last executing test programs: 14m10.09357637s ago: executing program 32 (id=1201): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="2c0000000206050000000000000000000000000005000400011d00000900020073797a320000000004"], 0x2c}, 0x1, 0x0, 0x0, 0x20000800}, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000280), 0xffff, 0x14f600) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.kill\x00', 0x275a, 0x0) mq_open(0x0, 0x2, 0x8, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x800080000000700, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x10]}}) 7m8.9793386s ago: executing program 33 (id=2176): openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x20040, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(0x0, 0x2, 0x143102) writev(r0, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) 6m53.293356676s ago: executing program 34 (id=2190): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='task\x00') getdents(r3, &(0x7f00000005c0)=""/180, 0xb4) 6m51.068153216s ago: executing program 2 (id=2195): socket(0x18, 0x3, 0x0) epoll_create1(0x0) socket$nl_generic(0x10, 0x3, 0x10) mkdir(&(0x7f00000002c0)='./file0\x00', 0x1e) lsetxattr$trusted_overlay_upper(&(0x7f0000000440)='./file0\x00', &(0x7f0000000500), 0x0, 0x0, 0x1) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000280)={0x1, 0x0, 0x73f0, 0x9}) socket$igmp(0x2, 0x3, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xa, 0x18, 0x8, 0x40, 0x42, 0x1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r1) r2 = fsopen(&(0x7f0000000080)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x8) r4 = openat$cgroup(r3, &(0x7f0000000100)='syz0\x00', 0x200002, 0x0) r5 = openat$cgroup_ro(r4, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) read$FUSE(r5, &(0x7f0000004000)={0x2020}, 0x2020) 6m50.489537067s ago: executing program 35 (id=2195): socket(0x18, 0x3, 0x0) epoll_create1(0x0) socket$nl_generic(0x10, 0x3, 0x10) mkdir(&(0x7f00000002c0)='./file0\x00', 0x1e) lsetxattr$trusted_overlay_upper(&(0x7f0000000440)='./file0\x00', &(0x7f0000000500), 0x0, 0x0, 0x1) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000280)={0x1, 0x0, 0x73f0, 0x9}) socket$igmp(0x2, 0x3, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xa, 0x18, 0x8, 0x40, 0x42, 0x1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r1) r2 = fsopen(&(0x7f0000000080)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x8) r4 = openat$cgroup(r3, &(0x7f0000000100)='syz0\x00', 0x200002, 0x0) r5 = openat$cgroup_ro(r4, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) read$FUSE(r5, &(0x7f0000004000)={0x2020}, 0x2020) 6m41.209952942s ago: executing program 36 (id=2202): openat(0xffffff9c, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_sctp(0xa, 0x1, 0x84) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=[@cred={{0x1c}}, @rights={{0x10}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x78}, 0x400000e0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0), 0x20000, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = dup(r4) syz_ublk_setup_queues(r5, r3, &(0x7f0000000880)={0x0, 0xfffffffe, 0x800, 0x4, 0x104}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x800, 0x0, 0x6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c84, 0x8000, 0x3, 0xbab}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2ced, 0x2, 0x1, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x20ec4b, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 6m23.464078499s ago: executing program 6 (id=2207): openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) r1 = fsopen(&(0x7f0000000040)='devtmpfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) mmap(&(0x7f00005b7000/0x1000)=nil, 0x1000, 0x2000009, 0x1010, r2, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0xe22, 0x8000, @private0={0xfc, 0x0, '\x00', 0x1}, 0x9}, 0x1c) mkdirat(0xffffffffffffff9c, 0x0, 0x1d2) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, 0x0, 0x40) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) socket$can_j1939(0x1d, 0x2, 0x7) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, 0x0, 0x1) write$sysctl(0xffffffffffffffff, &(0x7f0000000580)='1\x00', 0x2) fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000080)={[{0x2b, 'rdma'}]}, 0x6) 6m22.892333189s ago: executing program 6 (id=2208): r0 = socket$inet_sctp(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) vmsplice(r3, &(0x7f0000000540)=[{&(0x7f00000003c0)="16", 0x1}], 0x1, 0xd) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) splice(r2, 0x0, r4, 0x0, 0x6, 0xc) ioctl$FIONREAD(r3, 0x541b, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) openat$cgroup(0xffffffffffffffff, 0x0, 0x200002, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ff9000/0x4000)=nil, 0x4000, &(0x7f0000000280)='/dev/vcsa\x00') sendmsg$nl_route(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x10}, 0x4044) 6m22.237533753s ago: executing program 37 (id=2208): r0 = socket$inet_sctp(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) splice(r1, 0x0, r3, 0x0, 0x6, 0x0) vmsplice(r3, &(0x7f0000000540)=[{&(0x7f00000003c0)="16", 0x1}], 0x1, 0xd) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) splice(r2, 0x0, r4, 0x0, 0x6, 0xc) ioctl$FIONREAD(r3, 0x541b, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) openat$cgroup(0xffffffffffffffff, 0x0, 0x200002, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ff9000/0x4000)=nil, 0x4000, &(0x7f0000000280)='/dev/vcsa\x00') sendmsg$nl_route(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x10}, 0x4044) 5m36.539120315s ago: executing program 38 (id=2247): socket$netlink(0x10, 0x3, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r0, 0x0, 0x0) 5m8.497756104s ago: executing program 9 (id=2291): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0xb05, 0x1807, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x0, 0x4}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x6a855000) syz_open_dev$sndpcmc(0x0, 0x0, 0x2) r1 = socket$inet6(0xa, 0x3, 0x1) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00003, 0x3000007, 0x401d032, 0xffffffffffffffff, 0x0) pipe(0x0) move_pages(0x0, 0x2064, &(0x7f0000000040)=[&(0x7f0000ff9000/0x2000)=nil], &(0x7f0000001180), &(0x7f0000000000), 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2}) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454d1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x560, 0x0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x490, 0xffffffff, 0xffffffff, 0x490, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'vxcan1\x00', {0x8}}}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xfd}}, [], [0x0, 0xffffffff], 'pim6reg\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x3a0, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_virt_wifi\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x5}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'bridge_slave_0\x00', {0x53}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x5c0) r2 = socket(0xa, 0x5, 0x0) sendmsg$inet(r2, &(0x7f0000000480)={&(0x7f00000000c0)={0x2, 0x4e24, @rand_addr=0x64010101}, 0x10, 0x0}, 0x40288d4) sendmsg$inet_sctp(r2, &(0x7f0000000140)={&(0x7f0000000000)=@in6={0xa, 0x4e24, 0x80000ff, @loopback, 0xb}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000080)="fb", 0x1}], 0x1, &(0x7f0000000040)=[@dstaddrv4={0x18, 