last executing test programs: 1h11m46.957696489s ago: executing program 0 (id=49): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x58, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0xfffc}, [@IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x0}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x58}}, 0x0) 1h11m40.672831975s ago: executing program 0 (id=50): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) read$FUSE(r2, &(0x7f0000005180)={0x2020}, 0x2020) 1h11m35.930818443s ago: executing program 0 (id=51): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[], 0x50) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f00000008c0)={&(0x7f0000000680)="88e2", 0x0, 0x0, 0x0, 0xc, r1}, 0x38) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f00000001c0)=0x7) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x4044810}, 0x40000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$nl_sock_diag(0x10, 0x3, 0x4) mlock2(&(0x7f0000627000/0x3000)=nil, 0x3000, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(0xffffffffffffffff, 0x90009427, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r5, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000400)={0x3c, r6, 0xb97534d5fe9704cf, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x649}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc0}, 0x0) 1h10m57.699558631s ago: executing program 0 (id=54): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) r0 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x0, @remote}, 0x10, 0x0}, 0x3000c041) r1 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000005c0)="89000000120081ae08060cdc030ec0007f03e3f50000000000e2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec08120800030006010000bdad446b9bbc7a46e3988285dcdf12f21308f868fece015fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fffe5", 0x89}], 0x1}, 0x40) 1h10m49.09274233s ago: executing program 0 (id=56): r0 = getpid() prlimit64(r0, 0xd, &(0x7f0000000080)={0x796, 0xee0000}, &(0x7f00000000c0)) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x275a, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x1000, 0x2}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0x8, 0x8, 0x80, 0x2, 0x3, 0x80, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0xff, 0x0, 0x5, 0x4, 0x0, 0x50, 0x3c5b, 0x1, 0x24, 0xd, 0x2, 0x4, 0xffffffff, 0xe661, 0x0, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x243, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x5, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x3, 0x8, 0x4, 0x1, 0x40], [0x8, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bb, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea1, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x8, 0x9, 0x6, 0x4b, 0x8000, 0x1, 0xfe000000, 0x8, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x0, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x408, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x3038, 0x3e7, 0xb, 0x5, 0x4, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0xffff, 0xa620, 0x1, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x4, 0xc8, 0x7ff, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0x9602, 0x7, 0xaf, 0x8, 0x3, 0x226, 0x5, 0x5, 0x8, 0x30b1d693, 0xa1f, 0x89, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000001440)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000001340)="0e9849f1332c3a4f7cd80c990e6bb6b5979749a4fbaef24bc5bcc03ac73ad01da6441277f5ac3b4d0ab075522859b01dff8f24e16cd420439da93470adbb7411843f018e01848aec434d0395f241ae92"}) 1h10m48.706875187s ago: executing program 1 (id=57): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x20000004, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f00000002c0)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000280)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000180)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0xe, @empty, 0x2}, {0xa, 0x4e23, 0x7, @remote, 0x3}, r2, 0x7}}, 0x48) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x2, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r3, &(0x7f0000000540)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000100)=0x1, r4, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r3, &(0x7f0000000140)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e23, 0x6, @loopback, 0x3}, r4}}, 0x30) close_range(r0, 0xffffffffffffffff, 0x0) 1h10m42.842354396s ago: executing program 0 (id=58): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[], 0x50) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f00000008c0)={&(0x7f0000000680)="88e2", 0x0, 0x0, 0x0, 0xc, r1}, 0x38) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x4044810}, 0x40000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$nl_sock_diag(0x10, 0x3, 0x4) mlock2(&(0x7f0000627000/0x3000)=nil, 0x3000, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(0xffffffffffffffff, 0x90009427, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r4, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000400)={0x3c, r5, 0xb97534d5fe9704cf, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x649}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc0}, 0x0) 1h10m39.505507038s ago: executing program 1 (id=59): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) r1 = bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000500)={r1}, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0x19, &(0x7f0000000540)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x6}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r2}, 0xc) 1h10m29.364936685s ago: executing program 1 (id=60): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="05020000000002000000120000001800018014000200626f6e645f736c6176655f3100000000080009"], 0x34}}, 0x44884) 1h10m21.347213294s ago: executing program 1 (id=61): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) read$FUSE(r1, &(0x7f0000005180)={0x2020}, 0x2020) 1h10m14.955015212s