last executing test programs: 4.786399157s ago: executing program 0 (id=113): socket(0x11, 0x3, 0x300) bind$netlink(0xffffffffffffffff, &(0x7f0000000200)={0x10, 0x0, 0x3, 0x80065c9}, 0xc) read$FUSE(0xffffffffffffffff, &(0x7f0000006200)={0x2020}, 0x2020) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0xa8002, 0x0) ioctl$EVIOCGPROP(r1, 0x40047438, &(0x7f0000000180)=""/246) ioctl$PPPIOCSMRU1(r1, 0x40047452, &(0x7f0000000280)=0x6) 4.785331846s ago: executing program 3 (id=114): socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6(0xa, 0x2, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$igmp(0x2, 0x3, 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r4, @ANYBLOB="1f003300d000000008021100000108021100000050505050505000001502", @ANYRES16=r0], 0x3c}, 0x1, 0x0, 0x0, 0x8800}, 0x10) 4.785123792s ago: executing program 0 (id=115): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x1000, 0x1000, &(0x7f0000001000/0x1000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl(r2, 0x4048aecb, &(0x7f0000000400)="00000000000000000010") r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r3, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 4.737171753s ago: executing program 3 (id=116): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xf0, &(0x7f0000000100)={&(0x7f0000000280)=@newlink={0x20, 0x10, 0x401, 0x0, 0x0, {0x0, 0x48, 0x0, r1, 0x21eae}}, 0x20}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$unix(0x1, 0x2, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), r2) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)={0x50, r4, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {@void, @val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x7ff, 0x70}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'syzkaller0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}, @NL80211_ATTR_MESH_ID={0xa}]}, 0x50}, 0x1, 0x0, 0x0, 0x91}, 0x24044884) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r7 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) getsockopt$llc_int(r7, 0x10c, 0x5, &(0x7f0000000200), &(0x7f0000000280)=0x4) syz_emit_ethernet(0x35, &(0x7f0000000000)={@local, @local, @val={@val={0x88a8, 0x7, 0x1, 0x2}, {0x8100, 0x6, 0x0, 0x1}}, {@arp={0x806, @generic={0x10f, 0x88f5, 0x6, 0x6, 0x4, @link_local, "981f71d1bb16", @random="b04d290548a9", "1ba3a6aa4a"}}}}, &(0x7f0000000080)={0x1, 0x2, [0x829, 0x8cb, 0x3d, 0x66]}) socket$packet(0x11, 0x2, 0x300) close(r6) socket$inet_sctp(0x2, 0x1, 0x84) ioctl$SIOCSIFHWADDR(r6, 0x8914, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r8, &(0x7f0000000640)="000a18000000", 0x6, 0x4000000, 0x0, 0x0) 4.590455601s ago: executing program 3 (id=117): ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000780)={'syztnl0\x00', &(0x7f0000000700)={'ip6_vti0\x00', 0x0, 0x4, 0x20, 0x8, 0x3, 0x5f, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x7, 0x700, 0x5, 0x7bc}}) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f00000000c0)={0xcf47, 0x4cc, 0xffff, 0x9dff, 0x1, "8003e3ffff072000"}) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x3, 0x7fff, 0x16, "b0bf2ebb48c849ac0000000003000018bfff40"}) r1 = syz_open_pts(r0, 0x200) r2 = dup3(r1, r0, 0x0) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000080)=0xff) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000140)=0x12) 4.4787045s ago: executing program 0 (id=119): syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002e0010140878025000000000000010902270001010080000904000003e0010100070581020002000705020200020007058303400001"], 0x0) nanosleep(&(0x7f0000000300)={0x1}, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r0, 0x400448ca, 0x0) ioctl(r0, 0x400448c9, 0x0) (async) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000200)="4a00000011007f0314066f9a70932d490675bc59083301", 0x17) write(r0, &(0x7f0000000240)="4a00010011007f0314066f9a70932d490675bc59083301", 0x17) 3.682885254s ago: executing program 3 (id=125): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xf0, &(0x7f0000000100)={&(0x7f0000000280)=@newlink={0x20, 0x10, 0x401, 0x0, 0x0, {0x0, 0x48, 0x0, r1, 0x21eae}}, 0x20}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$unix(0x1, 0x2, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), r2) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)={0x50, r4, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {@void, @val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x7ff, 0x70}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'syzkaller0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}, @NL80211_ATTR_MESH_ID={0xa}]}, 0x50}, 0x1, 0x0, 0x0, 0x91}, 0x24044884) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r7 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) getsockopt$llc_int(r7, 0x10c, 0x5, &(0x7f0000000200), &(0x7f0000000280)=0x4) syz_emit_ethernet(0x35, &(0x7f0000000000)={@local, @local, @val={@val={0x88a8, 0x7, 0x1, 0x2}, {0x8100, 0x6, 0x0, 0x1}}, {@arp={0x806, @generic={0x10f, 0x88f5, 0x6, 0x6, 0x4, @link_local, "981f71d1bb16", @random="b04d290548a9", "1ba3a6aa4a"}}}}, &(0x7f0000000080)={0x1, 0x2, [0x829, 0x8cb, 0x3d, 0x66]}) socket$packet(0x11, 0x2, 0x300) close(r6) socket$inet_sctp(0x2, 0x1, 0x84) ioctl$SIOCSIFHWADDR(r6, 0x8914, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r8, &(0x7f0000000640)="000a18000000", 0x6, 0x4000000, 0x0, 0x0) 3.619667767s ago: executing program 3 (id=128): timerfd_create(0x9, 0x0) msgsnd(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="77070200"], 0x8, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet(0x2, 0x2, 0x11) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00008a00"/28], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0xd, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a800000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000040000850000008200000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) connect$pppl2tp(r2, &(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x115c, @loopback}, 0x1, 0x0, 0x1}}, 0x26) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/net/pppol2tp\x00', 0x0, 0x0) read(r5, &(0x7f0000000300), 0x1) read(r5, &(0x7f0000000400), 0x120) read(r5, &(0x7f0000000500), 0x1000) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB, @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000cd03000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0xedf0e51957efc755, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') read$qrtrtun(r7, &(0x7f00000004c0)=""/57, 0x39) migrate_pages(0x0, 0x71, 0x0, 0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f0000001400)=ANY=[@ANYBLOB="0100000042000000060000000800000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0c000000040000000400000001800000000000", @ANYBLOB="0000000000000000000000000000000000030000", @ANYRES32=0x0, @ANYRES32], 0x50) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="44000000090601020000000000000000000000000900020073797a310000000005000100070000001c0007801800018014000240"], 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) 2.689228863s ago: executing program 3 (id=139): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./dev\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0) r0 = syz_usb_connect(0x0, 0x47, &(0x7f0000000000)=ANY=[@ANYBLOB="120100020000004051045f500001010203020902350001020080300904000005ff00000007058102000200070501020002000705820200020007050202000200070583030a"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/ttyUSB0\x00', 0x2, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 2.320215227s ago: executing program 1 (id=146): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x38, r2, 0x1, 0xffffffff, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r3}}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x38}}, 0x20000000) sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000500)={0x1c, r2, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000011}, 0x4000810) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[], 0x30}}, 0x4000) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0xb}, 0x94) 2.110466093s ago: executing program 1 (id=149): r0 = socket$inet_sctp(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) vmsplice(r3, &(0x7f0000000540)=[{&(0x7f00000003c0)="16", 0x1}], 0x1, 0x5) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) splice(r2, 0x0, r4, 0x0, 0x6, 0xc) ioctl$FIONREAD(r3, 0x541b, &(0x7f00000002c0)) close_range(r0, 0xffffffffffffffff, 0x0) 1.839520028s ago: executing program 1 (id=154): bpf$PROG_LOAD(0x5, 0x0, 0x0) mount(0x0, 0x0, 0x0, 0x2200020, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d621ffbc9a4fd39b0631f6dde53a9a53608c10556e5734eb84049761471ce540c772e2d9f8004e26f7fcc059c062234d5595f6dba87b81d0806fb0289ce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd8048a967d9b912ef9f1dcc4ff8546fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2bbe99e30816127f46a1aae33d4d63d716c0975e1ce4a655362e7062ff6ab3934555c0184021b829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47910000118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f80492461d273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c528df8000000d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b1e152ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e36629589ff6b0ceb3438e4b432dd454c04be2d538aaf60c9f7a7281d32142f2fdbc3d37e5a072b5d7f0a349f1a75f01b5c203d4bdde6ff12de9a37f7fb9a16059ad97e2edefb5e0b0326bd25f6fd1d108efa9d30a9883815654486fe42cf2f676cdbb91f7582ab314be"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffffffffffe19}, 