0x84, 0x7, @rand_addr=0x64010101}], 0x18, 0x4855}, 0x24000052) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8923, &(0x7f0000000080)={'bridge_slave_0\x00', @random="0131be7839ff"}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 4m52.209090636s ago: executing program 39 (id=2291): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0xb05, 0x1807, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x20, 0x2, "", [{{0x9, 0x4, 0x0, 0x5, 0x2, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x0, 0x40, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x0, 0x4}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x6a855000) syz_open_dev$sndpcmc(0x0, 0x0, 0x2) r1 = socket$inet6(0xa, 0x3, 0x1) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00003, 0x3000007, 0x401d032, 0xffffffffffffffff, 0x0) pipe(0x0) move_pages(0x0, 0x2064, &(0x7f0000000040)=[&(0x7f0000ff9000/0x2000)=nil], &(0x7f0000001180), &(0x7f0000000000), 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2}) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454d1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000580)=@raw={'raw\x00', 0x8, 0x3, 0x560, 0x0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x490, 0xffffffff, 0xffffffff, 0x490, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'vxcan1\x00', {0x8}}}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xfd}}, [], [0x0, 0xffffffff], 'pim6reg\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x3a0, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_virt_wifi\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x5}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast2, 'bridge_slave_0\x00', {0x53}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x5c0) r2 = socket(0xa, 0x5, 0x0) sendmsg$inet(r2, &(0x7f0000000480)={&(0x7f00000000c0)={0x2, 0x4e24, @rand_addr=0x64010101}, 0x10, 0x0}, 0x40288d4) sendmsg$inet_sctp(r2, &(0x7f0000000140)={&(0x7f0000000000)=@in6={0xa, 0x4e24, 0x80000ff, @loopback, 0xb}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000080)="fb", 0x1}], 0x1, &(0x7f0000000040)=[@dstaddrv4={0x18, 0x84, 0x7, @rand_addr=0x64010101}], 0x18, 0x4855}, 0x24000052) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8923, &(0x7f0000000080)={'bridge_slave_0\x00', @random="0131be7839ff"}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 4m41.548974063s ago: executing program 40 (id=2299): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x530, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x460, 0xffffffff, 0xffffffff, 0x460, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1d8, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1, [0xff000000, 0xffffffff, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x39a}, 0x100, 0x20}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @local}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x590) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'syz_tun\x00'}) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f00000006c0)=ANY=[@ANYBLOB="18020000000000000000000000000000850000001700000095"], &(0x7f00000005c0)='GPL\x00'}, 0x94) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'batadv_slave_1\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={r2, r3, 0x25, 0x0, @val=@tracing={0x0, 0x800007f}}, 0x20) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000002c0)={@fallback=r2, 0x34, 0x0, 0x8, &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x7, 0x0, &(0x7f0000000180)=[0x0], &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0]}, 0x40) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000300)={0x3}, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r4 = getpgrp(0x0) sched_setaffinity(r4, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r6 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x1, 0x0) r7 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) rt_sigqueueinfo(r4, 0x33, &(0x7f00000000c0)={0x9, 0x7, 0x8000}) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r6, 0x8, &(0x7f00000002c0)=0x80000000000003) r8 = syz_open_dev$cec(&(0x7f0000000200), 0xffffffffffffffff, 0xc8520) ioctl$CEC_ADAP_S_LOG_ADDRS(r8, 0xc05c6104, &(0x7f0000000040)={"dfff00", 0x0, 0x5, 0x6, 0xfffffff9, 0xe, "00000000020000000000002100", "00000001", "0052008f", "0000f807", ["fdd5c01000", "0000000000000400", "00f638000000007c0300", "ffe9ff00"]}) ioctl$CEC_TRANSMIT(r8, 0xc0386105, &(0x7f0000000100)={0xfffffffffffffbf7, 0x1, 0x2, 0x0, 0x4, 0x7ffe, "7f2c00", 0x1, 0x56, 0x1, 0xfa, 0x9, 0x1}) ioctl$CEC_ADAP_S_LOG_ADDRS(r8, 0xc05c6104, &(0x7f0000000140)={"4497acf4", 0xb, 0x4, 0x0, 0x3, 0x1000006, "5500578ea5f4ffffffeb00001000", "1575b859", '\x00', '\'q6O', ["aabe8459c62224475793e8a7", "7f9ce2d2c4f439ff80e1d1c8", "a407001fda16d100"]}) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0xd4, 0x30, 0x200, 0x0, 0x0, {}, [{0xc0, 0x1, [@m_pedit={0xbc, 0x12, 0x0, 0x0, {{0xa}, {0x4}, {0x90, 0x6, "8fbe0e94e172a438285bee5b8680ead4fb0e68e2e4cb771dde8372bc6d6af3d71000d7264aaa793762cbda1b84b54696364f89537805c00f65ed7d0c3a0b08706f90ebbef60178dba81aafa500bd10197238d57f4d1ff993682cadd0efad0f7b1767c2029b96bba6c12ead887ecc10f32c8ddcb54a3a3b87660ea51a0c626367aa6eb72cb34c1476b01e6ac5"}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}]}]}, 0xd4}}, 0x4040) 3m18.3414297s ago: executing program 41 (id=2410): socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, 0x0, 0x50) setns(0xc9, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b1b, &(0x7f0000000000)={'wlan1\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3b}}) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r3, &(0x7f0000000840)=[{0x0}], 0x1) socket$packet(0x11, 0xa, 0x300) r4 = socket(0x1e, 0x4, 0x0) connect$tipc(r4, &(0x7f0000000040)=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x10) sendmmsg$unix(r4, &(0x7f0000004400), 0x400000000000203, 0x0) getsockopt$TIPC_SRC_DROPPABLE(r4, 0x10f, 0x80, 0x0, 0x0) 2m39.452442301s ago: executing program 7 (id=2454): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000100)=0x5) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) get_mempolicy(&(0x7f0000000400), 0x0, 0x5, &(0x7f00001ec000/0x3000)=nil, 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x47, &(0x7f0000000200)=0x7) keyctl$describe(0x6, 0x0, 0x0, 0x0) syz_emit_vhci(0x0, 0x7) sendfile(r0, r0, 0x0, 0x200000) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x8c5) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r5 = io_uring_setup(0x899, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) io_uring_enter(r5, 0x2219, 0x7721, 0x16, 0x0, 0x0) 2m35.858456338s ago: executing program 2 (id=2411): socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000500008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f0000000080)=0x7) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000540)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x90}, 0x4000010) socket$nl_generic(0x10, 0x3, 0x10) mount(&(0x7f0000000140)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='qnx6\x00', 0x2000802, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x12, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) r5 = socket$unix(0x1, 0x1, 0x0) landlock_create_ruleset(0x0, 0x0, 0x0) bind$unix(r5, &(0x7f0000003000)=@file={0x1}, 0x6e) listen(r5, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000640)=@file={0x1}, 