ago: executing program 1 (id=62): r0 = getpid() prlimit64(r0, 0xd, &(0x7f0000000080)={0x796, 0xee0000}, &(0x7f00000000c0)) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x275a, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x1000, 0x2}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0x8, 0x8, 0x80, 0x2, 0x3, 0x80, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0xff, 0x0, 0x5, 0x4, 0x0, 0x50, 0x3c5b, 0x1, 0x24, 0xd, 0x2, 0x4, 0xffffffff, 0xe661, 0x0, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x243, 0x3, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x5, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x3, 0x8, 0x4, 0x1, 0x40], [0x8, 0x9, 0x8000012f, 0x8004, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bb, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea1, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x4, 0x9, 0x8, 0x9, 0x6, 0x4b, 0x8000, 0x1, 0xfe000000, 0x8, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0x0, 0xbc45, 0x48c93690, 0x42, 0x3], [0x7, 0x408, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x3038, 0x3e7, 0xb, 0x5, 0x4, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xbf, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0xa, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x5, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0xffff, 0xa620, 0x1, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x16, 0xffffffff, 0x80000000, 0x5, 0x4, 0xc8, 0x7ff, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0x9602, 0x7, 0xaf, 0x8, 0x3, 0x226, 0x5, 0x5, 0x8, 0x30b1d693, 0xa1f, 0x89, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000001440)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000001340)="0e9849f1332c3a4f7cd80c990e6bb6b5979749a4fbaef24bc5bcc03ac73ad01da6441277f5ac3b4d0ab075522859b01dff8f24e16cd420439da93470adbb7411843f018e01848aec434d0395f241ae92"}) 1h10m6.896815051s ago: executing program 1 (id=63): r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc4c85513, &(0x7f0000000a80)={{0x5, 0x6, 0x404, 0x7, 'syz1\x00', 0x81}, 0x1, [0x6, 0xfffffffffffffffa, 0x20000000095, 0x7f, 0xffffffff, 0xfff, 0x1, 0xf, 0x1, 0x3, 0xfffffffffffffffd, 0x64, 0xfff, 0x100000001, 0x1, 0xc8, 0x51, 0xa5, 0x0, 0xb6, 0x8000000000000000, 0x8, 0x7, 0x4, 0x6, 0xff, 0x1, 0x4f51, 0x3, 0x37c7, 0xc, 0xbb33, 0x0, 0x63, 0x4, 0x4, 0x8, 0xffffffffffff7fff, 0x6, 0xfffffffffffffff7, 0x8, 0x0, 0x8, 0x401, 0x3, 0xc1bd, 0xffffffff, 0x8000000000000001, 0x800003, 0x0, 0x7, 0x72, 0x9, 0x2, 0x6a44d0ea, 0xffffffffffffffff, 0x9, 0x5f0, 0xfffffffffffff2e2, 0x7, 0x6, 0xfffffffffffffffd, 0x7, 0xf0, 0x26e692ff, 0x5, 0x2, 0x2, 0x2, 0x1, 0x9, 0x1, 0xe0000000000000, 0xd, 0x81, 0x80000001, 0x7ffe, 0x6, 0x6, 0x3ff, 0xffffffffffffcc1c, 0x10000, 0xfffffffffffffffb, 0x6, 0x100000001, 0x1, 0xf, 0x7dd, 0xfffffffffffff000, 0x8d6, 0x0, 0x5, 0x4, 0xafae, 0x1, 0x8, 0x1, 0xb, 0x1, 0xffff, 0x7, 0xcc, 0x1ff, 0xc, 0x0, 0x7, 0x5, 0x0, 0x3, 0x3, 0xaad, 0x7, 0x1, 0x8, 0xe2, 0x6, 0x6, 0xf, 0x7, 0x0, 0xa, 0x5, 0x40, 0x52a7, 0x9, 0xf0, 0x100000000, 0x140000000]}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$dri(0x0, 0x1ff, 0x0) unshare(0x2c020400) r3 = socket(0x15, 0x5, 0x0) getsockopt(r3, 0x200000000114, 0x2718, 0x0, &(0x7f0000000040)) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) brk(0x200000ffc000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a54000000060a010400000007000000000a0000010900010073797a3100000000200004801c000180090001006d617371000000000c000280080003400000000006000740bee100000900020073797a32"], 0x7c}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r3) sendmsg$IPSET_CMD_RENAME(r4, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[], 0x1c}}, 0x8150) 1h9m56.278963318s ago: executing program 32 (id=58): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[], 0x50) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f00000008c0)={&(0x7f0000000680)="88e2", 0x0, 0x0, 0x0, 0xc, r1}, 0x38) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x4044810}, 0x40000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$nl_sock_diag(0x10, 0x3, 0x4) mlock2(&(0x7f0000627000/0x3000)=nil, 0x3000, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(0xffffffffffffffff, 0x90009427, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r4, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000400)={0x3c, r5, 0xb97534d5fe9704cf, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x649}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc0}, 0x0) 1h9m18.545067597s ago: executing program 33 (id=63): r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc4c85513, &(0x7f0000000a80)={{0x5, 0x6, 0x404, 0x7, 'syz1\x00', 0x81}, 0x1, [0x6, 0xfffffffffffffffa, 0x20000000095, 0x7f, 0xffffffff, 0xfff, 0x1, 0xf, 0x1, 0x3, 0xfffffffffffffffd, 0x64, 0xfff, 0x100000001, 0x1, 0xc8, 0x51, 0xa5, 0x0, 0xb6, 0x8000000000000000, 0x8, 0x7, 0x4, 0x6, 0xff, 0x1, 0x4f51, 0x3, 0x37c7, 0xc, 0xbb33, 0x0, 0x63, 0x4, 0x4, 0x8, 0xffffffffffff7fff, 0x6, 0xfffffffffffffff7, 0x8, 0x0, 0x8, 0x401, 0x3, 0xc1bd, 0xffffffff, 0x8000000000000001, 0x800003, 0x0, 0x7, 0x72, 0x9, 0x2, 0x6a44d0ea, 0xffffffffffffffff, 0x9, 0x5f0, 0xfffffffffffff2e2, 0x7, 0x6, 0xfffffffffffffffd, 0x7, 0xf0, 0x26e692ff, 0x5, 0x2, 0x2, 0x2, 0x1, 0x9, 0x1, 0xe0000000000000, 0xd, 0x81, 0x80000001, 0x7ffe, 0x6, 0x6, 0x3ff, 0xffffffffffffcc1c, 0x10000, 0xfffffffffffffffb, 0x6, 0x100000001, 0x1, 0xf, 0x7dd, 0xfffffffffffff000, 0x8d6, 0x0, 0x5, 0x4, 0xafae, 0x1, 0x8, 0x1, 0xb, 0x1, 0xffff, 0x7, 0xcc, 0x1ff, 0xc, 0x0, 0x7, 0x5, 0x0, 0x3, 0x3, 0xaad, 0x7, 0x1, 0x8, 0xe2, 0x6, 0x6, 0xf, 0x7, 0x0, 0xa, 0x5, 0x40, 0x52a7, 0x9, 0xf0, 0x100000000, 0x140000000]}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$dri(0x0, 0x1ff, 0x0) unshare(0x2c020400) r3 = socket(0x15, 0x5, 0x0) getsockopt(r3, 0x200000000114, 0x2718, 