderstrike controller [ 112.764526][ T6023] shield 0003:0955:7214.0005: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.0-1/input0 [ 112.933612][ T6437] random: crng reseeded on system resumption [ 112.946469][ T5978] shield 0003:0955:7214.0005: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 112.946573][ T5991] usb 5-1: USB disconnect, device number 3 [ 112.950480][ T5978] shield 0003:0955:7214.0005: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 112.956124][ T5991] ------------[ cut here ]------------ [ 112.957940][ T5991] workqueue: work disable count underflowed [ 112.959894][ T5991] WARNING: kernel/workqueue.c:4410 at enable_work+0x2d1/0x320, CPU#2: kworker/2:3/5991 [ 112.961854][ T5978] shield 0003:0955:7214.0005: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 112.963095][ T5991] Modules linked in: [ 112.963119][ T5991] CPU: 2 UID: 0 PID: 5991 Comm: kworker/2:3 Not tainted syzkaller #0 PREEMPT(full) [ 112.963132][ T5991] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 112.967678][ T5978] shield 0003:0955:7214.0005: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 112.968159][ T5991] Workqueue: usb_hub_wq hub_event [ 112.980299][ T5991] RIP: 0010:enable_work+0x2d1/0x320 [ 112.982022][ T5991] Code: ff e8 e3 83 38 00 e8 7e c5 bd 09 e9 61 ff ff ff e8 d4 83 38 00 90 0f 0b 90 e9 17 fe ff ff e8 c6 83 38 00 48 8d 3d 5f 2b 0d 0f <67> 48 0f b9 3a 45 31 f6 e9 36 fe ff ff 48 89 ef e8 7a 10 a4 00 e9 [ 112.988272][ T5991] RSP: 0018:ffffc900069473b0 EFLAGS: 00010093 [ 112.990244][ T5991] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff81cf92d0 [ 112.993019][ T5991] RDX: ffff888026b24980 RSI: ffffffff81cf949a RDI: ffffffff90dcc000 [ 112.996099][ T5991] RBP: ffff8880135ee738 R08: 0000000000000007 R09: 0000000000000000 [ 112.998764][ T5991] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 113.001311][ T5991] R13: 1ffff92000d28e77 R14: ffff8880135ee698 R15: 000000007fffffff [ 113.003983][ T5991] FS: 0000000000000000(0000) GS:ffff88809734a000(0000) knlGS:0000000000000000 [ 113.007437][ T5991] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 113.009575][ T5991] CR2: 00000000f542bba8 CR3: 000000006b8eb000 CR4: 0000000000352ef0 [ 113.012247][ T5991] Call Trace: [ 113.013365][ T5991] [ 113.014375][ T5991] ? __pfx_enable_work+0x10/0x10 [ 113.016056][ T5991] ? __pfx___might_resched+0x10/0x10 [ 113.017864][ T5991] cancel_delayed_work_sync+0x96/0xf0 [ 113.019658][ T5991] thermal_zone_device_unregister+0x28e/0x4e0 [ 113.021629][ T5991] ? __pfx_shield_remove+0x10/0x10 [ 113.023395][ T5991] power_supply_unregister+0x10a/0x150 [ 113.025217][ T5991] shield_remove+0x75/0x130 [ 113.026782][ T5991] ? __pfx_shield_remove+0x10/0x10 [ 113.028569][ T5991] hid_device_remove+0xd1/0x270 [ 113.030175][ T5991] ? __pfx_hid_device_remove+0x10/0x10 [ 113.031976][ T5991] device_remove+0xcb/0x180 [ 113.032973][ T5978] libceph: connect (1)[c::]:6789 error -101 [ 113.033570][ T5991] device_release_driver_internal+0x42e/0x600 [ 113.033589][ T5991] bus_remove_device+0x22f/0x440 [ 113.033606][ T5991] device_del+0x376/0x9b0 [ 113.033618][ T5991] ? __pfx_device_del+0x10/0x10 [ 113.038063][ T5978] libceph: mon0 (1)[c::]:6789 connect error [ 113.038359][ T5991] ? do_raw_spin_lock+0x128/0x260 [ 113.047195][ T5991] ? find_held_lock+0x2b/0x80 [ 113.048823][ T5991] hid_destroy_device+0x19c/0x240 [ 113.050464][ T5991] usbhid_disconnect+0xa0/0xe0 [ 113.052059][ T5991] usb_unbind_interface+0x1dd/0x9e0 [ 113.053805][ T5991] ? kernfs_remove_by_name_ns+0x9f/0xf0 [ 113.055933][ T5991] ? __pfx_usb_unbind_interface+0x10/0x10 [ 113.057774][ T5991] device_remove+0x12a/0x180 [ 113.059298][ T5991] device_release_driver_internal+0x42e/0x600 [ 113.061262][ T5991] bus_remove_device+0x22f/0x440 [ 113.062884][ T5991] device_del+0x376/0x9b0 [ 113.064350][ T5991] ? __pfx_device_del+0x10/0x10 [ 113.065963][ T5991] ? kobject_put+0xb9/0x640 [ 113.067467][ T5991] usb_disable_device+0x367/0x810 [ 113.069154][ T5991] usb_disconnect+0x2e2/0x9a0 [ 113.070785][ T5991] hub_event+0x1d0c/0x4af0 [ 113.072275][ T5991] ? __lock_acquire+0x4a5/0x2630 [ 113.073938][ T5991] ? do_raw_spin_unlock+0x145/0x1e0 [ 113.075646][ T5991] ? __pfx_hub_event+0x10/0x10 [ 113.077235][ T5991] ? debug_object_deactivate+0x2e4/0x3b0 [ 113.079062][ T5991] ? perf_trace_sched_pi_setprio+0x640/0x750 [ 113.081087][ T5991] ? rcu_is_watching+0x12/0xc0 [ 113.082752][ T5991] process_one_work+0xa23/0x19a0 [ 113.084549][ T5991] ? __pfx_process_one_work+0x10/0x10 [ 113.086348][ T5991] ? __pfx_hub_event+0x10/0x10 [ 113.087934][ T5991] worker_thread+0x5ef/0xe50 [ 113.089490][ T5991] ? __pfx_worker_thread+0x10/0x10 [ 113.091186][ T5991] ? kthread+0x13a/0x450 [ 113.092589][ T5991] ? __pfx_worker_thread+0x10/0x10 [ 113.094397][ T5991] kthread+0x370/0x450 [ 113.095750][ T5991] ? __pfx_kthread+0x10/0x10 [ 113.097296][ T5991] ret_from_fork+0x754/0xd80 [ 113.098823][ T5991] ? __pfx_ret_from_fork+0x10/0x10 [ 113.100151][ T6008] usb 7-1: USB disconnect, device number 5 [ 113.100499][ T5991] ? __switch_to+0x7b4/0x1120 [ 113.104346][ T5991] ? __pfx_kthread+0x10/0x10 [ 113.105865][ T5991] ret_from_fork_asm+0x1a/0x30 [ 113.107454][ T5991] [ 113.108570][ T5991] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 113.110979][ T5991] CPU: 2 UID: 0 PID: 5991 Comm: kworker/2:3 Not tainted syzkaller #0 PREEMPT(full) [ 113.114097][ T5991] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 113.117972][ T5991] Workqueue: usb_hub_wq hub_event [ 113.119641][ T5991] Call Trace: [ 113.120745][ T5991] [ 113.121728][ T5991] dump_stack_lvl+0x100/0x190 [ 113.123282][ T5991] vpanic+0x552/0x970 [ 113.124639][ T5991] ? __pfx_vpanic+0x10/0x10 [ 113.126272][ T5991] panic+0xd1/0xe0 [ 113.127525][ T5991] ? __pfx_panic+0x10/0x10 [ 113.129008][ T5991] ? check_panic_on_warn+0x1f/0x90 [ 113.130684][ T5991] check_panic_on_warn.cold+0x19/0x34 [ 113.132439][ T5991] ? enable_work+0x2d1/0x320 [ 113.134074][ T5991] __warn.cold+0x191/0x348 [ 113.135634][ T5991] __report_bug+0x296/0x3d0 [ 113.137163][ T5991] ? enable_work+0x2d1/0x320 [ 113.138745][ T5991] ? __pfx___report_bug+0x10/0x10 [ 113.140419][ T5991] ? __pfx_debug_object_free+0x10/0x10 [ 113.142205][ T5991] ? enable_work+0x2ca/0x320 [ 113.143768][ T5991] ? enable_work+0x100/0x320 [ 113.145388][ T5991] ? find_held_lock+0x2b/0x80 [ 113.146970][ T5991] ? __flush_work+0x928/0xcb0 [ 113.148515][ T5991] ? __flush_work+0x928/0xcb0 [ 113.150069][ T5991] report_bug_entry+0xe1/0x290 [ 113.151657][ T5991] ? enable_work+0x2d1/0x320 [ 113.153209][ T5991] handle_bug+0x1cd/0x2a0 [ 113.154764][ T5991] exc_invalid_op+0x17/0x50 [ 113.156286][ T5991] asm_exc_invalid_op+0x1a/0x20 [ 113.158048][ T5991] RIP: 0010:enable_work+0x2d1/0x320 [ 113.159780][ T5991] Code: ff e8 e3 83 38 00 e8 7e c5 bd 09 e9 61 ff ff ff e8 d4 83 38 00 90 0f 0b 90 e9 17 fe ff ff e8 c6 83 38 00 48 8d 3d 5f 2b 0d 0f <67> 48 0f b9 3a 45 31 