0x6e) 2m33.26173073s ago: executing program 2 (id=2458): mkdirat(0xffffffffffffff9c, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2, 0x10b) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0xa7f3bbc663947270, 0x0, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f00000028c0), 0x8400, 0x0) read$FUSE(r3, &(0x7f000000a980)={0x2020}, 0x2020) 2m23.764892448s ago: executing program 42 (id=2454): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000100)=0x5) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) get_mempolicy(&(0x7f0000000400), 0x0, 0x5, &(0x7f00001ec000/0x3000)=nil, 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x47, &(0x7f0000000200)=0x7) keyctl$describe(0x6, 0x0, 0x0, 0x0) syz_emit_vhci(0x0, 0x7) sendfile(r0, r0, 0x0, 0x200000) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x8c5) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r5 = io_uring_setup(0x899, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) io_uring_enter(r5, 0x2219, 0x7721, 0x16, 0x0, 0x0) 2m18.03360942s ago: executing program 43 (id=2458): mkdirat(0xffffffffffffff9c, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2, 0x10b) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0xa7f3bbc663947270, 0x0, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f00000028c0), 0x8400, 0x0) read$FUSE(r3, &(0x7f000000a980)={0x2020}, 0x2020) 1m23.527363779s ago: executing program 3 (id=2545): sendmsg$key(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x4, 0x0, &(0x7f00008feff0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="020d0000100000002f3144e8edffffff03000600ff18000002004909000100000000000000001e0e080012000200010000d200000000000030006c540203009f7eae02000000adb20200000000f52c000000cdff00000001020014bb000001000000"], 0x80}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x4, &(0x7f0000000080)=@framed={{}, [@alu={0x7, 0x1, 0xb}]}, &(0x7f00000000c0)='GPL\x00'}, 0x90) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x60}, 0x1, 0x0, 0x0, 0x10040003}, 0x8008880) r0 = socket$netlink(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x8000) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000940)=ANY=[@ANYBLOB="58000000020601080000000000000000030000000900020073797a3100000000050001000700000005000500020000000c000780080006400000040111000300686173683a6e65742c6e657400000000050004"], 0x58}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000580)=ANY=[@ANYBLOB="50000000090601020000000000006ce6016000000900020073797a31000000000500010007000000280007800c00018008000140640101010c00148008000140ac1414bb0c0002800800"], 0x50}, 0x1, 0x0, 0x0, 0xd24f4d5778621d46}, 0x4) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000400)={0x1c, 0x4, 0x6, 0x101, 0x0, 0x0, {0x2, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x20004000) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) flock(0xffffffffffffffff, 0x2) 1m23.166959748s ago: executing program 3 (id=2546): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000b80)) r1 = socket$packet(0x11, 0x3, 0x300) r2 = dup(0xffffffffffffffff) r3 = fcntl$dupfd(r0, 0x406, r1) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000340)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/251, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000080)={0x0, r2}) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r4, 0xffffffffffffffff, 0x0) 1m22.820812766s ago: executing program 3 (id=2547): openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_sctp(0xa, 0x1, 0x84) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$packet(0x11, 0x3, 0x300) socket$netlink(0x10, 0x3, 0x4) stat(&(0x7f0000000340)='./file0\x00', 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000004900)={0x20, 0xd, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x2}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}]}, 0x20}}, 0x8000) mount$9p_virtio(&(0x7f0000000140), &(0x7f0000000180)='./sys\x00', &(0x7f0000000280), 0xc000, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x0, 0x0}}, &(0x7f0000000300)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/class/scsi_host/host0/scan\x00', 0x1, 0x0) write(r2, &(0x7f00000001c0)='- 0 -', 0x5) 1m20.120081665s ago: executing program 3 (id=2548): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x902, 0x4) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r1, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, 0xffffffffffffffff, 0x0}]) 1m19.593221333s ago: executing program 3 (id=2549): openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x3) ioctl$KVM_SET_LAPIC(r1, 0x4400ae8f, &(0x7f0000000340)={"fc399059429f41c88f296da1344951f21a435e19d50734dcdf95eeba160ba72052873e0026ba12320a8492197085aa330e9316fb7603b15e454c8518763baeac308191e250e15a58aabf5b3ecd13f87a62de7b72e0d24c693a4b21639331bee6cbf30563b863d82034aee0bef82ba3b85db024ba1cac050657f2579dcb891cee731766753a258801a5f767d6797981ce206eadbbef536bd8772a48f1833e360e1050cab4bf10d003258d679e49d70239b04adcfdccf1ea5ede82d17891e08a895bd6bd93b87ea8fd1f2a29894ecda469cd461defa657ee9eb2551ad7c53c9f0d52a049bfaaff3bac655367e385916168d61d3580daf26ecd3be14f55b0e513f3c3c955b06a7c197d562c2a855b44ee58bac8ed58400d42e085c9b1a839bad2f9b66ea5b7581ac715debda61a8007f39363f1c699922c05f3b35b08f1771370844b2a8a13b578141465fd38d1a7545a2a9ed8ca76956ca01b32fee4b86643bb26173c6b75e9ceb5c4fb2b23a19ec2e26860f474d73c60c6dee9c4eeb4d4a54cb0f8353aa2656df3d1cfb03df8a54de9cba19ce450a4ac51b1727f92b30b3bad901b4c2d95767fd47436d7041c93bc41c67487ac434b3881ac8caba2f42c587edce816b1fbcf68a5d03504f5ef00fea3632c8e21bb90a9a7b032b3f7c2952b49770bc5a335327b87a8a95c798d829096ab18206bf9718ac42b65f13d78e8278fdcd7f63cf4e9d1b5e27f8adb0f8ef70990c32fed48c361a67d501bc9afbbd48e248affbd1a1c901cfeb769eea352bbb215ac145c9098fa0240fc188cfc2640854f159aab147fe1455294d4faab8101f0af30a8089cab96b3edccccfb837d2d4a57632e320d16d6353045a0a01902b736d66a7556407c1daa945ae9e539ac45e235f09ef59a924e92d0637cdd5f3a7fd85a440e30b1a616cb391e54c9b43453fa1a4c337f3431ff05fc70cdbd5fc704b50f6f96bf0d67c2e90fbf583a974d51a30db97aea64a62358b65a6c699a20cf11db8d0dd1cda8d56efdc38da1c0791ded177b93035be018ab4ca7998a713c16f96ae6b88192899d53ffd3f14dfdccb99ea6fbe2d52a0a428de9b9cc908750ea613f26b3f409e5d430936550036cef1980646780c3a5c76b5fc5a77aa5187d5f3e5b6aa8ee63720a2ece54d241b3dff1c904b5f5d40790d4a7689464fc118d88a95b6d4a1b8606eeaf8134e329ab9194f4b37986597218c5130a1af65157c76b8505205087731a58b7bbfaf648d9d3d4b1ed440f2cae5a4432895100046641a0d94526b63887c79842452c6c6d5472ab032485cf22e62abb2b3137572670088f7e98f317aa14a1d21a38fa558624a3832bcd4bda0ba8dc1d87e53ae2f9d95930ba03022e5127c46d02427a49213e406c800a11c8b0373b9ca73eae0085460e62e88eb35fe3a80832ca1dcc3a4d95aceaa714"}) openat$kvm(0xffffffffffffff9c, 0x0, 0x101100, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r3, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0x78b}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) ioctl$KVM_SET_VCPU_EVENTS(r4, 0x4040aea0, &(0x7f0000000080)=@x86={0x6b, 0x4, 0x8, 0x0, 0x0, 0x0, 0x4, 0xa, 0xd, 0x1, 0x8, 0x8, 0x0, 0x2, 0x9, 0x3, 0x3, 0x2e, 0x4, '\x00', 0x1, 0xffffffffffffff7f}) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r4, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000000c0)={[0x800, 0x4, 0x81, 0x4, 0x8, 0x0, 0x7, 0x12, 0x400, 0x80000004, 0xfffffffffffffffc, 0x7, 0x5, 0x6, 0x100000000001], 0x1000, 