last executing test programs: 7.995185097s ago: executing program 3 (id=21): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mknodat(0xffffffffffffff9c, 0x0, 0x81c0, 0x0) ptrace$ARCH_SHSTK_ENABLE(0x1e, r0, 0x2, 0x5001) symlink(0x0, &(0x7f00000001c0)='./file0\x00') sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000c00)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240), 0x0, 0x20000040}], 0x1, 0x8040) syz_open_dev$video(&(0x7f00000004c0), 0x81, 0xa082) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/auth.rpcsec.context/channel\x00', 0x1, 0x0) write(r3, &(0x7f0000000400)="013030203030302032303030303030303030202d", 0x14) 6.866281082s ago: executing program 3 (id=24): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000005a80), 0xce5, 0x2400) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r0, 0x80045530, &(0x7f0000005ac0)=""/114) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_open_procfs(0x0, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000d00)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0xfffffffc}, 0x1c, &(0x7f0000000300), 0x0, 0x0, 0x0, 0xff000000}}, {{&(0x7f0000000080)={0xa, 0x4e20, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}, 0x45af}, 0x1c, 0x0}}], 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r4, 0x89f2, &(0x7f00000000c0)={'syztnl0\x00', &(0x7f0000000240)={'tunl0\x00', 0x0, 0x1, 0x7800, 0xffff, 0x8004, {{0x5, 0x4, 0x0, 0x28, 0x59, 0x68, 0x0, 0x10, 0x4, 0x0, @local, @remote}}}}) mount(0x0, 0x0, 0x0, 0x1214040, 0x0) syz_open_dev$video(&(0x7f0000000080), 0x8003, 0x105580) 6.38575182s ago: executing program 0 (id=25): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x20000) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000800)=@newtfilter={0x48, 0x2c, 0xd27, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xfff3, 0x7}, {}, {0xa, 0x1}}, [@filter_kind_options=@f_matchall={{0xd}, {0x14, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x2, 0xa}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x80}, 0x40010) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r7 = socket$inet(0x2, 0x2, 0x0) openat$sw_sync_info(0xffffffffffffff9c, &(0x7f0000000140), 0x101040, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f0000000200)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x24}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8914, &(0x7f0000000600)={'wlan0\x00', 0x1}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000100)={0x0, 0xffffffff, 0x0, 0x4, 0x6, "ee060100000016000057000020000000006000"}) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000900)={0x30, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x30}}, 0x0) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f00000000c0)={0x2c, r1, 0x5, 0x0, 0x4000000, {{}, {@val={0x8, 0x3, r6}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x985}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0x5}]}, 0x2c}}, 0x0) 5.790497536s ago: executing program 3 (id=27): r0 = syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0x2730, 0x800, 0x1, 0x82}, &(0x7f0000000180)=0x0, &(0x7f00000002c0)=0x0, &(0x7f0000000240)=0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x34000, 0x0) ioctl$FE_GET_PROPERTY(0xffffffffffffffff, 0x80106f53, &(0x7f0000000040)={0x30, 0x0}) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000040)=@IORING_OP_CLOSE={0x13, 0x48, 0x0, r0}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r4 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) io_uring_enter(r0, 0x1, 0x1, 0x1, 0x0, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003580)={0x20, 0x2f, 0x107, 0x70bd2e, 0x25dfdbfb, {0x2, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x2, 0x0, 0x0, @u32=0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8010) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) socket$kcm(0x2, 0x7, 0x2) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) syz_80211_inject_frame(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB], 0x305) 4.619169748s ago: executing program 2 (id=29): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/target/core/rd_mcp_0\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/target/core/rd_mcp_0/ramdisk0\x00', 0x1ed) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='rd_pages=1024\n', 0xe) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/target/core/rd_mcp_0/ramdisk0/enable\x00', 0x1, 0x0) write(r1, &(0x7f0000000180)='1\n', 0x2) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000540)={&(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000fee000/0x12000)=nil, &(0x7f0000ff6000/0x4000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff3000/0x2000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000fea000/0x7000)=nil, 0x0}, 0x68) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/functions/uac2.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/uac2.usb0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r2, &(0x7f0000000480)='usbip-vudc.0', 0xc) write(r2, &(0x7f00000004c0)='\n', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target/usb_gadget\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget/naa.5001405000000001\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/target/usb_gadget/naa.5001405000000001/tpgt_1/lun/lun_0\x00', 0x1ed) bpf$PROG_LOAD(0x5, &(0x7f0000001000)={0x6, 0xa, &(0x7f00000010c0)=@raw=[@generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xfffffff0}, @generic={0xb7, 0x3, 0x0, 0x0, 0xc}, @generic={0xb7, 0x4}, @generic={0xb7, 0x5}, @generic={0x85, 0x0, 0x0, 0x0, 0x63}, @generic={0x15, 0x0, 0x0, 0x2}, @generic={0x81, 0x1, 0x0, 0x1f}, @generic={0x85, 0x0, 0x0, 0x0, 0x56}, @generic={0x95}], &(0x7f00000011c0)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) 4.124455037s ago: executing program 0 (id=30): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x44, 0x6, 0x3c8, 0x168, 0x168, 0x0, 0x200, 0x168, 0x370, 0x370, 0x370, 0x370, 0x370, 0x6, 0x0, {[{{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x13}, 0xff, 0xff000000, 'pim6reg1\x00', 'bridge_slave_0\x00', {}, {0xff}, 0x88, 0x3}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0x3, 0x3}}}, {{@ip={@private=0xa010100, @local, 0x0, 0x0, 'vcan0\x00', 'veth0_virt_wifi\x00', {}, {0xff}}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x0, 0x1], 0x1}, {0x0, [0x0, 0x0, 0x0, 0x2, 0x4]}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0xff, 0xff, 'bond_slave_0\x00', 'veth1_virt_wifi\x00', {}, {0xff}, 0x5c, 0x2}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@private=0xa010102, @multicast1, 0x0, 0xffffff00, 'syzkaller0\x00', 'bond0\x00', {}, {}, 0x0, 0x0, 0x13}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@remote, @loopback, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0x98}, @ECN={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x428) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x519c02, 0x0) ioctl$FS_IOC_RESVSP(r2, 0x40305828, &(0x7f0000000040)={0x0, 0x1, 0x6, 0xfffffffffffffffe}) write(r2, &(0x7f0000001640)="8b", 0x1) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', @multicast}) socket$nl_netfilter(0x10, 0x3, 0xc) write$tun(r0, &(0x7f0000000000)={@val={0xa, 0x9000}, @void, @eth={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @empty, @void, {@ipv6={0x86dd, @tcp={0x9, 0x6, "6f449e", 0x14, 0x6, 0x1, @remote, @mcast2, {[], {{0x4e21, 0x4e21, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10, 0x8ed, 0x0, 0x6}}}}}}}}, 0x4e) 4.123766156s ago: executing program 1 (id=31): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x600) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f0000000040)={0x3, 0x3, 0x4, 0x1}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000ec0)={'syz0\x00', {0x0, 0x0, 0xfffc, 0x4}, 0x0, [0x9faf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x3, 0x0, 0x4, 0xfeffffff, 0x0, 0x0, 0xffff, 0x1, 0x0, 0x0, 0x20000000, 0x0, 0x4, 0x0, 0x6, 0x8, 0x7fff, 0x3, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28000000, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0xfffffffc, 0x3, 0x0, 0x401, 0x0, 0xffffffff, 0xdc, 0xa, 0x0, 0x2d52c0], [0x0, 0x1, 0x2, 0xb16, 0x0, 0xffffffcb, 0x0, 0x0, 0x0, 0x2000, 0x3, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x9, 0x0, 0x0, 0xfffffffd, 0xfffffffe, 0x0, 0x0, 0x10, 0x0, 0x0, 0x7, 0x0, 0x0, 0x4, 0x1000, 0x0, 0xf, 0xff, 0x2000002, 0x0, 0x0, 0x0, 0xfffffffe, 0x20000100, 0x1, 0x0, 0x0, 0x66bd, 0x0, 0xfefffffd, 0x1, 0x8, 0xd77, 0x0, 0x0, 0xfffff37a, 0x0, 0x0, 0x9bd, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xf, 