last executing test programs: 9.546845116s ago: executing program 0 (id=42): syz_emit_ethernet(0x96, &(0x7f00000005c0)={@broadcast, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "000308", 0x60, 0x3a, 0x0, @private1, @local, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "5b52ab", 0x0, 0x2b, 0x0, @private0, @private0, [@srh={0x11, 0x1ffffffffffffd4f, 0x4, 0x2, 0x8, 0x0, 0x4, [@private2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}]}, @dstopts={0x88}]}}}}}}}, 0x0) r0 = socket$tipc(0x1e, 0x5, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x8, 0x80000000) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r1, 0x84, 0x65, &(0x7f00000001c0)=[@in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in={0x2, 0x4e20, @loopback}, @in6={0xa, 0x4e21, 0x7, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x15}], 0x3c) setsockopt$TIPC_CONN_TIMEOUT(r0, 0x10f, 0x82, &(0x7f0000000080)=0x6, 0x4) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="5c0000000206010800000000000c000000000000050005000a000000050001000700000005000400000000000900020073797a310000000015000300686173683a69702c706f72742c6e6574"], 0x5c}}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) r4 = socket$netlink(0x10, 0x3, 0xc) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$IPSET_CMD_LIST(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x1c, 0x7, 0x6, 0x101, 0x0, 0x0, {0x3, 0x0, 0x9}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x80) 6.274810623s ago: executing program 3 (id=61): r0 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) openat$sndtimer(0xffffff9c, &(0x7f0000000000), 0x210201) socket$inet_udp(0x2, 0x2, 0x0) sync_file_range(r0, 0x9, 0x6, 0x6) r1 = socket$unix(0x1, 0x2, 0x0) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) writev(r2, &(0x7f0000000dc0)=[{&(0x7f0000000a00)="1b", 0x1}], 0x1) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0x8080c61) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, 0x0) rseq(0x0, 0x0, 0x2000000000000000, 0x0) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0x2049c0, 0x0) pipe2$watch_queue(&(0x7f0000002240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r6 = add_key$user(&(0x7f0000000100), 0x0, &(0x7f0000000180)="8e", 0x1, 0xffffffffffffffff) r7 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0x5ba8, 0xfffffffffffffffd) keyctl$KEYCTL_WATCH_KEY(0x20, r7, r4, 0x400000000000007c) r8 = add_key(&(0x7f0000000080)='big_key\x00', &(0x7f00000005c0)={'syz', 0x1}, &(0x7f0000000f80)='G', 0x1, 0xfffffffffffffffb) keyctl$KEYCTL_WATCH_KEY(0x20, r8, r5, 0x47) keyctl$KEYCTL_WATCH_KEY(0x20, r6, r5, 0xe1) close_range(r3, 0xffffffffffffffff, 0x0) sendmmsg$sock(r1, &(0x7f00000006c0)=[{{&(0x7f0000000080)=@ethernet={0x1, @random="27dce08e54bd"}, 0x80, &(0x7f0000000640)=[{&(0x7f00000001c0)="d7e87f99faecec7c0429d3a377972845f7e7501587da8de9e6c07644500a55b3044d2e75bb07cc7dec8f6dfa412c2bf947b514d25075e6c62c3f7224856262033861e80500968691306cfa4c83b02ea822b765b33ca482a7e70f2f74cbcc4fcbf39eaaf3950c2b06dc6c2e137ea192fd70b4e32f5787d87821c8565223191986eac38378a195f2a0f76e49aa8002a4ce7a8158400fd6427b9a37a8ce802ce343d55627db0587cc491c36a0", 0xab}, {&(0x7f0000000440)="e610bfce5ef4fba95b2a28f66a84b5a156664a56dde6c48206c73bb5b96990df481c83020e66e1355342a59393bc516b03f0c79700348451b07afbca15d15e22d6f3c04f11d57ab29705bfd2c2f3b25c9be5498b9bb0a824f959ab91fe77d6e03e14db7c5d40da2106c3c5fe427aafdf59092f6a2923213e6dc1dd87285a9c4a2d895ac0f1931465dbb29289a348abb40930049bad388f771410becf93cc1862f2d9d1438441961c64cc14df771777b5f41b48ee5d088a0e437413376f6218083429f688fa03e76bd8e6f3b2f5006e3b98591b516cdcc35e2be3629acafd1ecc4012479b9b10288860b26988f9", 0xed}, {&(0x7f0000000540)="767a5610a133317ed424ff13043978707db454b1ba50", 0x16}, {&(0x7f0000000580)="3d96a2138cc985241e7d7ede005cb7162ee8c7aa6ce6b9f65a3a079e73a929f25f32180f88387a23e77a4145edfc3bafa70a636d85c81c045e833f92ed574b301f0d8bcf0cd85bd10de112dcbb", 0x4d}], 0x4, &(0x7f0000000680)=[@timestamping={{0x10, 0x1, 0x25, 0x3}}, @mark={{0x10, 0x1, 0x24, 0x6}}], 0x20}}], 0x1, 0x4000000) 5.722635796s ago: executing program 3 (id=62): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x1f, {[@global=@item_012={0x2, 0x1, 0x9, "2313"}, @global=@item_012={0x2, 0x1, 0x0, "e53f"}, @global=@item_4={0x3, 0x1, 0x0, '\f\x00'}, @global=@item_4={0x3, 0x1, 0x0, "0900be00"}, @main=@item_4={0x3, 0x0, 0x8}, @local=@item_4={0x3, 0x2, 0x1, "09007a15"}, @local=@item_4={0x3, 0x2, 0x0, "5d8c3dda"}]}}, 0x0}, 0x0) 5.271552187s ago: executing program 0 (id=63): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000280)={0x58, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0xfffc}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x17}, @IPSET_ATTR_NETMASK={0x5, 0x14, 0xa}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x400040c0}, 0x8000000) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)={r0}) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="12011f00abbe6740e9174e8b089c000000010902120001000000000904000000ff"], 0x0) syz_usb_control_io(0xffffffffffffffff, &(0x7f0000000340)={0x2c, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0xf, 0x22, {0x5, 0xf, 0x22, 0x4, [@generic={0x3}, @wireless={0xb, 0x10, 0x1, 0x0, 0x0, 0x5d, 0x0, 0x4}, @generic={0x3}, @ssp_cap={0xc, 0x10, 0xa, 0x7}]}}, 0x0, 0x0}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000340)={0x2c, &(0x7f00000001c0)=ANY=[@ANYBLOB="201006000000065f01"], 0x0, 0x0, 0x0, 0x0}, 0x0) 5.202543718s ago: executing program 1 (id=64): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$FS_IOC_GETFSLABEL(r1, 0x81009431, &(0x7f0000000900)) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, 0x0, 0x0) write$dsp(r0, &(0x7f00000001c0)="5cba", 0x2) ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0) r5 = syz_open_dev$sndpcmc(0x0, 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r5, 0xc2604111, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) close(0x3) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000400), 0x0) sendmsg$NL80211_CMD_DEL_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x800}, 0x40) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4000000000000007910900000000000620000000000000095000000000000009e574bffff1729aba9b39a58e3cd8757e44cf3611b8e327a0279acba1f7791408d1efa421239728e2e5cc319b58520609dfd4a1a021d000000000000efffff75c3d894d99aef659f8b0000c515d8c219fbd9da31fc3ce3e9a2653000aec385a84a3d3f466bba30ac1486a70037fb03adef1a427fb0f4cb3072182da7c30000000000000000000000000000000000000000000000000000297e9fed660213ecb576987ad0972f18fbb7c9ecc03901f028b15b30ecf3205f90c9684ddc80d13bf37afc00e5efd686e6fb5ef4ee00b66126f773434a5c0d2ad3526bc484a6b94396117615f78f97637d8f8838aa75efb657ddafb15b88d97e47731cc3f55ce4e6a42562e6fb1f0000003030249c350044b09c36d10549a5949ff21418f1517508fb13540a82b5030cd9bb1bb066ca833c1fef6cefa28543ee520e46a3e96aca0d5a5f8cb34ad9c54c3a9a698f835bb83bcfd81ac5cfa18ce0740717994b5152cd0fa735433e50dccee16a208245b4366d44bb7ebd169b9e3a66d0cb29291a50f642ae4cb007540c806cd1cf88fdcaa393d1e1a697649401a802b474e374c767cb1ce52fd917d6af3de547be8429540de37f868a7f25d47c4b710836436008d4e8c8b42aeee84629d06d75ef09e0260b41de1f750480e492b6822d6275b7ccda1141707069cdb21de7a98dc37efdd806cc3619ad0659998bdd90b008c1"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x94) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) 4.172547452s ago: executing program 2 (id=65): openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000004002, 0x0) socket(0x400000000010, 0x3, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000640)=@newtfilter={0x50, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {}, {0x7, 0x10}}, [@filter_kind_options=@f_flow={{0x9}, {0x20, 