last executing test programs: 4.467984894s ago: executing program 3 (id=4): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r0, &(0x7f00000010c0)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{0x0}, {&(0x7f0000000e80)="44900000000056ee66c372f3105eb186dd8062fad2d5b5bfb0ba06f274a8d026bd209da8ffa6a26e3b3f8075704a9d0ef9aff7f1e7db24609f02d34e76992c9df9fe6888c6c9a4825c6223be6ac54536025af1dea54e527c68b0ff250261953f2da79a78104c2d9e7b16ed86b124945aa9ab7581ebd385fb61d442035db81e18c2d2462d0bb25fff9d3b1ce90b597992b2a4d541611ce77f58dce7c9500118229e7cdf4ca7f6adca92c73d97ce54164c1942b2568635bec8e020b41fb2f8000000000000000000000000000000001c8a9f7956583e26f6f0edc415851d0b8305fe66c2b7c114e3712d87744938848f24a13cb604000000000000000000000000000000c7aa5035897b20a6c23f1fc4af2990c07f784b985a3de7740bd33848702930", 0x122}, {&(0x7f00000003c0)="641a6a2b863c0dd898013a3f97a834ebb75a925ab48c844221841a232932fc2e37e327de21450df098c113e179", 0x2d}, {&(0x7f0000000540)="985e44efeabe001cabcf3d8673c3a254a9a2d3197970cb347b70a243bf77139a94bc3ae91684aaf7b7dff691deb8f8aef2d915fb3a0794a9a9b431a819bca6122c350637808dde804a048fd8696e524b2934126c443ce93d82e931eb9918e6c0827686e59209d2e02c9210fd8048f04ad6c48b3072092c483271361816bf21afb8473a064f1988536d4b5888807b3aaafa", 0x91}], 0x4}}, {{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000fc0)="31fdffffffffffffff74098b2e5e55a1828636f60fc0cfdac56c75f1687f0c56287423f5eed69f117e766bdbad0c2171ad6227e1173ab6efa2fcb1c420a51a0917861009000000f049c606ccab7cda1f0e3490fbe385ea382294882839a22674037b8910bd8a1420e33eb1be6d10cfb24eb7cccdf1528ef33b34ab07cdb0909a9ba999d89d0c5d7c9c8c569334e9547e1e343b451d9025c4e153612d4674b9411fb4de29559900bcb388d291aa839ab0954e6a8dfc19c3c1533a11d81e03a487b0d736f1caacc2bbf1194598a652677efb930a5b6ee292c5", 0xd8}], 0x1}}, {{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000940)="42e013913edbeb683c44e18a52b5a2462064ddd92caaba941de80d06047dedb7eeeff3a27eacf4c416b6979d7e918608807c44d01535dbaab3b390086e4fd43c6b5931187023646d6beac2340fdc7a0d81214ac708818f64d287311e8828dfd3e3dd67efdb129a6e52745d1540e5707be06bf411cc16a18c4d34e522a1f003498f1a03ea1f8828b6c902286c71a9bc21923972dacfa74fef6a0fd3267e599c1dd33dff5d7b28f134bda4a2e2a151d9aa4fc9c5", 0xb3}], 0x1}}, {{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f00000002c0)="e6bac1668e5b309efda177b827c14e1e59e57a59774d9a207d394f8b262cb974444d941c9401556676af700fd38224908adba4b8aee34bca25112816982b78c0be11782e21f26b871d9870f08d7834856d8a5dc7b179af4e0195037bf8f88583e76883590a3b12847f967a26b34ee3189936ac699c3a26c9b3d0", 0x7a}], 0x1}}, {{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f00000001c0)="d59f41c0418ebad512facf22d697f3c97fa25becae148b518203467ee73c881817657efe92a415cd70d9ae44e7de8d81f558e67adb0be705fcdae72a6125b0a47c9267278147923ab3f54170671e0918c5d3fa469152f3ec9191578240878db51753dbc15f7852f7e1614e75c90c1a0440a4cb3df109e647bf01db4235", 0x7d}, {&(0x7f0000000700)="73347c742785f90aa563b4c01785f8371c6c153843eb25bce2d86628414138f6d3eb90c44817fbcc958e331db94a8d1119eefe09b541e73e4789594b627b7ba9", 0x40}], 0x2, &(0x7f0000000d00)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x10001}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x2}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x8}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @multicast1, @loopback}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x4}}], 0x80}}], 0x5, 0x2090) socket$kcm(0x2d, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r0, &(0x7f00000000c0)="f43945ca864918caf5375823337eb7c72fc5b6b5161a2c0ca175ff29e6e88a7cc3f70000000000", 0xffffffffffffff73, 0x340080d1, 0x0, 0x0) 4.264147253s ago: executing program 3 (id=5): mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = socket(0x10, 0x3, 0x0) getsockopt$IP_VS_SO_GET_VERSION(r0, 0x0, 0x480, &(0x7f0000000140), &(0x7f0000000240)=0x40) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) r2 = socket$inet6(0xa, 0x5, 0x0) bind$inet6(r2, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x41}}}, 0x1c) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.memory_pressure\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000180), 0xfea7) r5 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) setsockopt$netrom_NETROM_T1(r5, 0x103, 0x1, &(0x7f0000001180)=0x5, 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) landlock_create_ruleset(&(0x7f0000000040)={0x2, 0x3, 0x3}, 0x18, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)) r6 = syz_open_dev$dri(&(0x7f0000000300), 0x1, 0xf2681) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r6, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r6, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0xc2) setsockopt$inet6_tcp_int(r7, 0x6, 0x2000000000000022, &(0x7f0000000340)=0x1, 0x4) setsockopt$inet6_tcp_TCP_REPAIR(r7, 0x6, 0x13, &(0x7f0000000100)=0x1, 0x4) 3.992371794s ago: executing program 2 (id=3): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) ioprio_set$uid(0x3, 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file1\x00', 0xe142, 0x0) sendfile(r0, r0, 0x0, 0x800000007) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @broadcast}) write$tun(r1, &(0x7f0000000200)={@val={0xa, 0xb3f0}, @void, @eth={@broadcast, @local, @void, {@ipv6={0x86dd, @icmpv6={0x9, 0x6, "4fac27", 0x10, 0x3a, 0x1, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x4, 0x200, 0x2000004, 0x54}}}}}}}, 0x4a) r3 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f0000000100)={&(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000040), &(0x7f0000000080)=[0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0], 0x5, 0x0, 0x2, 0x2}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000340)={0x8, 