0x0, 0x2], [0x8, 0xa, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x9, 0x0, 0x7, 0x20000, 0xfffffffd, 0x2, 0xe, 0xffff, 0x0, 0x0, 0xffffff7f, 0x9, 0x0, 0x0, 0x0, 0x9, 0x0, 0x2, 0xf, 0x0, 0xd12, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x1000000, 0x8000000, 0x403, 0x0, 0x0, 0x0, 0x80, 0x8, 0x0, 0x7, 0xca, 0x0, 0xfffffffe, 0x4], [0x0, 0xfffffffc, 0xfffffffc, 0xc, 0x6, 0x0, 0x7, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x7e, 0x0, 0x3, 0x2, 0x0, 0xe, 0x4000000, 0x0, 0x0, 0x8d, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xfffeffff, 0x1fd, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0xfffffffd, 0x7fd, 0x0, 0x40002, 0x2, 0x0, 0x0, 0x6, 0x0, 0x401, 0x100000, 0x4, 0x10000, 0x0, 0x0, 0xfffffffd, 0x2, 0x0, 0x0, 0x0, 0x0, 0x5]}, 0x45c) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x1ffffc, 0xb66, &(0x7f0000006680)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), r4) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl1\x00', r5, 0x4, 0x0, 0x0, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x3a}, @private1={0xfc, 0x1, '\x00', 0x1}, 0x80, 0x0, 0x1, 0x1}}) r7 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r8 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r7) mmap$IORING_OFF_SQ_RING(0x0, 0x8000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000940)={r8}, 0x0, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r4, 0x89f3, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000180)={'ip6tnl0\x00', r6, 0x0, 0x0, 0x0, 0x4, 0x8, @remote, @dev={0xfe, 0x80, '\x00', 0xe}, 0x0, 0x1, 0xfffffffe, 0x1}}) r9 = socket$inet(0xa, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r9, 0x0, 0x40, &(0x7f00000002c0)=@mangle={'mangle\x00', 0x44, 0x6, 0x410, 0x138, 0x98, 0x138, 0x0, 0x0, 0x378, 0x378, 0x378, 0x378, 0x378, 0x6, 0x0, {[{{@ip={@loopback, @multicast1=0xe0007600, 0x0, 0x0, 'gre0\x00', 'ip6gre0\x00', {}, {}, 0x0, 0x0, 0x11}, 0x7a00, 0x70, 0x98}, @inet=@DSCP={0x28, 'DSCP\x00', 0x0, {0x3}}}, {{@ip={@multicast1, @local, 0x0, 0x0, 'wg1\x00', 'nicvf0\x00', {}, {}, 0x11}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0xb8, 0x100, 0x0, {}, [@common=@unspec=@limit={{0x48}, {0x0, 0x28, 0x9, 0x0, 0x0, 0x1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private2, 'veth0_virt_wifi\x00', {0x7}}}}, {{@ip={@rand_addr, @private, 0xffffffff, 0xff, 'syzkaller0\x00', 'veth1_to_team\x00', {}, {0xff}}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @empty}}}, {{@ip={@empty, @empty, 0xff000000, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x1fb, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x470) 4.010205389s ago: executing program 3 (id=32): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x60dc7000) r3 = openat$userio(0xffffffffffffff9c, &(0x7f0000000080), 0x22242, 0x0) read(r3, &(0x7f0000000180)=""/236, 0xec) close(r1) r4 = memfd_create(&(0x7f0000000040)='-&:{-\xaa]{\x00', 0x2) pwrite64(r4, &(0x7f00000000c0)='\x00', 0x1, 0x3fff) fcntl$addseals(r4, 0x409, 0xf) r5 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r6, {0x0, 0x9}, {0xffff, 0xffff}, {0x1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_FLOW_MODE={0x8, 0x5, 0x2}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x81}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000001980)=ANY=[@ANYBLOB="f8000000190001002dbd7000ffdbdf25ac1e0001000000000000000000000000ac1414aa00000000000000000000000000020000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7f0000000000000000ffffffffffffffff0400000000000000ffffffffffffffff070000000000000000000000000000000000000000000000000a000000000000feffffffff7f400002000000000008020000004400050080ffffff000000000000000000000000000004d2ff00"/145], 0xf8}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r8, 0x42}, 0x80, &(0x7f0000000440)=[{&(0x7f00000001c0)='\'', 0x1}], 0x1}, 0x4005) 3.566920579s ago: executing program 0 (id=33): r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, 0x0) syz_usb_connect$uac3(0x5, 0x80, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000f4ff00108c0d140040000102030109026e0003010ab00f080b00060126309e0904000000010130000a24010d0a00070000000904010000e10130000904010101010230000e0501092001040a140a252595f200005271ff09040200000102300009040225250e0000000d01009f70680e34756114304b4b96495f1183e86525e094f8f87f056d666f5a2fcdf13cd350b396bd0406f260b5a50e1304060000000d7e1b9aebb729b05f87daeabb1334166b34e7e84a9ee3518180d8c7ed3ca2976da91f0737d898cfe3e531456c0a83360ffbb206ee12beb28b1700ef2add19c2dd94e5f9b006e0375f"], 0x0) r1 = syz_open_dev$vim2m(&(0x7f0000000240), 0x6, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_DQBUF(r1, 0xc044560f, &(0x7f0000000380)=@mmap={0x0, 0x1, 0x4, 0x802006, 0x0, {}, {0x0, 0x2, 0x0, 0x0, 0x4, 0x0, "37bb54f0"}}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, 0x0) munmap(&(0x7f0000c75000/0x4000)=nil, 0x4000) socket$inet(0x2, 0x4000000000000001, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e24, 0x4, @rand_addr, 0x3d}, 0x1c) listen(r2, 0x0) close(0x3) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0x2f, &(0x7f0000000040)=0x5, 0x4) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) sendto$inet(r3, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) remap_file_pages(&(0x7f00005fd000/0x4000)=nil, 0x4000, 0x0, 0x5, 0x20) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) 3.418161385s ago: executing program 2 (id=34): socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) inotify_init1(0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000040), 0x401, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r0) syz_open_procfs(0x0, &(0x7f0000000100)='mountinfo\x00') openat$hpet(0xffffffffffffff9c, &(0x7f0000000000), 0x80080, 0x0) socket$inet6(0xa, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f00000001c0)=ANY=[@ANYRES32=r1], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000001, 0x12, r1, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_GETKMSGREDIRECT(r2, 0x541c, &(0x7f0000000000)) r3 = openat(0xffffffffffffff9c, 0x0, 0x101042, 0x0) pwrite64(r3, 0x0, 0x0, 0x10c6b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) 3.33154692s ago: executing program 2 (id=35): r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl(r0, 0xa, &(0x7f00000001c0)) r1 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x80000, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000002ec0), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$kcm(0x29, 0x5, 0x0) write$cgroup_pressure(r2, &(0x7f0000000140)={'full'}, 0xfffffdef) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8f}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000480)=0x45) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r4, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r5 = socket$inet6(0xa, 0x80003, 0x6) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000340)={{{@in=@broadcast, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x800000000000, 0x4, 0x3}, {0x0, 0x4, 0x0, 0xa78a}, 0xfffffffe, 0x0, 0x1}, {{@in=@private, 0x0, 0x33}, 0x0, @in=@rand_addr=0x64010101, 0x0, 0x3, 0x1, 0x7}}, 0xe8) sendmmsg(r5, &(0x7f0000000480), 0x2e9, 0x0) connect$tipc(r1, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r1, 0x40046f41, &(0x7f0000000440)=0x20000) 3.250174986s ago: executing program 1 (id=36): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./tracing\x00', &(0x7f0000000200)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracing/events/sched/filter\x00', 0x1, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x88200, 0x0) lseek(r1, 0x5, 0x3) chmod(&(0x7f00000000c0)='./tracing\x00', 0x16) openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000280)=@IORING_OP_WRITE={0x17, 0x0, 0x6000, @fd_index=0x3, 0x9, 0x0, 0x0, 0x14, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x4, @tid=r2}, &(0x7f0000bbdffc)=0x0) timer_settime(r3, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) futex(&(0x7f000000cffc)=0x1, 0x6, 0x2, 0x0, 0x0, 0xfffffffe) r4 = syz_open_dev$evdev(&(0x7f0000000000), 0x2, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) gettid() r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r5) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(0xffffffffffffffff, 0x0, 0x24040814) sendmsg$TIPC_CMD_SET_NODE_ADDR(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, r6, 0x300, 0x70bd2d, 0x25dfdbfe, {{}, {}, {0x8, 0x11, 0x9}}, ["", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x40000c1}, 0x5) ioctl$EVIOCGMASK(r4, 0x80104592, &(0x7f0000000300)={0x0, 