0x2, [@TCA_FLOW_EMATCHES={0x1c, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1e7}}, @TCA_EMATCH_TREE_LIST={0x10, 0x2, 0x0, 0x1, [@TCF_EM_CONTAINER={0xc, 0x1, 0x0, 0x0, {{0xe6a7}}}]}]}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x20048084}, 0x0) 4.126848444s ago: executing program 1 (id=66): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000440)=@file={0x0, './bus\x00'}, 0x6e) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, 0x0, 0x10, &(0x7f0000000140)) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/acpi/devices/PNP0C0F:00/status\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)) read(r1, &(0x7f00000002c0)=""/10, 0x5b) openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x12) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, 0x0, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x44, &(0x7f0000000040)={0x0, 0x0}, 0x10) 3.917716748s ago: executing program 2 (id=67): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r1, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x5, 0xc}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x5fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r2, 0x0, 0x0) 3.699000754s ago: executing program 1 (id=68): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25cfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f00000002c0), 0x4) r7 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r7, 0x0, 0x8080) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000300)=@xdp={0x2c, 0x0, r6, 0x3d}, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0x26}], 0x1}, 0x0) 3.506755948s ago: executing program 2 (id=69): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket(0x40000000015, 0x5, 0x0) connect$inet(r3, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r3, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{}, 0x0, 0x0}, 0x20) sendmsg$NL80211_CMD_JOIN_MESH(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[], 0x1a000}}, 0x0) 3.373817221s ago: executing program 0 (id=70): syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) openat$sndtimer(0xffffff9c, &(0x7f0000000000), 0x210201) r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_buf(r0, 0x0, 0x30, &(0x7f0000000340)=""/225, &(0x7f0000000180)=0xe1) r1 = socket$unix(0x1, 0x2, 0x0) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) writev(r2, &(0x7f0000000dc0)=[{&(0x7f0000000a00)="1b", 0x1}], 0x1) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0x8080c61) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, 0x0) rseq(0x0, 0x0, 0x2000000000000000, 0x0) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0x2049c0, 0x0) pipe2$watch_queue(&(0x7f0000002240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r6 = add_key$user(&(0x7f0000000100), 0x0, &(0x7f0000000180)="8e", 0x1, 0xffffffffffffffff) r7 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0x5ba8, 0xfffffffffffffffd) keyctl$KEYCTL_WATCH_KEY(0x20, r7, r4, 0x400000000000007c) r8 = add_key(&(0x7f0000000080)='big_key\x00', &(0x7f00000005c0)={'syz', 0x1}, &(0x7f0000000f80)='G', 0x1, 0xfffffffffffffffb) keyctl$KEYCTL_WATCH_KEY(0x20, r8, r5, 0x47) keyctl$KEYCTL_WATCH_KEY(0x20, r6, r5, 0xe1) close_range(r3, 0xffffffffffffffff, 0x0) sendmmsg$sock(r1, &(0x7f00000006c0)=[{{&(0x7f0000000080)=@ethernet={0x1, @random="27dce08e54bd"}, 0x80, &(0x7f0000000640)=[{&(0x7f00000001c0)="d7e87f99faecec7c0429d3a377972845f7e7501587da8de9e6c07644500a55b3044d2e75bb07cc7dec8f6dfa412c2bf947b514d25075e6c62c3f7224856262033861e80500968691306cfa4c83b02ea822b765b33ca482a7e70f2f74cbcc4fcbf39eaaf3950c2b06dc6c2e137ea192fd70b4e32f5787d87821c8565223191986eac38378a195f2a0f76e49aa8002a4ce7a8158400fd6427b9a37a8ce802ce343d55627db0587cc491c36a0", 0xab}, {&(0x7f0000000440)="e610bfce5ef4fba95b2a28f66a84b5a156664a56dde6c48206c73bb5b96990df481c83020e66e1355342a59393bc516b03f0c79700348451b07afbca15d15e22d6f3c04f11d57ab29705bfd2c2f3b25c9be5498b9bb0a824f959ab91fe77d6e03e14db7c5d40da2106c3c5fe427aafdf59092f6a2923213e6dc1dd87285a9c4a2d895ac0f1931465dbb29289a348abb40930049bad388f771410becf93cc1862f2d9d1438441961c64cc14df771777b5f41b48ee5d088a0e437413376f6218083429f688fa03e76bd8e6f3b2f5006e3b98591b516cdcc35e2be3629acafd1ecc4012479b9b10288860b26988f9", 0xed}, {&(0x7f0000000540)="767a5610a133317ed424ff13043978707db454b1ba50", 0x16}, {&(0x7f0000000580)="3d96a2138cc985241e7d7ede005cb7162ee8c7aa6ce6b9f65a3a079e73a929f25f32180f88387a23e77a4145edfc3bafa70a636d85c81c045e833f92ed574b301f0d8bcf0cd85bd10de112dcbb", 0x4d}], 0x4, &(0x7f0000000680)=[@timestamping={{0x10, 0x1, 0x25, 0x3}}, @mark={{0x10, 0x1, 0x24, 0x6}}], 0x20}}], 0x1, 0x4000000) 3.220943865s ago: executing program 0 (id=71): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6) ftruncate(r0, 0x200000) pwrite64(r0, &(0x7f0000000100)="0000010042", 0x5, 0x1be) pwrite64(r0, &(0x7f0000000100)="55aa", 0x2, 0x1fe) pwrite64(r0, &(0x7f0000000100)='PRIVHEAD', 0x8, 0xc00) pwrite64(r0, &(0x7f0000000100)="0002000b", 0x4, 0xc0c) pwrite64(r0, &(0x7f0000000100)='12345678-1234-1234-1234-123456789612', 0x24, 0xc30) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00', 0x4, 0xd23) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\b', 0x7, 0xd2b) pwrite64(r0, &(0x7f0000000100)='PRIVHEAD', 0x8, 0x1e8000) pwrite64(r0, &(0x7f0000000100)="0002000b", 0x4, 0x1e800c) pwrite64(r0, &(0x7f0000000100)='12345678-1234-1234-1234-123456789612', 0x24, 0x1e8030) pwrite64(r0, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\a', 0x7, 0x1e8123) pwrite64(r0, &(0x7f00000000c0)="da", 0x1, 0x1e812b) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', '\x00', '\x00', [0x0, 0x3]}) 3.203702565s ago: executing program 1 (id=72): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, 0x0) ioctl$FS_IOC_GETFSLABEL(r1, 0x81009431, &(0x7f0000000900)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, 0x0, 0x0) write$dsp(r0, &(0x7f00000001c0), 0x0) r4 = syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r4, 0xc2604111, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='blkio.bfq.empty_time\x00', 0x26e1, 0x0) close(0x3) r6 = socket$inet_tcp(0x2, 0x1, 0x6) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet_tcp_buf(r6, 0x6, 0x1f, &(0x7f0000000400)='espintcp', 0x8) sendmsg$NL80211_CMD_DEL_INTERFACE(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x800}, 0x40) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4000000000000007910900000000000620000000000000095000000000000009e574bffff1729aba9b39a58e3cd8757e44cf3611b8e327a0279acba1f7791408d1efa421239728e2e5cc319b58520609dfd4a1a021d000000000000efffff75c3d894d99aef659f8b0000c515d8c219fbd9da31fc3ce3e9a2653000aec385a84a3d3f466bba30ac1486a70037fb03adef1a427fb0f4cb3072182da7c30000000000000000000000000000000000000000000000000000297e9fed660213ecb576987ad0972f18fbb7c9ecc03901f028b15b30ecf3205f90c9684ddc80d13bf37afc00e5efd686e6fb5ef4ee00b66126f773434a5c0d2ad3526bc484a6b94396117615f78f97637d8f8838aa75efb657ddafb15b88d97e47731cc3f55ce4e6a42562e6fb1f0000003030249c350044b09c36d10549a5949ff21418f1517508fb13540a82b5030cd9bb1bb066ca833c1fef6cefa28543ee520e46a3e96aca0d5a5f8cb34ad9c54c3a9a698f835bb83bcfd81ac5cfa18ce0740717994b5152cd0fa735433e50dccee16a208245b4366d44bb7ebd169b9e3a66d0cb29291a50f642ae4cb007540c806cd1cf88fdcaa393d1e1a697649401a802b474e374c767cb1ce52fd917d6af3de547be8429540de37f868a7f25d47c4b710836436008d4e8c8b42aeee84629d06d75ef09e0260b41de1f750480e492b6822d6275b7ccda1141707069cdb21de7a98dc37efdd806cc3619ad0659998bdd90b008c1"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x94) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) 2.494601612s ago: executing program 3 (id=73): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, 0x0, 