f6 e9 36 fe ff ff 48 89 ef e8 7a 10 a4 00 e9 [ 113.166009][ T5991] RSP: 0018:ffffc900069473b0 EFLAGS: 00010093 [ 113.167989][ T5991] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff81cf92d0 [ 113.170768][ T5991] RDX: ffff888026b24980 RSI: ffffffff81cf949a RDI: ffffffff90dcc000 [ 113.173413][ T5991] RBP: ffff8880135ee738 R08: 0000000000000007 R09: 0000000000000000 [ 113.176250][ T5991] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 113.178883][ T5991] R13: 1ffff92000d28e77 R14: ffff8880135ee698 R15: 000000007fffffff [ 113.181437][ T5991] ? enable_work+0x100/0x320 [ 113.182945][ T5991] ? enable_work+0x2ca/0x320 [ 113.184499][ T5991] ? __pfx_enable_work+0x10/0x10 [ 113.186151][ T5991] ? __pfx___might_resched+0x10/0x10 [ 113.187961][ T5991] cancel_delayed_work_sync+0x96/0xf0 [ 113.189700][ T5991] thermal_zone_device_unregister+0x28e/0x4e0 [ 113.191689][ T5991] ? __pfx_shield_remove+0x10/0x10 [ 113.193375][ T5991] power_supply_unregister+0x10a/0x150 [ 113.195445][ T5991] shield_remove+0x75/0x130 [ 113.197034][ T5991] ? __pfx_shield_remove+0x10/0x10 [ 113.198705][ T5991] hid_device_remove+0xd1/0x270 [ 113.200306][ T5991] ? __pfx_hid_device_remove+0x10/0x10 [ 113.202083][ T5991] device_remove+0xcb/0x180 [ 113.203581][ T5991] device_release_driver_internal+0x42e/0x600 [ 113.205572][ T5991] bus_remove_device+0x22f/0x440 [ 113.207238][ T5991] device_del+0x376/0x9b0 [ 113.208651][ T5991] ? __pfx_device_del+0x10/0x10 [ 113.210227][ T5991] ? do_raw_spin_lock+0x128/0x260 [ 113.211877][ T5991] ? find_held_lock+0x2b/0x80 [ 113.213430][ T5991] hid_destroy_device+0x19c/0x240 [ 113.215435][ T5991] usbhid_disconnect+0xa0/0xe0 [ 113.217015][ T5991] usb_unbind_interface+0x1dd/0x9e0 [ 113.218708][ T5991] ? kernfs_remove_by_name_ns+0x9f/0xf0 [ 113.220735][ T5991] ? __pfx_usb_unbind_interface+0x10/0x10 [ 113.222583][ T5991] device_remove+0x12a/0x180 [ 113.224229][ T5991] device_release_driver_internal+0x42e/0x600 [ 113.226213][ T5991] bus_remove_device+0x22f/0x440 [ 113.227842][ T5991] device_del+0x376/0x9b0 [ 113.229365][ T5991] ? __pfx_device_del+0x10/0x10 [ 113.230970][ T5991] ? kobject_put+0xb9/0x640 [ 113.232466][ T5991] usb_disable_device+0x367/0x810 [ 113.234365][ T5991] usb_disconnect+0x2e2/0x9a0 [ 113.235955][ T5991] hub_event+0x1d0c/0x4af0 [ 113.237430][ T5991] ? __lock_acquire+0x4a5/0x2630 [ 113.239167][ T5991] ? do_raw_spin_unlock+0x145/0x1e0 [ 113.240868][ T5991] ? __pfx_hub_event+0x10/0x10 [ 113.242435][ T5991] ? debug_object_deactivate+0x2e4/0x3b0 [ 113.244321][ T5991] ? perf_trace_sched_pi_setprio+0x640/0x750 [ 113.246355][ T5991] ? rcu_is_watching+0x12/0xc0 [ 113.247931][ T5991] process_one_work+0xa23/0x19a0 [ 113.249654][ T5991] ? __pfx_process_one_work+0x10/0x10 [ 113.251429][ T5991] ? __pfx_hub_event+0x10/0x10 [ 113.253000][ T5991] worker_thread+0x5ef/0xe50 [ 113.254537][ T5991] ? __pfx_worker_thread+0x10/0x10 [ 113.256322][ T5991] ? kthread+0x13a/0x450 [ 113.257710][ T5991] ? __pfx_worker_thread+0x10/0x10 [ 113.259396][ T5991] kthread+0x370/0x450 [ 113.260725][ T5991] ? __pfx_kthread+0x10/0x10 [ 113.262350][ T5991] ret_from_fork+0x754/0xd80 [ 113.263906][ T5991] ? __pfx_ret_from_fork+0x10/0x10 [ 113.265563][ T5991] ? __switch_to+0x7b4/0x1120 [ 113.267131][ T5991] ? __pfx_kthread+0x10/0x10 [ 113.268822][ T5991] ret_from_fork_asm+0x1a/0x30 [ 113.270392][ T5991] [ 113.272124][ T5991] Kernel Offset: disabled [ 113.273550][ T5991] Rebooting in 86400 seconds..