0x0, &(0x7f0000000040)) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) brk(0x200000ffc000) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a54000000060a010400000007000000000a0000010900010073797a3100000000200004801c000180090001006d617371000000000c000280080003400000000006000740bee100000900020073797a32"], 0x7c}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r3) sendmsg$IPSET_CMD_RENAME(r4, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[], 0x1c}}, 0x8150) 43m53.467680801s ago: executing program 3 (id=171): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_TSINFO_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)={0x20, r1, 0x6a98047402e98331, 0x70bd25, 0x0, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x5}]}]}, 0x20}, 0x1, 0x0, 0x0, 0xa080}, 0x0) 43m37.368598012s ago: executing program 3 (id=172): setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x7, 0x0, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000002280)={0x3, &(0x7f0000000000)=[{0x20, 0x2, 0x81, 0xfffff024}, {0x48}, {0x6, 0xba, 0x2, 0xffff}]}, 0x10) syz_emit_ethernet(0x36, &(0x7f0000001440)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @empty, @void, {@ipv6={0x86dd, @generic={0x3, 0x6, "46cd47", 0x0, 0x4d, 0x0, @empty, @private1}}}}, 0x0) 43m17.617060522s ago: executing program 3 (id=175): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'bond0\x00'}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000080}, 0x0) 43m2.627066373s ago: executing program 3 (id=176): unshare(0x28020480) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1000000, 0x5d032, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x80801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000199000/0x800000)=nil, 0x800000, 0x0, 0x4000000000000000}) 42m37.325893026s ago: executing program 3 (id=178): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)=@newlink={0x48, 0x10, 0x1, 0x71bd29, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x7afc5, 0xe0f}, [@IFLA_IFNAME={0x14, 0x3, 'team0\x00'}, @IFLA_VFINFO_LIST={0x14, 0x16, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, [@IFLA_VF_SPOOFCHK={0xc, 0x4, {0xffffffdb, 0x9}}]}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x850}, 0x0) 42m22.18137258s ago: executing program 3 (id=180): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) bind$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000040)=0x95, 0x4) connect$inet6(r1, &(0x7f0000002140)={0xa, 0x4e25, 0x1, @mcast2, 0x5}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) 41m28.933062277s ago: executing program 34 (id=180): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) bind$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000040)=0x95, 0x4) connect$inet6(r1, &(0x7f0000002140)={0xa, 0x4e25, 0x1, @mcast2, 0x5}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) 6m15.644345612s ago: executing program 2 (id=423): close(0x3) r0 = userfaultfd(0x80801) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x100}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000000000/0x400000)=nil, 0x400000}, 0x1}) syz_open_procfs(0xffffffffffffffff, &(0x7f0000002100)='numa_maps\x00') ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 5m49.137351671s ago: executing program 2 (id=425): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup(r0) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e20, 0x4, @dev={0xfe, 0x80, '\x00', 0x21}, 0x8}, 0x1c) setsockopt$inet_opts(r1, 0x0, 0x4, 0x0, 0x0) 5m5.045276869s ago: executing program 2 (id=427): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0xff, 0x0, 0x7fff0026}]}) r1 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000040)=0x3) syz_open_dev$sndpcmp(&(0x7f0000000b00), 0x0, 0x14b000) syz_open_dev$sndpcmp(&(0x7f0000000440), 0x0, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) r3 = syz_open_dev$sndpcmp(0x0, 0x0, 0xa2c65) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_SW_PARAMS(r3, 0xc0884113, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 4m50.61500573s ago: executing program 2 (id=429): setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a69702c706f7274"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) socket$nl_netfilter(0x10, 0x3, 0xc) 4m29.792391552s ago: executing program 2 (id=432): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000240)=0x9, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000180)=[{&(0x7f0000000400)="580000001500add427323b472545b4560a117fffffff81000e220e227f000008925aa80013007b00090080007f000001e809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee000000deff000000", 0x53}], 0x1) 4m20.705677262s ago: executing program 2 (id=433): r0 = io_uring_setup(0x3450, &(0x7f0000000080)={0x0, 0x1539, 0x0, 0x2}) prctl$PR_MCE_KILL(0x21, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000002700)=""/4096, 0x1000}], 0x0, 0x11a}, 0x20) 3m28.036876132s ago: executing program 35 (id=433): r0 = io_uring_setup(0x3450, &(0x7f0000000080)={0x0, 0x1539, 0x0, 0x2}) prctl$PR_MCE_KILL(0x21, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000002700)=""/4096, 0x1000}], 0x0, 0x11a}, 0x20) 1m18.79285713s ago: executing program 4 (id=446): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={0x1c, r1, 0x1, 0x7c, 0x40000, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc082}, 0x4000800) 1m11.85193571s ago: executing program 4 (id=447): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x34, 0x0, &(0x7f0000000680)="98dc9d640be2785d04ef1c5a5d2d32d9b32b3feca80cd89eea85a36d8b2d30dd47c684f1dabc0ce50798429ecabbf22bcfc2be2a"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000440)=[@request_death={0x400c6313}], 0x0, 0x1000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) read$FUSE(r3, &(0x7f00000034c0)={0x2020}, 0xcac) 57.626896938s ago: executing program 4 (id=448): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa2003, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x20004, r0, 0x2}) r3 = syz_open_dev$dri(&(0x7f0000000280), 0x1ff, 0x140) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r3, 