0x0) 2.374585365s ago: executing program 2 (id=74): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$FS_IOC_GETFSLABEL(r1, 0x81009431, &(0x7f0000000900)) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, 0x0, 0x0) write$dsp(r0, &(0x7f00000001c0)="5cba", 0x2) ioctl$SNDCTL_DSP_SYNC(r0, 0x5001, 0x0) r5 = syz_open_dev$sndpcmc(0x0, 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r5, 0xc2604111, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) close(0x3) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000400), 0x0) sendmsg$NL80211_CMD_DEL_INTERFACE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x800}, 0x40) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4000000000000007910900000000000620000000000000095000000000000009e574bffff1729aba9b39a58e3cd8757e44cf3611b8e327a0279acba1f7791408d1efa421239728e2e5cc319b58520609dfd4a1a021d000000000000efffff75c3d894d99aef659f8b0000c515d8c219fbd9da31fc3ce3e9a2653000aec385a84a3d3f466bba30ac1486a70037fb03adef1a427fb0f4cb3072182da7c30000000000000000000000000000000000000000000000000000297e9fed660213ecb576987ad0972f18fbb7c9ecc03901f028b15b30ecf3205f90c9684ddc80d13bf37afc00e5efd686e6fb5ef4ee00b66126f773434a5c0d2ad3526bc484a6b94396117615f78f97637d8f8838aa75efb657ddafb15b88d97e47731cc3f55ce4e6a42562e6fb1f0000003030249c350044b09c36d10549a5949ff21418f1517508fb13540a82b5030cd9bb1bb066ca833c1fef6cefa28543ee520e46a3e96aca0d5a5f8cb34ad9c54c3a9a698f835bb83bcfd81ac5cfa18ce0740717994b5152cd0fa735433e50dccee16a208245b4366d44bb7ebd169b9e3a66d0cb29291a50f642ae4cb007540c806cd1cf88fdcaa393d1e1a697649401a802b474e374c767cb1ce52fd917d6af3de547be8429540de37f868a7f25d47c4b710836436008d4e8c8b42aeee84629d06d75ef09e0260b41de1f750480e492b6822d6275b7ccda1141707069cdb21de7a98dc37efdd806cc3619ad0659998bdd90b008c1"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x94) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) 1.547490734s ago: executing program 1 (id=75): openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000004002, 0x0) socket(0x400000000010, 0x3, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000640)=@newtfilter={0x50, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {}, {0x7, 0x10}}, [@filter_kind_options=@f_flow={{0x9}, {0x20, 0x2, [@TCA_FLOW_EMATCHES={0x1c, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1e7}}, @TCA_EMATCH_TREE_LIST={0x10, 0x2, 0x0, 0x1, [@TCF_EM_CONTAINER={0xc, 0x1, 0x0, 0x0, {{0xe6a7}}}]}]}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x20048084}, 0x0) 1.490667395s ago: executing program 3 (id=76): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000440)=@file={0x0, './bus\x00'}, 0x6e) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, 0x0, 0x10, &(0x7f0000000140)) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/acpi/devices/PNP0C0F:00/status\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)) read(r1, &(0x7f00000002c0)=""/10, 0x5b) openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x12) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, 0x0, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x44, &(0x7f0000000040)={0x0, 0x0}, 0x10) 1.489555575s ago: executing program 0 (id=77): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r1, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x5, 0xc}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x5fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x0) 387.390241ms ago: executing program 3 (id=78): r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0102, 0x0) write$vga_arbiter(r0, &(0x7f0000000280)=ANY=[@ANYBLOB='lock io'], 0xc) write$vga_arbiter(r0, &(0x7f0000000500)=ANY=[@ANYBLOB], 0x3c) close_range(r0, 0xffffffffffffffff, 0x0) 305.927283ms ago: executing program 2 (id=79): syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) openat$sndtimer(0xffffff9c, &(0x7f0000000000), 0x210201) r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_buf(r0, 0x0, 0x30, &(0x7f0000000340)=""/225, &(0x7f0000000180)=0xe1) r1 = socket$unix(0x1, 0x2, 0x0) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) writev(r2, &(0x7f0000000dc0)=[{&(0x7f0000000a00)="1b", 0x1}], 0x1) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0x8080c61) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, 0x0) rseq(0x0, 0x0, 0x2000000000000000, 0x0) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0x2049c0, 0x0) pipe2$watch_queue(&(0x7f0000002240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r6 = add_key$user(&(0x7f0000000100), 0x0, &(0x7f0000000180)="8e", 0x1, 0xffffffffffffffff) r7 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0x5ba8, 0xfffffffffffffffd) keyctl$KEYCTL_WATCH_KEY(0x20, r7, r4, 0x400000000000007c) r8 = add_key(&(0x7f0000000080)='big_key\x00', &(0x7f00000005c0)={'syz', 0x1}, &(0x7f0000000f80)='G', 0x1, 0xfffffffffffffffb) keyctl$KEYCTL_WATCH_KEY(0x20, r8, r5, 0x47) keyctl$KEYCTL_WATCH_KEY(0x20, r6, r5, 0xe1) close_range(r3, 0xffffffffffffffff, 0x0) sendmmsg$sock(r1, &(0x7f00000006c0)=[{{&(0x7f0000000080)=@ethernet={0x1, @random="27dce08e54bd"}, 0x80, &(0x7f0000000640)=[{&(0x7f00000001c0)="d7e87f99faecec7c0429d3a377972845f7e7501587da8de9e6c07644500a55b3044d2e75bb07cc7dec8f6dfa412c2bf947b514d25075e6c62c3f7224856262033861e80500968691306cfa4c83b02ea822b765b33ca482a7e70f2f74cbcc4fcbf39eaaf3950c2b06dc6c2e137ea192fd70b4e32f5787d87821c8565223191986eac38378a195f2a0f76e49aa8002a4ce7a8158400fd6427b9a37a8ce802ce343d55627db0587cc491c36a0", 0xab}, {&(0x7f0000000440)="e610bfce5ef4fba95b2a28f66a84b5a156664a56dde6c48206c73bb5b96990df481c83020e66e1355342a59393bc516b03f0c79700348451b07afbca15d15e22d6f3c04f11d57ab29705bfd2c2f3b25c9be5498b9bb0a824f959ab91fe77d6e03e14db7c5d40da2106c3c5fe427aafdf59092f6a2923213e6dc1dd87285a9c4a2d895ac0f1931465dbb29289a348abb40930049bad388f771410becf93cc1862f2d9d1438441961c64cc14df771777b5f41b48ee5d088a0e437413376f6218083429f688fa03e76bd8e6f3b2f5006e3b98591b516cdcc35e2be3629acafd1ecc4012479b9b10288860b26988f9", 0xed}, {&(0x7f0000000540)="767a5610a133317ed424ff13043978707db454b1ba50", 0x16}, {&(0x7f0000000580)="3d96a2138cc985241e7d7ede005cb7162ee8c7aa6ce6b9f65a3a079e73a929f25f32180f88387a23e77a4145edfc3bafa70a636d85c81c045e833f92ed574b301f0d8bcf0cd85bd10de112dcbb", 0x4d}], 0x4, &(0x7f0000000680)=[@timestamping={{0x10, 0x1, 0x25, 0x3}}, @mark={{0x10, 0x1, 0x24, 0x6}}], 0x20}}], 0x1, 0x4000000) 294.910783ms ago: executing program 1 (id=80): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25cfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f00000002c0), 0x4) r7 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r7, 0x0, 0x8080) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000300)=@xdp={0x2c, 0x0, r6, 0x3d}, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0x26}], 0x1}, 0x0) 219.398425ms ago: executing program 3 (id=81): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000400)=ANY=[@ANYBLOB="1400000010000100f7000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc08000340000000144c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a3100000000200003801c0000800c00018006000100d10300000c000440000000000000000114000000110001"], 0xb8}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="2c0100000d0a010800000000000000000a0000010900020073797a31000000000900010073797a310000000000010380fc0000800c00018006000100ff"], 0x12c}, 0x1, 0x0, 0x0, 0x4048885}, 0x8000) 38.811129ms ago: executing program 0 (id=82): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket(0x40000000015, 0x5, 0x0) connect$inet(r3, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r3, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{}, 0x0, 0x0}, 0x20) sendmsg$NL80211_CMD_JOIN_MESH(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[], 