0x42) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f00000008c0)=r1, 0x4) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendto$packet(r2, &(0x7f00000002c0)="05031600d3fc140000004788031c09102c28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r3, 0x1, 0x0, 0x6, @multicast}, 0x14) 1.839157703s ago: executing program 1 (id=155): madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x24020000) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r2 = syz_clone(0x95008100, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) wait4(r2, 0x0, 0x80000000, 0x0) 1.650085107s ago: executing program 2 (id=157): timerfd_create(0x9, 0x0) msgsnd(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="77070200"], 0x8, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet(0x2, 0x2, 0x11) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00008a00"/28], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0xd, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a800000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000040000850000008200000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) connect$pppl2tp(r2, &(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x115c, @loopback}, 0x1, 0x0, 0x1}}, 0x26) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/net/pppol2tp\x00', 0x0, 0x0) read(r5, &(0x7f0000000300), 0x1) read(r5, &(0x7f0000000400), 0x120) read(r5, &(0x7f0000000500), 0x1000) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB, @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000cd03000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0xedf0e51957efc755, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') read$qrtrtun(r7, &(0x7f00000004c0)=""/57, 0x39) migrate_pages(0x0, 0x71, 0x0, 0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f0000001400)=ANY=[@ANYBLOB="0100000042000000060000000800000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0c000000040000000400000001800000000000", @ANYBLOB="0000000000000000000000000000000000030000", @ANYRES32=0x0, @ANYRES32], 0x50) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="44000000090601020000000000000000000000000900020073797a310000000005000100070000001c0007801800018014000240"], 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) 1.057842915s ago: executing program 0 (id=158): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) syz_emit_ethernet(0x36, &(0x7f0000000280)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x44}, @remote, @void, {@ipv4={0x800, @dccp={{0x6, 0x4, 0x1, 0x8, 0x28, 0x68, 0x0, 0x9, 0x21, 0x0, @rand_addr=0x64010100, @local, {[@end]}}, {{0x4e20, 0x4e21, 0x4, 0x1, 0xb, 0x0, 0x0, 0x0, 0x2, "740e23", 0xd, '1\x00'}}}}}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000700180a050000000000000000000a0000000900010073797a30000000000900020073797a31000000001400000011"], 0x54}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x5}, 0x38) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000240)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff020000000000000000000000000001"], 0xfdef) 942.839862ms ago: executing program 0 (id=159): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="f8000000190001002abd7000000000007f000001000000000000000000000000ac1414aa00000000000000000000000000000000000000000a00400000000000", @ANYRES32=0x0, @ANYRES32], 0xf8}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) r1 = socket$inet6(0xa, 0x3, 0x2) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) connect$unix(0xffffffffffffffff, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000019180)={0x1, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) connect$inet(0xffffffffffffffff, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x0) sendmsg$NFT_MSG_GETFLOWTABLE(r3, 0x0, 0x90) setsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast2, @in6=@mcast1, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x200, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x400000000000000, 0x0, 0xfffffffffffffffc, 0xff}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@broadcast, 0x0, 0x2, 0x0, 0xb7, 0x1, 0xffffff7e}}, 0xe4) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0xffd8) r4 = syz_open_dev$evdev(&(0x7f0000000040), 0x2, 0x80) ioctl$EVIOCGKEY(r4, 0x80404518, &(0x7f0000000080)=""/85) 942.453785ms ago: executing program 1 (id=160): msgsnd(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="77070200000003fd"], 0x8, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet(0x2, 0x2, 0x11) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00008a00"/28], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0xd, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a800000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000040000850000008200000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) connect$pppl2tp(r2, &(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x115c, @loopback}, 0x1, 0x0, 0x1}}, 0x26) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/net/pppol2tp\x00', 0x0, 0x0) read(r5, &(0x7f0000000300), 0x1) read(r5, &(0x7f0000000400), 0x120) read(r5, &(0x7f0000000500), 0x1000) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB, @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000cd03000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0xedf0e51957efc755, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') read$qrtrtun(r7, &(0x7f00000004c0)=""/57, 0x39) migrate_pages(0x0, 0x71, 0x0, 0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f0000001400)=ANY=[@ANYBLOB="0100000042000000060000000800000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0c000000040000000400000001800000000000", @ANYBLOB="0000000000000000000000000000000000030000", @ANYRES32=0x0, @ANYRES32], 0x50) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="44000000090601020000000000000000000000000900020073797a310000000005000100070000001c0007801800018014000240"], 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) 728.465444ms ago: executing program 2 (id=161): timerfd_create(0x9, 0x0) msgsnd(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="77070200000003fd"], 0x8, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r0 = socket$inet(0x2, 0x2, 0x11) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00008a00"/28], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0xd, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a800000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000040000850000008200000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) connect$pppl2tp(r1, &(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x115c, @loopback}, 0x1, 0x0, 0x1}}, 0x26) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/net/pppol2tp\x00', 0x0, 0x0) read(r4, &(0x7f0000000300), 0x1) read(r4, &(0x7f0000000400), 0x120) read(r4, &(0x7f0000000500), 0x1000) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB, @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000cd03000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0xedf0e51957efc755, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') read$qrtrtun(r6, &(0x7f00000004c0)=""/57, 0x39) migrate_pages(0x0, 0x71, 0x0, 0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f0000001400)=ANY=[@ANYBLOB="0100000042000000060000000800000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0c000000040000000400000001800000000000", @ANYBLOB="0000000000000000000000000000000000030000", @ANYRES32=0x0, @ANYRES32], 0x50) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="44000000090601020000000000000000000000000900020073797a310000000005000100070000001c0007801800018014000240"], 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) 669.798097ms ago: executing program 2 (id=162): ioctl$SNDRV_TIMER_IOCTL_CREATE(0xffffffffffffffff, 0xc02054a5, &(0x7f0000000080)={0x81, 0xffffffffffffffff, 'id1\x00'}) r1 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000002c0)={0xffffffffffffffff}, 0x4) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000040)={@map=r0, 0xffffffffffffffff, 0x15, 0x2, 