0x4fb40}) ioctl$KVM_SET_MP_STATE(r4, 0x4004ae99, &(0x7f0000000000)=0x3) ioctl$KVM_RUN(r4, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r0, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, &(0x7f0000000080)="d8df0f23b3b9ce000000b807000000ba000000000f301b8154fea900c1210680320000c4e28ddc8dcd000000c182fd3f0000c8b950020000b801000400b9a6080000b800000100265d7aeabbc900bbc9000f30300f272d9d53bf0000c4b9e16dc30101220f01c3", 0xffffffffffffff72}], 0x1, 0x14, 0x0, 0x0) ioctl$KVM_RUN(r0, 0xae80, 0x0) 1m18.896392869s ago: executing program 3 (id=2550): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4) r0 = syz_open_dev$sg(&(0x7f0000002440), 0x0, 0x141000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) getpgrp(r1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x4) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) add_key$user(&(0x7f0000000380), &(0x7f0000000000)={'syz', 0x0}, &(0x7f0000000140)='_', 0x1, 0xfffffffffffffffe) add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) add_key$user(&(0x7f0000006400), &(0x7f0000006c00)={'syz', 0x3}, &(0x7f0000000980)="3e12d23d346cfdeb1716f738274bc1c03bee4423fa20837e6e86b86592e9be8351aabbd6e24f37d5095f839fa4a3507df4f7526f2440e7988da94ccd868dd8741d1e2d7ae6a21d056c2c51a416a76b1a03dc55ea62", 0x55, 0xfffffffffffffffe) keyctl$dh_compute(0x17, 0x0, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'sha256\x00'}}) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000340)=0xc291) openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x1e5) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) 1m18.171488549s ago: executing program 44 (id=2550): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x4) r0 = syz_open_dev$sg(&(0x7f0000002440), 0x0, 0x141000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) getpgrp(r1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x4) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) add_key$user(&(0x7f0000000380), &(0x7f0000000000)={'syz', 0x0}, &(0x7f0000000140)='_', 0x1, 0xfffffffffffffffe) add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) add_key$user(&(0x7f0000006400), &(0x7f0000006c00)={'syz', 0x3}, &(0x7f0000000980)="3e12d23d346cfdeb1716f738274bc1c03bee4423fa20837e6e86b86592e9be8351aabbd6e24f37d5095f839fa4a3507df4f7526f2440e7988da94ccd868dd8741d1e2d7ae6a21d056c2c51a416a76b1a03dc55ea62", 0x55, 0xfffffffffffffffe) keyctl$dh_compute(0x17, 0x0, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'sha256\x00'}}) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000340)=0xc291) openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x1e5) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) 1m18.1623739s ago: executing program 1 (id=2552): sendmsg$key(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x4, 0x0, &(0x7f00008feff0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="020d0000100000002f3144e8edffffff03000600ff18000002004909000100000000000000001e0e080012000200010000d200000000000030006c540203009f7eae02000000adb20200000000f52c000000cdff00000001020014bb000001000000"], 0x80}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x4, &(0x7f0000000080)=@framed={{}, [@alu={0x7, 0x1, 0xb}]}, &(0x7f00000000c0)='GPL\x00'}, 0x90) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x60}, 0x1, 0x0, 0x0, 0x10040003}, 0x8008880) r0 = socket$netlink(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x8000) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000940)=ANY=[@ANYBLOB="58000000020601080000000000000000030000000900020073797a3100000000050001000700000005000500020000000c000780080006400000040111000300686173683a6e65742c6e657400000000050004"], 0x58}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000580)=ANY=[@ANYBLOB="50000000090601020000000000006ce6016000000900020073797a31000000000500010007000000280007800c00018008000140640101010c00148008000140ac1414bb0c0002800800"], 0x50}, 0x1, 0x0, 0x0, 0xd24f4d5778621d46}, 0x4) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000400)={0x1c, 0x4, 0x6, 0x101, 0x0, 0x0, {0x2, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x20004000) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) flock(0xffffffffffffffff, 0x2) 1m17.840117524s ago: executing program 1 (id=2553): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000b80)) r1 = socket$packet(0x11, 0x3, 0x300) r2 = dup(0xffffffffffffffff) r3 = fcntl$dupfd(r0, 0x406, r1) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000340)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/251, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000080)={0x0, r2}) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r4, 0xffffffffffffffff, 0x0) 1m17.526165816s ago: executing program 1 (id=2554): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000180)={0x1}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000002000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000040)="0f01cb650f7410262e66f36d0f330f09660f3a0cb90000a6752066b9800000c00f326635004000000f300f01d7ba4100ed", 0x31}], 0x1, 0x4498bda7e2139f37, 0x0, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000100)={[{0x9, 0xfff, 0x7, 0x0, 0x12, 0x8, 0x40, 0x4, 0x2b, 0x2, 0x7, 0x0, 0x7fffffffffffffff}, {0x7ff, 0x1ff, 0x9, 0x18, 0x9, 0x81, 0x97, 0x40, 0x5, 0xbc, 0x4, 0x9, 0x3}, {0xd3, 0x80b0, 0x5, 0x2, 0x84, 0x9, 0xfc, 0xe, 0xe, 0x9, 0xe, 0x6, 0x4}]}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x3, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000240)={[0x0, 0x5, 0x40, 0x40, 0x0, 0x3, 0x2004cb, 0x4000000000000000, 0x2, 0x3, 0x0, 0x7, 0x5, 0x2, 0x9, 0x1], 0x80a0000, 0x451}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1m17.028427919s ago: executing program 1 (id=2555): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x902, 0x4) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r1, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, 0xffffffffffffffff, 0x0}]) 1m16.256021577s ago: executing program 1 (id=2556): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x3) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000340)={"fc399059429f41c88f296da1344951f21a435e19d50734dcdf95eeba160ba72052873e0026ba12320a8492197085aa330e9316fb7603b15e454c8518763baeac308191e250e15a58aabf5b3ecd13f87a62de7b72e0d24c693a4b21639331bee6cbf30563b863d82034aee0bef82ba3b85db024ba1cac050657f2579dcb891cee731766753a258801a5f767d6797981ce206eadbbef536bd8772a48f1833e360e1050cab4bf10d003258d679e49d70239b04adcfdccf1ea5ede82d17891e08a895bd6bd93b87ea8fd1f2a29894ecda469cd461defa657ee9eb2551ad7c53c9f0d52a049bfaaff3bac655367e385916168d61d3580daf26ecd3be14f55b0e513f3c3c955b06a7c197d562c2a855b44ee58bac8ed58400d42e085c9b1a839bad2f9b66ea5b7581ac715debda61a8007f39363f1c699922c05f3b35b08f1771370844b2a8a13b578141465fd38d1a7545a2a9ed8ca76956ca01b32fee4b86643bb26173c6b75e9ceb5c4fb2b23a19ec2e26860f474d73c60c6dee9c4eeb4d4a54cb0f8353aa2656df3d1cfb03df8a54de9cba19ce450a4ac51b1727f92b30b3bad901b4c2d95767fd47436d7041c93bc41c67487ac434b3881ac8caba2f42c587edce816b1fbcf68a5d03504f5ef00fea3632c8e21bb90a9a7b032b3f7c2952b49770bc5a335327b87a8a95c798d829096ab18206bf9718ac42b65f13d78e8278fdcd7f63cf4e9d1b5e27f8adb0f8ef70990c32fed48c361a67d501bc9afbbd48e248affbd1a1c901cfeb769eea352bbb215ac145c9098fa0240fc188cfc2640854f159aab147fe1455294d4faab8101f0af30a8089cab96b3edccccfb837d2d4a57632e320d16d6353045a0a01902b736d66a7556407c1daa945ae9e539ac45e235f09ef59a924e92d0637cdd5f3a7fd85a440e30b1a616cb391e54c9b43453fa1a4c337f3431ff05fc70cdbd5fc704b50f6f96bf0d67c2e90fbf583a974d51a30db97aea64a62358b65a6c699a20cf11db8d0dd1cda8d56efdc38da1c0791ded177b93035be018ab4ca7998a713c16f96ae6b88192899d53ffd3f14dfdccb99ea6fbe2d52a0a428de9b9cc908750ea613f26b3f409e5d430936550036cef1980646780c3a5c76b5fc5a77aa5187d5f3e5b6aa8ee63720a2ece54d241b3dff1c904b5f5d40790d4a7689464fc118d88a95b6d4a1b8606eeaf8134e329ab9194f4b37986597218c5130a1af65157c76b8505205087731a58b7bbfaf648d9d3d4b1ed440f2cae5a4432895100046641a0d94526b63887c79842452c6c6d5472ab032485cf22e62abb2b3137572670088f7e98f317aa14a1d21a38fa558624a3832bcd4bda0ba8dc1d87e53ae2f9d95930ba03022e5127c46d02427a49213e406c800a11c8b0373b9ca73eae0085460e62e88eb35fe3a80832ca1dcc3a4d95aceaa714"}) openat$kvm(0xffffffffffffff9c, 