0x1a000}}, 0x0) 0s ago: executing program 2 (id=83): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, 0x0) ioctl$FS_IOC_GETFSLABEL(r1, 0x81009431, &(0x7f0000000900)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, 0x0, 0x0) write$dsp(r0, &(0x7f00000001c0)='\\', 0x1) r4 = syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r4, 0xc2604111, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='blkio.bfq.empty_time\x00', 0x26e1, 0x0) close(0x3) r6 = socket$inet_tcp(0x2, 0x1, 0x6) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet_tcp_buf(r6, 0x6, 0x1f, &(0x7f0000000400)='espintcp', 0x8) sendmsg$NL80211_CMD_DEL_INTERFACE(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x800}, 0x40) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4000000000000007910900000000000620000000000000095000000000000009e574bffff1729aba9b39a58e3cd8757e44cf3611b8e327a0279acba1f7791408d1efa421239728e2e5cc319b58520609dfd4a1a021d000000000000efffff75c3d894d99aef659f8b0000c515d8c219fbd9da31fc3ce3e9a2653000aec385a84a3d3f466bba30ac1486a70037fb03adef1a427fb0f4cb3072182da7c30000000000000000000000000000000000000000000000000000297e9fed660213ecb576987ad0972f18fbb7c9ecc03901f028b15b30ecf3205f90c9684ddc80d13bf37afc00e5efd686e6fb5ef4ee00b66126f773434a5c0d2ad3526bc484a6b94396117615f78f97637d8f8838aa75efb657ddafb15b88d97e47731cc3f55ce4e6a42562e6fb1f0000003030249c350044b09c36d10549a5949ff21418f1517508fb13540a82b5030cd9bb1bb066ca833c1fef6cefa28543ee520e46a3e96aca0d5a5f8cb34ad9c54c3a9a698f835bb83bcfd81ac5cfa18ce0740717994b5152cd0fa735433e50dccee16a208245b4366d44bb7ebd169b9e3a66d0cb29291a50f642ae4cb007540c806cd1cf88fdcaa393d1e1a697649401a802b474e374c767cb1ce52fd917d6af3de547be8429540de37f868a7f25d47c4b710836436008d4e8c8b42aeee84629d06d75ef09e0260b41de1f750480e492b6822d6275b7ccda1141707069cdb21de7a98dc37efdd806cc3619ad0659998bdd90b008c1"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x94) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.9' (ED25519) to the list of known hosts. syzkaller login: [ 77.435603][ T5763] cgroup: Unknown subsys name 'net' [ 77.600660][ T5763] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 79.386807][ T5763] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 81.054494][ T5782] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 81.065130][ T5792] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 81.073391][ T5792] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 81.074043][ T5782] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 81.088469][ T5791] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 81.093219][ T5790] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 81.104201][ T5782] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 81.113632][ T5790] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 81.121387][ T5782] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 81.123498][ T5791] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 81.128859][ T5790] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 81.143973][ T5782] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 81.152578][ T5790] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 81.153233][ T5792] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 81.160939][ T5790] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 81.168225][ T5792] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 81.173846][ T5782] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 81.188345][ T5792] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 81.188373][ T5790] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 81.205014][ T51] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 81.217844][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 81.225248][ T5782] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 81.238709][ T51] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 81.251946][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 81.700947][ T5777] chnl_net:caif_netlink_parms(): no params data found [ 81.760938][ T5775] chnl_net:caif_netlink_parms(): no params data found [ 81.786042][ T5774] chnl_net:caif_netlink_parms(): no params data found [ 81.832811][ T5776] chnl_net:caif_netlink_parms(): no params data found [ 81.964739][ T5777] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.978258][ T5777] bridge0: port 1(bridge_slave_0) entered disabled state [ 81.986012][ T5777] bridge_slave_0: entered allmulticast mode [ 81.999278][ T5777] bridge_slave_0: entered promiscuous mode [ 82.010294][ T5777] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.022803][ T5777] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.030353][ T5777] bridge_slave_1: entered allmulticast mode [ 82.043810][ T5777] bridge_slave_1: entered promiscuous mode [ 82.271305][ T5775] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.279712][ T5775] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.292503][ T5775] bridge_slave_0: entered allmulticast mode [ 82.300250][ T5775] bridge_slave_0: entered promiscuous mode [ 82.315344][ T5775] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.322514][ T5775] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.335353][ T5775] bridge_slave_1: entered allmulticast mode [ 82.346268][ T5775] bridge_slave_1: entered promiscuous mode [ 82.361894][ T5776] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.369615][ T5776] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.383349][ T5776] bridge_slave_0: entered allmulticast mode [ 82.390832][ T5776] bridge_slave_0: entered promiscuous mode [ 82.410980][ T5777] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.421702][ T5774] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.430758][ T5774] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.439746][ T5774] bridge_slave_0: entered allmulticast mode [ 82.446793][ T5774] bridge_slave_0: entered promiscuous mode [ 82.464929][ T5774] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.472146][ T5774] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.482185][ T5774] bridge_slave_1: entered allmulticast mode [ 82.489196][ T5774] bridge_slave_1: entered promiscuous mode [ 82.496948][ T5776] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.504174][ T5776] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.511522][ T5776] bridge_slave_1: entered allmulticast mode [ 82.518999][ T5776] bridge_slave_1: entered promiscuous mode [ 82.528155][ T5777] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.578055][ T5775] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.612342][ T5774] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.634358][ T5775] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.661090][ T5776] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 82.673922][ T5774] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.697266][ T5777] team0: Port device team_slave_0 added [ 82.718072][ T5776] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 82.740136][ T5777] team0: Port device team_slave_1 added [ 82.751348][ T5775] team0: Port device team_slave_0 added [ 82.773903][ T5774] team0: Port device team_slave_0 added [ 82.792326][ T5775] team0: Port device team_slave_1 added [ 82.808791][ T5774] team0: Port device team_slave_1 added [ 82.831699][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.838884][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.865230][ T5777] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 82.890405][ T5776] team0: Port device team_slave_0 added [ 82.899514][ T5776] team0: Port device team_slave_1 added [ 