0xffffffffffffffff, @void, @value=r1}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000ac0)=ANY=[@ANYBLOB="b702000007000000bfa30000000000000703000000fefffe7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000c9be17044171e1d3d7b1efd036d7af273bce36015779c4cef58fa35d17c668a4b63e069efb29797573b8538e31ec24925095a163b9d4e76be2661f2a395e41f7e31a8021e00b00104e0801d4de36e5fdc6c42a7b3ff13f2360a6e231fd223bc33091dd61258a1fda45991fbdce6793c8a4785ee8b60092659b941bbd694dff0f0000000000003a45404b04bf97c4fea679c032b363956cd8bac9626b5db1b07a0bd7cc85e961506a35a04617dc0200379e731d3a8d8feac94a4ee293001f6ce7d5b40bf2a7f9be8173a9639a79fae885d05afe042c0e7821d406c967379e7521292d24d6c8034f2fc7c855a8945e9bce678ee9a015abc9daac8876623db56346916674ceb55f60b493f2f4d736acb2f206fc538450a676d71c01175b8454eb92567e8f8a707b590d7219288e23ee0800000000000010a49fc8f4ff0300000000000000000000cb947d6017ad27714772ad790af252e648ef8c313c604324f5b306000000000000cf327a00000000000000080a70162bba30ad7804fa4140f1a754ffff000000ab744d306619dfb3a37d897662bee00189f43da46a908a235c84cbad335fd1d2f2ef93a6a70c8b8ece0e243eab05a34ab0a7e7e497065e5e282e284f8d5e8852a265d528075214af000000000070d42182d8f3a347d48289a8b29b911ac473c5fa02bb0e24e5b7b238e27263a23c0b865f75331d888c72df1da4b290582f00024227f03204add786a87b23ceb17c25810e769fe2d6a7bd8e504843b66b1a8c7b364bd2194ba9c8f60ac0c9b18d8c1b9e1a736825c91b4dff0000c1c5dcffa295c2930000000000235d84b0193a5ea7c77cdb7de9ce1a59ab4158097b4dd13ebfaf4425c6855530b56a3320d85c8fe85f667998b1a7e589f486c107761108e4e230419fd27b6ad9c10b25c6b6ed84badbb970dcf133279dd355e41de944564bdab99c5c712a9fbc8e9691c775bb94f746505e1e748cf1710d52468b4b1625ce21612ed5e807dfb5f19f3267e5366b2c0b2a0be49ae476263c9407ac6c596bf3cf66204984f5aebf93d1caa220ea6969cea852fe9a7d1eee13f1f48722a69ad9fb850bd093a302b9250245900ad5c8e5f20ddf77ee3d5a168964fad1aa7347d36c502d02b1d96d753ef6fc354fc126070060c65c147651fca62c0a06939f40c90ebc3042e753fe91b5770b24f25c558736dd7e1e9fb214cbb04c5c6ee4c970b320ba6fb6ef4615f4092de54c519f4622e1224153463ea80248a45a95a189958f586d606dcaa9aac656cf95a2d35225cfb0e6f47486d5cbb04a590116d4de92e203e107d68728a189b0d537d2442beab2f8ce7b2dd357200dcd139e47267012fc2a2b6bad79be429d1ddaccbe0139f16ca1b9bc1103000000ed1ece54cfdbe04670bee9b42fe3dc42033997e2e700b6edb2b49b5f2f6001ee0a9e5d1bee199ce9124a5cb479040000000000000049ead5b02d5ea1dcf6cdcf332fe94b3c1932d8d391754774a32c9b7e6ca4023bce2c7281d27a2cb62383ab3a3bb535650fbfb96c89936855eb7a485698f0d20c3eedd6123ef8f218d52ea2c346f80acb8b9a71856d2f2d1a7c6f45ee127b6a1d1ac1e243ed02e49e8aafe835919564af915965a050c37ceff855bd2dec3452c7c38f5dbf1ff1ff00020000000000006a1a029ea6540b40b2f797813af2c7d4ed235c2dc5f1dbbfcc52b2f55fd3f9f100c4891d0cb4c10ed01489bf235c45822594d7a6edc9d1270a7819fc0c597fdfb4d7842da1b411346297a40bbf221bbf63ad3822575dcc01a3c34b5aa4e3750400000000000000fc0fd9c746cf0ed4b0343d00a154e6a869346256ffbd666a34414ab0f40bec45b1c24f02ac9bc20e69201968537dd4dc61323c8b6d3643183631664eeca616696fb30fe89c8bdb15037c801fca4a9c220fec5d14582a00b62548ddf2599e5ffc5330cefb8903d276eae21b0b4b20100ead8256636c7e754185e815dd21445cc965a0526da38021a3e540949494ef3041cfa5067f556a0af5c19d27ff4f61fa7762d7963c96853709e773f14c47eef784cb145ae9d6d37fc7b5d83e05ac773fcc429eae6826a9d207d4c39df8eed9cc2ae3f68df1c6495a82d02939b448bf8038521057714e6e6405000000be9e0b0025d16b7eff573f78364ed70a62a7b1e55311dc0193d47f9ecc8c7ad268dc6e2e75f8cc83315411bd6c6b88e1850ee757ac2f9e4d6ac510003717d5847a19e750db92d33d6bdc434d0b52b2eb4b1790459e35122f46b205120a54bf657da9fd55d43a89e333481de468f5984a69509e9eac7a5b39c004396e8cb3ab037fd62fa43f259f13ebc4b590e9ea07ea37689049c799cd444d45dabe3e3cf086768daa6816c37793d17a284d2828f5eab2d3d0bedd5334b7bb4c983fa9cd4bd86f0ad227901e83ef4871695380d25bea2929fa66382af6ddb89917ab100046151bd08fce74247955247daa1ea75139b9ce3771526503c7db3a4b3ff39301986c1fd9b5c42d39e768946c9a7ee8dd081bfb6ea5fa132ebdbe72d02ce9f2000000006f63ae8311afc4943c963d39e42c54a3f52d121bfb425fe268892f654febdaee43e95b5ae6749275e1ad8b8b279e1ae296e03a8d9386d8e199dc1f00000008000000000000000026c43493c622f041b47d329b248e8ccd92e9b17007ba2578eefcb59f50343722e6cba3be72fd037eb5fa243a395b5c83376a14414b32c2e8a33de8000000003927da2bec76f4e15c8bf3715c5bfe7b3617d0fcf9b5861554b5b76b8ae69c644a48931306a16cff8a38ea95553867e2c5fb1e99b1802e616345871b4611627874cfbe30fa5793c873ae6f75427f3eeda690147b9615b096d967c2d7f5ddf725f0544f8750a5ed04d6ca0f223506fec5d5e65b467c59459f6113cf41c174a63a17fc79d0b777a0c903c0d2e7f79b6f9ce68a3b72315407040f6a09cadc25e87b7c6b4a3079c7989b4cf04b2581b555fa9a2d74392939b4dbaa9e620e22ab975ac3a5a329157762c1f29075fbdd39451a56b97c90e4fde6782a7c78e7fbe8400054dcafcd51e9eef2d2ea10a3f2636ac2239cef5d8505060de55f472aa89cb8e0188f2ee96cb1ae8dee3c03d0a942c6289cbc4499cea402bd0550520f4aae98c436f18a667ae4efeb5e6a4b1b3f53536145a87578ead8ec76b17acd9d9629449714ed1302714c3519fdd8529b5a86ce2fabb7f285fe73730000000000000000000000000000000073b6f8e9255567374cb2cc80be58fca5b1dc50d85342e56beda632edb7f0a4abcabae102fadfbffecc6b1549315dda8e09d18a7fe5e1574e4fad426b6ca211da39a16dffdd661a20b20c390e00004b002cd83b754c3d32819c823027b3cf8f8da6e63d099712be370bb2aa06debff931ea0a2e7aa0390000000000000045b6720d74c470d49e1e97d1668bb75ad994089d723c2eeaad3f857937fa3df615121a1841ed452dd395788e1a82efda18b41c06c948ef44af8500fbe1ee0828a3b047afb80435935b0f99b381dcf101e9a1593bdaab3bc88c70bf56995a4790a339e1b62516356644ed7df6db419d0976a5169e68e8bd4712552c5ec03f2818c17c4a5bf1e5ecd9bb40074a63c66b61f4779226a99dc5ff9c442e93991570797493569e6f9ccd6d73bcbce41022e2731fc61b6bf0188c74a21471332a546ffe8e9dd738aa2ca782ff5a547a1ad7c348c59ff99d1496404eafcd0333df8f2801d39ad0c82735af24b819efc2fd67c6a53835f0af6a51d1b9123f4b9af7fa2ee2ebf4bc2973cf04380b41aa7577e35bcd28446bfcea19aa85440fe0fdce12e53da7b8842b7527a34d1bcb16fcdc84f2c46a78c01c2ff463cdd0d65267b0822e899e893514a02acd8c21583d181224175d08ff75223da84d53656eb7ab46ad442d70c67a6010029329924b8b39e6dc4b2077a4b9645d8e0a445ae2c7be53d66007d491ab0f6851a2cc1cffeed15f586a035c1a2888c56f43"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000140)={'wlan1\x00', 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000700), r5) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000980)={0x50, r6, 0x1, 0x70bd2f, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_REKEY_DATA={0x34, 0x7a, 0x0, 0x1, [@NL80211_REKEY_DATA_KEK={0x24, 0x1, @kek_ext="6be92feab126f0c7b126a26d95e1dd5c2d885ad55f4469a5989362075154a4b1"}, @NL80211_REKEY_DATA_REPLAY_CTR={0xc, 0x3, "18188f63ec3e4771"}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000100)={r2, 0x18000000000002a0, 0xe80, 0x0, &(0x7f0000000000)="b9ff03030018698cb89e40f086dd6058650e00002f00630677", 0x0, 0xfa, 0x2000000, 0x3f, 0xc0, &(0x7f0000000440), &(0x7f0000000080), 0x4}, 0x50) 588.369951ms ago: executing program 2 (id=163): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) r3 = openat$cgroup(r2, &(0x7f0000000080)='syz1\x00', 0x200002, 0x0) r4 = openat$cgroup_type(r3, &(0x7f00000001c0), 0x2, 0x0) write$cgroup_type(r4, &(0x7f0000000240), 0x9) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000200), r0) ioctl$AUTOFS_IOC_FAIL(r1, 0x9361, 0x9f) sendmsg$NFC_CMD_LLC_SET_PARAMS(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x14, r5, 0x1, 0x70bd2d, 0x25dfdbfc}, 0x14}}, 0x20004000) 540.24907ms ago: executing program 2 (id=164): timerfd_create(0x9, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet(0x2, 0x2, 0x11) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00008a00"/28], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0xd, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a800000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000040000850000008200000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) connect$pppl2tp(r2, &(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x115c, @loopback}, 0x1, 0x0, 0x1}}, 0x26) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/net/pppol2tp\x00', 0x0, 0x0) read(r5, &(0x7f0000000300), 0x1) read(r5, &(0x7f0000000400), 0x120) read(r5, &(0x7f0000000500), 0x1000) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB, @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000cd03000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0xedf0e51957efc755, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') read$qrtrtun(r7, &(0x7f00000004c0)=""/57, 0x39) migrate_pages(0x0, 0x71, 0x0, 0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f0000001400)=ANY=[@ANYBLOB="0100000042000000060000000800000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0c000000040000000400000001800000000000", @ANYBLOB="0000000000000000000000000000000000030000", @ANYRES32=0x0, @ANYRES32], 0x50) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="44000000090601020000000000000000000000000900020073797a310000000005000100070000001c0007801800018014000240"], 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) 300.265384ms ago: executing program 2 (id=165): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x9d, 0x11e41e7a, 0x20000000, 0x6, 0x2}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x0, 0x5}}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) getrlimit(0xc, &(0x7f0000000300)) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x4, &(0x7f0000000680)={0x3, 0x3, 0x0, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$audio1(0xffffff9c, 0x0, 0x400, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000fc0)={0x7c0, r5, 0x1, 0x70bd28, 0x0, {}, [@WGDEVICE_A_PEERS={0x790, 0x8, 0x0, 0x1, [{0x46c, 0x0, 0x0, 0x1, [@WGPEER_A_ALLOWEDIPS={0x444, 0x9, 0x0, 