0x0, 0x101100, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r4, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0x78b}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) ioctl$KVM_SET_VCPU_EVENTS(r5, 0x4040aea0, &(0x7f0000000080)=@x86={0x6b, 0x4, 0x8, 0x0, 0x0, 0x0, 0x4, 0xa, 0xd, 0x1, 0x8, 0x8, 0x0, 0x2, 0x9, 0x3, 0x3, 0x2e, 0x4, '\x00', 0x1, 0xffffffffffffff7f}) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r5, 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f00000000c0)={[0x800, 0x4, 0x81, 0x4, 0x8, 0x0, 0x7, 0x12, 0x400, 0x80000004, 0xfffffffffffffffc, 0x7, 0x5, 0x6, 0x100000000001], 0x1000, 0x4fb40}) ioctl$KVM_SET_MP_STATE(r5, 0x4004ae99, &(0x7f0000000000)=0x3) ioctl$KVM_RUN(r5, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r0, r1, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, &(0x7f0000000080)="d8df0f23b3b9ce000000b807000000ba000000000f301b8154fea900c1210680320000c4e28ddc8dcd000000c182fd3f0000c8b950020000b801000400b9a6080000b800000100265d7aeabbc900bbc9000f30300f272d9d53bf0000c4b9e16dc30101220f01c3", 0xffffffffffffff72}], 0x1, 0x14, 0x0, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) 1m15.434586143s ago: executing program 1 (id=2557): socket$packet(0x11, 0x2, 0x300) bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) r0 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_DQEVENT(r0, 0x80885659, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f00000000c0)={0x3, 0x980900, 0x3}) writev(0xffffffffffffffff, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) pipe(0x0) r1 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x2) fchdir(r2) mkdir(0x0, 0x0) mkdir(&(0x7f0000000240)='./file0/file0\x00', 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) 1m14.832139573s ago: executing program 45 (id=2557): socket$packet(0x11, 0x2, 0x300) bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) r0 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_DQEVENT(r0, 0x80885659, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f00000000c0)={0x3, 0x980900, 0x3}) writev(0xffffffffffffffff, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) pipe(0x0) r1 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x2) fchdir(r2) mkdir(0x0, 0x0) mkdir(&(0x7f0000000240)='./file0/file0\x00', 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) 56.471583495s ago: executing program 4 (id=2467): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) fallocate(0xffffffffffffffff, 0x20, 0x0, 0x4000) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) statx(r0, 0x0, 0x1000, 0xf0cb2f4a0c2cfc5d, 0x0) 56.228398375s ago: executing program 4 (id=2559): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x2}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000b80)) r1 = socket$packet(0x11, 0x3, 0x300) r2 = dup(0xffffffffffffffff) r3 = fcntl$dupfd(r0, 0x406, r1) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000340)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/251, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r3, 0x4008af30, &(0x7f0000000080)={0x0, r2}) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r4, 0xffffffffffffffff, 0x0) 55.954733921s ago: executing program 4 (id=2560): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000000c0)={0x60, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0xfffd}, [@IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x18, 0x7, 0x0, 0x1, [@IPSET_ATTR_CIDR={0x5, 0x3, 0x1f}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x60}}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10048047}, 0x4000050) 55.801749867s ago: executing program 4 (id=2561): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x902, 0x4) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r1, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, 0xffffffffffffffff, 0x0}]) 55.334896714s ago: executing program 4 (id=2562): bpf$MAP_CREATE(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x25, 0x0, 0x0) bind$inet(r4, &(0x7f00000001c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10) connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x0) 54.564382222s ago: executing program 4 (id=2563): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) setns(0xc9, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x40, r0, 0xb97534d5fe9704cf, 0x70bd29, 0xfffffffc, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x800}, @NL80211_ATTR_PEER_AID={0x6, 0xb5, 0x2c9}, @NL80211_ATTR_STA_FLAGS={0x4}]}, 0x40}, 0x1, 0x0, 0x0, 0x404c000}, 0x0) 53.789671811s ago: executing program 46 (id=2563): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) setns(0xc9, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x40, r0, 0xb97534d5fe9704cf, 0x70bd29, 0xfffffffc, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x800}, @NL80211_ATTR_PEER_AID={0x6, 0xb5, 0x2c9}, @NL80211_ATTR_STA_FLAGS={0x4}]}, 0x40}, 0x1, 0x0, 0x0, 0x404c000}, 0x0) 48.771481105s ago: executing program 6 (id=2473): io_uring_setup(0x2a8d, &(0x7f0000000240)={0x0, 0x86a1, 0x2, 0x3, 0x1ff}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240), 0x48103, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) getpid() openat$sysfs(0xffffffffffffff9c, 0x0, 0x122102, 0x0) times(0xfffffffffffffffe) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, 0x0) sendmsg$nl_route(r1, 0x0, 0x4054) setns(0xc9, 0x0) r3 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r3, 0x114, 0x8, &(0x7f0000000200), 0x4) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r4, 0x5403, &(0x7f0000000000)={0x3, 0x8, 0xd, 0x0, 0x16, "bae9b23b2225cb76ef3ebbbf666395606aed1a"}) socketpair$unix(0x1, 0x2, 0x0, 0x0) io_uring_setup(0x5ba8, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="380000003f000500010000000000000001010000000000000f0001006f76732d73797374656d00000800020000000000080009002a000000"], 0x38}}, 0x0) 48.071534561s ago: executing program 6 (id=2567): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x902, 0x4) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, 0x0) io_submit(0x0, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r1, 0x0}]) 47.644460242s ago: executing program 6 (id=2568): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x0) syz_emit_ethernet(0x7e, &(0x7f0000000300)={@local, @local, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x48, 0x11, 0x0, @remote, @local, {[], {0x4e20, 0xe22, 0x48, 0x0, @wg=@cookie={0x3, 0x2, "88c73b21f267636d01dbe5712c1c941e1cdafbbb43f09c28", "e13808ca72381f41e5fff9620915b6f78670dfaf9a2038083179cf6b7931c9b4"}}}}}}}, 