0x8169, 0x18}) 3.848333582s ago: executing program 3 (id=6): openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff0000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="2c235aa9c5", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) ioctl$OCFS2_IOC_GROUP_EXTEND(r0, 0x40046f01, &(0x7f00000002c0)=0x7) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46", 0xb5}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) syz_usb_control_io$cdc_ecm(r2, &(0x7f0000000140)={0x14, 0x0, &(0x7f0000000100)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_ep_write$ath9k_ep1(r2, 0x82, 0xc38, &(0x7f0000000300)=ANY=[]) 2.824778146s ago: executing program 1 (id=2): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x0) recvmsg$kcm(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000003940)=[{&(0x7f0000000900)=""/4105, 0x1009}], 0x1}, 0x2) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000003280)={0x73622a85, 0xa, 0x4}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@acquire], 0xffffffffffffff47, 0x0, 0x0}) dup3(r2, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000540)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0xfffffffffffffffd}) r4 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r4, &(0x7f0000000000)={0x23, 0x4}, 0x10) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000240), 0x802, 0x0) write$uinput_user_dev(r5, &(0x7f0000001940)={'syz0\x00', {0x8, 0x1, 0x8, 0x8}, 0x3d, [0x9, 0x2, 0x1, 0x0, 0x2, 0x1ff, 0x5, 0x2, 0x5, 0x4, 0x56a, 0x971d, 0xf39e, 0x750a, 0x0, 0x6, 0x6, 0xf603, 0x2, 0x7, 0x5, 0x5, 0xfffffff7, 0x3ff, 0x77f5, 0x80, 0x8, 0x8, 0x2, 0xc, 0x1, 0x45, 0x0, 0x8, 0x3, 0x4, 0x2, 0xf04, 0xffffff81, 0x1, 0x0, 0xffffffff, 0x8001, 0x9, 0x81, 0x2, 0x8, 0x9, 0x0, 0x9fe3, 0x2, 0xffffffff, 0x10001, 0x9, 0x2, 0x40, 0x5, 0x81, 0x2, 0x7, 0x8, 0x3, 0xffffff17, 0x80], [0xfffffffa, 0x48, 0x7ff, 0x0, 0x3, 0x9, 0x8, 0xfffffff8, 0x2, 0x8, 0x3, 0x2, 0x6c, 0x9, 0x6, 0x5, 0x1, 0xf56, 0x9, 0xc, 0x9, 0x1, 0xf45, 0x655, 0x0, 0x9, 0x9, 0xfffffff8, 0x3, 0x8, 0x7, 0x6, 0x3, 0x6, 0xf, 0x400, 0x3, 0x6, 0x60, 0x400, 0x3, 0x3, 0xffff263a, 0x516, 0x3, 0x10001, 0x8, 0x401, 0x3, 0xb, 0x0, 0x4, 0xfffffff8, 0x0, 0x0, 0x9, 0x2, 0x3, 0x7, 0x8c, 0x1, 0x3, 0x0, 0x8], [0x9, 0x7aaffa43, 0x2, 0x4d, 0x4, 0x2, 0x114, 0xfffff6c1, 0x7f, 0xffffffa7, 0x1, 0x0, 0xf26, 0x8, 0x4, 0x10000, 0x2, 0x1, 0x4, 0x4, 0x7fffffff, 0x2, 0xffffffff, 0x5, 0x8, 0x4, 0xffffffff, 0x5, 0x4, 0x5d466bc6, 0x72, 0x3, 0x7, 0xffff, 0x6, 0x6, 0x0, 0xc0f, 0x5, 0x9, 0xd, 0x1, 0x0, 0x0, 0x400, 0x6167, 0x28, 0x9, 0x5db8c233, 0x9, 0x4, 0x2, 0x1, 0x2, 0xf, 0x8, 0x6, 0xe5d, 0x0, 0x0, 0x4, 0x3, 0x46, 0x5], [0x9, 0x2343, 0x9, 0x1, 0x62, 0x0, 0x3, 0x57a, 0x9, 0x0, 0x2, 0x3, 0x56b, 0x7, 0x1, 0x8, 0x5, 0x6, 0x10001, 0x465d, 0x0, 0x8, 0x7ff, 0xffffffff, 0x9, 0xc, 0x5, 0x5, 0x81, 0x0, 0x0, 0x6, 0x5, 0x8, 0x81, 0x87, 0x9, 0xe7b, 0xfde7, 0x10000, 0x3ff, 0xb, 0x4, 0x5, 0xd, 0x7, 0x8001, 0x200, 0x1, 0x116, 0xffffad46, 0x9d2, 0x9, 0x6b71, 0x800, 0x1a30, 0xf2b, 0x0, 0x3, 0xb2, 0x72, 0x40, 0x6, 0x20]}, 0x45c) ioctl$SIOCPNENABLEPIPE(r4, 0x89ed, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0xffffffffffffff67, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000800)={@ptr={0x66642a85, 0x0, 0x0, 0x0, 0x2, 0x3e}, @ptr={0x70742a85, 0x20000000, &(0x7f0000000580)=""/236, 0xec, 0x1, 0x26}, @fda={0x66646185, 0x9, 0x1, 0xb8}}, &(0x7f0000000280)={0x0, 0x28, 0x50}}, 0x1040}], 0x0, 0x0, 0x0}) 2.668807687s ago: executing program 2 (id=7): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f00000001c0), r0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) openat2(0xffffffffffffff9c, 0x0, &(0x7f0000000040)={0x2040, 0xa440bbc8e621c4f7}, 0x18) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5", 0x4) r2 = accept4(r1, 0x0, 0x0, 0x800) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000001500), 0x400, 0x0) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000001580)={0x28, 0x6, 0x0, 0x0, &(0x7f0000ffe000/0x2000)=nil, 0x2000, 0xffffffffffffffff}) socket(0x11, 0x800, 0xeb6e) r4 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r4, 0x800448d2, 0x0) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0xf3099273a1b81afc}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) bind$netrom(r2, &(0x7f0000000300)={{0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x8}, [@null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null]}, 0x48) syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = fanotify_init(0x1, 0x40000) ppoll(&(0x7f0000000940)=[{r5, 0x4094}], 0x1, &(0x7f0000000980)={0x0, 0x3938700}, 0x0, 0x0) r6 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) r7 = syz_open_procfs(0x0, &(0x7f00000020c0)='net/wireless\x00') setfsuid(0xee00) getresuid(&(0x7f0000000200), &(0x7f0000000240), &(0x7f00000002c0)=0x0) setfsuid(r8) preadv(r7, &(0x7f0000001540)=[{&(0x7f0000001600)=""/171, 0xab}], 0x1, 0x2000000, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) r9 = syz_usb_connect(0x3, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0xf8, 0xd1, 0x81, 0x8, 0x2c42, 0x16f8, 0x5d24, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x75, 0xfc, 0x0, 0x5, "", [{{0x9, 0x4, 0xa3, 0xa2, 0x0, 0x6, 0xcc, 0xf6, 0xc}}]}}]}}, &(0x7f0000000ec0)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r9, &(0x7f0000001880)={0x14, 0x0, &(0x7f0000001840)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_control_io$uac1(r9, &(0x7f0000001a80)={0x14, 0x0, &(0x7f0000001a40)=ANY=[@ANYBLOB="00fbe406532d3a06e818"]}, 0x0) syz_usb_control_io$printer(r9, 0x0, &(0x7f0000002600)={0x34, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$VHOST_SET_LOG_FD(r6, 