0xffffffffffffff36, &(0x7f0000000200)="952bb3e006ae9a4c3a"}) syz_open_dev$evdev(&(0x7f00000000c0), 0x2, 0x862b01) writev(r0, &(0x7f0000005400)=[{&(0x7f0000005440)="994b7372433f40b7dc8743e65285b2f966dd667ba378d42a5d28e7755590ab29f26bc78bfdb6d6f80e94c469c6126d556a04e65a31f8a53e9313b0f7be0b4df0f29938b84f3ddb13a659a36c31bf50e780e3c414aa91f1d3bb7f633196aafc5d28d7196a0b7d9cc94134d9c8d36990d05a66c22efce3df34cbbb257201d8cb03f7488b2ba731a04910e873232c5e9b123fce3873fe20fa7e2afd0d24a7b9e22ec740ddd30fbc1ae5b9b1dfbe6895c3a81990058f09b4967ccc8b1de924e8114f43e4f77edefee8a5e6603003c2a02bbbb9fee5754a531bda8b57b3f6f73118e36674dc2cd985eae7a2ba8acd1fee9787c6ddc5fd2e480523c9ed591abea739dcd445c6d8e989b7546f3f536cba268c2e871327ed042184ba6ba6881af6b63e272f06e6ca5443753427a599651078bbb9ac978bb077d019c83276c4ca044463940f1e2e4bbe7f4439fe50a605ba3d96c151a598f6d99d33f64b596312b01eb324f5488bc3297f8fe65594b6c188e329720fed0d3758ef1d229553e75b661385632ab1bdf396db9c77f310d3d4e2cc1b0d1e55916109aa5517557c2f8953fe0c46a53139a2220bf8fac027ec", 0x1ab}], 0x1) open_tree(r0, &(0x7f0000000040)='./tracing/events/sched/filter\x00', 0x1000) 2.870189742s ago: executing program 2 (id=37): socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000500)={0xffffffffffffffff}) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r1, 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/configs/c.1/file0\x00', 0x181201, 0x0) write(r2, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/strings/0x409\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f00000002c0)='123456789', 0x9) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f00000002c0)={0xffffffffffffffff}) splice(r4, 0x0, r3, 0x0, 0xffffffffffff8000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/ecm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/configs/c.1/strings/0x409\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r5, &(0x7f00000004c0)='\n', 0x1) 2.869776154s ago: executing program 3 (id=38): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) add_key(&(0x7f0000000000)='pkcs7_test\x00', 0x0, &(0x7f0000000100)="307106092a864886f70d010702a0643062020101310f300d06096086480165030402010500300b06092a864886f711010701313f303d0201013014300f310d300b0603550403130454657374020101300d06096086480165030402010500300d06092a864886f70d0101010500040401020304", 0x73, 0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0xa, 0xf, &(0x7f00000027c0)=@ringbuf={{}, {{0x18, 0x1, 0x0}, {}, {}, {0x85, 0x0, 0x0, 0x8}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {}, [], {{0x5, 0x1, 0xb, 0xa}, {}, {0x85, 0x0, 0x0, 0xa0}}}, &(0x7f0000000a80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x51}, 0x94) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x7, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10104, 0xa01}, [@IFLA_IFNAME={0x14, 0x3, 'xfrm0\x00'}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x3c}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000480)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYRESOCT=r2], 0x34}}, 0x20042800) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r5, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r6 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r6, 0x4008af00, &(0x7f0000000140)=0x200000000) preadv2(r6, &(0x7f0000000080)=[{&(0x7f0000000000)=""/72, 0x48}], 0x1, 0x0, 0x0, 0x3) unshare(0x2c060000) unshare(0x2a060400) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000000000), 0x0) futex(&(0x7f000000cffc), 0xc, 0x1, 0x0, 0x0, 0x0) io_getevents(0x0, 0x2, 0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r7 = syz_init_net_socket$x25(0x9, 0x5, 0x0) listen(r7, 0x1) accept4$x25(r7, 0x0, 0x0, 0x80800) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000180)={'#! ', './file0', [{0x20, '/dev/vhost-vsock\x00'}], 0xa, "d8ab5d47"}, 0x21) 2.056031036s ago: executing program 0 (id=39): openat$tun(0xffffffffffffff9c, 0x0, 0x40000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8000000008, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000380)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) creat(0x0, 0x4) unlink(&(0x7f00000003c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') r3 = open(&(0x7f0000000000)='./file1\x00', 0x143142, 0x80) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x0) syz_clone3(&(0x7f0000000300)={0x4a40200, 0x0, 0x0, 0x0, {0x2e}, &(0x7f00000001c0)=""/13, 0xd, &(0x7f0000000200)=""/57, 0x0, 0x0, {r4}}, 0x58) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000000140)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15}, 0x94) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="050000000c0000004200000040000000c0"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100), &(0x7f00000001c0), 0x10f0, r5}, 0x38) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000004c0), &(0x7f0000000640), 0x16c5, r5}, 0x38) sendfile(r3, r3, 0x0, 0x1000000201005) 2.055570987s ago: executing program 1 (id=40): r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl(r0, 0xa, &(0x7f00000001c0)) r1 = openat$ubi_ctrl(0xffffffffffffff9c, 0x0, 0x80000, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000002ec0), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$kcm(0x29, 0x5, 0x0) write$cgroup_pressure(r2, &(0x7f0000000140)={'full'}, 0xfffffdef) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8f}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000480)=0x45) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r4, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r5 = socket$inet6(0xa, 0x80003, 0x6) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000340)={{{@in=@broadcast, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x800000000000, 0x4, 0x3}, {0x0, 0x4, 0x0, 0xa78a}, 0xfffffffe, 0x0, 0x1}, {{@in=@private, 0x0, 0x33}, 0x0, @in=@rand_addr=0x64010101, 0x0, 0x3, 0x1, 0x7}}, 0xe8) sendmmsg(r5, &(0x7f0000000480), 0x2e9, 0x0) connect$tipc(r1, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r1, 0x40046f41, &(0x7f0000000440)=0x20000) 1.944678292s ago: executing program 2 (id=41): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x0, 0x44) r5 = fanotify_init(0x8, 0x1) fanotify_mark(r5, 0x541, 0x1, r4, 0x0) fanotify_mark(r5, 0x542, 0x48001021, r4, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="1e15503ef4ab332412c027eb6f0c6a18000000000000000000000095361e5771b51bad2343c6390000000061126000000000009500000000000000047571ecf3590119d01f15e9dcd61307937fa0dba05f80650f5c65a0b5470b55cda266b0fcb962d6b06314b22074535b7f0064f15b"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x80) sendmsg$nl_netfilter(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[@ANYBLOB="bc000000000105060100000000000000020000003400018014000180080001007f000001080002007f0000011c000280050001000600000006000200303900000600030006bb00003400028014000180080001007f000001080002007f0000011c00028005000100060000000600020006bb00000600030030390000080003000000000e08000700000000780d000580090001007070747000000000200004801c000180"], 0xbc}}, 0x0) unshare(0x26020600) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r6, 0x6, 0x9, 0x0, &(0x7f0000000040)=0x21) 1.365841724s ago: executing program 3 (id=42): mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_io_uring_setup(0x66e, &(0x7f0000000300)={0x0, 0xcd1d, 0x10100, 0x1000000, 0x20000}, 0x0, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0xc1842, 0x0) syz_usb_disconnect(0xffffffffffffffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) connect$inet(0xffffffffffffffff, 0x0, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_ublk_setup_io_uring(0x20, 0x0, 0x0, 0x0, 0x0) syz_ublk_add_dev(r1, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmmsg$inet(r4, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0xf5) preadv(0xffffffffffffffff, &(0x7f0000000640)=[{&(0x7f0000000500)=""/189, 0xbd}], 0x1, 0x300100, 0x0) 1.265212355s ago: executing program 1 (id=43): r0 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{0x0}], 0x1) setrlimit(0x0, &(0x7f0000000280)={0xc800, 0xfffffffe}) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x80, 0x0) mount$tmpfs(0x0, 0x0, 0x0, 0x86022, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB], 0xec}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYRES16], 0x48) r3 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r3, 0x0, 0x41, 0x0, 0x44) getsockopt$EBT_SO_GET_ENTRIES(r3, 0x0, 0x81, &(0x7f0000000500)={'nat\x00', 0x0, 0x4, 0x97, [0x0, 0x7, 0x2, 0x0, 0x6, 0x5], 0x0, &(0x7f00000002c0), &(0x7f0000000400)=""/151}, &(0x7f0000000580)=0x50) set_mempolicy(0x2, &(0x7f0000000600)=0x54, 0x6) bpf$MAP_CREATE(0x0, 0x0, 0x48) ptrace(0x4206, 0x0) write(0xffffffffffffffff, &(0x7f0000000000)='3', 0x4e) 1.100076345s ago: executing program 1 (id=44): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1c0) mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1c0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) close(r0) r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r1, &(0x7f0000000300)='0x0104', 0x6) close(r1) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/configs/c.1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/ncm.usb0\x00', 0x1c0) symlinkat(&(0x7f00000003c0)='./config/usb_gadget/g1/configs/c.1/../../functions/ncm.