0x0) 44.139335025s ago: executing program 9 (id=2558): sendmsg$key(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000100)={0x4, 0x0, &(0x7f00008feff0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="020d0000100000002f3144e8edffffff03000600ff18000002004909000100000000000000001e0e080012000200010000d200000000000030006c540203009f7eae02000000adb20200000000f52c000000cdff00000001020014bb000001000000"], 0x80}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x4, &(0x7f0000000080)=@framed={{}, [@alu={0x7, 0x1, 0xb}]}, &(0x7f00000000c0)='GPL\x00'}, 0x90) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x60}, 0x1, 0x0, 0x0, 0x10040003}, 0x8008880) r0 = socket$netlink(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x8000) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000940)=ANY=[@ANYBLOB="58000000020601080000000000000000030000000900020073797a3100000000050001000700000005000500020000000c000780080006400000040111000300686173683a6e65742c6e657400000000050004"], 0x58}, 0x1, 0x0, 0x0, 0x20008000}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000580)=ANY=[@ANYBLOB="50000000090601020000000000006ce6016000000900020073797a31000000000500010007000000280007800c00018008000140640101010c00148008000140ac1414bb0c0002800800"], 0x50}, 0x1, 0x0, 0x0, 0xd24f4d5778621d46}, 0x4) sendmsg$IPSET_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000400)={0x1c, 0x4, 0x6, 0x101, 0x0, 0x0, {0x2, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x20004000) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) flock(0xffffffffffffffff, 0x2) 44.072434665s ago: executing program 6 (id=2571): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r1, 0x2, &(0x7f0000000000)=0x80000000000003) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0) ioctl$RTC_UIE_ON(r3, 0x7003) 43.26497842s ago: executing program 47 (id=2571): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r1, 0x2, &(0x7f0000000000)=0x80000000000003) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x140, 0x0) ioctl$RTC_UIE_ON(r3, 0x7003) 43.252305892s ago: executing program 9 (id=2573): io_uring_setup(0x2a8d, &(0x7f0000000240)={0x0, 0x86a1, 0x2, 0x3, 0x1ff}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240), 0x48103, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) getpid() openat$sysfs(0xffffffffffffff9c, 0x0, 0x122102, 0x0) times(0xfffffffffffffffe) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, 0x0) sendmsg$nl_route(r1, 0x0, 0x4054) setns(0xc9, 0x0) r3 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r3, 0x114, 0x8, &(0x7f0000000200), 0x4) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r4, 0x5403, &(0x7f0000000000)={0x3, 0x8, 0xd, 0x0, 0x16, "bae9b23b2225cb76ef3ebbbf666395606aed1a"}) socketpair$unix(0x1, 0x2, 0x0, 0x0) io_uring_setup(0x5ba8, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="380000003f000500010000000000000001010000000000000f0001006f76732d73797374656d00000800020000000000080009002a000000"], 0x38}}, 0x0) 42.757128615s ago: executing program 9 (id=2574): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x902, 0x4) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, 0x0) io_submit(0x0, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r1, 0x0}]) 42.220394383s ago: executing program 9 (id=2575): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sec\x00', &(0x7f00000000c0)='securityfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/ima/policy\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='measure', 0x7) 41.383646803s ago: executing program 9 (id=2576): bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000d44652ff8115c2ae3de931d4599f6c53c1fd3d49b935fe990d68da8951e70961b3e1afbf01530976071018dc19a9e4fba3ba37c517df524b1424174db0b9597ebeb1fb09daa3d1393be49c0346455484f1afefd88a994d0bed9257dbd5ee739145e3791ba51dbfb459211d9a61dd156f6d2983ad73e4dd6f721f9994931187f6a0a2ec09e8740a46f2a0711cbffb4edd4ac7427c9f47095bb0d28862e64dae1fa0105cbd19", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYBLOB='\x00'/25], 0x48) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870f500090582020002"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f000001b7c0)=[{{&(0x7f0000000040)={0x2, 0x4e21, @multicast1}, 0x10, 0x0, 0x0, 0x0, 0x30}}], 0x1, 0x4008804) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xa8, &(0x7f0000000040)=ANY=[@ANYBLOB="6b0ee0b3d41b1b"]) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000004c0)={0xffffffffffffffff, 0x18000000000002a0, 0x5e, 0x0, &(0x7f00000002c0)="d2ff03076003008cb89e08f086dd", 0x0, 0x1001, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 40.685523249s ago: executing program 48 (id=2576): bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000d44652ff8115c2ae3de931d4599f6c53c1fd3d49b935fe990d68da8951e70961b3e1afbf01530976071018dc19a9e4fba3ba37c517df524b1424174db0b9597ebeb1fb09daa3d1393be49c0346455484f1afefd88a994d0bed9257dbd5ee739145e3791ba51dbfb459211d9a61dd156f6d2983ad73e4dd6f721f9994931187f6a0a2ec09e8740a46f2a0711cbffb4edd4ac7427c9f47095bb0d28862e64dae1fa0105cbd19", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYBLOB='\x00'/25], 0x48) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870f500090582020002"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f000001b7c0)=[{{&(0x7f0000000040)={0x2, 0x4e21, @multicast1}, 0x10, 0x0, 0x0, 0x0, 0x30}}], 0x1, 0x4008804) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xa8, &(0x7f0000000040)=ANY=[@ANYBLOB="6b0ee0b3d41b1b"]) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000004c0)={0xffffffffffffffff, 0x18000000000002a0, 0x5e, 0x0, &(0x7f00000002c0)="d2ff03076003008cb89e08f086dd", 0x0, 0x1001, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 39.203628574s ago: executing program 5 (id=2578): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x0) syz_emit_ethernet(0x7e, &(0x7f0000000300)={@local, @local, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x48, 0x11, 0x0, @remote, @local, {[], {0x4e20, 0xe22, 0x48, 0x0, @wg=@cookie={0x3, 0x2, "88c73b21f267636d01dbe5712c1c941e1cdafbbb43f09c28", "e13808ca72381f41e5fff9620915b6f78670dfaf9a2038083179cf6b7931c9b4"}}}}}}}, 0x0) 38.961411415s ago: executing program 5 (id=2579): socket(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_emit_vhci(0x0, 0x15) r3 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r3, 0x5) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xf, 0x4, 0x4, 0x4, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x10, 0x5, &(0x7f0000000300)=ANY=[@ANYBLOB="b70200000af40000bfa3000000000000b704000000000000850000003f00000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sk_msg=0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000500)={@map=r4, r5, 0x7, 0x0, 0x0, @void, @value=0x0}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000600)={r4, &(0x7f0000000640), &(0x7f0000000680)=@tcp=r3}, 0x20) sendto(r3, &(0x7f0000000700)="01", 0xffffffee, 0x0, 0x0, 0x0) 37.423319671s ago: executing program 5 (id=2580): io_uring_setup(0x2a8d, &(0x7f0000000240)={0x0, 0x86a1, 0x2, 0x3, 0x1ff}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240), 0x48103, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) getpid() openat$sysfs(0xffffffffffffff9c, 0x0, 0x122102, 0x0) times(0xfffffffffffffffe) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, 