0x4004af07, &(0x7f0000000180)=r7) 1.702146403s ago: executing program 1 (id=8): openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff0000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) add_key$fscrypt_provisioning(&(0x7f0000000340), 0x0, 0x0, 0x0, 0xfffffffffffffffe) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="2c235aa9c5", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) ioctl$OCFS2_IOC_GROUP_EXTEND(r0, 0x40046f01, &(0x7f00000002c0)=0x7) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)=""/83, 0x53}], 0x1}, 0x0) r2 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) syz_usb_control_io$cdc_ecm(r2, &(0x7f0000000140)={0x14, 0x0, &(0x7f0000000100)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_ep_write$ath9k_ep1(r2, 0x82, 0xc38, &(0x7f0000000300)=ANY=[]) 1.701829511s ago: executing program 0 (id=1): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/comedi4\x00', 0x20002, 0x0) ioctl$COMEDI_INSN(r0, 0x8028640c, &(0x7f0000000280)={0x8000001, 0x300, 0x0, 0x0, 0x4000007}) r1 = socket$inet(0x2, 0x3, 0x0) getsockopt$inet_tcp_int(r1, 0x6, 0x2c, 0x0, &(0x7f0000000140)) socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000000c0)={0x44, r3, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_FRAME={0x26, 0x33, @action={{{}, {}, @broadcast}, @channel_switch={0x0, 0x4, {{0x25, 0x3, {0x0, 0x9d}}, @val={0x3e, 0x1}, @void}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8800}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x4000}, 0xc, 0x0}, 0x20000000) r5 = socket$kcm(0x23, 0x5, 0x0) listen(r5, 0x800) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000f00)=[{&(0x7f0000000200)="5c00000014006b05c84e21000ab16d6e230675f811000000440002005817d30461bc24eeb556a7ef595105ea1698fa51f60a64c9f408000000e786a6d0bdbdc3d44bd70011b6c0504bb9189d9193e9bd00"/92, 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x240040c4) r7 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r8, &(0x7f0000000600)="f3", 0x1, 0x0, &(0x7f0000001600)={0xa, 0x4e24, 0xffffffff, @rand_addr=' \x01\x00', 0x8}, 0x1c) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r8, 0x84, 0x7c, &(0x7f00000017c0)={0x0, 0xb1, 0x1}, 0x8) ioctl$COMEDI_DEVCONFIG(r7, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r7, 0x40946400, &(0x7f0000000600)={'8255\x00', [0x78, 0x0, 0x0, 0xc, 0x8, 0x6, 0x100002, 0x7, 0x5, 0x100, 0x7, 0xd, 0x1, 0x20003, 0x0, 0x101, 0x3, 0x80000000, 0x3, 0x1b18, 0x6, 0x4, 0x0, 0xffffffff, 0xb, 0xe69, 0x3c, 0xc, 0x10000006, 0x664, 0xfffffff8]}) r9 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r9, &(0x7f0000000380)={0x23, 0x0, 0x58}, 0x10) fcntl$dupfd(0xffffffffffffffff, 0x0, r9) accept4(r5, 0x0, 0x0, 0x80000) 737.355313ms ago: executing program 3 (id=9): socket$inet6(0xa, 0x1, 0x84) socket(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) socket$kcm(0x10, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x200800, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) syz_open_procfs(0x0, &(0x7f0000000480)='maps\x00') syz_open_dev$tty1(0xc, 0x4, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) r0 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x48640) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x0, &(0x7f00000000c0), &(0x7f0000000180), &(0x7f0000000200), &(0x7f00000001c0)=[0x7fffffff], 0x0, 0x1}) 0s ago: executing program 3 (id=10): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x48802) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x4048aecb, &(0x7f0000000040)) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.245' (ED25519) to the list of known hosts. syzkaller login: [ 75.337773][ T5810] cgroup: Unknown subsys name 'net' [ 75.569026][ T5810] cgroup: Unknown subsys name 'cpuset' [ 75.644883][ T5810] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 77.271292][ T5810] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 79.670858][ T5828] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 79.682157][ T5829] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 79.693551][ T5829] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 79.697282][ T5829] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 79.698333][ T5828] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 79.699285][ T5828] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 79.706724][ T5829] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 79.707433][ T5829] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 79.708246][ T5829] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 79.714679][ T5142] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 79.812441][ T60] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 79.841842][ T60] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 79.852790][ T60] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 79.865703][ T60] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 79.872650][ T60] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 79.967972][ T60] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 79.983848][ T60] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 79.985735][ T60] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 79.986722][ T60] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 79.987663][ T60] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 80.769378][ T5823] chnl_net:caif_netlink_parms(): no params data found [ 80.799902][ T5824] chnl_net:caif_netlink_parms(): no params data found [ 80.877794][ T5825] chnl_net:caif_netlink_parms(): no params data found [ 80.901194][ T5821] chnl_net:caif_netlink_parms(): no params data found [ 81.140385][ T5823] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.140553][ T5823] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.140903][ T5823] bridge_slave_0: entered allmulticast mode [ 81.143525][ T5823] bridge_slave_0: entered promiscuous mode [ 81.173243][ T5824] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.173408][ T5824] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.173765][ T5824] bridge_slave_0: entered allmulticast mode [ 81.176842][ T5824] bridge_slave_0: entered promiscuous mode [ 81.204791][ T5823] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.205058][ T5823] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.205321][ T5823] bridge_slave_1: entered allmulticast mode [ 81.207418][ T5823] bridge_slave_1: entered promiscuous mode [ 81.238649][ T5824] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.239118][ T5824] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.239393][ T5824] bridge_slave_1: entered allmulticast mode [ 81.242722][ T5824] bridge_slave_1: entered promiscuous mode [ 81.309965][ T5825] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.310152][ T5825] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.310314][ T5825] bridge_slave_0: entered allmulticast mode [ 81.312101][ T5825] bridge_slave_0: entered promiscuous mode [ 81.350955][ T5821] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.351200][ T5821] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.353822][ T5821] bridge_slave_0: entered allmulticast mode [ 81.358805][ T5821] bridge_slave_0: entered promiscuous mode [ 81.391761][ T5825] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.391971][ T5825] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.392195][ T5825] bridge_slave_1: entered allmulticast mode [ 81.395402][ T5825] bridge_slave_1: entered promiscuous mode [ 81.409336][ T5823] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.409716][ T5821] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.410975][ T5821] bridge0: port 2(bridge_slave_1) entered disabled state [ 81.411523][ T5821] bridge_slave_1: entered allmulticast mode [ 81.416683][ T5821] bridge_slave_1: entered promiscuous mode [ 81.428527][ T5824] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.463340][ T5823] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.486226][ T5824] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.545328][ T5825] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.570943][ T5821] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 81.593460][ T5825] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.598044][ T5823] team0: Port device team_slave_0 added [ 81.606255][ T5821] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 81.610347][ T5824] team0: Port device team_slave_0 added [ 81.635288][ T5823] team0: Port device team_slave_1 added [ 81.652348][ T5824] team0: Port device team_slave_1 added [ 81.785967][ T60] Bluetooth: hci0: command tx timeout [ 81.785967][ T5142] Bluetooth: hci2: command tx timeout [ 81.940127][ T5825] team0: Port device team_slave_0 added [ 81.945738][ T5142] Bluetooth: hci1: command tx timeout [ 81.971609][ T5821] team0: Port device team_slave_0 added [ 81.996606][ T5825] team0: Port device team_slave_1 added [ 81.998060][ T5823] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 81.998070][ T5823] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.998083][ T5823] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.002530][ T5821] team0: Port device team_slave_1 added [ 82.003773][ T5824] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.003782][ T5824] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.003800][ T5824] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.024217][ T60] Bluetooth: hci3: command tx timeout [ 82.039167][ T5823] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.039182][ T5823] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.039206][ T5823] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.119491][ T5824] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.119507][ T5824] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.119531][ T5824] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.264350][ T5825] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.264364][ T5825] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.264381][ T5825] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.322330][ T5821] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.322345][ T5821] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.322368][ T5821] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.339233][ T5825] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.339248][ T5825] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.339271][ T5825] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.401575][ T5821] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.401591][ T5821] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 82.401615][ T5821] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.513854][ T5823] hsr_slave_0: entered promiscuous mode [ 82.516793][ T5823] hsr_slave_1: entered promiscuous mode [ 82.529721][ T5824] hsr_slave_0: entered promiscuous mode [ 82.530949][ T5824] hsr_slave_1: entered promiscuous mode [ 82.531944][ T5824] debugfs: 'hsr0' already exists in 'hsr' [ 82.532024][ T5824] Cannot create hsr debugfs directory [ 82.605339][ T5825] hsr_slave_0: entered promiscuous mode [ 82.606625][ T5825] hsr_slave_1: entered promiscuous mode [ 82.607578][ T5825] debugfs: 'hsr0' already exists in 'hsr' [ 82.607601][ T5825] Cannot create hsr debugfs directory [ 82.639934][ T5821] hsr_slave_0: entered promiscuous mode [ 82.641125][ T5821] hsr_slave_1: entered