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/ncm.usb0\x00') write(0xffffffffffffffff, 0x0, 0x0) close(0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r2, &(0x7f0000000500)='0x40\n\x00', 0x5) close(r2) write(0xffffffffffffffff, 0x0, 0x0) close(0xffffffffffffffff) symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/os_desc/../configs/c.1\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/os_desc/c.1\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/functions/ncm.usb0/os_desc/interface.ncm/compatible_id\x00', 0x1, 0x0) write(r3, &(0x7f00000006c0)='WINNCM\n\x00', 0x8) write(0xffffffffffffffff, &(0x7f0000000740)='dummy_udc.0', 0xb) syz_open_dev$usbfs(&(0x7f0000000780), 0x16, 0x2) 968.413813ms ago: executing program 1 (id=45): ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0x418000) r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090000082502000000000000000109025c00020100f92a0904000001020900000524060001053408fa6e0d240f0100000000000d000a0006471a010000190581"], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(0xffffffffffffffff) write$char_usb(r1, 0x0, 0x0) r2 = syz_usb_connect(0x0, 0x36, 0x0, 0x0) pwritev2(0xffffffffffffffff, &(0x7f0000000340), 0x0, 0xc0, 0x6, 0x14) syz_usb_control_io$lan78xx(r2, 0x0, 0x0) syz_usb_control_io$uac2(r2, 0x0, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x1c0000000000) syz_usb_disconnect(r0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000002000/0x18000)=nil, 0x0, 0x0, 0x4498bda7e2139f51, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$sock_netdev_private(0xffffffffffffffff, 0x8949, 0x0) ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID(r3, 0x4068aea3, 0x0) 945.423366ms ago: executing program 0 (id=46): socket$inet_tcp(0x2, 0x1, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x21, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) read$FUSE(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x40) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x428440, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) set_mempolicy(0x8000, 0x0, 0xa) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) openat2$dir(0xffffff9c, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000280)={0x612000, 0x81, 0x13}, 0x18) bind$802154_dgram(r3, &(0x7f0000000040)={0x24, @long={0x3, 0x0, {0xaaaaaaaaaaaa0102}}}, 0x14) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x6) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_generic(0x10, 0x3, 0x10) connect$802154_dgram(r3, &(0x7f0000000240)={0x24, @short}, 0x14) sendmmsg(r3, &(0x7f00000196c0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0xd, 0x0}}], 0x4000050, 0x400c010) 150.919477ms ago: executing program 2 (id=47): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) add_key(&(0x7f0000000000)='pkcs7_test\x00', 0x0, &(0x7f0000000100)="307106092a864886f70d010702a0643062020101310f300d06096086480165030402010500300b06092a864886f711010701313f303d0201013014300f310d300b0603550403130454657374020101300d06096086480165030402010500300d06092a864886f70d0101010500040401020304", 0x73, 0xffffffffffffffff) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0xa, 0xf, &(0x7f00000027c0)=@ringbuf={{}, {{0x18, 0x1, 0x0}, {}, {}, {0x85, 0x0, 0x0, 0x8}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {}, [], {{0x5, 0x1, 0xb, 0xa}, {}, {0x85, 0x0, 0x0, 0xa0}}}, &(0x7f0000000a80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x51}, 0x94) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x7, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10104, 0xa01}, [@IFLA_IFNAME={0x14, 0x3, 'xfrm0\x00'}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x3c}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000480)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYRESOCT=r2], 0x34}}, 0x20042800) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r5, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r6 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r6, 0x4008af00, &(0x7f0000000140)=0x200000000) preadv2(r6, &(0x7f0000000080)=[{&(0x7f0000000000)=""/72, 0x48}], 0x1, 0x0, 0x0, 0x3) unshare(0x2c060000) unshare(0x2a060400) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0xc, 0x1, 0x0, 0x0, 0x0) io_getevents(0x0, 0x2, 0x0, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r7 = syz_init_net_socket$x25(0x9, 0x5, 0x0) listen(r7, 0x1) accept4$x25(r7, 0x0, 0x0, 0x80800) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000180)={'#! ', './file0', [{0x20, '/dev/vhost-vsock\x00'}], 0xa, "d8ab5d4743"}, 0x22) 0s ago: executing program 0 (id=48): mkdirat(0xffffffffffffff9c, &(0x7f0000000050)='./sys\x00', 0x1ed) mount(0x0, &(0x7f0000000060)='./sys\x00', &(0x7f0000000070)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x1, 0x0) write(r0, 0x0, 0x0) close(r0) write(0xffffffffffffffff, &(0x7f0000000300)='pcspkr', 0x6) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config\x00', 0x1ed) mount(0x0, &(0x7f0000000500)='./config\x00', &(0x7f0000000600)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1\x00', 0x1ed) r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r1, &(0x7f0000000900)='0x1d6b', 0x6) r2 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r2, &(0x7f0000000b00), 0x0) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000000c00)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1ed) symlinkat(0x0, 0xffffffffffffff9c, 0x0) symlinkat(&(0x7f0000001000)='./config/usb_gadget/g1/functions/uvc.usb0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001100)='./config/usb_gadget/g1/functions/uvc.usb0/control/class/ss/h\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000001200)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000001300)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0x1ed) mkdirat(0xffffffffffffff9c, &(0x7f0000001400)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u/360p\x00', 0x1ed) symlinkat(&(0x7f0000001500)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f0000001600)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h/u\x00') symlinkat(&(0x7f0000001700)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000001800)='./config/usb_gadget/g1/functions/uvc.usb0/streaming/class/fs/h\x00') kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:30969' (ED25519) to the list of known hosts. [ 43.514422][ T5665] cgroup: Unknown subsys name 'net' [ 43.685807][ T5665] cgroup: Unknown subsys name 'cpuset' [ 43.691103][ T5665] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 44.876063][ T5665] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 50.542468][ T5741] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 50.549203][ T5746] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 50.550489][ T5747] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 50.550878][ T5746] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 50.551492][ T5746] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 50.551651][ T5747] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 50.552575][ T5747] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 50.554009][ T5747] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 50.554123][ T5746] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 50.555578][ T5746] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 50.556045][ T5746] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 50.556551][ T5747] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 50.559275][ T67] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 50.560544][ T5747] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 50.564393][ T5098] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 50.583962][ T5098] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 50.593094][ T5750] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 50.597941][ T5750] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 50.604403][ T5750] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 50.605682][ T5750] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 51.475741][ T5752] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.476250][ T5752] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.476337][ T5752] bridge_slave_0: entered allmulticast mode [ 51.477153][ T5752] bridge_slave_0: entered promiscuous mode [ 51.496750][ T5739] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.496826][ T5739] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.496910][ T5739] bridge_slave_0: entered allmulticast mode [ 51.497862][ T5739] bridge_slave_0: entered promiscuous mode [ 51.510144][ T5748] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.510219][ T5748] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.510315][ T5748] bridge_slave_0: entered allmulticast mode [ 51.512200][ T5748] bridge_slave_0: entered promiscuous mode [ 51.514235][ T5752] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.514343][ T5752] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.514438][ T5752] bridge_slave_1: entered allmulticast mode [ 51.515868][ T5752] bridge_slave_1: entered promiscuous mode [ 51.555688][ T5739] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.555804][ T5739] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.555911][ T5739] bridge_slave_1: entered allmulticast mode [ 51.557470][ T5739] bridge_slave_1: entered promiscuous mode [ 51.569426][ T5748] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.569508][ T5748] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.569618][ T5748] bridge_slave_1: entered allmulticast mode [ 51.571123][ T5748] bridge_slave_1: entered promiscuous mode [ 51.612966][ T5748] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 51.625607][ T5752] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 51.633778][ T5739] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 51.635191][ T5748] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 51.636227][ T5739] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 51.644760][ T5752] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 51.644888][ T5743] bridge0: port 1(bridge_slave_0) entered blocking state [ 51.644950][ T5743] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.645064][ T5743] bridge_slave_0: entered allmulticast mode [ 51.645800][ T5743] bridge_slave_0: entered promiscuous mode [ 51.678012][ T5748] team0: Port device team_slave_0 added [ 51.679987][ T5748] team0: Port device team_slave_1 added [ 51.680129][ T5743] bridge0: port 2(bridge_slave_1) entered blocking state [ 51.680286][ T5743] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.680385][ T5743] bridge_slave_1: entered allmulticast mode [ 51.681247][ T5743] bridge_slave_1: entered promiscuous mode [ 51.707798][ T5739] team0: Port device team_slave_0 added [ 51.722171][ T5752] team0: Port device team_slave_0 added [ 51.724884][ T5743] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 51.727138][ T5739] team0: Port device team_slave_1 added [ 51.728343][ T5743] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 51.742391][ T5752] team0: Port device team_slave_1 added [ 51.776503][ T5748] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 51.776516][ T5748] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 51.776528][ T5748] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 51.777908][ T5748] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 51.777919][ T5748] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 51.777932][ T5748] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 51.805537][ T5739] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 51.805552][ T5739] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 51.805572][ T5739] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 51.807721][ T5743] team0: Port device team_slave_0 added [ 51.808321][ T5739] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 51.808337][ T5739] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 51.808357][ T5739] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 51.832105][ T5743] team0: Port device team_slave_1 added [ 51.863398][ T5743] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 51.863416][ T5743] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 51.863440][ T5743] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 51.876357][ T5752] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 51.876374][ T5752] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 51.876395][ T5752] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 51.890874][ T5743] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 51.890889][ T5743] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 51.890910][ T5743] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 51.897271][ T5748] hsr_slave_0: entered promiscuous mode [ 51.898265][ T5748] hsr_slave_1: entered promiscuous mode [ 51.899730][ T5752] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 51.899739][ T5752] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 51.899778][ T5752] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 51.956362][ T5739] hsr_slave_0: entered promiscuous mode [ 51.956798][ T5739] hsr_slave_1: entered promiscuous mode [ 51.957112][ T5739] debugfs: 'hsr0' already exists in 'hsr' [ 51.957163][ T5739] Cannot create hsr debugfs directory [ 52.028597][ T5743] hsr_slave_0: entered promiscuous mode [ 52.029771][ T5743] hsr_slave_1: entered promiscuous mode [ 52.030371][ T5743] debugfs: 'hsr0' already exists in 'hsr' [ 52.030390][ T5743] Cannot create hsr debugfs directory [ 52.065504][ T5752] hsr_slave_0: entered promiscuous mode [ 52.066158][ T5752] hsr_slave_1: entered promiscuous mode [ 52.066597][ T5752] debugfs: 'hsr0' already exists in 'hsr' [ 52.066612][ T5752] Cannot create hsr debugfs directory [ 52.359274][ T5748] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 52.370319][ T5748] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 52.373210][ T5748] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 52.379181][ T5748] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 52.381182][ T5748] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 52.385606][ T5748] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 52.392806][ T5748] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 52.397286][ T5748] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 52.443856][ T5739] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 52.446212][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 52.447182][ T5739] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 52.455059][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 52.456368][ T5739] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 52.464598][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 52.465814][ T5739] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 52.469421][ T5739] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 52.555657][ T5743] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 52.560086][ T5743] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 52.560633][ T5743] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 52.562655][ T5743] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 52.567692][ T5743] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 52.574674][ T5743] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 52.575476][ T5743] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 52.585828][ T5743] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 52.593021][ T5741] Bluetooth: hci2: command tx timeout [ 52.593214][ T5741] Bluetooth: hci1: command tx timeout [ 52.594048][ T5750] Bluetooth: hci0: command tx timeout [ 52.669402][ T5752] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 52.672146][ T5741] Bluetooth: hci3: command tx timeout [ 52.674972][ T5752] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 52.683971][ T5752] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 52.686079][ T5752] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 52.687070][ T5752] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 52.689234][ T5752] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 52.691037][ T5752] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 52.695783][ T5752] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 52.715124][ T5748] 8021q: adding VLAN 0 to HW filter on device bond0 [ 52.763432][ T5748] 8021q: adding VLAN 0 to