0xc00c642e, &(0x7f00000000c0)={0x0, 0x0, r2}) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000180)=0x6) 51.044549471s ago: executing program 4 (id=449): lsetxattr$security_capability(0x0, &(0x7f0000000200), 0x0, 0x0, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6770c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) readv(0xffffffffffffffff, &(0x7f0000001400), 0x0) ioctl$UI_BEGIN_FF_ERASE(0xffffffffffffffff, 0xc00c55ca, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$poke(0x5, r0, 0x0, 0x5) sendto$inet6(0xffffffffffffffff, &(0x7f0000000540)="900000001c001f4d154a817393278bff0a80a57802000000e503740014000100ac14", 0x22, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) unlinkat(0xffffffffffffff9c, &(0x7f0000000000)='mnt/encrypted_dir\x00', 0x200) socket$nl_route(0x10, 0x3, 0x0) 9.889072984s ago: executing program 4 (id=450): r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)={0x1, 0x840, 0x0, {}, {0x77359400}, {}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "ef1d62ee7e923b0ad9cda5b28dd4753620a2f0271768a8284c18a4e2b5e44dc77098b18fd964df81213608ec503db52d42f1a78c97322f4ae4c8dc89cf2b1440"}}, 0x80}}, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400}) 0s ago: executing program 4 (id=451): r0 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101001, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000140)={'comedi_parport\x00', [0x3, 0x2, 0x7fffffff, 0x84e1, 0x2f, 0x2006, 0x6, 0x8, 0x80ffa, 0x0, 0x0, 0x8500, 0x1003, 0x1000004, 0xf, 0x10000, 0xffffffa8, 0x7ffbfffd, 0x1ff, 0x9ea, 0x10, 0x40000, 0x8, 0x5, 0x746f, 0x8, 0x5, 0x8, 0x4, 0x0, 0x7ffd]}) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:14659' (ED25519) to the list of known hosts. syzkaller login: [ 541.651346][ T3216] cgroup: Unknown subsys name 'net' [ 542.391121][ T3216] cgroup: Unknown subsys name 'cpuset' [ 542.825725][ T3216] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 637.394514][ T3216] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 780.377400][ T3229] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 780.926367][ T3229] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 783.507592][ T3227] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 783.735761][ T3227] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 800.803460][ T3229] hsr_slave_0: entered promiscuous mode [ 800.877509][ T3229] hsr_slave_1: entered promiscuous mode [ 801.233933][ T3227] hsr_slave_0: entered promiscuous mode [ 801.296994][ T3227] hsr_slave_1: entered promiscuous mode [ 801.351699][ T3227] debugfs: 'hsr0' already exists in 'hsr' [ 801.355308][ T3227] Cannot create hsr debugfs directory [ 813.087904][ T3229] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 813.335418][ T3229] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 813.645619][ T3229] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 814.275352][ T3229] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 816.276063][ T3227] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 816.594007][ T3227] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 817.072044][ T3227] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 817.176577][ T3227] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 831.298362][ T3229] 8021q: adding VLAN 0 to HW filter on device bond0 [ 836.330989][ T3227] 8021q: adding VLAN 0 to HW filter on device bond0 [ 891.736848][ T3229] veth0_vlan: entered promiscuous mode [ 892.790532][ T3229] veth1_vlan: entered promiscuous mode [ 895.609157][ T3229] veth0_macvtap: entered promiscuous mode [ 896.614702][ T3229] veth1_macvtap: entered promiscuous mode [ 900.204681][ T3227] veth0_vlan: entered promiscuous mode [ 901.083928][ T3784] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 901.257550][ T3784] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 901.576112][ T3784] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 901.583289][ T3784] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 901.886391][ T3227] veth1_vlan: entered promiscuous mode [ 906.606063][ T3227] veth0_macvtap: entered promiscuous mode [ 907.570428][ T3227] veth1_macvtap: entered promiscuous mode [ 909.227418][ T3229] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 910.770621][ T3519] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 910.871197][ T3344] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 910.980803][ T3344] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 910.997029][ T3344] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 951.092632][ T3840] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 951.442721][ T3840] usb 2-1: Using ep0 maxpacket: 32 [ 951.585347][ T3840] usb 2-1: config index 0 descriptor too short (expected 29220, got 36) [ 951.616956][ T3840] usb 2-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 951.621336][ T3840] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 951.631248][ T3840] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 951.634047][ T3840] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 951.643418][ T3840] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 951.648138][ T3840] usb 2-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 951.653196][ T3840] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 952.035438][ T3840] usb 2-1: config 0 descriptor?? [ 954.053730][ T3840] usblp 2-1:0.0: usblp0: USB Bidirectional printer dev 2 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 955.793699][ T3863] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 955.906081][ T3863] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 956.243112][ T3869] usb 2-1: USB disconnect, device number 2 [ 957.159964][ T3869] usblp0: removed [ 969.222095][ T3890] C: renamed from batadv_slave_0 (while UP) [ 969.475736][ T3890] netlink: 'syz.0.9': attribute type 8 has an invalid length. [ 969.478207][ T3890] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1001.265892][ T3914] netlink: 'syz.0.16': attribute type 5 has an invalid length. [ 1011.064062][ T3921] bridge_slave_0: entered promiscuous mode [ 1011.114004][ T3921] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 1013.560404][ T30] audit: type=1400 audit(1012.430:2): apparmor="DENIED" operation="change_profile" class="file" info="label not found" error=-22 profile="unconfined" name="&" pid=3917 comm="syz.0.19" [ 1023.933835][ T3928] netlink: 'syz.0.23': attribute type 1 has an invalid length. [ 1024.546261][ T3928] macvlan2: entered promiscuous mode [ 1024.564235][ T3928] macvlan2: entered allmulticast mode [ 1067.891539][ T10] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 1069.042208][ T10] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1069.043985][ T10] usb 1-1: config 0 has no interfaces? [ 1069.045417][ T10] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1069.046758][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1069.377611][ T10] usb 1-1: config 0 descriptor?? [ 1075.607810][ T3792] usb 1-1: USB disconnect, device number 2 [ 1159.844811][ T4005] binder: BINDER_SET_CONTEXT_MGR already set [ 1159.930928][ T4005] binder: 4004:4005 ioctl 4018620d 200000004a80 returned -16 [ 1173.977504][ T4008] pim6reg: entered allmulticast mode [ 1186.532900][ T4021] binder: BINDER_SET_CONTEXT_MGR already set [ 1186.534195][ T4021] binder: 4020:4021 ioctl 4018620d 200000004a80 returned -16 [ 1239.522414][ T4044] binder: 4043:4044 ioctl c0306201 200000001440 returned -11 [ 1275.777217][ T4059] binder: 4058:4059 ioctl c0306201 200000001440 returned -11 [ 1344.821715][ T3519] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1346.872907][ T3519] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1349.987454][ T3519] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1352.852965][ T3519] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1373.304042][ T3519] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1373.941462][ T3519] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1374.130779][ T3519] bond0 (unregistering): Released all slaves [ 1376.483240][ T3519] hsr_slave_0: left promiscuous mode [ 1376.570604][ T3519] hsr_slave_1: left promiscuous mode [ 1376.924877][ T3519] veth1_macvtap: left promiscuous mode [ 1376.927056][ T3519] veth0_macvtap: left promiscuous mode [ 1376.939503][ T3519] veth1_vlan: left promiscuous mode [ 1376.942097][ T3519] veth0_vlan: left promiscuous mode [ 1385.014494][ T3519] pim6reg (unregistering): left allmulticast mode [ 1416.943226][ T3519] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1418.514021][ T3519] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1420.375710][ T3519] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1421.882904][ T3519] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1424.810489][ T4067] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1425.257339][ T4067] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1437.595040][ T3519] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1437.814471][ T3519] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1437.926339][ T3519] bond0 (unregistering): Released all slaves [ 1439.783019][ T3519] hsr_slave_0: left promiscuous mode [ 1439.872755][ T3519] hsr_slave_1: left promiscuous mode [ 1440.443440][ T3519] veth1_macvtap: left promiscuous mode [ 1440.446519][ T3519] veth0_macvtap: left promiscuous mode [ 1440.500900][ T3519] veth1_vlan: left promiscuous mode [ 1440.503966][ T3519] veth0_vlan: left promiscuous mode [ 1474.057385][ T4067] hsr_slave_0: entered promiscuous mode [ 1474.142065][ T4067] hsr_slave_1: entered promiscuous mode [ 1481.850087][ T4117] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1482.310330][ T4117] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1488.374852][ T4067] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1488.605223][ T4067] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1489.347896][ T4067] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1489.606643][ T4067] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1510.058364][ T4117] hsr_slave_0: entered promiscuous mode [ 1510.102730][ T4117] hsr_slave_1: entered promiscuous mode [ 1510.127487][ T4117] debugfs: 'hsr0' already exists in 'hsr' [ 1510.131808][ T4117] Cannot create hsr debugfs directory [ 1533.316015][ T4067] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1534.407414][ T4117] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1534.823807][ T4117] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1535.400753][ T4117] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1536.316261][ T4117] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1572.154012][ T4117] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1660.805731][ T4067] veth0_vlan: entered promiscuous mode [ 1662.860038][ T4067] veth1_vlan: entered promiscuous mode [ 1667.583186][ T4067] veth0_macvtap: entered promiscuous mode [ 1669.036831][ T4067] veth1_macvtap: entered promiscuous mode [ 1677.143984][ T3344] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1677.266842][ T3344] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1677.324822][ T3344] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1677.391035][ T3344] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1707.197747][ T4117] veth0_vlan: entered promiscuous mode [ 1709.016996][ T4117] veth1_vlan: entered promiscuous mode [ 1715.485791][ T4117] veth0_macvtap: entered promiscuous mode [ 1717.197418][ T4117] veth1_macvtap: entered promiscuous mode [ 1724.225297][ T40] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1724.227788][ T40] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1724.256118][ T40] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1724.258438][ T40] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1797.388039][ T4822] binder: 4821:4822 