promiscuous mode [ 82.642011][ T5821] debugfs: 'hsr0' already exists in 'hsr' [ 82.642032][ T5821] Cannot create hsr debugfs directory [ 83.543000][ T5823] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 83.597191][ T5823] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 83.606975][ T5823] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 83.655705][ T5823] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 83.668001][ T5823] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 83.698611][ T5823] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 83.722934][ T5823] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 83.758777][ T5823] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 83.865848][ T60] Bluetooth: hci2: command tx timeout [ 83.866351][ T60] Bluetooth: hci0: command tx timeout [ 83.926913][ T5825] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 83.968828][ T5825] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 83.973524][ T5825] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 84.010318][ T5825] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 84.019319][ T5825] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 84.025749][ T5142] Bluetooth: hci1: command tx timeout [ 84.051293][ T5825] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 84.080749][ T5825] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 84.104337][ T5142] Bluetooth: hci3: command tx timeout [ 84.119660][ T5825] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 84.285922][ T5824] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 84.321556][ T5824] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 84.340606][ T5824] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 84.370051][ T5824] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 84.377242][ T5824] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 84.407957][ T5824] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 84.446716][ T5824] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 84.481843][ T5824] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 84.640793][ T5821] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 84.685466][ T5821] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 84.702790][ T5821] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 84.739344][ T5821] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 84.742418][ T5821] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 84.779951][ T5821] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 84.796835][ T5821] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 84.830876][ T5821] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 84.926632][ T5823] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.021810][ T5823] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.083493][ T43] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.090412][ T43] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.119310][ T5825] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.140174][ T43] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.140627][ T43] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.249144][ T5825] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.258072][ T5824] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.296331][ T3600] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.297063][ T3600] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.375938][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.376094][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.420939][ T5824] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.459762][ T3600] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.459895][ T3600] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.496811][ T5821] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.529074][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.529174][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.676324][ T5821] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.739002][ T68] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.739222][ T68] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.780817][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.780957][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.945213][ T5142] Bluetooth: hci2: command tx timeout [ 85.958935][ T5142] Bluetooth: hci0: command tx timeout [ 86.070207][ T5823] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.104285][ T5142] Bluetooth: hci1: command tx timeout [ 86.185065][ T5142] Bluetooth: hci3: command tx timeout [ 86.334435][ T5825] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.532238][ T5823] veth0_vlan: entered promiscuous mode [ 86.599503][ T5823] veth1_vlan: entered promiscuous mode [ 86.637712][ T5824] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.806576][ T5825] veth0_vlan: entered promiscuous mode [ 86.829076][ T5821] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.865206][ T5823] veth0_macvtap: entered promiscuous mode [ 86.894164][ T5825] veth1_vlan: entered promiscuous mode [ 86.899804][ T5823] veth1_macvtap: entered promiscuous mode [ 86.951595][ T5824] veth0_vlan: entered promiscuous mode [ 87.006222][ T5823] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.011366][ T5824] veth1_vlan: entered promiscuous mode [ 87.041719][ T5823] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.093278][ T43] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.123861][ T43] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.137323][ T5825] veth0_macvtap: entered promiscuous mode [ 87.170342][ T43] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.188070][ T44] cfg80211: failed to load regulatory.db [ 87.189801][ T43] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.190932][ T5821] veth0_vlan: entered promiscuous mode [ 87.230878][ T5825] veth1_macvtap: entered promiscuous mode [ 87.375894][ T5821] veth1_vlan: entered promiscuous mode [ 87.422734][ T5824] veth0_macvtap: entered promiscuous mode [ 87.610849][ T5825] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.612882][ T5824] veth1_macvtap: entered promiscuous mode [ 87.665913][ T5825] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.747746][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.757529][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.773721][ T531] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.773745][ T531] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.815799][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.849055][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.869185][ T5824] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.948039][ T5821] veth0_macvtap: entered promiscuous mode [ 87.966018][ T5824] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.024308][ T5142] Bluetooth: hci0: command tx timeout [ 88.024341][ T5142] Bluetooth: hci2: command tx timeout [ 88.101035][ T5821] veth1_macvtap: entered promiscuous mode [ 88.152791][ T1253] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.152810][ T1253] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.155208][ T43] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.184681][ T60] Bluetooth: hci1: command tx timeout [ 88.227424][ T43] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.273584][ T60] Bluetooth: hci3: command tx timeout [ 88.365825][ T43] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.398508][ T43] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.643079][ T5821] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.731819][ T3600] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.731837][ T3600] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.745847][ T5821] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.970484][ T1218] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.046228][ T1218] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.082049][ T1218] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.112498][ T1218] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.181539][ T43] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.181575][ T43] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.520138][ T43] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.520156][ T43] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.006632][ T5922] syz.2.3 uses obsolete (PF_INET,SOCK_PACKET) [ 90.010050][ T1197] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.010068][ T1197] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.014538][ T5922] syzkaller1: entered promiscuous mode [ 90.014562][ T5922] syzkaller1: entered allmulticast mode [ 90.287759][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.287784][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.471214][ T5559] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 90.668705][ T5559] usb 4-1: Using ep0 maxpacket: 16 [ 90.738204][ T5559] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 90.738263][ T5559] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 90.738290][ T5559] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 90.738310][ T5559] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 90.738332][ T5559] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 90.741171][ T5559] usb 4-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 90.741199][ T5559] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 90.741216][ T5559] usb 4-1: Manufacturer: syz [ 90.849375][ T5559] usb 4-1: config 0 descriptor?? [ 90.855700][ T43] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.855727][ T43] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.195883][ T5924] binder: 5923:5924 ioctl c0306201 200000000080 returned -14 [ 91.246671][ T5924] binder: BINDER_SET_CONTEXT_MGR already set [ 91.246686][ T5924] binder: 5923:5924 ioctl 4018620d 200000000040 returned -16 [ 91.281118][ T5559] rc_core: IR keymap rc-hauppauge not found [ 91.281137][ T5559] Registered IR keymap rc-empty [ 91.305947][ T5559] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 91.327398][ T5924] binder: 5923:5924 ioctl c0306201 2000000003c0 returned -14 [ 91.327993][ T5559] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 91.343655][ T5926] warning: `syz.2.7' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 91.386524][ T5559] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 91.425441][ T5559] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input5 [ 91.479792][ T5559] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 91.494223][ T5559] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 91.517332][ T5559] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 91.534184][ T5559] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 91.554205][ T5559] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 91.575190][ T5559] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 91.595534][ T5559] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 91.615835][ T5559] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 91.634182][ T5559] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 91.655135][ T5559] mceusb 4-1:0.0: Error: mce write submit urb error = -90 [ 91.770532][ T5874] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 91.812806][ T5559] mceusb 