HW filter on device team0 [ 52.783145][ T5739] 8021q: adding VLAN 0 to HW filter on device bond0 [ 52.793404][ T1160] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.793519][ T1160] bridge0: port 1(bridge_slave_0) entered forwarding state [ 52.795591][ T1160] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.795668][ T1160] bridge0: port 2(bridge_slave_1) entered forwarding state [ 52.855247][ T5739] 8021q: adding VLAN 0 to HW filter on device team0 [ 52.869644][ T1160] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.869716][ T1160] bridge0: port 1(bridge_slave_0) entered forwarding state [ 52.893430][ T1160] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.893476][ T1160] bridge0: port 2(bridge_slave_1) entered forwarding state [ 52.899935][ T5743] 8021q: adding VLAN 0 to HW filter on device bond0 [ 52.919056][ T5752] 8021q: adding VLAN 0 to HW filter on device bond0 [ 52.946902][ T5743] 8021q: adding VLAN 0 to HW filter on device team0 [ 52.969133][ T111] bridge0: port 1(bridge_slave_0) entered blocking state [ 52.969476][ T111] bridge0: port 1(bridge_slave_0) entered forwarding state [ 52.976165][ T5752] 8021q: adding VLAN 0 to HW filter on device team0 [ 52.985561][ T38] bridge0: port 2(bridge_slave_1) entered blocking state [ 52.985644][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state [ 53.010286][ T38] bridge0: port 1(bridge_slave_0) entered blocking state [ 53.010410][ T38] bridge0: port 1(bridge_slave_0) entered forwarding state [ 53.036711][ T38] bridge0: port 2(bridge_slave_1) entered blocking state [ 53.036794][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state [ 53.326952][ T5748] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 53.367945][ T5748] veth0_vlan: entered promiscuous mode [ 53.394883][ T5739] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 53.395191][ T5748] veth1_vlan: entered promiscuous mode [ 53.457829][ T5748] veth0_macvtap: entered promiscuous mode [ 53.465064][ T5748] veth1_macvtap: entered promiscuous mode [ 53.486436][ T5739] veth0_vlan: entered promiscuous mode [ 53.489683][ T5748] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 53.503670][ T5748] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 53.506621][ T5739] veth1_vlan: entered promiscuous mode [ 53.566136][ T5553] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.588031][ T5752] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 53.610843][ T5743] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 53.611224][ T5739] veth0_macvtap: entered promiscuous mode [ 53.637556][ T5739] veth1_macvtap: entered promiscuous mode [ 53.646394][ T224] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 53.646413][ T224] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 53.706075][ T5739] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 53.711959][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.714144][ T111] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 53.714157][ T111] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 53.725907][ T5752] veth0_vlan: entered promiscuous mode [ 53.729308][ T5739] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 53.753884][ T5752] veth1_vlan: entered promiscuous mode [ 53.784782][ T5743] veth0_vlan: entered promiscuous mode [ 53.801744][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.801849][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.801929][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.802712][ T5748] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 53.823220][ T5748] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 53.839995][ T5743] veth1_vlan: entered promiscuous mode [ 53.844553][ T5748] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 53.845316][ T5748] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 53.868122][ T5748] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 53.885324][ T5752] veth0_macvtap: entered promiscuous mode [ 53.885522][ T38] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 53.885536][ T38] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 53.892607][ T5553] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 53.938507][ T5743] veth0_macvtap: entered promiscuous mode [ 53.940099][ T5752] veth1_macvtap: entered promiscuous mode [ 53.953552][ T38] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 53.953572][ T38] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 53.957803][ T5743] veth1_macvtap: entered promiscuous mode [ 53.986361][ T5752] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 53.990686][ T5743] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 53.999312][ T5743] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 54.001303][ T5752] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 54.025074][ T5553] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.160161][ T111] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 54.160183][ T111] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 54.216945][ T111] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 54.216963][ T111] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 54.217121][ T111] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 54.217130][ T111] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 54.262629][ T111] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 54.262652][ T111] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 54.316114][ T58] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 54.344314][ T5816] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.371775][ T5816] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.392800][ T5816] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.392837][ T5816] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.392860][ T5816] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.392883][ T5816] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.392904][ T5816] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.392931][ T5816] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.392953][ T5816] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 54.473525][ T58] usb 5-1: New USB device found, idVendor=0403, idProduct=c631, bcdDevice= 1.00 [ 54.480787][ T58] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 54.537101][ T5897] Console: switching to colour dummy device 80x25 [ 54.583169][ T58] i2c-tiny-usb 5-1:1.0: version 1.00 found at bus 005 address 002 [ 54.648751][ T5898] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 54.671517][ T5898] pci 0000:00:01.0: BAR 0 [mem 0xfd000000-0xfdffffff pref] [ 54.671655][ T5898] pci 0000:00:01.0: BAR 2 [mem 0xfeaf4000-0xfeaf4fff] [ 54.671698][ T5741] Bluetooth: hci1: command tx timeout [ 54.671888][ T5898] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 54.673223][ T5898] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 54.681584][ T5741] Bluetooth: hci0: command tx timeout [ 54.681610][ T5741] Bluetooth: hci2: command tx timeout [ 54.709022][ T5898] pci 0000:00:01.0: Adding to iommu group 1 [ 54.717383][ T5898] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 54.717406][ T5898] pci 0000:00:01.0: vgaarb: bridge control possible [ 54.717419][ T5898] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 54.729930][ T5898] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 54.739002][ T5898] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 54.745116][ T5898] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 54.752977][ T5741] Bluetooth: hci3: command tx timeout [ 54.760655][ T5898] [drm] Found bochs VGA, ID 0xb0c5. [ 54.760673][ T5898] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 54.787295][ T5898] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 1 [ 54.997103][ T5903] ucsi_ccg 0-0008: i2c_transfer failed -95 [ 54.997131][ T5903] ucsi_ccg 0-0008: ucsi_ccg_init failed - -95 [ 54.997722][ T5903] ucsi_ccg 0-0008: probe with driver ucsi_ccg failed with error -95 [ 55.001005][ T5903] i2c i2c-0: new_device: Instantiated device ccgx-ucsi at 0x08 [ 55.030459][ T5898] Console: switching to colour frame buffer device 160x50 [ 55.092318][ T5898] bochs-drm 0000:00:01.0: [drm] fb0: bochs-drmdrmfb frame buffer device [ 55.133559][ T5903] ucsi_ccg 1-0008: ucsi_ccg_init failed - -110 [ 55.133676][ T5903] ucsi_ccg 1-0008: probe with driver ucsi_ccg failed with error -110 [ 55.133864][ T5903] i2c i2c-1: new_device: Instantiated device ccgx-ucsi at 0x08 [ 55.212054][ T58] (null): failure reading functionality [ 55.214364][ T58] i2c