ioctl c0306201 200000001440 returned -11 [ 1823.065953][ T4843] netlink: 104 bytes leftover after parsing attributes in process `syz.2.75'. [ 1851.385227][ T4861] binder_alloc: 4860: binder_alloc_buf, no vma [ 1851.537808][ T4861] binder: 4860:4861 ioctl c0306201 200000001440 returned -11 [ 1872.784693][ T4874] netlink: 104 bytes leftover after parsing attributes in process `syz.3.81'. [ 1876.133047][ T4876] netlink: 766 bytes leftover after parsing attributes in process `syz.2.82'. [ 1916.375954][ T4898] netlink: 104 bytes leftover after parsing attributes in process `syz.2.87'. [ 1980.343219][ T4927] netlink: 104 bytes leftover after parsing attributes in process `syz.2.93'. [ 1993.124853][ T4933] netlink: 4 bytes leftover after parsing attributes in process `syz.3.94'. [ 2002.145381][ T4940] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2002.324142][ T4940] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2051.602940][ T4967] netlink: 104 bytes leftover after parsing attributes in process `syz.3.99'. [ 2071.045467][ T4976] netlink: 16 bytes leftover after parsing attributes in process `syz.3.101'. [ 2099.311114][ T4987] input: syz0 as /devices/virtual/input/input0 [ 2137.754013][ T5006] binder: BINDER_SET_CONTEXT_MGR already set [ 2137.755156][ T5006] binder: 5001:5006 ioctl 4018620d 200000000040 returned -16 [ 2165.435609][ T5013] DRBG: could not allocate CTR cipher TFM handle: ctr(aes) [ 2217.204846][ T5039] binder: BINDER_SET_CONTEXT_MGR already set [ 2217.207013][ T5039] binder: 5038:5039 ioctl 4018620d 200000000040 returned -16 [ 2218.543513][ T5040] binder: 5038:5040 ioctl c0306201 200000000780 returned -14 [ 2232.062210][ T5046] syzkaller0: entered promiscuous mode [ 2232.064549][ T5046] syzkaller0: entered allmulticast mode [ 2236.412664][ T5042] Zero length message leads to an empty skb [ 2278.912334][ T5065] netlink: 8 bytes leftover after parsing attributes in process `syz.3.119'. [ 2278.952897][ T5065] netlink: 'syz.3.119': attribute type 30 has an invalid length. [ 2278.956382][ T5065] netlink: 'syz.3.119': attribute type 29 has an invalid length. [ 2279.022044][ T5065] netlink: 4 bytes leftover after parsing attributes in process `syz.3.119'. [ 2287.828495][ T5068] binder: BINDER_SET_CONTEXT_MGR already set [ 2287.947916][ T5068] binder: 5066:5068 ioctl 4018620d 200000000040 returned -16 [ 2298.163048][ T5070] netlink: 4 bytes leftover after parsing attributes in process `syz.3.121'. [ 2312.732900][ T5073] syzkaller0: entered promiscuous mode [ 2312.736006][ T5073] syzkaller0: entered allmulticast mode [ 2316.337163][ T5078] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2316.786819][ T5078] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2339.925851][ T5085] netlink: 104 bytes leftover after parsing attributes in process `syz.2.124'. [ 2340.213635][ T5086] xt_hashlimit: size too large, truncated to 1048576 [ 2392.556888][ T5098] syzkaller0: entered promiscuous mode [ 2392.683262][ T5098] syzkaller0: entered allmulticast mode [ 2406.103045][ T5110] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2406.192947][ T5110] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2481.217838][ T5143] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2481.501188][ T5143] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2502.224518][ T5151] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2503.002804][ T5151] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2558.784213][ T5176] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2558.944615][ T5176] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2619.196906][ T5202] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2619.482768][ T5202] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2700.560504][ T5242] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2700.833376][ T5242] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2718.682629][ T5246] process 'syz.3.156' launched './file2' with NULL argv: empty string added [ 2724.985414][ T5253] tap0: tun_chr_ioctl cmd 1074025677 [ 2725.072286][ T5253] tap0: linktype set to 774 [ 2772.390907][ T5274] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2772.514203][ T5274] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2810.513894][ T5293] netlink: 'syz.3.165': attribute type 2 has an invalid length. [ 2835.174845][ T5307] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2835.241080][ T5307] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2895.976603][ T5324] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2896.173619][ T5324] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2919.667034][ T5331] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2919.934582][ T5331] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2954.214213][ T5340] xt_hashlimit: size too large, truncated to 1048576 [ 2964.017307][ T5344] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2964.316926][ T5344] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3055.257370][ T40] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3057.301081][ T40] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3061.857848][ T40] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3065.626609][ T40] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3095.396921][ T40] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 3095.806839][ T40] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 3096.407421][ T40] bond0 (unregistering): Released all slaves [ 3098.767440][ T40] hsr_slave_0: left promiscuous mode [ 3098.853015][ T40] hsr_slave_1: left promiscuous mode [ 3099.456825][ T40] veth1_macvtap: left promiscuous mode [ 3099.470830][ T40] veth0_macvtap: left promiscuous mode [ 3099.495596][ T40] veth1_vlan: left promiscuous mode [ 3099.515895][ T40] veth0_vlan: left promiscuous mode [ 3180.878311][ T5512] Illegal XDP return value 4294967294 on prog (id 6) dev