4-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 91.812832][ T5559] mceusb 4-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 91.915950][ T5559] usb 4-1: USB disconnect, device number 2 [ 92.075120][ T5874] usb 3-1: Using ep0 maxpacket: 8 [ 92.090857][ T5874] usb 3-1: unable to get BOS descriptor or descriptor too short [ 92.094138][ T5874] usb 3-1: config 117 has an invalid interface number: 163 but max is 0 [ 92.094159][ T5874] usb 3-1: config 117 has no interface number 0 [ 92.094187][ T5874] usb 3-1: config 117 interface 163 has no altsetting 0 [ 92.123866][ T5874] usb 3-1: New USB device found, idVendor=2c42, idProduct=16f8, bcdDevice=5d.24 [ 92.123895][ T5874] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 92.123913][ T5874] usb 3-1: Product: syz [ 92.123925][ T5874] usb 3-1: Manufacturer: syz [ 92.123937][ T5874] usb 3-1: SerialNumber: syz [ 92.387168][ T5891] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 92.625564][ T5891] usb 2-1: Using ep0 maxpacket: 16 [ 92.628992][ T5891] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 92.629039][ T5891] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 92.629066][ T5891] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 92.629085][ T5891] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 92.629105][ T5891] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 92.630589][ T5891] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 92.630614][ T5891] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 92.630632][ T5891] usb 2-1: Manufacturer: syz [ 92.685219][ T5939] netlink: 'syz.0.1': attribute type 2 has an invalid length. [ 92.899971][ T43] wlan1: BSS 50:50:50:50:50:50 switches to unsupported channel (0 MHz), disconnecting [ 93.032754][ T5891] usb 2-1: config 0 descriptor?? [ 93.101901][ T43] wlan1: Selected IBSS BSSID 50:50:50:50:50:50 based on configured SSID [ 93.286301][ T5874] f81534a_ctrl 3-1:117.163: probe with driver f81534a_ctrl failed with error -71 [ 93.395997][ T5874] usb 3-1: USB disconnect, device number 2 [ 93.624480][ T5891] rc_core: IR keymap rc-hauppauge not found [ 93.624500][ T5891] Registered IR keymap rc-empty [ 93.624657][ T5891] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 93.631946][ C0] [ 93.631958][ C0] ====================================================== [ 93.631965][ C0] WARNING: possible circular locking dependency detected [ 93.631990][ C0] syzkaller #0 Not tainted [ 93.631998][ C0] ------------------------------------------------------ [ 93.632003][ C0] syz.0.1/5933 is trying to acquire lock: [ 93.632013][ C0] ffff88823bf6ea60 (slock-AF_PHONET/1){+.+.}-{3:3}, at: __sk_receive_skb+0x1bf/0x9e0 [ 93.632067][ C0] [ 93.632067][ C0] but task is already holding lock: [ 93.632071][ C0] ffff88803626d160 (slock-AF_PHONET){+...}-{3:3}, at: __sk_receive_skb+0x1f1/0x9e0 [ 93.632103][ C0] [ 93.632103][ C0] which lock already depends on the new lock. [ 93.632103][ C0] [ 93.632109][ C0] [ 93.632109][ C0] the existing dependency chain (in reverse order) is: [ 93.632114][ C0] [ 93.632114][ C0] -> #1 (slock-AF_PHONET){+...}-{3:3}: [ 93.632160][ C0] rt_spin_lock+0x83/0x400 [ 93.632178][ C0] __sk_receive_skb+0x1f1/0x9e0 [ 93.632196][ C0] phonet_rcv+0x781/0xc40 [ 93.632209][ C0] process_backlog+0x5e1/0xc60 [ 93.632227][ C0] __napi_poll+0xab/0x550 [ 93.632240][ C0] net_rx_action+0x696/0xe00 [ 93.632256][ C0] handle_softirqs+0x1de/0x6d0 [ 93.632272][ C0] __local_bh_enable_ip+0x170/0x2b0 [ 93.632290][ C0] netif_rx+0xb9/0xf0 [ 93.632311][ C0] pn_send+0x62a/0x8e0 [ 93.632324][ C0] pn_skb_send+0x218/0x530 [ 93.632338][ C0] pipe_snd_status+0x1f1/0x320 [ 93.632353][ C0] pipe_do_rcv+0xf15/0x16a0 [ 93.632369][ C0] __sk_receive_skb+0x962/0x9e0 [ 93.632386][ C0] pep_do_rcv+0x685/0xaa0 [ 93.632401][ C0] __release_sock+0x2a9/0x3d0 [ 93.632413][ C0] release_sock+0x1be/0x290 [ 93.632429][ C0] pep_sock_accept+0xd47/0x11e0 [ 93.632444][ C0] pn_socket_accept+0xc1/0x310 [ 93.632464][ C0] do_accept+0x6ca/0x930 [ 93.632482][ C0] __sys_accept4+0x139/0x230 [ 93.632499][ C0] __x64_sys_accept4+0x9a/0xb0 [ 93.632517][ C0] do_syscall_64+0x15f/0xf80 [ 93.632536][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.632552][ C0] [ 93.632552][ C0] -> #0 (slock-AF_PHONET/1){+.+.}-{3:3}: [ 93.632580][ C0] __lock_acquire+0x15a5/0x2cf0 [ 93.632598][ C0] lock_acquire+0x106/0x350 [ 93.632616][ C0] rt_spin_lock_nested+0x81/0x3f0 [ 93.632631][ C0] __sk_receive_skb+0x1bf/0x9e0 [ 93.632648][ C0] pep_do_rcv+0x685/0xaa0 [ 93.632662][ C0] __sk_receive_skb+0x962/0x9e0 [ 93.632679][ C0] phonet_rcv+0x781/0xc40 [ 93.632693][ C0] process_backlog+0x5e1/0xc60 [ 93.632710][ C0] __napi_poll+0xab/0x550 [ 93.632725][ C0] net_rx_action+0x696/0xe00 [ 93.632742][ C0] handle_softirqs+0x1de/0x6d0 [ 93.632757][ C0] __local_bh_enable_ip+0x170/0x2b0 [ 93.632772][ C0] netif_rx+0xb9/0xf0 [ 93.632793][ C0] pn_send+0x62a/0x8e0 [ 93.632806][ C0] pn_skb_send+0x218/0x530 [ 93.632820][ C0] pep_sock_close+0x2c1/0x5b0 [ 93.632835][ C0] pn_socket_release+0x9b/0xc0 [ 93.632862][ C0] __sock_release+0xb9/0x250 [ 93.632877][ C0] sock_close+0x1c/0x30 [ 93.632891][ C0] __fput+0x461/0xa70 [ 93.632909][ C0] task_work_run+0x1d9/0x270 [ 93.632929][ C0] exit_to_user_mode_loop+0xed/0x480 [ 93.632948][ C0] do_syscall_64+0x33e/0xf80 [ 93.632968][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.632983][ C0] [ 93.632983][ C0] other info that might help us debug this: [ 93.632983][ C0] [ 93.632989][ C0] Possible unsafe locking scenario: [ 93.632989][ C0] [ 93.632994][ C0] CPU0 CPU1 [ 93.632999][ C0] ---- ---- [ 93.633005][ C0] lock(slock-AF_PHONET); [ 93.633016][ C0] lock(slock-AF_PHONET/1); [ 93.633033][ C0] lock(slock-AF_PHONET); [ 93.633047][ C0] lock(slock-AF_PHONET/1); [ 93.633062][ C0] [ 93.633062][ C0] *** DEADLOCK *** [ 93.633062][ C0] [ 93.633067][ C0] 7 locks held by syz.0.1/5933: [ 93.633077][ C0] #0: ffff88805ec98978 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x89/0x250 [ 93.633123][ C0] #1: ffff88803f31d218 (sk_lock-AF_PHONET){+.