i2c-2: failure reading functionality [ 55.310896][ T58] i2c i2c-2: connected i2c-tiny-usb device [ 55.324454][ T58] usb 5-1: USB disconnect, device number 2 [ 55.437751][ T5907] netlink: 'syz.1.4': attribute type 1 has an invalid length. [ 56.270528][ T111] IPVS: starting estimator thread 0... [ 56.532919][ T5922] IPVS: using max 43 ests per chain, 103200 per kthread [ 56.601493][ T43] audit: type=1400 audit(1790188078.361:2): apparmor="STATUS" info="failed to unpack profile flags" error=-71 profile="unconfined" name="//o" pid=5916 comm="syz.1.8" name="//o" offset=45 [ 56.751936][ T5741] Bluetooth: hci2: command tx timeout [ 56.751961][ T5741] Bluetooth: hci0: command tx timeout [ 56.751975][ T5741] Bluetooth: hci1: command tx timeout [ 56.809118][ T5926] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 56.842060][ T5750] Bluetooth: hci3: command tx timeout [ 56.843482][ T5927] netlink: 36 bytes leftover after parsing attributes in process `syz.2.10'. [ 56.969398][ T5931] netlink: 'syz.1.11': attribute type 10 has an invalid length. [ 57.047461][ T5931] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 57.062744][ T5931] netlink: 'syz.1.11': attribute type 10 has an invalid length. [ 57.092602][ T5926] md: could not open device unknown-block(0,0). [ 57.092818][ T5926] md: error, md_import_device() returned -6 [ 57.912212][ T5957] Rounding down aligned max_sectors from 4294967295 to 4294967288 [ 57.928544][ T5956] nvmet_rdma: binding CM ID to 172.20.20.23:4420 failed (-99) [ 58.370276][ T5961] loop6: detected capacity change from 0 to 8 [ 58.568292][ T5961] Dev loop6: unable to read RDB block 8 [ 58.568508][ T5961] loop6: unable to read partition table [ 58.570106][ T5961] loop6: partition table beyond EOD, truncated [ 58.570338][ T5961] loop_reread_partitions: partition scan of loop6 (þ被xü^>Ñà–ì) failed (rc=-5) [ 58.596590][ T5961] futex_wake_op: syz.0.18 tries to shift op by 144; fix this program [ 58.600959][ T5961] openvswitch: netlink: Multiple metadata blocks provided [ 58.710580][ T5965] smpboot: CPU 1 is now offline [ 58.765121][ T5741] Bluetooth: hci0: command tx timeout [ 58.765162][ T5741] Bluetooth: hci1: command tx timeout [ 58.765207][ T5750] Bluetooth: hci2: command tx timeout [ 58.858636][ T5750] Bluetooth: hci3: command tx timeout [ 60.118749][ T5987] PKCS7: Unknown OID: [41] 1.2.840.113553.1.7.1 [ 60.118766][ T5987] PKCS7: Unknown OID: [41] 1.2.840.113553.1.7.1 [ 60.118774][ T5987] PKCS7: Unsupported data type 106 [ 60.153933][ T5987] bridge_slave_0: left allmulticast mode [ 60.153954][ T5987] bridge_slave_0: left promiscuous mode [ 60.155192][ T5987] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.372380][ T5987] bridge_slave_1: left allmulticast mode [ 60.372405][ T5987] bridge_slave_1: left promiscuous mode [ 60.392448][ T5987] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.436918][ T5987] bond0: (slave bond_slave_0): Releasing backup interface [ 60.609255][ T5987] bond0: (slave bond_slave_1): Releasing backup interface [ 60.903766][ T5987] team0: Port device team_slave_0 removed [ 60.934988][ T5987] team0: Port device team_slave_1 removed [ 60.936045][ T5987] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 60.936065][ T5987] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 60.943007][ T5987] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 60.943032][ T5987] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 60.953282][ T5987] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 60.994954][ T5988] team0: Port device xfrm0 added [ 61.956124][ T6018] faux_driver vgem: [drm] Unknown color mode 6; guessing buffer size. [ 62.124173][ T6010] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 62.833884][ T6024] se_dev->se_dev_ptr already set for storage object [ 63.330242][ T6036] netlink: 68 bytes leftover after parsing attributes in process `syz.3.32'. [ 63.672360][ T4775] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 63.901504][ T4775] usb 5-1: Using ep0 maxpacket: 16 [ 63.901996][ T4775] usb 5-1: New USB device found, idVendor=0d8c, idProduct=0014, bcdDevice= 0.40 [ 63.904384][ T4775] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 63.904400][ T4775] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 63.908683][ T4775] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 63.908700][ T4775] usb 5-1: Product: syz [ 63.908708][ T4775] usb 5-1: Manufacturer: syz [ 63.908715][ T4775] usb 5-1: SerialNumber: syz [ 64.100826][ T6052] PKCS7: Unknown OID: [41] 1.2.840.113553.1.7.1 [ 64.100846][ T6052] PKCS7: Unknown OID: [41] 1.2.840.113553.1.7.1 [ 64.100853][ T6052] PKCS7: Unsupported data type 106 [ 64.117105][ T6052] bridge_slave_0: left allmulticast mode [ 64.117166][ T6052] bridge_slave_0: left promiscuous mode [ 64.117336][ T6052] bridge0: port 1(bridge_slave_0) entered disabled state [ 64.120858][ T6052] bridge_slave_1: left allmulticast mode [ 64.120920][ T6052] bridge_slave_1: left promiscuous mode [ 64.121186][ T6052] bridge0: port 2(bridge_slave_1) entered disabled state [ 64.143645][ T6052] bond0: (slave bond_slave_0): Releasing backup interface [ 64.179683][ T6052] bond0: (slave bond_slave_1): Releasing backup interface [ 64.195405][ T6052] team0: Port device team_slave_0 removed [ 64.201865][ T6052] team0: Port device team_slave_1 removed [ 64.202343][ T6052] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 64.202357][ T6052] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 64.206704][ T6052] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 64.206719][ T6052] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 64.214324][ T6052] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 64.239241][ T6054] team0: Port device xfrm0 added [ 64.319382][ T6038] mmap: syz.0.33 (6038) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 64.347923][ T4775] usb 5-1: 0:2 : does not exist [ 64.347939][ T4775] usb 5-1: 0:3 : does not exist [ 64.347946][ T4775] usb 5-1: 0:4 : does not exist [ 64.347954][ T4775] usb 5-1: 0:5 : does not exist [ 64.348050][ T4775] usb 5-1: BAAD SPEAKERPHONE c_chmask mismatch [ 64.453035][ T4775] snd-usb-audio 5-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 64.463280][ T4775] usb 5-1: USB disconnect, device number 3 [ 64.520593][ T5745] udevd[5745]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 65.825171][ T6076] netlink: 24 bytes leftover after parsing attributes in process `syz.2.41'. [ 66.261851][ T35] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 66.426385][ T35] usb 6-1: Using ep0 maxpacket: 8 [ 66.427111][ T35] usb 6-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 66.428064][ T35] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 66.428080][ T35] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 66.428107][ T35] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 100, changing to 10 [ 66.428128][ T35] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 24936, setting to 1024 [ 66.428159][ T35] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 66.473544][ T35] hub 6-1:1.0: bad descriptor, ignoring hub [ 66.473565][ T35] hub 6-1:1.0: probe with driver hub failed with error -5 [ 66.473910][ T35] cdc_wdm 6-1:1.0: skipping garbage [ 66.473918][ T35] cdc_wdm 6-1:1.0: skipping garbage [ 66.509650][ T35] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 66.509664][ T35] cdc_wdm 6-1:1.0: Unknown control protocol [ 66.827340][ T6090] PKCS7: Unknown OID: [41] 1.2.840.113553.1.7.1 [ 66.827366][ T6090] PKCS7: Unknown OID: [41] 1.2.840.113553.1.7.1 [ 66.827376][ T6090] PKCS7: Unsupported data type 106 [ 66.846353][ T6090] bridge_slave_0: left allmulticast mode [ 66.846379][ T6090] bridge_slave_0: left promiscuous mode [ 66.846529][ T6090] bridge0: port 1(bridge_slave_0) entered disabled state [ 66.869539][ T6090] bridge_slave_1: left allmulticast mode [ 66.869559][ T6090] bridge_slave_1: left promiscuous mode [ 66.870003][ T6090] bridge0: port 2(bridge_slave_1) entered disabled state [ 66.898104][ T6090] bond0: (slave bond_slave_0): Releasing backup interface [ 66.931451][ T6090] bond0: (slave bond_slave_1): Releasing backup interface [ 66.955119][ T6090] team0: Port device team_slave_0 removed [ 66.973591][ T6090] team0: Port device team_slave_1 removed [ 66.974520][ T6090] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 66.974537][ T6090] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 67.015630][ T6093] [ 67.028180][ T6093] ====================================================== [ 67.031114][ T6093] WARNING: possible circular locking dependency detected [ 67.034967][ T6093] syzkaller #0 Not tainted [ 67.037018][ T6093] ------------------------------------------------------ [ 67.040119][ T6090] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 67.040141][ T6090] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 67.048450][ T6093] syz.0.48/6093 is trying to acquire lock: [ 67.051363][ T6093] ffffffff90400e68 (gadget_subsys.su_mutex){+.