82.918603][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 82.925730][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 82.952099][ T5777] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 82.990211][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 82.997298][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.024041][ T5775] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.049098][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.056191][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.082553][ T5774] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.095554][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.102517][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.128781][ T5774] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.148638][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.155895][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.181951][ T5775] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.207908][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.216409][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.223855][ T5789] Bluetooth: hci3: command tx timeout [ 83.243016][ T51] Bluetooth: hci1: command tx timeout [ 83.253311][ T5776] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.255913][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.271126][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.297469][ T5776] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.302997][ T51] Bluetooth: hci2: command tx timeout [ 83.314243][ T5789] Bluetooth: hci0: command tx timeout [ 83.349046][ T5777] hsr_slave_0: entered promiscuous mode [ 83.355462][ T5777] hsr_slave_1: entered promiscuous mode [ 83.399429][ T5775] hsr_slave_0: entered promiscuous mode [ 83.406234][ T5775] hsr_slave_1: entered promiscuous mode [ 83.412387][ T5775] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 83.420282][ T5775] Cannot create hsr debugfs directory [ 83.465092][ T5776] hsr_slave_0: entered promiscuous mode [ 83.472227][ T5776] hsr_slave_1: entered promiscuous mode [ 83.479513][ T5776] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 83.487239][ T5776] Cannot create hsr debugfs directory [ 83.499509][ T5774] hsr_slave_0: entered promiscuous mode [ 83.506231][ T5774] hsr_slave_1: entered promiscuous mode [ 83.512306][ T5774] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 83.520608][ T5774] Cannot create hsr debugfs directory [ 83.976626][ T5777] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 83.998529][ T5777] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 84.008106][ T5777] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 84.019560][ T5777] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 84.077716][ T5775] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 84.097605][ T5775] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 84.114381][ T5775] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 84.137825][ T5775] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 84.191701][ T5776] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 84.209394][ T5776] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 84.220865][ T5776] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 84.255676][ T5776] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 84.334934][ T5774] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 84.361497][ T5774] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 84.372739][ T5774] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 84.397754][ T5774] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 84.442808][ T5777] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.469202][ T5777] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.497572][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.505096][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.531895][ T5775] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.545952][ T3454] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.553140][ T3454] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.596886][ T5775] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.657604][ T3454] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.664829][ T3454] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.693816][ T3454] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.700983][ T3454] bridge0: port 2(bridge_slave_1) entered forwarding state [ 84.796576][ T5776] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.878149][ T5776] 8021q: adding VLAN 0 to HW filter on device team0 [ 84.891814][ T5774] 8021q: adding VLAN 0 to HW filter on device bond0 [ 84.925847][ T5775] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 84.942056][ T5775] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 84.960302][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.967454][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 84.995007][ T3433] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.002139][ T3433] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.037612][ T5774] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.086782][ T751] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.094021][ T751] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.137490][ T751] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.144717][ T751] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.245661][ T5777] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 85.303454][ T51] Bluetooth: hci1: command tx timeout [ 85.308972][ T5789] Bluetooth: hci3: command tx timeout [ 85.341022][ T5774] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 85.383481][ T51] Bluetooth: hci0: command tx timeout [ 85.389029][ T5789] Bluetooth: hci2: command tx timeout [ 85.421723][ T5777] veth0_vlan: entered promiscuous mode [ 85.462711][ T5777] veth1_vlan: entered promiscuous mode [ 85.507051][ T5775] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 85.565687][ T5777] veth0_macvtap: entered promiscuous mode [ 85.594981][ T5775] veth0_vlan: entered promiscuous mode [ 85.605759][ T5777] veth1_macvtap: entered promiscuous mode [ 85.638909][ T5775] veth1_vlan: entered promiscuous mode [ 85.680859][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 85.705825][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 85.743870][ T5777] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.763413][ T5777] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.783406][ T5777] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.792173][ T5777] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.847992][ T5775] veth0_macvtap: entered promiscuous mode [ 85.881965][ T5775] veth1_macvtap: entered promiscuous mode [ 85.952620][ T1146] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 85.956529][ T5774] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 85.968724][ T1146] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 85.987539][ T5776] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.037170][ T1146] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.038648][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 86.045436][ T1146] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.069139][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.080682][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 86.092765][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 86.106655][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.117783][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 86.148320][ T5775] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.157797][ T5775] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.167533][ T5775] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.176371][ T5775] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.391345][ T5774] veth0_vlan: entered promiscuous mode [ 86.431980][ T751] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.441812][ T751] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.452261][ T5776] veth0_vlan: entered promiscuous mode [ 86.465475][ T5774] veth1_vlan: entered promiscuous mode [ 86.482360][ T5776] veth1_vlan: entered promiscuous mode [ 86.540391][ T751] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.549331][ T751] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.596615][ T5774] veth0_macvtap: entered promiscuous mode [ 86.610365][ T5776] veth0_macvtap: entered promiscuous mode [ 86.625743][ T5774] veth1_macvtap: entered promiscuous mode [ 86.673959][ T9] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 86.685547][ T5776] veth1_macvtap: entered promiscuous mode [ 86.707707][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 86.723137][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.736008][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 86.747628][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.760167][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 86.791279][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 86.802697][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.819138][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 86.838896][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.851325][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 86.862206][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 86.874849][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.886933][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 86.900909][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.911695][ T5851] ip6_tunnel: non-ECT from fc01:0000:0000:0000:0000:0000:0000:0001 with DS=0x4f [ 86.913881][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 86.937421][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 86.937896][ T9] usb 2-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 86.949384][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 86.967233][ T9] usb 2-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 86.971935][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 86.988823][ T9] usb 2-1: Product: syz [ 86.995063][ T9] usb 2-1: SerialNumber: syz [ 87.005559][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.013355][ T9] usb 2-1: config 0 descriptor?? [ 87.020940][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 87.032180][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.042315][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 87.053276][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.067088][ T972] cfg80211: failed to load regulatory.db [ 87.075176][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.098026][ T5776] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.107246][ T5776] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.123600][ T5776] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.132401][ T5776] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.145895][ T5774] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.159239][ T5774] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.168347][ T5774] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.178487][ T5774] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.257708][ T8] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 87.339442][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.351958][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.385638][ T5789] Bluetooth: hci3: command tx timeout [ 87.391478][ T5789] Bluetooth: hci1: command tx timeout [ 87.397223][ T1146] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.406676][ T1146] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.453806][ T8] usb 1-1: Using ep0 maxpacket: 16 [ 87.464510][ T51] Bluetooth: hci0: command tx timeout [ 87.470133][ T5789] Bluetooth: hci2: command tx timeout [ 87.476234][ T8] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 87.492659][ T8] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 87.496171][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.512006][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.524035][ T5823] usb 2-1: USB disconnect, device number 2 [ 87.541587][ T8] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 87.574684][ T8] usb 1-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 87.584968][ T8] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 87.610288][ T1146] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 87.617915][ T8] usb 1-1: config 0 descriptor?? [ 87.621779][ T1146] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 87.960090][ T5856] fuse: Invalid rootmode [ 88.073786][ T5859] syzkaller0: entered promiscuous mode [ 88.085002][ T5859] syzkaller0: entered allmulticast mode [ 88.144975][ T8] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 88.171029][ T8] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 88.191606][ T8] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 88.219969][ T8] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 88.230501][ T8] microsoft 0003:045E:07DA.0001: unknown main item tag 0x0 [ 88.280751][ T8] input: HID 045e:07da as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:045E:07DA.0001/input/input5 [ 88.394816][ T8] microsoft 0003:045E:07DA.0001: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.0-1/input0 [ 88.546566][ T5868] loop4: detected capacity change from 0 to 7 [ 88.594497][ T5868] Dev loop4: unable to read RDB block 7 [ 88.621509][ T5868] loop4: unable to read partition table [ 88.660005][ T5868] loop4: partition table beyond EOD, truncated [ 88.706783][ T5868] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 88.772231][ T5142] Dev loop4: unable to read RDB block 7 [ 88.787963][ T5142] loop4: unable to read partition table [ 88.797440][ T5142] loop4: partition table beyond EOD, truncated [ 89.106592][ T5871] syz.3.9[5871]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 89.187919][ T5871] process 'syz.3.9' launched '/dev/fd/3' with NULL argv: empty string added [ 89.256293][ T5872] input: syz1 as /devices/virtual/input/input6 [ 89.356083][ T5875] Zero length message leads to an empty skb [ 89.466991][ T5789] Bluetooth: hci1: command tx timeout [ 89.472469][ T5789] Bluetooth: hci3: command tx timeout [ 89.545352][ T51] Bluetooth: hci0: command tx timeout [ 89.551514][ T5789] Bluetooth: hci2: command tx timeout [ 89.670942][ T5823] usb 1-1: USB disconnect, device number 2 [ 89.966782][ T5886] fuse: Bad value for 'rootmode' [ 90.147219][ T5887] tipc: Enabling of bearer rejected, failed to enable media [ 90.178663][ T5892] syzkaller0: entered promiscuous mode [ 90.198837][ T5892] syzkaller0: entered allmulticast mode [ 90.220116][ T5896] loop4: detected capacity change from 0 to 7 [ 90.232145][ T5896] Dev loop4: unable to read RDB block 7 [ 90.242184][ T5896] loop4: unable to read partition table [ 90.253273][ T5896] loop4: partition table beyond EOD, truncated [ 90.272400][ T5896] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 91.031054][ T5914] fuse: Bad value for 'rootmode' [ 91.802677][ T5922] syzkaller0: entered promiscuous mode [ 91.862607][ T5922] syzkaller0: entered allmulticast mode [ 92.809275][ T5947] fuse: Bad value for 'rootmode' [ 94.218940][ T5958] netlink: 12 bytes leftover after parsing attributes in process `syz.0.42'. [ 94.317952][ T5960] syzkaller0: entered