0x1, [{0xd0, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @empty}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @empty}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @loopback}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @rand_addr=0x64010102}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @remote}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, {0x5, 0x3, 0x1}}]}, {0x28, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @mcast1}, {0x5, 0x3, 0x1}}]}, {0x1c, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @remote}, {0x5, 0x3, 0x2}}]}, {0xb8, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @mcast2}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @remote}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @dev={0xfe, 0x80, '\x00', 0x3c}}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @empty}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @local}, {0x5, 0x3, 0x1}}]}, {0x4c, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @ipv4={'\x00', '\xff\xff', @remote}}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @local}, {0x5, 0x3, 0x1}}]}, {0x58, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @private=0xa010100}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @private=0xa010102}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @ipv4={'\x00', '\xff\xff', @local}}, {0x5, 0x3, 0x2}}]}, {0xd0, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @mcast1}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @local}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @multicast2}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @dev={0xfe, 0x80, '\x00', 0x1f}}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @remote}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @multicast1}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @local}, {0x5, 0x3, 0x1}}]}, {0x100, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @dev={0xfe, 0x80, '\x00', 0x43}}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x6}}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @rand_addr=0x64010100}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @remote}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @ipv4={'\x00', '\xff\xff', @empty}}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @remote}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @multicast1}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, {0x5, 0x3, 0x3}}]}]}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @a_g}]}, {0x4c, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24, 0x1, @neg}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "491bc0be1dc1f88092e741a88b64f6dd9218ad21b44b472e44f1d0807ee6675c"}]}, {0x2d4, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x9, 0x7, @empty, 0x3}}, @WGPEER_A_ALLOWEDIPS={0x28c, 0x9, 0x0, 0x1, [{0x28, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @remote}, {0x5, 0x3, 0x1}}]}, {0x28, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, {0x5}}]}, {0x1c, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x5}}]}, {0x4}, {0x1c, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @loopback}, {0x5, 0x3, 0x2}}]}, {0x94, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @private=0xa010102}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @mcast2}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @empty}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @empty}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @multicast2}, {0x5, 0x3, 0x1}}]}, {0x64, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @broadcast}, {0x5, 0x3, 0x7}}, @ipv6={{0x6}, {0x14, 0x2, @local}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, {0x5, 0x3, 0x3}}]}, {0x94, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @multicast2}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @dev={0xfe, 0x80, '\x00', 0x2d}}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @private=0xa010101}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @remote}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @mcast1}, {0x5, 0x3, 0x2}}]}, {0x70, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @rand_addr=' \x01\x00'}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @mcast2}, {0x5, 0x3, 0x1}}]}]}]}]}, @WGDEVICE_A_LISTEN_PORT={0x6, 0x6, 0x4e21}, @WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}]}, 0x7c0}, 0x1, 0x0, 0x0, 0x4004840}, 0x2000000) creat(&(0x7f0000000440)='./file0\x00', 0x0) syz_clone(0x1010000, &(0x7f0000000340), 0x0, 0x0, 0x0, 0x0) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0) sendfile(r6, r6, 0x0, 0x40008) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000005c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {}, 0x2c, {}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x1}}]}}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r8, &(0x7f0000003340)=[{{0x0, 0xfffffffffffffed1, &(0x7f0000000280)=[{&(0x7f0000000600)='4', 0x1}], 0x1, &(0x7f00000002c0)=[@rights={{0x10}}], 0x10, 0x40}}], 0x1, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r7, 0x0, r9, 0x0, 0x39011, 0x0) 56.556686ms ago: executing program 0 (id=166): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x4, 0x0, @loopback, 0x4}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040), 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_128={{0x304}, "0000000400", "6abc00000000000000000000001000", "f0630400"}, 0x28) sendto$inet6(r1, &(0x7f0000000240)="c6", 0x1, 0x8040, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={0x0, 0x3fff}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 0s ago: executing program 1 (id=167): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='0\x00', &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/configs\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) symlinkat(&(0x7f0000000280)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/configs/c.1/tcm.usb0\x00') kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:33676' (ED25519) to the list of known hosts. [ 42.411015][ T5691] cgroup: Unknown subsys name 'net' [ 42.577127][ T5691] cgroup: Unknown subsys name 'cpuset' [ 42.583391][ T5691] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 43.568047][ T5691] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 47.426617][ T5737] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 47.431508][ T5737] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 47.435576][ T5737] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 47.441883][ T5748] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 47.445534][ T5748] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 47.448007][ T5742] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 47.448316][ T5748] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 47.450880][ T5742] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 47.453893][ T5748] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 47.455989][ T5749] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 47.456409][ T5742] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 47.456497][ T5742] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 47.457557][ T5748] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 47.457609][ T5742] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 47.463008][ T5749] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 47.469324][ T5097] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 47.475107][ T5748] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 47.478204][ T5748] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 47.481332][ T64] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 47.486392][ T64] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 48.212184][ T5743] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.215206][ T5743] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.217619][ T5743] bridge_slave_0: entered allmulticast mode [ 48.220476][ T5743] bridge_slave_0: entered promiscuous mode [ 48.232219][ T5744] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.234665][ T5744] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.236943][ T5744] bridge_slave_0: entered allmulticast mode [ 48.242435][ T5744] bridge_slave_0: entered promiscuous mode [ 48.264710][ T5743] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.267589][ T5743] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.270426][ T5743] bridge_slave_1: entered allmulticast mode [ 48.274208][ T5743] bridge_slave_1: entered promiscuous mode [ 48.278056][ T5744] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.281147][ T5744] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.284456][ T5744] bridge_slave_1: entered allmulticast mode [ 48.288369][ T5744] bridge_slave_1: entered promiscuous mode [ 48.292533][ T5735] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.296298][ T5735] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.299312][ T5735] bridge_slave_0: entered allmulticast mode [ 48.303884][ T5735] bridge_slave_0: entered promiscuous mode [ 48.308977][ T5735] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.312063][ T5735] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.315445][ T5735] bridge_slave_1: entered allmulticast mode [ 48.319503][ T5735] bridge_slave_1: entered promiscuous mode [ 48.365631][ T5739] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.368661][ T5739] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.371969][ T5739] bridge_slave_0: entered allmulticast mode [ 48.375798][ T5739] bridge_slave_0: entered promiscuous mode [ 48.393890][ T5744] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.403717][ T5739] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.406198][ T5739] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.409300][ T5739] bridge_slave_1: entered allmulticast mode [ 48.414945][ T5739] bridge_slave_1: entered promiscuous mode [ 48.420729][ T5743] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.427543][ T5743] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.434105][ T5744] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.450075][ T5735] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.491498][ T5735] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.505889][ T5744] team0: Port device team_slave_0 added [ 48.508703][ T5743] team0: Port device team_slave_0 added [ 48.518680][ T5739] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.523508][ T5744] team0: Port device team_slave_1 added [ 48.526996][ T5743] team0: Port device team_slave_1 added [ 48.537677][ T5739] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.556353][ T5735] team0: Port device team_slave_0 added [ 48.577014][ T5744] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.579210][ T5744] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.587242][ T5744] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.593239][ T5735] team0: Port device team_slave_1 added [ 48.602058][ T5743] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.604282][ T5743] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.612336][ T5743] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.616324][ T5744] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.619112][ T5744] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.627068][ T5744] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.639046][ T5739] team0: Port device team_slave_0 added [ 48.641442][ T5743] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.643638][ T5743] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.651800][ T5743] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.670694][ T5739] team0: Port device team_slave_1 added [ 48.680723][ T5735] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.683263][ T5735] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.691337][ T5735] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.718421][ T5743] hsr_slave_0: entered promiscuous mode [ 48.721904][ T5743] hsr_slave_1: entered promiscuous mode [ 48.725272][ T5735] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.727529][ T5735] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.735574][ T5735] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.745931][ T5739] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.748741][ T5739] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.759135][ T5739] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.775993][ T5739] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.778793][ T5739] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.789065][ T5739] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.810543][ T5744] hsr_slave_0: entered promiscuous mode [ 48.813061][ T5744] hsr_slave_1: entered promiscuous mode [ 48.815212][ T5744] debugfs: 'hsr0' already exists in 'hsr' [ 48.817086][ T5744] Cannot create hsr debugfs directory [ 48.875395][ T5735] hsr_slave_0: entered promiscuous mode [ 48.877779][ T5735] hsr_slave_1: entered promiscuous mode [ 48.879957][ T5735] debugfs: 'hsr0' already exists in 'hsr' [ 48.882150][ T5735] Cannot create hsr debugfs directory [ 48.914419][ T5739] hsr_slave_0: entered promiscuous mode [ 48.916728][ T5739] hsr_slave_1: entered promiscuous mode [ 48.918789][ T5739] debugfs: 'hsr0' already exists in 'hsr' [ 48.920596][ T5739] Cannot create hsr debugfs directory [ 49.142754][ T5743] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 49.149581][ T5743] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 49.152554][ T5743] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 49.156592][ T5743] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 49.160101][ T5743] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 49.165436][ T5743] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 49.176515][ T5743] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 49.183843][ T5743] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 49.217625][ T5735] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 49.226108][ T5735] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 49.232891][ T5735] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 49.242127][ T5735] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 49.245067][ T5735] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 49.250063][ T5735] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 49.253278][ T5735] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 49.257646][ T5735] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 49.311364][ T5744] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 49.316278][ T5744] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 49.325027][ T5744] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 49.329776][ T5744] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 49.333415][ T5744] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 49.337501][ T5744] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 49.340246][ T5744] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 49.344672][ T5744] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 49.405009][ T5739] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 49.412198][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 49.417591][ T5739] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 49.424363][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 49.429641][ T5739] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 49.435040][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 49.444544][ T5739] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 49.449580][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 49.455232][ T5743] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.477084][ T5735] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.499880][ T5743] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.523036][ T5735] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.528763][ T424] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.531390][ T424] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.543695][ T5737] Bluetooth: hci1: command tx timeout [ 49.544269][ T64] Bluetooth: hci2: command tx timeout [ 49.544297][ T5748] Bluetooth: hci3: command tx timeout [ 49.544432][ T5748] Bluetooth: hci0: command tx timeout [ 49.546616][ T424] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.554834][ T424] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.569742][ T1155] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.572012][ T1155] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.588026][ T1155] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.590325][ T1155] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.650058][ T5744] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.698569][ T5744] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.714393][ T424] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.717061][ T424] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.723056][ T5739] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.734042][ T424] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.736498][ T424] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.765362][ T5739] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.785794][ T1155] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.788259][ T1155] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.806827][ T1155] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.809164][ T1155] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.057276][ T5735] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 50.103591][ T5743] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 50.108202][ T5735] veth0_vlan: entered promiscuous mode [ 50.124336][ T5744] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 50.135488][ T5735] veth1_vlan: entered promiscuous mode [ 50.164443][ T5743] veth0_vlan: entered promiscuous mode [ 50.178325][ T5739] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 50.182836][ T5743] veth1_vlan: entered promiscuous mode [ 50.201901][ T5744] veth0_vlan: entered promiscuous mode [ 50.209851][ T5735] veth0_macvtap: entered promiscuous mode [ 50.225830][ T5735] veth1_macvtap: entered promiscuous mode [ 