0x0) sendmsg$nl_route(r1, 0x0, 0x4054) setns(0xc9, 0x0) r3 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r3, 0x114, 0x8, &(0x7f0000000200), 0x4) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r4, 0x5403, &(0x7f0000000000)={0x3, 0x8, 0xd, 0x0, 0x16, "bae9b23b2225cb76ef3ebbbf666395606aed1a"}) socketpair$unix(0x1, 0x2, 0x0, 0x0) io_uring_setup(0x5ba8, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="380000003f000500010000000000000001010000000000000f0001006f76732d73797374656d00000800020000000000080009002a000000"], 0x38}}, 0x0) 37.030060626s ago: executing program 5 (id=2581): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x902, 0x4) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, 0x0) io_submit(0x0, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r1, 0x0}]) 36.732473136s ago: executing program 5 (id=2582): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sec\x00', &(0x7f00000000c0)='securityfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/ima/policy\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='measure', 0x7) 34.342606423s ago: executing program 5 (id=2583): r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000440)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a000008048002000905811765"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x3, 0x40, &(0x7f00000006c0)=ANY=[], 0x0) syz_usb_control_io$sierra_net(r1, 0x0, &(0x7f0000000e00)={0x1c, &(0x7f0000000680)={0x40, 0x10, 0xa5, "a72f03b93ebada60244028f6ccfa055da77c30aa88757509a23e5cb32f860cd4407c2635a28b5fb27d9b9ea7f52c2599154776349ea1ea856e189672e5ea906ea2d193b89eb77b62a47997b4753065e74a9febdeedd0f87434c3f44006a4128d6d7e7a755e1fdd3ef7c493ce55197cea3c040f5468ed566cec05755f120716cb6fadb55213de5de490bc14edd0c5ac9ebb0c6b8e48a30472189f911f1843616ffaddec5c76"}, 0x0, 0x0}) syz_usb_ep_write(r1, 0x81, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r2, &(0x7f0000000140)=""/164, 0xa4) 33.564479662s ago: executing program 49 (id=2583): r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000440)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a000008048002000905811765"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x3, 0x40, &(0x7f00000006c0)=ANY=[], 0x0) syz_usb_control_io$sierra_net(r1, 0x0, &(0x7f0000000e00)={0x1c, &(0x7f0000000680)={0x40, 0x10, 0xa5, "a72f03b93ebada60244028f6ccfa055da77c30aa88757509a23e5cb32f860cd4407c2635a28b5fb27d9b9ea7f52c2599154776349ea1ea856e189672e5ea906ea2d193b89eb77b62a47997b4753065e74a9febdeedd0f87434c3f44006a4128d6d7e7a755e1fdd3ef7c493ce55197cea3c040f5468ed566cec05755f120716cb6fadb55213de5de490bc14edd0c5ac9ebb0c6b8e48a30472189f911f1843616ffaddec5c76"}, 0x0, 0x0}) syz_usb_ep_write(r1, 0x81, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r2, &(0x7f0000000140)=""/164, 0xa4) 15.136149415s ago: executing program 8 (id=2564): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat2$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./tracing/events/sched/filter\x00', &(0x7f0000000100)={0x420000, 0x68, 0x12}, 0x18) mkdirat(r1, &(0x7f0000000000)='./tracing\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) syz_open_procfs(0x0, 0x0) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x1, 0x0) write$proc_mixer(r3, &(0x7f0000000380)=ANY=[@ANYBLOB="4f4741494e20274361707475726520566f6c756d65272030303030303030303030303030303030303030300a494741494e0a50486ce2369e9e7101d386d8c8cc4f4e454f55540a535045414b455220274344204361707475726527203030303030303030313337343338"], 0x4000) close(r3) mlockall(0x2) syz_open_dev$evdev(&(0x7f0000000080), 0x1, 0x8047) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) syz_clone3(0x0, 0x0) io_setup(0x8, &(0x7f0000000600)) write(0xffffffffffffffff, &(0x7f0000000080)='common_pid > 0', 0xe) r4 = userfaultfd(0x801) ioctl$UFFDIO_API(r4, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) read(0xffffffffffffffff, &(0x7f0000000140)=""/105, 0x69) ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ff6000/0xa000)=nil, 0xa000}) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x5, 0x2) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) 12.797071473s ago: executing program 8 (id=2585): socket$inet6_udp(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r1, &(0x7f0000000380)={0xa, 0x4e23, 0xfffffffc, @loopback}, 0x1c) listen(r1, 0x4) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000080)={0x0, 0x4}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000040)={0x0, 0x7}, 0x8) sendmmsg$inet6(r0, &(0x7f0000000980)=[{{&(0x7f00000000c0)={0xa, 0x4e23, 0x1, @loopback, 0x1}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000001680)="89", 0x1}], 0x1}}], 0x1, 0x20000000) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000240)=ANY=[], 0x10) 12.247112825s ago: executing program 8 (id=2586): io_uring_setup(0x2a8d, &(0x7f0000000240)={0x0, 0x86a1, 0x2, 0x3, 0x1ff}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240), 0x48103, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) getpid() openat$sysfs(0xffffffffffffff9c, 0x0, 0x122102, 0x0) times(0xfffffffffffffffe) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, 0x0) sendmsg$nl_route(r1, 0x0, 0x4054) setns(0xc9, 0x0) r3 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r3, 0x114, 0x8, &(0x7f0000000200), 0x4) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r4, 0x5403, &(0x7f0000000000)={0x3, 0x8, 0xd, 0x0, 0x16, "bae9b23b2225cb76ef3ebbbf666395606aed1a"}) socketpair$unix(0x1, 0x2, 0x0, 0x0) io_uring_setup(0x5ba8, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="380000003f000500010000000000000001010000000000000f0001006f76732d73797374656d00000800020000000000080009002a000000"], 0x38}}, 0x0) 11.783845802s ago: executing program 8 (id=2587): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x902, 0x4) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040), 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r1, 0x0, 0x0) 11.350503854s ago: executing program 8 (id=2588): madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) 10.681870605s ago: executing program 8 (id=2589): syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) syz_open_dev$vbi(0x0, 0x0, 0x2) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) close(0x3) 9.92649082s ago: executing program 50 (id=2589): syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) syz_open_dev$vbi(0x0, 0x0, 0x2) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) close(0x3) 9.258261331s ago: executing program 0 (id=2572): mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0x0) openat$vim2m(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000180)={0x1}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000002000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, &(0x7f0000000040)="0f01cb650f7410262e66f36d0f330f09660f3a0cb90000a6752066b9800000c00f326635004000000f300f01d7ba4100ed", 0x31}], 0x1, 0x4498bda7e2139f37, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x3, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000240)={[0x0, 0x5, 0x40, 0x40, 0x0, 0x3, 0x2004cb, 0x4000000000000000, 0x2, 0x3, 0x0, 0x7, 0x5, 0x2, 0x9, 0x1], 0x80a0000, 0x451}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 8.510033376s ago: executing program 0 (id=2591): socket$inet6_udp(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r1, &(0x7f0000000380)={0xa, 0x4e23, 0xfffffffc, @loopback}, 