+.}-{0:0}, at: pep_sock_close+0x86/0x5b0 [ 93.633164][ C0] #2: ffffffff8e3c81c0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 [ 93.633205][ C0] #3: ffffffff8e3c81c0 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x271/0xc60 [ 93.633247][ C0] #4: ffff88803626d160 (slock-AF_PHONET){+...}-{3:3}, at: __sk_receive_skb+0x1f1/0x9e0 [ 93.633290][ C0] #5: ffffffff8e3c81c0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 [ 93.633330][ C0] #6: ffff88803626d218 (sk_lock-AF_PHONET){+.+.}-{0:0}, at: phonet_rcv+0x781/0xc40 [ 93.633369][ C0] [ 93.633369][ C0] stack backtrace: [ 93.633392][ C0] CPU: 0 UID: 0 PID: 5933 Comm: syz.0.1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 93.633412][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 93.633429][ C0] Call Trace: [ 93.633436][ C0] [ 93.633443][ C0] dump_stack_lvl+0xe8/0x150 [ 93.633462][ C0] print_circular_bug+0x2e1/0x300 [ 93.633488][ C0] check_noncircular+0x12e/0x150 [ 93.633515][ C0] __lock_acquire+0x15a5/0x2cf0 [ 93.633537][ C0] ? try_to_take_rt_mutex+0x840/0xb00 [ 93.633562][ C0] ? __sk_receive_skb+0x1bf/0x9e0 [ 93.633580][ C0] lock_acquire+0x106/0x350 [ 93.633599][ C0] ? __sk_receive_skb+0x1bf/0x9e0 [ 93.633619][ C0] ? sk_filter_trim_cap+0x8f1/0xce0 [ 93.633638][ C0] rt_spin_lock_nested+0x81/0x3f0 [ 93.633655][ C0] ? __sk_receive_skb+0x1bf/0x9e0 [ 93.633674][ C0] ? __pfx_sk_filter_trim_cap+0x10/0x10 [ 93.633689][ C0] ? __lock_acquire+0x6b5/0x2cf0 [ 93.633709][ C0] ? __pfx_rt_spin_lock_nested+0x10/0x10 [ 93.633727][ C0] ? rt_spin_lock+0x1e0/0x400 [ 93.633745][ C0] __sk_receive_skb+0x1bf/0x9e0 [ 93.633768][ C0] pep_do_rcv+0x685/0xaa0 [ 93.633786][ C0] ? __pfx_pep_do_rcv+0x10/0x10 [ 93.633806][ C0] ? __pfx_pep_do_rcv+0x10/0x10 [ 93.633823][ C0] ? phonet_rcv+0x781/0xc40 [ 93.633838][ C0] __sk_receive_skb+0x962/0x9e0 [ 93.633866][ C0] phonet_rcv+0x781/0xc40 [ 93.633880][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 93.633905][ C0] ? __pfx_phonet_rcv+0x10/0x10 [ 93.633922][ C0] ? process_backlog+0x271/0xc60 [ 93.633941][ C0] ? process_backlog+0x271/0xc60 [ 93.633959][ C0] ? __pfx_phonet_rcv+0x10/0x10 [ 93.633972][ C0] process_backlog+0x5e1/0xc60 [ 93.633992][ C0] __napi_poll+0xab/0x550 [ 93.634009][ C0] net_rx_action+0x696/0xe00 [ 93.634029][ C0] ? __pfx_net_rx_action+0x10/0x10 [ 93.634045][ C0] ? kvm_sched_clock_read+0x11/0x20 [ 93.634064][ C0] ? __pfx_sched_clock_cpu+0x10/0x10 [ 93.634082][ C0] ? enqueue_to_backlog+0x340/0xcb0 [ 93.634097][ C0] handle_softirqs+0x1de/0x6d0 [ 93.634113][ C0] __local_bh_enable_ip+0x170/0x2b0 [ 93.634127][ C0] netif_rx+0xb9/0xf0 [ 93.634144][ C0] pn_send+0x62a/0x8e0 [ 93.634157][ C0] pn_skb_send+0x218/0x530 [ 93.634171][ C0] pep_sock_close+0x2c1/0x5b0 [ 93.634190][ C0] pn_socket_release+0x9b/0xc0 [ 93.634208][ C0] __sock_release+0xb9/0x250 [ 93.634226][ C0] ? __pfx_sock_close+0x10/0x10 [ 93.634242][ C0] sock_close+0x1c/0x30 [ 93.634258][ C0] __fput+0x461/0xa70 [ 93.634281][ C0] task_work_run+0x1d9/0x270 [ 93.634304][ C0] ? __pfx_task_work_run+0x10/0x10 [ 93.634327][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.634345][ C0] exit_to_user_mode_loop+0xed/0x480 [ 93.634365][ C0] ? rcu_is_watching+0x15/0xb0 [ 93.634387][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.634404][ C0] do_syscall_64+0x33e/0xf80 [ 93.634426][ C0] ? trace_irq_disable+0x3b/0x140 [ 93.634444][ C0] ? clear_bhb_loop+0x40/0x90 [ 93.634463][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.634480][ C0] RIP: 0033:0x7fcf1435c819 [ 93.634512][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.634526][ C0] RSP: 002b:00007fff904fc278 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 93.634545][ C0] RAX: 0000000000000000 RBX: 00007fcf145d7da0 RCX: 00007fcf1435c819 [ 93.634557][ C0] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 93.634566][ C0] RBP: 00007fcf145d7da0 R08: 0000000000000006 R09: 0000000000000000 [ 93.634577][ C0] R10: 00007fcf145d7cb0 R11: 0000000000000246 R12: 0000000000016ab0 [ 93.634589][ C0] R13: 00007fcf145d627c R14: 0000000000016a2c R15: 00007fff904fc380 [ 93.634604][ C0] [ 93.644167][ T5891] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 93.664830][ T5891] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 93.782821][ T5891] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input7 [ 93.883614][ T5947] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 93.933578][ T5891] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 93.951748][ T5891] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 93.970770][ T5891] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 93.984148][ T5891] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 94.004325][ T5891] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 94.025574][ T5891] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 94.044289][ T5891] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 94.064923][ T5891] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 94.094358][ T5891] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 94.115704][ T5891] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 94.175141][ T5891] mceusb 2-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 94.175163][ T5891] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 94.486721][ T5891] usb 2-1: USB disconnect, device number 2