50.234624][ T5744] veth1_vlan: entered promiscuous mode [ 50.249474][ T5743] veth0_macvtap: entered promiscuous mode [ 50.260840][ T5735] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 50.266725][ T5739] veth0_vlan: entered promiscuous mode [ 50.272454][ T5743] veth1_macvtap: entered promiscuous mode [ 50.283054][ T5735] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 50.295231][ T5739] veth1_vlan: entered promiscuous mode [ 50.310698][ T5743] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 50.325457][ T5744] veth0_macvtap: entered promiscuous mode [ 50.328881][ T5743] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 50.342389][ T5744] veth1_macvtap: entered promiscuous mode [ 50.376681][ T5744] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 50.383493][ T5739] veth0_macvtap: entered promiscuous mode [ 50.399926][ T5744] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 50.403866][ T5739] veth1_macvtap: entered promiscuous mode [ 50.410564][ T107] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.415454][ T107] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.421457][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.457799][ T82] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.460518][ T82] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.465722][ T5739] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 50.483397][ T5739] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 50.484578][ T107] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.489720][ T107] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.535386][ T107] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.538932][ T107] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.540216][ T5735] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 50.557640][ T5735] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 50.559454][ T82] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.566788][ T82] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.570249][ T5735] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 50.583326][ T5735] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 50.605661][ T5735] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 50.609038][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.613828][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.654505][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.654781][ T5814] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.661131][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.668639][ T5814] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.710917][ T107] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.717719][ T107] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.740233][ T12] tipc: Subscription rejected, illegal request [ 50.751933][ T5788] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.759610][ T5788] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.765117][ T5788] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.770811][ T5788] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.774432][ T5788] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.777220][ T5788] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.780383][ T5788] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.784351][ T5788] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.787214][ T5788] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.789940][ T5788] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.793568][ T5788] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.811813][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.814935][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.955764][ T5904] evm: overlay not supported [ 51.029039][ T5908] sd 0:0:0:0: PR command failed: 1026 [ 51.030947][ T5908] sd 0:0:0:0: Sense Key : Illegal Request [current] [ 51.033916][ T5908] sd 0:0:0:0: Add. Sense: Invalid command operation code [ 51.220107][ T5929] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 51.227517][ T5929] block device autoloading is deprecated and will be removed. [ 51.282330][ T5932] block device autoloading is deprecated and will be removed. [ 51.282357][ T5935] block device autoloading is deprecated and will be removed. [ 51.312374][ T5936] syz.0.20 uses obsolete (PF_INET,SOCK_PACKET) [ 51.338982][ T5938] Bluetooth: MGMT ver 1.23 [ 51.621758][ T64] Bluetooth: hci0: command tx timeout [ 51.623043][ T5737] Bluetooth: hci3: command tx timeout [ 51.623051][ T5740] Bluetooth: hci2: command tx timeout [ 51.631706][ T5737] Bluetooth: hci1: command tx timeout [ 51.769395][ T1034] IPVS: starting estimator thread 0... [ 51.771382][ T5960] IPVS: sync thread started: state = BACKUP, mcast_ifn = syz_tun, syncid = 0, id = 0 [ 51.863732][ T5959] IPVS: using max 45 ests per chain, 108000 per kthread [ 52.341607][ T1471] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 52.511845][ T1471] usb 6-1: Using ep0 maxpacket: 32 [ 52.514824][ T1471] usb 6-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 52.520980][ T1471] usb 6-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 52.524616][ T1471] usb 6-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 52.528317][ T1471] usb 6-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 52.533163][ T1471] usb 6-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 52.541829][ T1471] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 52.544376][ T1471] usb 6-1: Product: syz [ 52.545651][ T1471] usb 6-1: Manufacturer: syz [ 52.547095][ T1471] usb 6-1: SerialNumber: syz [ 52.561772][ C1] imon 6-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 52.567588][ T1471] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.1/usb6/6-1/6-1:155.0/input/input5 [ 52.791240][ T1471] imon 6-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 52.794339][ T1471] (id 0x00) [ 52.851223][ T1471] rc_core: IR keymap rc-imon-pad not found [ 52.853230][ T1471] Registered IR keymap rc-empty [ 52.855078][ T1471] imon 6-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 52.858537][ T1471] imon 6-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 52.921247][ T5999] mac80211_hwsim hwsim3 wlan1: entered allmulticast mode [ 52.961785][ T5834] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 52.995433][ T1471] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.1/usb6/6-1/6-1:155.0/rc/rc0 [ 53.002809][ T1471] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.1/usb6/6-1/6-1:155.0/rc/rc0/input6 [ 53.018099][ T1471] imon 6-1:155.0: iMON device (15c2:ffdc, intf0) on usb<6:2> initialized [ 53.144046][ T5834] usb 5-1: New USB device found, idVendor=0830, idProduct=0080, bcdDevice= 1.00 [ 53.149041][ T5834] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 53.156184][ T5834] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 53.159481][ T5834] usb 5-1: Product: syz [ 53.162136][ T5834] usb 5-1: Manufacturer: syz [ 53.164114][ T5834] usb 5-1: SerialNumber: syz [ 53.171912][ T5834] kl5kusb105 5-1:1.0: KL5KUSB105D / PalmConnect converter detected [ 53.179902][ T5834] usb 5-1: KL5KUSB105D / PalmConnect converter now attached to ttyUSB0 [ 53.551910][ T5788] tipc: Subscription rejected, illegal request [ 53.580097][ T6019] imon:send_packet: task interrupted [ 53.583497][ T6019] imon:send_packet: packet tx failed (-512) [ 53.585827][ T6019] imon:vfd_write: send packet #1 failed [ 53.590151][ T6019] imon:send_packet: packet tx failed (-32) [ 53.611480][ T6019] imon:vfd_write: send packet #0 failed [ 53.702746][ T5737] Bluetooth: hci2: command tx timeout [ 53.711219][ T5737] Bluetooth: hci1: command tx timeout [ 53.711372][ T64] Bluetooth: hci0: command tx timeout [ 53.711389][ T5740] Bluetooth: hci3: command tx timeout [ 53.728524][ T851] usb 6-1: USB disconnect, device number 2 [ 54.206813][ T6029] Console: switching to colour dummy device 80x25 [ 54.367990][ T6030] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 54.410379][ T6030] pci 0000:00:01.0: BAR 0 [mem 0xfd000000-0xfdffffff pref] [ 54.418906][ T6030] pci 0000:00:01.0: BAR 2 [mem 0xfeaf4000-0xfeaf4fff] [ 54.422165][ T6030] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 54.450009][ T6030] pci 0000:00:01.0: Adding to iommu group 1 [ 54.466116][ T6030] pci 0000:00:01.0: vgaarb: bridge control possible [ 54.468667][ T6030] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=none,locks=none [ 54.488137][ T6030] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 54.492968][ T6030] pci 0000:00:01.0: ROM [mem 0x81000000-0x8100ffff pref]: assigned [ 54.496111][ T6030] pci 0000:00:01.0: BAR 2 [mem 0x81010000-0x81010fff]: assigned [ 54.507145][ T6030] bochs-drm 0000:00:01.0: enabling device (0100 -> 0102) [ 54.526198][ T6030] [drm] Found bochs VGA, ID 0xb0c5. [ 54.528522][ T6030] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81010000. [ 54.560055][ T6030] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 54.609892][ T6044] capability: warning: `syz.1.61' uses 32-bit capabilities (legacy support in use) [ 