syz_tun, expect packet loss! [ 3192.905990][ T5355] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 3193.303362][ T5355] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 3200.907654][ T5557] netlink: 'syz.2.198': attribute type 21 has an invalid length. [ 3200.911815][ T5557] netlink: 132 bytes leftover after parsing attributes in process `syz.2.198'. [ 3225.770561][ T5594] netlink: 24 bytes leftover after parsing attributes in process `syz.2.200'. [ 3233.941752][ T5355] hsr_slave_0: entered promiscuous mode [ 3233.994312][ T5355] hsr_slave_1: entered promiscuous mode [ 3234.087216][ T5355] debugfs: 'hsr0' already exists in 'hsr' [ 3234.101098][ T5355] Cannot create hsr debugfs directory [ 3260.467296][ T5355] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 3261.053641][ T5355] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 3261.388038][ T5355] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 3262.035921][ T5355] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 3284.488373][ T5736] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3284.648584][ T5736] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3302.552363][ T5355] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3320.316127][ T5754] netlink: 'syz.2.206': attribute type 13 has an invalid length. [ 3363.142041][ T5782] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3363.273392][ T5782] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3493.471129][ T5355] veth0_vlan: entered promiscuous mode [ 3495.677572][ T5355] veth1_vlan: entered promiscuous mode [ 3500.592231][ T5355] veth0_macvtap: entered promiscuous mode [ 3501.157675][ T5355] veth1_macvtap: entered promiscuous mode [ 3505.823999][ T5194] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 3505.827771][ T5194] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 3506.078293][ T4941] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 3506.092260][ T4941] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 3603.371555][ T5894] faux_driver vgem: [drm] Unknown color mode 181; guessing buffer size. [ 3624.971057][ T5905] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3625.166165][ T5905] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3681.493665][ T5935] vxcan1: Caught tx_queue_len zero misconfig [ 3724.384781][ T5948] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3724.497948][ T5948] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3735.533501][ T5954] ip6gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 3745.764049][ T5960] geneve1: entered promiscuous mode [ 3761.900547][ T5971] netlink: 12 bytes leftover after parsing attributes in process `syz.4.247'. [ 3804.772689][ T5988] netlink: 'syz.2.253': attribute type 21 has an invalid length. [ 3804.774878][ T5988] netlink: 132 bytes leftover after parsing attributes in process `syz.2.253'. [ 3815.231031][ T5993] netlink: 12 bytes leftover after parsing attributes in process `syz.2.255'. [ 3850.927075][ T6008] netlink: 8 bytes leftover after parsing attributes in process `syz.4.261'. [ 3915.045977][ T6035] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 3915.624945][ T6035] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 3940.515792][ T6045] ip6tnl0: Caught tx_queue_len zero misconfig [ 3973.051417][ T6054] binder: 6053:6054 ioctl c0306201 200000001440 returned -11 [ 4009.470410][ T6077] netlink: 104 bytes leftover after parsing attributes in process `syz.4.283'. [ 4020.546547][ T6081] binder: 6079:6081 ioctl c0306201 0 returned -14 [ 4058.071761][ T6111] macvtap1: entered promiscuous mode [ 4127.591546][ T6148] binder: 6147:6148 ioctl c0306201 0 returned -14 [ 4128.111483][ T6148] binder: BINDER_SET_CONTEXT_MGR already set [ 4128.112897][ T6148] binder: 6147:6148 ioctl 4018620d 200000000040 returned -16 [ 4152.682172][ T6159] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 4152.744645][ T6159] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 4205.072755][ T6182] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 4205.206076][ T6182] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 4227.295919][ T6191] binder: BINDER_SET_CONTEXT_MGR already set [ 4227.297707][ T6191] binder: 6188:6191 ioctl 4018620d 200000000040 returned -16 [ 4228.325790][ T6191] binder: 6188:6191 ioctl c0306201 200000001440 returned -11 [ 4331.335305][ T6226] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 4331.465602][ T6226] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 4428.264676][ T6265] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 4428.332860][ T6265] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 4494.082274][ T6297] lo: Caught tx_queue_len zero misconfig [ 4561.578141][ T6328] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 4562.226041][ T6328] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 4592.931589][ T6340] binder: 6339:6340 ioctl 4018620d 0 returned -22 [ 4638.307100][ T6359] binder: 6358:6359 ioctl 4018620d 0 returned -22 [ 4663.622975][ T6365] capability: warning: `syz.4.366' uses deprecated v2 capabilities in a way that may be insecure [ 4684.592587][ T6377] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 4684.821787][ T6377] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 4687.414372][ T6377] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 4687.553603][ T6377] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 4718.561662][ T6397] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 4718.628342][ T6397] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 4755.535396][ T6412] xt_connbytes: Forcing CT accounting to be enabled [ 4755.624019][ T6412] xt_CT: You must specify a L4 protocol and not use inversions on it [ 4759.233722][ T6414] netlink: 'syz.2.379': attribute type 1 has an invalid length. [ 4769.881824][ T6419] macvlan2: entered promiscuous mode [ 4769.883136][ T6419] macvlan2: entered