+.}-{4:4}, at: uvcg_streaming_header_allow_link+0x7c/0x650 [ 67.056164][ T6093] [ 67.056164][ T6093] but task is already holding lock: [ 67.059338][ T6093] ffff8880138b8ac0 (&sb->s_type->i_mutex_key#26){++++}-{4:4}, at: configfs_symlink+0x452/0x1340 [ 67.063138][ T6093] [ 67.063138][ T6093] which lock already depends on the new lock. [ 67.063138][ T6093] [ 67.067905][ T6093] [ 67.067905][ T6093] the existing dependency chain (in reverse order) is: [ 67.074987][ T6093] [ 67.074987][ T6093] -> #3 (&sb->s_type->i_mutex_key#26){++++}-{4:4}: [ 67.079181][ T6093] lock_acquire+0x1d1/0x380 [ 67.082046][ T6093] down_write+0x8b/0x1f0 [ 67.084654][ T6093] configfs_depend_item_unlocked+0xf3/0x6a0 [ 67.087592][ T6093] usbg_make_tpg+0x251/0x610 [ 67.089862][ T6093] target_fabric_make_tpg+0xab/0x8c0 [ 67.091912][ T6093] configfs_mkdir+0x525/0xd40 [ 67.093674][ T6093] vfs_mkdir+0x364/0x850 [ 67.095229][ T6093] filename_mkdirat+0x48b/0x5e0 [ 67.097083][ T6093] __ia32_sys_mkdirat+0x88/0xc0 [ 67.099161][ T6093] __do_fast_syscall_32+0x13a/0x8b0 [ 67.102049][ T6093] do_fast_syscall_32+0x32/0x70 [ 67.104465][ T6093] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 67.107481][ T6093] [ 67.107481][ T6093] -> #2 (tpg_instances_lock){+.+.}-{4:4}: [ 67.110221][ T6093] lock_acquire+0x1d1/0x380 [ 67.112053][ T6093] __mutex_lock+0x1a4/0x1bd0 [ 67.114493][ T6093] tcm_alloc_inst+0x5f/0x1e0 [ 67.116459][ T6093] try_get_usb_function_instance+0x136/0x1f0 [ 67.119081][ T6093] usb_get_function_instance+0x16/0x70 [ 67.121306][ T6093] function_make+0x18c/0x3f0 [ 67.123154][ T6093] configfs_mkdir+0x525/0xd40 [ 67.125474][ T6093] vfs_mkdir+0x364/0x850 [ 67.127435][ T6093] filename_mkdirat+0x48b/0x5e0 [ 67.130007][ T6093] __ia32_sys_mkdirat+0x88/0xc0 [ 67.132986][ T6093] __do_fast_syscall_32+0x13a/0x8b0 [ 67.135759][ T6093] do_fast_syscall_32+0x32/0x70 [ 67.138387][ T6093] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 67.141757][ T6093] [ 67.141757][ T6093] -> #1 (func_lock){+.+.}-{4:4}: [ 67.144553][ T6093] lock_acquire+0x1d1/0x380 [ 67.146493][ T6093] __mutex_lock+0x1a4/0x1bd0 [ 67.148494][ T6093] try_get_usb_function_instance+0x26/0x1f0 [ 67.151133][ T6093] usb_get_function_instance+0x16/0x70 [ 67.153701][ T6093] function_make+0x18c/0x3f0 [ 67.155755][ T6093] configfs_mkdir+0x525/0xd40 [ 67.157939][ T6093] vfs_mkdir+0x364/0x850 [ 67.160208][ T6093] filename_mkdirat+0x48b/0x5e0 [ 67.163638][ T6093] __ia32_sys_mkdirat+0x88/0xc0 [ 67.166750][ T6093] __do_fast_syscall_32+0x13a/0x8b0 [ 67.169764][ T6093] do_fast_syscall_32+0x32/0x70 [ 67.171879][ T6093] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 67.174456][ T6093] [ 67.174456][ T6093] -> #0 (gadget_subsys.su_mutex){+.+.}-{4:4}: [ 67.177666][ T6093] check_prev_add+0xeb/0xe60 [ 67.179854][ T6093] __lock_acquire+0x1528/0x1f40 [ 67.182283][ T6093] lock_acquire+0x1d1/0x380 [ 67.184776][ T6093] __mutex_lock+0x1a4/0x1bd0 [ 67.187625][ T6093] uvcg_streaming_header_allow_link+0x7c/0x650 [ 67.191488][ T6093] configfs_symlink+0x695/0x1340 [ 67.194241][ T6093] vfs_symlink+0x178/0x4d0 [ 67.196370][ T6093] filename_symlinkat+0x2a6/0x560 [ 67.199398][ T6093] __ia32_sys_symlinkat+0x9b/0xe0 [ 67.201665][ T6093] __do_fast_syscall_32+0x13a/0x8b0 [ 67.203933][ T6093] do_fast_syscall_32+0x32/0x70 [ 67.206055][ T6093] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 67.209339][ T6093] [ 67.209339][ T6093] other info that might help us debug this: [ 67.209339][ T6093] [ 67.214202][ T6093] Chain exists of: [ 67.214202][ T6093] gadget_subsys.su_mutex --> tpg_instances_lock --> &sb->s_type->i_mutex_key#26 [ 67.214202][ T6093] [ 67.221354][ T6093] Possible unsafe locking scenario: [ 67.221354][ T6093] [ 67.224276][ T6093] CPU0 CPU1 [ 67.226658][ T6093] ---- ---- [ 67.228696][ T6093] lock(&sb->s_type->i_mutex_key#26); [ 67.231002][ T6093] lock(tpg_instances_lock); [ 67.234014][ T6093] lock(&sb->s_type->i_mutex_key#26); [ 67.239207][ T6093] lock(gadget_subsys.su_mutex); [ 67.241407][ T6093] [ 67.241407][ T6093] *** DEADLOCK *** [ 67.241407][ T6093] [ 67.245531][ T6093] locks held by syz.0.48/6093: 2, last CPU#0: [ 67.249554][ T6093] #0: ffff88802252c460 (sb_writers#14){.+.+}-{0:0}, at: filename_create+0x10d/0x400 [ 67.253293][ T6093] #1: ffff8880138b8ac0 (&sb->s_type->i_mutex_key#26){++++}-{4:4}, at: configfs_symlink+0x452/0x1340 [ 67.257341][ T6093] [ 67.257341][ T6093] stack backtrace: [ 67.262193][ T6093] CPU: 0 UID: 0 PID: 6093 Comm: syz.0.48 Not tainted syzkaller #0 PREEMPT(full) [ 67.266298][ T6093] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 67.270615][ T6093] Call Trace: [ 67.272091][ T6093] [ 67.273371][ T6093] dump_stack_lvl+0x100/0x190 [ 67.275456][ T6093] print_circular_bug.cold+0x178/0x1be [ 67.278310][ T6093] check_noncircular+0x146/0x160 [ 67.284212][ T6093] check_prev_add+0xeb/0xe60 [ 67.288528][ T6093] ? stack_trace_save+0x8e/0xc0 [ 67.290582][ T6093] __lock_acquire+0x1528/0x1f40 [ 67.292612][ T6093] ? kasan_save_track+0x14/0x30 [ 67.294546][ T6093] ? kasan_save_free_info+0x3b/0x70 [ 67.296703][ T6093] lock_acquire+0x1d1/0x380 [ 67.299810][ T6093] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 67.304324][ T6093] ? __pfx___might_resched+0x10/0x10 [ 67.306944][ T6093] __mutex_lock+0x1a4/0x1bd0 [ 67.309071][ T6093] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 67.311958][ T6093] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 67.314484][ T6093] ? __lock_acquire+0x5c0/0x1f40 [ 67.316927][ T6093] ? __pfx___mutex_lock+0x10/0x10 [ 67.318857][ T6093] ? make_vfsuid+0xec/0x140 [ 67.321266][ T6093] ? __pfx___might_resched+0x10/0x10 [ 67.323938][ T6093] ? make_vfsgid+0xf1/0x140 [ 67.326190][ T6093] ? uvcg_streaming_header_allow_link+0x7c/0x650 [ 67.330113][ T6093] ? security_inode_permission+0xbf/0x250 [ 67.333551][ T6093] uvcg_streaming_header_allow_link+0x7c/0x650 [ 67.336984][ T6093] ? inode_permission+0x374/0x620 [ 67.341075][ T6093] ? mntput_no_expire+0xe7/0x220 [ 67.344242][ T6093] configfs_symlink+0x695/0x1340 [ 67.346702][ T6093] ? bpf_lsm_inode_permission+0x9/0x10 [ 67.349114][ T6093] ? security_inode_permission+0xbf/0x250 [ 67.351603][ T6093] ? __pfx_configfs_symlink+0x10/0x10 [ 67.354198][ T6093] vfs_symlink+0x178/0x4d0 [ 67.356731][ T6093] filename_symlinkat+0x2a6/0x560 [ 67.359439][ T6093] ? __pfx_filename_symlinkat+0x10/0x10 [ 67.362370][ T6093] ? strncpy_from_user+0x19d/0x2d0 [ 67.365170][ T6093] ? do_getname+0x191/0x390 [ 67.367326][ T6093] __ia32_sys_symlinkat+0x9b/0xe0 [ 67.369620][ T6093] __do_fast_syscall_32+0x13a/0x8b0 [ 67.371907][ T6093] do_fast_syscall_32+0x32/0x70 [ 67.374017][ T6093] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 67.377022][ T6093] RIP: 0023:0xf7f13fec [ 67.380581][ T6093] Code: Unable to access opcode bytes at 0xf7f13fc2. [ 67.387209][ T6093] RSP: 002b:00000000f53d650c EFLAGS: 00000292 ORIG_RAX: 0000000000000130 [ 67.390976][ T6093] RAX: ffffffffffffffda RBX: 0000000080001500 RCX: 00000000ffffff9c [ 67.394461][ T6093] RDX: 0000000080001600 RSI: 0000000000000000 RDI: 0000000000000000 [ 67.397682][ T6093] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 67.401578][ T6093] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 67.404722][ T6093] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 67.408404][ T6093] [ 67.449228][ C3] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 67.449253][ C3] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 67.449373][ T5846] usb 6-1: USB disconnect, device number 2 [ 67.449459][ C3] cdc_wdm 6-1:1.0: nonzero urb status received: -71 [ 67.449480][ C3] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 67.449496][ C3] cdc_wdm 6-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 67.476129][ T6090] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 67.480735][ T6099] Bluetooth: MGMT ver 1.23 [ 67.509622][ T6091] team0: Port device xfrm0 added [ 71.482960][ T1437] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.483071][ T1437] ieee802154 phy1 wpan1: encryption failed: -22 [ 76.592408][ T9] cfg80211: failed to load regulatory.db