54.721669][ T6030] Console: switching to colour frame buffer device 160x50 [ 54.726498][ T6046] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3780442281 (7560884562 ns) > initial count (4669583980 ns). Using initial count to start timer. [ 54.765971][ T6030] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 54.828320][ T6051] kl5kusb105d ttyUSB0: reading line status failed: -32 [ 55.034063][ T5588] usb 5-1: USB disconnect, device number 2 [ 55.036832][ T6064] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 55.042862][ T6064] block device autoloading is deprecated and will be removed. [ 55.045314][ T5588] kl5kusb105d ttyUSB0: KL5KUSB105D / PalmConnect converter now disconnected from ttyUSB0 [ 55.051747][ T5588] kl5kusb105 5-1:1.0: device disconnected [ 55.573185][ T6077] kvm: pic: non byte read [ 55.579419][ T6077] kvm: pic: non byte read [ 55.587828][ T6077] kvm: pic: non byte read [ 55.591390][ T6077] kvm: pic: non byte read [ 55.594639][ T6077] kvm: pic: non byte read [ 55.597929][ T6077] kvm: pic: non byte read [ 55.601647][ T6077] kvm: pic: non byte read [ 55.604240][ T6077] kvm: pic: non byte read [ 55.606905][ T6077] kvm: pic: non byte read [ 55.609932][ T6077] kvm: pic: non byte read [ 55.782270][ T5740] Bluetooth: hci3: command tx timeout [ 55.793212][ T5740] Bluetooth: hci0: command tx timeout [ 55.795905][ T5737] Bluetooth: hci1: command tx timeout [ 55.795952][ T64] Bluetooth: hci2: command tx timeout [ 55.993674][ T6106] faux_driver vgem: [drm] Unknown color mode 7; guessing buffer size. [ 57.321216][ T5588] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 57.501300][ T5588] usb 8-1: Using ep0 maxpacket: 8 [ 57.504814][ T5588] usb 8-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 57.510870][ T5588] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 57.515991][ T5588] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 57.520090][ T5588] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 100, changing to 10 [ 57.525156][ T5588] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24936, setting to 1024 [ 57.539232][ T5588] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 57.553029][ T5588] hub 8-1:1.0: bad descriptor, ignoring hub [ 57.558008][ T5588] hub 8-1:1.0: probe with driver hub failed with error -5 [ 57.563618][ T5588] cdc_wdm 8-1:1.0: skipping garbage [ 57.565517][ T5588] cdc_wdm 8-1:1.0: skipping garbage [ 57.571176][ T5588] cdc_wdm 8-1:1.0: cdc-wdm0: USB WDM device [ 57.575888][ T5588] cdc_wdm 8-1:1.0: Unknown control protocol [ 57.607022][ T6140] kvm: emulating exchange as write [ 57.861299][ T64] Bluetooth: hci2: command tx timeout [ 57.908565][ T42] audit: type=1326 audit(1786301461.141:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6152 comm="syz.0.101" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f48fec code=0x0 [ 58.093086][ T6158] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 58.106637][ T6158] CIFS: Attempting to mount //127.0.0.1/share [ 58.219492][ C3] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 58.222346][ C3] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 58.226075][ C3] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 58.228414][ C3] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 58.231033][ C3] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 58.233663][ C3] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 58.236273][ C3] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 58.238862][ C3] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 58.241475][ C3] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 58.244067][ C3] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 58.246680][ C3] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 58.249264][ C3] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 58.251912][ C3] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 58.254507][ C3] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 58.256813][ C3] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 58.259332][ C3] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 58.261945][ C3] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 58.264520][ C3] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 58.267113][ C3] cdc_wdm 8-1:1.0: nonzero urb status received: -71 [ 58.269245][ C3] cdc_wdm 8-1:1.0: wdm_int_callback - 0 bytes [ 58.277389][ T851] usb 8-1: USB disconnect, device number 2 [ 58.277461][ C3] cdc_wdm 8-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 58.393270][ T6162] Bluetooth: Short BCSP packet [ 58.395383][ T62] Bluetooth: Error in BCSP hdr checksum [ 58.820937][ T6158] CIFS: VFS: Error connecting to socket. Aborting operation. [ 58.824592][ T6158] CIFS: VFS: cifs_mount failed w/return code = -4 [ 60.106405][ T6188] kvm: user requested TSC rate below hardware speed [ 60.115348][ T6188] kvm: vcpu 2: requested 148514 ns lapic timer period limited to 200000 ns [ 60.118551][ T6188] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (200000 ns). Using initial count to start timer. [ 60.285249][ T6197] mac80211_hwsim hwsim5 wlan1: entered allmulticast mode [ 60.422078][ T64] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 60.645857][ T6209] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=4252604744 (544333407232 ns) > initial count (412347679616 ns). Using initial count to start timer. [ 60.750919][ T6212] netlink: 12 bytes leftover after parsing attributes in process `syz.1.121'. [ 60.758803][ T5827] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 60.865739][ T6214] binder: 6213:6214 ioctl c0306201 80000580 returned -14 [ 60.912221][ T5827] usb 5-1: New USB device found, idVendor=8087, idProduct=0025, bcdDevice= 0.00 [ 60.921419][ T5827] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 62.130404][ T6253] kvm: pic: single mode not supported [ 62.130722][ T6253] picdev_read: 4 callbacks suppressed [ 62.130731][ T6253] kvm: pic: non byte read [ 62.138304][ T6253] kvm: pic: non byte read [ 62.141439][ T6253] kvm: pic: non byte read [ 62.144814][ T6253] kvm: pic: non byte read [ 62.147591][ T6253] kvm: pic: single mode not supported [ 62.147742][ T6253] kvm: pic: level sensitive irq not supported [ 62.149878][ T6253] kvm: pic: non byte read [ 62.155290][ T6253] kvm: pic: level sensitive irq not supported [ 62.156639][ T6253] kvm: pic: non byte read [ 62.166327][ T6253] kvm: pic: single mode not supported [ 62.166634][ T6253] kvm: pic: non byte read [ 62.174792][ T6253] kvm: pic: non byte read [ 62.178263][ T6253] kvm: pic: non byte read [ 62.395546][ T6265] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 62.521155][ T5881] usb 8-1: new high-speed USB device number 3 using dummy_hcd 2#nL>ՂxL KYާӎ?:>vǬQM LKڭ::xiÁ2,gEؐG &m `H|(?[ 62.692439][ T5881] usb 8-1: New USB device found, idVendor=0451, idProduct=505f, bcdDevice= 1.00 [ 62.696973][ T5881] usb 8-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 62.702315][ T5881] usb 8-1: config 2 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 62.708345][ T5881] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 62.712218][ T5881] usb 8-1: Product: syz [ 62.713603][ T5881] usb 8-1: Manufacturer: syz [ 62.715115][ T5881] usb 8-1: SerialNumber: syz [ 62.723074][ T6277] nbd1: detected capacity change from 0 to 63 [ 62.726364][ T5881] ti_usb_3410_5052 8-1:2.0: TI USB 5052 2 port adapter converter detected [ 62.727050][ T6281] block nbd1: NBD_DISCONNECT [ 62.731671][ T6281] block nbd1: Disconnected due to user request. [ 62.736334][ T6281] block nbd1: shutting down sockets [ 62.738631][ T5881] usb 8-1: TI USB 5052 2 port adapter converter now attached to ttyUSB0 [ 62.753606][ C2] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 62.755174][ C3] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 62.758095][ C2] Buffer I/O error on dev nbd1, logical block 0, async page read [ 62.760449][ C3] Buffer I/O error on dev nbd1, logical block 1, async page read [ 62.764610][ T5881] usb 8-1: TI USB 5052 2 port adapter converter now attached to ttyUSB1 [ 62.765812][ C3] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 62.771754][ C3] Buffer I/O error on dev nbd1, logical block 2, async page read [ 62.771752][ C2] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 62.777922][ C2] Buffer I/O error on dev nbd1, logical block 3, async page read [ 62.781832][ T30] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 62.789852][ T30] Buffer I/O error on dev nbd1, logical block 0, async page read [ 62.793577][ T30] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 62.798668][ T30] Buffer I/O error on dev nbd1, logical block 1, async page read [ 62.801995][ T30] Buffer I/O error on dev nbd1, logical block 2, async page read [ 62.805282][ T30] Buffer I/O error on dev nbd1, logical block 3, async page read [ 62.810140][ T30] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 62.814076][ T30] Buffer I/O error on dev nbd1, logical block 0, async page read [ 62.817083][ T30] Buffer I/O error on dev nbd1, logical block 