promiscuous mode [ 94.331037][ T5960] syzkaller0: entered allmulticast mode [ 96.927666][ T6000] syzkaller0: entered promiscuous mode [ 96.936787][ T6000] syzkaller0: entered allmulticast mode [ 97.191217][ T9] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 97.434290][ T9] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 97.504767][ T9] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9374, bcdDevice=bc.3b [ 97.595049][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 97.776187][ T9] usb 3-1: config 0 descriptor?? [ 98.333737][ T9] ath6kl: Unsupported hardware version: 0x0 [ 98.378734][ T9] ath6kl: Failed to init ath6kl core: -22 [ 98.403762][ T9] ath6kl_usb: probe of 3-1:0.0 failed with error -22 [ 98.595485][ T5823] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 98.675491][ T28] usb 3-1: USB disconnect, device number 2 [ 98.681918][ T5781] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 98.843304][ T5823] usb 4-1: Using ep0 maxpacket: 16 [ 98.890832][ T5823] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 98.951995][ T5781] usb 1-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 98.978286][ T5823] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 99.004917][ T5781] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 99.033813][ T5823] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 99.111114][ T5781] usb 1-1: config 0 descriptor?? [ 99.149519][ T5823] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 99.282405][ T5823] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 99.363912][ T5823] usb 4-1: config 0 descriptor?? [ 99.381341][ T5781] [drm] vendor descriptor length:6 data:06 5f 01 00 04 03 00 00 00 00 00 [ 99.740068][ T5781] [drm:udl_init] *ERROR* Selecting channel failed [ 99.901441][ T5781] [drm] Initialized udl 0.0.1 20120220 for 1-1:0.0 on minor 2 [ 99.909107][ T5781] [drm] Initialized udl on minor 2 [ 99.918069][ T5781] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 99.931395][ T5781] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 99.942042][ T5822] udl 1-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 99.956512][ T5781] usb 1-1: USB disconnect, device number 3 [ 99.973959][ T5822] udl 1-1:0.0: [drm] Cannot find any crtc or sizes [ 100.015561][ T5823] usbhid 4-1:0.0: can't add hid device: -71 [ 100.021644][ T5823] usbhid: probe of 4-1:0.0 failed with error -71 [ 100.075301][ T5823] usb 4-1: USB disconnect, device number 2 [ 100.128197][ T6031] syzkaller0: entered promiscuous mode [ 100.136509][ T6031] syzkaller0: entered allmulticast mode [ 101.304877][ T6041] loop0: detected capacity change from 0 to 4096 [ 101.526088][ T6043] ldm_parse_privhead(): Database is normally 2048 bytes, it claims to be 0 bytes. [ 101.793796][ T6043] ldm_parse_privhead(): PRIVHEAD disk size doesn't match real disk size [ 101.914672][ T6043] ldm_validate_privheads(): Cannot find PRIVHEAD 1. [ 101.985229][ T6043] loop0: [ 103.484018][ T6065] syzkaller0: entered promiscuous mode [ 103.495260][ T6065] syzkaller0: entered allmulticast mode [ 104.287314][ C1] ------------[ cut here ]------------ [ 104.293156][ C1] WARNING: CPU: 1 PID: 6074 at net/mac80211/tx.c:5048 __ieee80211_beacon_get+0x1141/0x1520 [ 104.303216][ C1] Modules linked in: [ 104.307115][ C1] CPU: 1 PID: 6074 Comm: syz.0.82 Not tainted syzkaller #0 [ 104.314334][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 104.324428][ C1] RIP: 0010:__ieee80211_beacon_get+0x1141/0x1520 [ 104.330764][ C1] Code: f7 4c 89 ef e8 10 ba b7 f7 45 31 ed 4c 8b bc 24 a0 00 00 00 e9 7f fe ff ff e8 cb d7 79 f7 0f 0b e9 61 f8 ff ff e8 bf d7 79 f7 <0f> 0b e9 85 fb ff ff e8 b3 d7 79 f7 48 c7 c7 20 c7 65 8e 4c 89 e6 [ 104.350429][ C1] RSP: 0018:ffffc900001f0a18 EFLAGS: 00010246 [ 104.356530][ C1] RAX: ffffffff8a0d9ab1 RBX: dffffc0000000000 RCX: ffff88802a938000 [ 104.364527][ C1] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 104.372500][ C1] RBP: 0000000000000000 R08: ffff88802a938000 R09: 0000000000000003 [ 104.380491][ C1] R10: 0000000000000007 R11: 0000000000000100 R12: ffff88805bf5a440 [ 104.388482][ C1] R13: ffff88805a832424 R14: ffff88805bf5a930 R15: ffff88805a832400 [ 104.396484][ C1] FS: 00007f47d5cc86c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 104.405457][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 104.412047][ C1] CR2: 00007f9c394e5ff8 CR3: 0000000078875000 CR4: 00000000003506e0 [ 104.420077][ C1] Call Trace: [ 104.423404][ C1] [ 104.426284][ C1] ? __ieee80211_beacon_get+0x36/0x1520 [ 104.431865][ C1] ieee80211_beacon_get_tim+0xbf/0x580 [ 104.437412][ C1] ? ieee80211_beacon_get_template_ema_list+0x90/0x90 [ 104.444219][ C1] mac80211_hwsim_beacon_tx+0x3bd/0x770 [ 104.449806][ C1] __iterate_interfaces+0x225/0x4c0 [ 104.455092][ C1] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 104.461379][ C1] ? ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 [ 104.468604][ C1] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 104.474869][ C1] ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 [ 104.481925][ C1] mac80211_hwsim_beacon+0xbb/0x1b0 [ 104.487287][ C1] ? hw_scan_work+0xf10/0xf10 [ 104.491990][ C1] __hrtimer_run_queues+0x525/0xc10 [ 104.497237][ C1] ? hrtimer_interrupt+0x980/0x980 [ 104.502361][ C1] ? read_tsc+0x9/0x20 [ 104.506470][ C1] hrtimer_run_softirq+0x177/0x290 [ 104.511589][ C1] handle_softirqs+0x27d/0x820 [ 104.516394][ C1] ? read_tsc+0x9/0x20 [ 104.520464][ C1] ? ktime_get+0x24b/0x280 [ 104.524911][ C1] ? __irq_exit_rcu+0xd3/0x190 [ 104.529699][ C1] ? do_softirq+0x1a0/0x1a0 [ 104.534234][ C1] ? irqtime_account_irq+0xb6/0x1c0 [ 104.539440][ C1] __irq_exit_rcu+0xd3/0x190 [ 104.544052][ C1] ? irq_exit_rcu+0x20/0x20 [ 104.548557][ C1] irq_exit_rcu+0x9/0x20 [ 104.552797][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 104.558496][ C1] [ 104.561425][ C1] [ 104.564392][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 104.570382][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0xc0/0x120 [ 104.576903][ C1] Code: c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 41 c6 04 07 f8 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 1b 98 c3 f6 65 8b 05 3c 66 6a 75 85 c0 74 3c 48 c7 04 24 0e 36 [ 104.596531][ C1] RSP: 0018:ffffc90004b47580 EFLAGS: 00000206 [ 104.602600][ C1] RAX: dffffc0000000004 RBX: 0000000000000a02 RCX: 1a88e9b949a5a100 [ 104.610622][ C1] RDX: dffffc0000000000 RSI: ffffffff8acacbe0 RDI: 0000000000000001 [ 104.618664][ C1] RBP: ffffc90004b47610 R08: ffffffff911ef5af R09: 1ffffffff223deb5 [ 104.626688][ C1] R10: dffffc0000000000 R11: fffffbfff223deb6 R12: dffffc0000000000 [ 104.634774][ C1] R13: 0000000000000000 R14: ffff88807e0f96c0 R15: 1ffff92000968eb0 [ 104.642771][ C1] ? _raw_spin_unlock+0x40/0x40 [ 104.647672][ C1] ? __wake_up_common+0x28e/0x4d0 [ 104.652710][ C1] __wake_up_sync_key+0x12c/0x1a0 [ 104.657754][ C1] ? __wake_up_locked_key_bookmark+0x20/0x20 [ 104.663763][ C1] ? sock_load_diag_module+0x140/0x140 [ 104.669229][ C1] __unix_dgram_recvmsg+0x4bb/0xd90 [ 104.674541][ C1] ? unix_unhash+0x10/0x10 [ 104.678987][ C1] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 104.685199][ C1] ? mark_lock+0x94/0x320 [ 104.689535][ C1] ? unix_dgram_recvmsg+0xad/0xd0 [ 104.694589][ C1] ? unix_dgram_sendmsg+0x16e0/0x16e0 [ 104.700226][ C1] sock_recvmsg_nosec+0x82/0xd0 [ 104.705109][ C1] ____sys_recvmsg+0x4d7/0x5d0 [ 104.709916][ C1] ? __sys_recvmsg_sock+0x50/0x50 [ 104.714973][ C1] ? import_iovec+0x73/0xa0 [ 104.719478][ C1] ___sys_recvmsg+0x214/0x590 [ 104.724178][ C1] ? __sys_recvmsg+0x2a0/0x2a0 [ 104.728951][ C1] ? __lock_acquire+0x7d80/0x7d80 [ 104.733996][ C1] ? __might_fault+0xc6/0x120 [ 104.738670][ C1] ? __might_fault+0xaa/0x120 [ 104.743385][ C1] do_recvmmsg+0x377/0x810 [ 104.747806][ C1] ? __sys_recvmmsg+0x290/0x290 [ 104.752661][ C1] ? __ia32_sys_get_robust_list+0x110/0x110 [ 104.758574][ C1] ? rcu_read_lock_sched_held+0x8a/0x110 [ 104.764236][ C1] __x64_sys_recvmmsg+0x199/0x250 [ 104.769271][ C1] ? do_recvmmsg+0x810/0x810 [ 104.773908][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 104.779110][ C1] do_syscall_64+0x55/0xb0 [ 104.783562][ C1] ? clear_bhb_loop+0x40/0x90 [ 104.788236][ C1] ? clear_bhb_loop+0x40/0x90 [ 104.792941][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 104.798848][ C1] RIP: 0033:0x7f47d4d9e159 [ 104.803307][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 104.822945][ C1] RSP: 002b:00007f47d5cc8028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 104.831371][ C1] RAX: ffffffffffffffda RBX: 00007f47d5026090 RCX: 00007f47d4d9e159 [ 104.839386][ C1] RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000003 [ 104.847388][ C1] RBP: 00007f47d4e35024 R08: 0000000000000000 R09: 0000000000000000 [ 104.855390][ C1] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 104.863393][ C1] R13: 00007f47d5026128 R14: 00007f47d5026090 R15: 00007fffc95b19c8 [ 104.871385][ C1] [ 104.874427][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 104.881713][ C1] CPU: 1 PID: 6074 Comm: syz.0.82 Not tainted syzkaller #0 [ 104.888900][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 104.898949][ C1] Call Trace: [ 104.902223][ C1] [ 104.905069][ C1] dump_stack_lvl+0x18c/0x250 [ 104.909831][ C1] ? show_regs_print_info+0x20/0x20 [ 104.915022][ C1] ? load_image+0x420/0x420 [ 104.919540][ C1] panic+0x2ca/0x720 [ 104.923435][ C1] ? bpf_jit_dump+0xd0/0xd0 [ 104.927944][ C1] __warn+0x2e0/0x470 [ 104.931921][ C1] ? __ieee80211_beacon_get+0x1141/0x1520 [ 104.937649][ C1] ? __ieee80211_beacon_get+0x1141/0x1520 [ 104.943454][ C1] report_bug+0x2be/0x4f0 [ 104.947778][ C1] ? __ieee80211_beacon_get+0x1141/0x1520 [ 104.953493][ C1] ? __ieee80211_beacon_get+0x1141/0x1520 [ 104.959213][ C1] ? __ieee80211_beacon_get+0x1143/0x1520 [ 104.964931][ C1] handle_bug+0xcf/0x120 [ 104.969172][ C1] exc_invalid_op+0x1a/0x50 [ 104.973669][ C1] asm_exc_invalid_op+0x1a/0x20 [ 104.978514][ C1] RIP: 0010:__ieee80211_beacon_get+0x1141/0x1520 [ 104.984838][ C1] Code: f7 4c 89 ef e8 10 ba b7 f7 45 31 ed 4c 8b bc 24 a0 00 00 00 e9 7f fe ff ff e8 cb d7 79 f7 0f 0b e9 61 f8 ff ff e8 bf d7 79 f7 <0f> 0b e9 85 fb ff ff e8 b3 d7 79 f7 48 c7 c7 20 c7 65 8e 4c 89 e6 [ 105.004437][ C1] RSP: 0018:ffffc900001f0a18 EFLAGS: 00010246 [ 105.010498][ C1] RAX: ffffffff8a0d9ab1 RBX: dffffc0000000000 RCX: ffff88802a938000 [ 105.018463][ C1] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 [ 105.026425][ C1] RBP: 0000000000000000 R08: ffff88802a938000 R09: 0000000000000003 [ 105.034391][ C1] R10: 0000000000000007 R11: 0000000000000100 R12: ffff88805bf5a440 [ 105.042367][ C1] R13: ffff88805a832424 R14: ffff88805bf5a930 R15: ffff88805a832400 [ 105.050372][ C1] ? __ieee80211_beacon_get+0x1141/0x1520 [ 105.056098][ C1] ? __ieee80211_beacon_get+0x1141/0x1520 [ 105.061897][ C1] ? __ieee80211_beacon_get+0x36/0x1520 [ 105.067443][ C1] ieee80211_beacon_get_tim+0xbf/0x580 [ 105.072903][ C1] ? ieee80211_beacon_get_template_ema_list+0x90/0x90 [ 105.079665][ C1] mac80211_hwsim_beacon_tx+0x3bd/0x770 [ 105.085212][ C1] __iterate_interfaces+0x225/0x4c0 [ 105.090406][ C1] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 105.096641][ C1] ? ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 [ 105.103832][ C1] ? mac80211_hwsim_vendor_cmd_test+0x2f0/0x2f0 [ 105.110086][ C1] ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 [ 105.117123][ C1] mac80211_hwsim_beacon+0xbb/0x1b0 [ 105.122319][ C1] ? hw_scan_work+0xf10/0xf10 [ 105.127025][ C1] __hrtimer_run_queues+0x525/0xc10 [ 105.132231][ C1] ? hrtimer_interrupt+0x980/0x980 [ 105.137352][ C1] ? read_tsc+0x9/0x20 [ 105.141456][ C1] hrtimer_run_softirq+0x177/0x290 [ 105.146579][ C1] handle_softirqs+0x27d/0x820 [ 105.151345][ C1] ? read_tsc+0x9/0x20 [ 105.155423][ C1] ? ktime_get+0x24b/0x280 [ 105.159839][ C1] ? __irq_exit_rcu+0xd3/0x190 [ 105.164601][ C1] ? do_softirq+0x1a0/0x1a0 [ 105.169120][ C1] ? irqtime_account_irq+0xb6/0x1c0 [ 105.174319][ C1] __irq_exit_rcu+0xd3/0x190 [ 105.178940][ C1] ? irq_exit_rcu+0x20/0x20 [ 105.183444][ C1] irq_exit_rcu+0x9/0x20 [ 105.187680][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 105.193312][ C1] [ 105.196255][ C1] [ 105.199199][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 105.205177][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0xc0/0x120 [ 105.211694][ C1] Code: c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 41 c6 04 07 f8 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 1b 98 c3 f6 65 8b 05 3c 66 6a 75 85 c0 74 3c 48 c7 04 24 0e 36 [ 105.231308][ C1] RSP: 0018:ffffc90004b47580 EFLAGS: 00000206 [ 105.237390][ C1] RAX: dffffc0000000004 RBX: 0000000000000a02 RCX: 1a88e9b949a5a100 [ 105.245366][ C1] RDX: dffffc0000000000 RSI: ffffffff8acacbe0 RDI: 0000000000000001 [ 105.253360][ C1] RBP: ffffc90004b47610 R08: ffffffff911ef5af R09: 1ffffffff223deb5 [ 105.261380][ C1] R10: dffffc0000000000 R11: fffffbfff223deb6 R12: dffffc0000000000 [ 105.269445][ C1] R13: 0000000000000000 R14: ffff88807e0f96c0 R15: 1ffff92000968eb0 [ 105.277429][ C1] ? _raw_spin_unlock+0x40/0x40 [ 105.282302][ C1] ? __wake_up_common+0x28e/0x4d0 [ 105.287368][ C1] __wake_up_sync_key+0x12c/0x1a0 [ 105.292399][ C1] ? __wake_up_locked_key_bookmark+0x20/0x20 [ 105.298386][ C1] ? sock_load_diag_module+0x140/0x140 [ 105.303847][ C1] __unix_dgram_recvmsg+0x4bb/0xd90 [ 105.309072][ C1] ? unix_unhash+0x10/0x10 [ 105.313495][ C1] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 105.319672][ C1] ? mark_lock+0x94/0x320 [ 105.324016][ C1] ? unix_dgram_recvmsg+0xad/0xd0 [ 105.329042][ C1] ? unix_dgram_sendmsg+0x16e0/0x16e0 [ 105.334412][ C1] sock_recvmsg_nosec+0x82/0xd0 [ 105.339263][ C1] ____sys_recvmsg+0x4d7/0x5d0 [ 105.344038][ C1] ? __sys_recvmsg_sock+0x50/0x50 [ 105.349070][ C1] ? import_iovec+0x73/0xa0 [ 105.353590][ C1] ___sys_recvmsg+0x214/0x590 [ 105.358280][ C1] ? __sys_recvmsg+0x2a0/0x2a0 [ 105.363064][ C1] ? __lock_acquire+0x7d80/0x7d80 [ 105.368097][ C1] ? __might_fault+0xc6/0x120 [ 105.372767][ C1] ? __might_fault+0xaa/0x120 [ 105.377440][ C1] do_recvmmsg+0x377/0x810 [ 105.381859][ C1] ? __sys_recvmmsg+0x290/0x290 [ 105.386718][ C1] ? __ia32_sys_get_robust_list+0x110/0x110 [ 105.392612][ C1] ? rcu_read_lock_sched_held+0x8a/0x110 [ 105.398257][ C1] __x64_sys_recvmmsg+0x199/0x250 [ 105.403282][ C1] ? do_recvmmsg+0x810/0x810 [ 105.407888][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 105.413095][ C1] do_syscall_64+0x55/0xb0 [ 105.417548][ C1] ? clear_bhb_loop+0x40/0x90 [ 105.422238][ C1] ? clear_bhb_loop+0x40/0x90 [ 105.426929][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 105.432841][ C1] RIP: 0033:0x7f47d4d9e159 [ 105.437273][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 105.456873][ C1] RSP: 002b:00007f47d5cc8028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 105.465288][ C1] RAX: ffffffffffffffda RBX: 00007f47d5026090 RCX: 00007f47d4d9e159 [ 105.473277][ C1] RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000003 [ 105.481248][ C1] RBP: 00007f47d4e35024 R08: 0000000000000000 R09: 0000000000000000 [ 105.489213][ C1] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 105.497181][ C1] R13: 00007f47d5026128 R14: 00007f47d5026090 R15: 00007fffc95b19c8 [ 105.505172][ C1] [ 105.508479][ C1] Kernel Offset: disabled [ 105.512810][ C1] Rebooting in 86400 seconds..