allmulticast mode [ 4770.008344][ T6419] bond1: entered promiscuous mode [ 4770.073459][ T6419] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 4770.273127][ T6419] bond1: left promiscuous mode [ 4803.890805][ T6471] syz.4.384 uses obsolete (PF_INET,SOCK_PACKET) [ 4900.126883][ T6507] vcan0: tx drop: invalid da for name 0x0000000000000033 [ 4967.545679][ T6534] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 4967.698136][ T6534] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 5072.002129][ T6572] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 5072.104045][ T6572] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 5116.793856][ T6591] binder: 6590:6591 ioctl c0306201 200000001440 returned -11 [ 5270.978283][ T6636] fuse: Bad value for 'group_id' [ 5271.220760][ T6636] fuse: Bad value for 'group_id' [ 5317.103987][ T6072] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 5319.077368][ T6648] kthread_run failed with err -4 [ 5320.526797][ T6072] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 5323.967694][ T6072] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 5326.897404][ T6072] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 5333.465638][ T6662] fuse: Bad value for 'group_id' [ 5333.499952][ T6662] fuse: Bad value for 'group_id' [ 5351.697436][ T6072] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 5352.157170][ T6072] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 5352.743641][ T6072] bond0 (unregistering): Released all slaves [ 5354.675613][ T6072] bond1 (unregistering): Released all slaves [ 5358.491467][ T6072] hsr_slave_0: left promiscuous mode [ 5358.551295][ T6072] hsr_slave_1: left promiscuous mode [ 5359.369366][ T6072] veth1_macvtap: left promiscuous mode [ 5359.397752][ T6072] veth0_macvtap: left promiscuous mode [ 5359.424312][ T6072] veth1_vlan: left promiscuous mode [ 5359.427817][ T6072] veth0_vlan: left promiscuous mode [ 5373.937215][ T6677] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 5373.997738][ T6677] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 5419.375115][ T6714] binder: 6701:6714 ioctl c0306201 200000000040 returned -22 [ 5419.538063][ T6714] binder: 6701:6714 ioctl c0306201 0 returned -14 [ 5483.161441][ T6643] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 5483.734442][ T6643] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 5489.385667][ C1] ------------[ cut here ]------------ [ 5489.386262][ C1] WARNING: [irq_settings_is_per_cpu_devid(desc)] kernel/irq/manage.c:2150 at request_threaded_irq+0x320/0x38c, CPU#1: syz.4.451/6848 [ 5489.388895][ C1] Modules linked in: [ 5489.390791][ C1] CPU: 1 UID: 0 PID: 6848 Comm: syz.4.451 Tainted: G L syzkaller #0 PREEMPT [ 5489.391547][ C1] Tainted: [L]=SOFTLOCKUP [ 5489.391769][ C1] Hardware name: riscv-virtio,qemu (DT) [ 5489.392408][ C1] epc : request_threaded_irq+0x320/0x38c [ 5489.393116][ C1] ra : request_threaded_irq+0x320/0x38c [ 5489.393716][ C1] epc : ffffffff8033dfb0 ra : ffffffff8033dfb0 sp : ffff8f80030a77c0 [ 5489.394098][ C1] gp : ffffffff8a22a0c0 tp : ffffaf801ac74f80 t0 : 0000000000000000 [ 5489.394468][ C1] t1 : ffffffff91601820 t2 : ffffffff91601828 s0 : ffff8f80030a7820 [ 5489.394851][ C1] s1 : 0000000000000000 a0 : 0000000000000005 a1 : 0000000000000000 [ 5489.395189][ C1] a2 : 0000000000080000 a3 : ffffffff8033dfb0 a4 : ffff8f8005e11b18 [ 5489.395582][ C1] a5 : 0000000000010b18 a6 : 0000000000000003 a7 : ffffffff86864460 [ 5489.395946][ C1] s2 : 0000000000200000 s3 : ffffaf8011d1a000 s4 : 0000000000000002 [ 5489.396336][ C1] s5 : ffffffff84bcbc14 s6 : ffffaf801d1c0800 s7 : 0000000000000000 [ 5489.396709][ C1] s8 : ffffffff877b5b00 s9 : 0000000000020000 s10: ffffaf801d1c0800 [ 5489.397115][ C1] s11: 0000000000000001 t3 : 0000000000000001 t4 : 0000000000001fff [ 5489.397451][ C1] t5 : 00000000000000c8 t6 : 0000000000000002 ssp : 0000000000000000 [ 5489.397843][ C1] status: 0000000200000120 badaddr: ffffffff8033dfb0 cause: 0000000000000003 [ 5489.398345][ C1] [] request_threaded_irq+0x320/0x38c [ 5489.399131][ C1] [] parport_attach+0x780/0xb14 [ 5489.399858][ C1] [] comedi_device_attach+0x350/0x7ec [ 5489.400530][ C1] [] do_devconfig_ioctl+0x1a2/0x654 [ 5489.401035][ C1] [] comedi_unlocked_ioctl+0x750/0x30e0 [ 5489.401612][ C1] [] __riscv_sys_ioctl+0x17c/0x1e4 [ 5489.402112][ C1] [] syscall_handler+0x92/0x114 [ 5489.402816][ C1] [] do_trap_ecall_u+0x402/0x680 [ 5489.403395][ C1] [] handle_exception+0x15e/0x16a [ 5489.405150][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 5489.406071][ C1] CPU: 1 UID: 0 PID: 6848 Comm: syz.4.451 Tainted: G L syzkaller #0 PREEMPT [ 5489.406782][ C1] Tainted: [L]=SOFTLOCKUP [ 5489.407002][ C1] Hardware name: riscv-virtio,qemu (DT) [ 5489.407257][ C1] Call Trace: [ 5489.407463][ C1] [] dump_backtrace+0x2e/0x3c [ 5489.408166][ C1] [] show_stack+0x30/0x3c [ 5489.408710][ C1] [] dump_stack_lvl+0x114/0x1ac [ 5489.409480][ C1] [] dump_stack+0x1c/0x28 [ 5489.410171][ C1] [] vpanic+0x334/0x760 [ 5489.410670][ C1] [] trace_suspend_resume+0x0/0x420 [ 5489.411206][ C1] [] check_panic_on_warn+0xc0/0xe4 [ 5489.411744][ C1] [] __warn+0x216/0x654 [ 5489.412266][ C1] [] __report_bug+0x1d4/0x2ac [ 5489.412993][ C1] [] report_bug+0xd8/0x28c [ 5489.413696][ C1] [] handle_break+0x13a/0x30c [ 5489.414314][ C1] [] do_trap_break+0x188/0x358 [ 5489.414896][ C1] [] handle_exception+0x15e/0x16a [ 5489.415463][ C1] [] request_threaded_irq+0x320/0x38c [ 5489.416024][ C1] [] parport_attach+0x780/0xb14 [ 5489.416759][ C1] [] comedi_device_attach+0x350/0x7ec [ 5489.417390][ C1] [] do_devconfig_ioctl+0x1a2/0x654 [ 5489.417936][ C1] [] comedi_unlocked_ioctl+0x750/0x30e0 [ 5489.418541][ C1] [] __riscv_sys_ioctl+0x17c/0x1e4 [ 5489.419049][ C1] [] syscall_handler+0x92/0x114 [ 5489.419666][ C1] [] do_trap_ecall_u+0x402/0x680 [ 5489.420270][ C1] [] handle_exception+0x15e/0x16a [ 5489.421283][ C1] SMP: stopping secondary CPUs