1, async page read [ 62.821258][ T1304] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 62.824587][ T1304] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 62.827836][ T1304] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 62.832321][ T5754] ldm_validate_partition_table(): Disk read failed. [ 62.839282][ T5754] Dev nbd1: unable to read RDB block 0 [ 62.844121][ T5754] nbd1: unable to read partition table [ 62.853906][ T5754] ldm_validate_partition_table(): Disk read failed. [ 62.857756][ T5754] Dev nbd1: unable to read RDB block 0 [ 62.860968][ T5754] nbd1: unable to read partition table [ 62.982292][ T64] Bluetooth: hci4: Reading Intel version command failed (-110) [ 62.983112][ T5737] Bluetooth: hci4: command 0xfc05 tx timeout [ 62.989122][ T5737] Bluetooth: hci4: Resetting usb device. [ 63.142478][ T50] usb 5-1: reset high-speed USB device number 3 using dummy_hcd [ 63.271245][ T50] usb 5-1: device descriptor read/64, error -32 [ 63.316822][ T6220] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 63.357289][ T6227] Bluetooth: MGMT ver 1.23 [ 64.036379][ T6316] netlink: 68 bytes leftover after parsing attributes in process `syz.0.159'. [ 64.822532][ T6258] ti_usb_3410_5052_2 ttyUSB0: ti_open - cannot clear output buffers, -110 [ 64.840573][ T1471] usb 8-1: USB disconnect, device number 3 [ 64.930099][ T851] usb 5-1: USB disconnect, device number 3 [ 64.946776][ T1471] ti_usb_3410_5052_2 ttyUSB0: TI USB 5052 2 port adapter converter now disconnected from ttyUSB0 [ 64.977260][ T1471] ti_usb_3410_5052_2 ttyUSB1: TI USB 5052 2 port adapter converter now disconnected from ttyUSB1 [ 65.001200][ T1471] ti_usb_3410_5052 8-1:2.0: device disconnected [ 65.003572][ T6339] [ 65.004676][ T6339] ====================================================== [ 65.007609][ T6339] WARNING: possible circular locking dependency detected [ 65.010518][ T6339] syzkaller #0 Tainted: G L [ 65.013213][ T6339] ------------------------------------------------------ [ 65.016049][ T6339] syz.1.167/6339 is trying to acquire lock: [ 65.018233][ T6339] ffffffff9024e8c0 (tpg_instances_lock){+.+.}-{4:4}, at: tcm_alloc+0x20/0x440 [ 65.021546][ T6339] [ 65.021546][ T6339] but task is already holding lock: [ 65.024187][ T6339] ffff88802a678390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x57/0x3a0 [ 65.027388][ T6339] [ 65.027388][ T6339] which lock already depends on the new lock. [ 65.027388][ T6339] [ 65.031095][ T6339] [ 65.031095][ T6339] the existing dependency chain (in reverse order) is: [ 65.034367][ T6339] [ 65.034367][ T6339] -> #3 (&gi->lock){+.+.}-{4:4}: [ 65.036937][ T6339] lock_acquire+0x1b9/0x370 [ 65.038847][ T6339] __mutex_lock+0x1a4/0x1bd0 [ 65.040728][ T6339] config_usb_cfg_link+0x57/0x3a0 [ 65.042720][ T6339] configfs_symlink+0x540/0x11f0 [ 65.044755][ T6339] vfs_symlink+0x178/0x4d0 [ 65.046564][ T6339] filename_symlinkat+0x2a6/0x560 [ 65.048564][ T6339] __ia32_sys_symlinkat+0x9b/0xe0 [ 65.050587][ T6339] __do_fast_syscall_32+0xe7/0x970 [ 65.052639][ T6339] do_fast_syscall_32+0x32/0x70 [ 65.054583][ T6339] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 65.057058][ T6339] [ 65.057058][ T6339] -> #2 (&sb->s_type->i_mutex_key#26){++++}-{4:4}: [ 65.060155][ T6339] lock_acquire+0x1b9/0x370 [ 65.062008][ T6339] down_write+0x8b/0x1f0 [ 65.063739][ T6339] configfs_depend_item_unlocked+0xf3/0x6a0 [ 65.066047][ T6339] usbg_make_tpg+0x261/0x620 [ 65.067887][ T6339] target_fabric_make_tpg+0xab/0x8c0 [ 65.070008][ T6339] configfs_mkdir+0x51e/0xb70 [ 65.071890][ T6339] vfs_mkdir+0x361/0x850 [ 65.073624][ T6339] filename_mkdirat+0x48b/0x5e0 [ 65.075556][ T6339] __ia32_sys_mkdir+0x6a/0x90 [ 65.077415][ T6339] __do_fast_syscall_32+0xe7/0x970 [ 65.079380][ T6339] do_fast_syscall_32+0x32/0x70 [ 65.081386][ T6339] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 65.083828][ T6339] [ 65.083828][ T6339] -> #1 (&opts->dep_lock){+.+.}-{4:4}: [ 65.086573][ T6339] lock_acquire+0x1b9/0x370 [ 65.088408][ T6339] __mutex_lock+0x1a4/0x1bd0 [ 65.090260][ T6339] usbg_make_tpg+0x1a4/0x620 [ 65.092158][ T6339] target_fabric_make_tpg+0xab/0x8c0 [ 65.094261][ T6339] configfs_mkdir+0x51e/0xb70 [ 65.096143][ T6339] vfs_mkdir+0x361/0x850 [ 65.097852][ T6339] filename_mkdirat+0x48b/0x5e0 [ 65.099777][ T6339] __ia32_sys_mkdir+0x6a/0x90 [ 65.101641][ T6339] __do_fast_syscall_32+0xe7/0x970 [ 65.103657][ T6339] do_fast_syscall_32+0x32/0x70 [ 65.105640][ T6339] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 65.108282][ T6339] [ 65.108282][ T6339] -> #0 (tpg_instances_lock){+.+.}-{4:4}: [ 65.111326][ T6339] check_prev_add+0xeb/0xe60 [ 65.113201][ T6339] __lock_acquire+0x136c/0x1a40 [ 65.115125][ T6339] lock_acquire+0x1b9/0x370 [ 65.116950][ T6339] __mutex_lock+0x1a4/0x1bd0 [ 65.118797][ T6339] tcm_alloc+0x20/0x440 [ 65.120526][ T6339] usb_get_function+0x5e/0xd0 [ 65.122418][ T6339] config_usb_cfg_link+0x1ed/0x3a0 [ 65.124498][ T6339] configfs_symlink+0x540/0x11f0 [ 65.126384][ T6339] vfs_symlink+0x178/0x4d0 [ 65.128226][ T6339] filename_symlinkat+0x2a6/0x560 [ 65.130227][ T6339] __ia32_sys_symlinkat+0x9b/0xe0 [ 65.132254][ T6339] __do_fast_syscall_32+0xe7/0x970 [ 65.134278][ T6339] do_fast_syscall_32+0x32/0x70 [ 65.136202][ T6339] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 65.138661][ T6339] [ 65.138661][ T6339] other info that might help us debug this: [ 65.138661][ T6339] [ 65.142268][ T6339] Chain exists of: [ 65.142268][ T6339] tpg_instances_lock --> &sb->s_type->i_mutex_key#26 --> &gi->lock [ 65.142268][ T6339] [ 65.147132][ T6339] Possible unsafe locking scenario: [ 65.147132][ T6339] [ 65.149771][ T6339] CPU0 CPU1 [ 65.151697][ T6339] ---- ---- [ 65.153621][ T6339] lock(&gi->lock); [ 65.155048][ T6339] lock(&sb->s_type->i_mutex_key#26); [ 65.157776][ T6339] lock(&gi->lock); [ 65.160100][ T6339] lock(tpg_instances_lock); [ 65.161833][ T6339] [ 65.161833][ T6339] *** DEADLOCK *** [ 65.161833][ T6339] [ 65.164734][ T6339] 3 locks held by syz.1.167/6339: [ 65.166560][ T6339] #0: ffff888021d34450 (sb_writers#14){.+.+}-{0:0}, at: filename_create+0x10d/0x400 [ 65.169957][ T6339] #1: ffff888012e82280 (&sb->s_type->i_mutex_key#26){++++}-{4:4}, at: configfs_symlink+0x3c0/0x11f0 [ 65.173848][ T6339] #2: ffff88802a678390 (&gi->lock){+.+.}-{4:4}, at: config_usb_cfg_link+0x57/0x3a0 [ 65.177192][ T6339] [ 65.177192][ T6339] stack backtrace: [ 65.179331][ T6339] CPU: 3 UID: 0 PID: 6339 Comm: syz.1.167 Tainted: G L syzkaller #0 PREEMPT(full) [ 65.179357][ T6339] Tainted: [L]=SOFTLOCKUP [ 65.179364][ T6339] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 65.179374][ T6339] Call Trace: [ 65.179383][ T6339] [ 65.179391][ T6339] dump_stack_lvl+0x100/0x190 [ 65.179419][ T6339] print_circular_bug.cold+0x178/0x1c7 [ 65.179447][ T6339] check_noncircular+0x146/0x160 [ 65.179475][ T6339] check_prev_add+0xeb/0xe60 [ 65.179503][ T6339] __lock_acquire+0x136c/0x1a40 [ 65.179521][ T6339] lock_acquire+0x1b9/0x370 [ 65.179536][ T6339] ? tcm_alloc+0x20/0x440 [ 65.179555][ T6339] ? __pfx___might_resched+0x10/0x10 [ 65.179579][ T6339] __mutex_lock+0x1a4/0x1bd0 [ 65.179600][ T6339] ? tcm_alloc+0x20/0x440 [ 65.179619][ T6339] ? tcm_alloc+0x20/0x440 [ 65.179637][ T6339] ? __mutex_lock+0x26d/0x1bd0 [ 65.179656][ T6339] ? config_usb_cfg_link+0x57/0x3a0 [ 65.179676][ T6339] ? __pfx___mutex_lock+0x10/0x10 [ 65.179701][ T6339] ? tcm_alloc+0x20/0x440 [ 65.179718][ T6339] tcm_alloc+0x20/0x440 [ 65.179737][ T6339] usb_get_function+0x5e/0xd0 [ 65.179751][ T6339] config_usb_cfg_link+0x1ed/0x3a0 [ 65.179771][ T6339] ? mntput_no_expire+0xe7/0x220 [ 65.179795][ T6339] configfs_symlink+0x540/0x11f0 [ 65.179815][ T6339] ? bpf_lsm_inode_permission+0x9/0x10 [ 65.179849][ T6339] ? security_inode_permission+0xbf/0x250 [ 65.179888][ T6339] ? __pfx_configfs_symlink+0x10/0x10 [ 65.179911][ T6339] vfs_symlink+0x178/0x4d0 [ 65.179935][ T6339] filename_symlinkat+0x2a6/0x560 [ 65.179957][ T6339] ? __pfx_filename_symlinkat+0x10/0x10 [ 65.179976][ T6339] ? strncpy_from_user+0x19d/0x2d0 [ 65.180006][ T6339] ? do_getname+0x191/0x390 [ 65.180053][ T6339] __ia32_sys_symlinkat+0x9b/0xe0 [ 65.180074][ T6339] __do_fast_syscall_32+0xe7/0x970 [ 65.180100][ T6339] do_fast_syscall_32+0x32/0x70 [ 65.180125][ T6339] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 65.180148][ T6339] RIP: 0023:0xf707efec [ 65.180169][ T6339] Code: Unable to access opcode bytes at 0xf707efc2. [ 65.180184][ T6339] RSP: 002b:00000000f546d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000130 [ 65.180201][ T6339] RAX: ffffffffffffffda RBX: 0000000080000280 RCX: 00000000ffffff9c [ 65.180212][ T6339] RDX: 0000000080000300 RSI: 0000000000000000 RDI: 0000000000000000 [ 65.180223][ T6339] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 65.180232][ T6339] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 65.180242][ T6339] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 65.180257][ T6339] [ 70.982560][ T1434] ieee802154 phy0 wpan0: encryption failed: -22 [ 70.985325][ T1434] ieee802154 phy1 wpan1: encryption failed: -22