0x1c) listen(r1, 0x4) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000080)={0x0, 0x4}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000040)={0x0, 0x7}, 0x8) sendmmsg$inet6(r0, &(0x7f0000000980)=[{{&(0x7f00000000c0)={0xa, 0x4e23, 0x1, @loopback, 0x1}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000001680)="89", 0x1}], 0x1}}], 0x1, 0x20000000) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000240)=ANY=[], 0x10) 8.141045327s ago: executing program 0 (id=2592): r0 = syz_usb_connect(0x0, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000408106050000010000000109021900010100803209040000010a00000007058102"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x10000) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 5.031301894s ago: executing program 0 (id=2593): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x902, 0x4) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040), 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r1, 0x0, 0x0) 4.765665268s ago: executing program 0 (id=2594): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3) ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000340)={"fc399059429f41c88f296da1344951f21a435e19d50734dcdf95eeba160ba72052873e0026ba12320a8492197085aa330e9316fb7603b15e454c8518763baeac308191e250e15a58aabf5b3ecd13f87a62de7b72e0d24c693a4b21639331bee6cbf30563b863d82034aee0bef82ba3b85db024ba1cac050657f2579dcb891cee731766753a258801a5f767d6797981ce206eadbbef536bd8772a48f1833e360e1050cab4bf10d003258d679e49d70239b04adcfdccf1ea5ede82d17891e08a895bd6bd93b87ea8fd1f2a29894ecda469cd461defa657ee9eb2551ad7c53c9f0d52a049bfaaff3bac655367e385916168d61d3580daf26ecd3be14f55b0e513f3c3c955b06a7c197d562c2a855b44ee58bac8ed58400d42e085c9b1a839bad2f9b66ea5b7581ac715debda61a8007f39363f1c699922c05f3b35b08f1771370844b2a8a13b578141465fd38d1a7545a2a9ed8ca76956ca01b32fee4b86643bb26173c6b75e9ceb5c4fb2b23a19ec2e26860f474d73c60c6dee9c4eeb4d4a54cb0f8353aa2656df3d1cfb03df8a54de9cba19ce450a4ac51b1727f92b30b3bad901b4c2d95767fd47436d7041c93bc41c67487ac434b3881ac8caba2f42c587edce816b1fbcf68a5d03504f5ef00fea3632c8e21bb90a9a7b032b3f7c2952b49770bc5a335327b87a8a95c798d829096ab18206bf9718ac42b65f13d78e8278fdcd7f63cf4e9d1b5e27f8adb0f8ef70990c32fed48c361a67d501bc9afbbd48e248affbd1a1c901cfeb769eea352bbb215ac145c9098fa0240fc188cfc2640854f159aab147fe1455294d4faab8101f0af30a8089cab96b3edccccfb837d2d4a57632e320d16d6353045a0a01902b736d66a7556407c1daa945ae9e539ac45e235f09ef59a924e92d0637cdd5f3a7fd85a440e30b1a616cb391e54c9b43453fa1a4c337f3431ff05fc70cdbd5fc704b50f6f96bf0d67c2e90fbf583a974d51a30db97aea64a62358b65a6c699a20cf11db8d0dd1cda8d56efdc38da1c0791ded177b93035be018ab4ca7998a713c16f96ae6b88192899d53ffd3f14dfdccb99ea6fbe2d52a0a428de9b9cc908750ea613f26b3f409e5d430936550036cef1980646780c3a5c76b5fc5a77aa5187d5f3e5b6aa8ee63720a2ece54d241b3dff1c904b5f5d40790d4a7689464fc118d88a95b6d4a1b8606eeaf8134e329ab9194f4b37986597218c5130a1af65157c76b8505205087731a58b7bbfaf648d9d3d4b1ed440f2cae5a4432895100046641a0d94526b63887c79842452c6c6d5472ab032485cf22e62abb2b3137572670088f7e98f317aa14a1d21a38fa558624a3832bcd4bda0ba8dc1d87e53ae2f9d95930ba03022e5127c46d02427a49213e406c800a11c8b0373b9ca73eae0085460e62e88eb35fe3a80832ca1dcc3a4d95aceaa714"}) openat$kvm(0xffffffffffffff9c, 0x0, 0x101100, 0x0) r4 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r5, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0x78b}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_SET_VCPU_EVENTS(r6, 0x4040aea0, &(0x7f0000000080)=@x86={0x6b, 0x4, 0x8, 0x0, 0x0, 0x0, 0x4, 0xa, 0xd, 0x1, 0x8, 0x8, 0x0, 0x2, 0x9, 0x3, 0x3, 0x2e, 0x4, '\x00', 0x1, 0xffffffffffffff7f}) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, r6, 0x0) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f00000000c0)={[0x800, 0x4, 0x81, 0x4, 0x8, 0x0, 0x7, 0x12, 0x400, 0x80000004, 0xfffffffffffffffc, 0x7, 0x5, 0x6, 0x100000000001], 0x1000, 0x4fb40}) ioctl$KVM_SET_MP_STATE(r6, 0x4004ae99, &(0x7f0000000000)=0x3) ioctl$KVM_RUN(r6, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, &(0x7f0000000080)="d8df0f23b3b9ce000000b807000000ba000000000f301b8154fea900c1210680320000c4e28ddc8dcd000000c182fd3f0000c8b950020000b801000400b9a6080000b800000100265d7aeabbc900bbc9000f30300f272d9d53bf0000c4b9e16dc30101220f01c3", 0xffffffffffffff72}], 0x1, 0x14, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 3.436322569s ago: executing program 0 (id=2595): bpf$ENABLE_STATS(0x20, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) mknod$loop(&(0x7f00000000c0)='./file0\x00', 0x8, 0x0) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x2, 0x0, 0x2, 0x0) prlimit64(0x0, 0x1, &(0x7f0000000380)={0xc, 0x5}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000340)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) timerfd_create(0x7, 0x80000) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, &(0x7f00000001c0)={0x77359400}) mount(0x0, 0x0, 0x0, 0x2001, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100), 0x6ad01, 0x0) ioctl$VFAT_IOCTL_READDIR_BOTH(0xffffffffffffffff, 0x82307201, &(0x7f0000000440)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000000)="13000000010203", 0x7}, {&(0x7f0000000140)}], 0x2) socket$nl_generic(0x10, 0x3, 0x10) dup2(r0, r2) add_key$keyring(0x0, &(0x7f0000000200)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='huge=always,mpol=interleave']) chdir(&(0x7f0000000240)='./file0\x00') ioctl$SNDRV_TIMER_IOCTL_CONTINUE(0xffffffffffffffff, 0x54a2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c000000070601080008000000000000000000000500010006"], 0x1c}}, 0x8050) recvmsg(r3, &(0x7f0000003400)={0x0, 0x0, 0x0}, 0x120) 2.565110364s ago: executing program 51 (id=2595): bpf$ENABLE_STATS(0x20, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) mknod$loop(&(0x7f00000000c0)='./file0\x00', 0x8, 0x0) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x2, 0x0, 0x2, 0x0) prlimit64(0x0, 0x1, &(0x7f0000000380)={0xc, 0x5}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000340)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) timerfd_create(0x7, 0x80000) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, &(0x7f00000001c0)={0x77359400}) mount(0x0, 0x0, 0x0, 0x2001, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100), 0x6ad01, 0x0) ioctl$VFAT_IOCTL_READDIR_BOTH(0xffffffffffffffff, 0x82307201, &(0x7f0000000440)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000000)="13000000010203", 0x7}, {&(0x7f0000000140)}], 0x2) socket$nl_generic(0x10, 0x3, 0x10) dup2(r0, r2) add_key$keyring(0x0, &(0x7f0000000200)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='huge=always,mpol=interleave']) chdir(&(0x7f0000000240)='./file0\x00') ioctl$SNDRV_TIMER_IOCTL_CONTINUE(0xffffffffffffffff, 0x54a2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c000000070601080008000000000000000000000500010006"], 0x1c}}, 0x8050) recvmsg(r3, &(0x7f0000003400)={0x0, 0x0, 0x0}, 0x120) 2.521636281s ago: executing program 7 (id=2577): r0 = epoll_create1(0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000100)={0x20000014}) r2 = syz_open_procfs(0x0, &(0x7f0000000140)='fdinfo/3\x00') read$FUSE(r2, &(0x7f00000040c0)={0x2020}, 0x2020) 2.290659669s ago: executing program 7 (id=2597): socket$inet6_udp(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r1, &(0x7f0000000380)={0xa, 0x4e23, 0xfffffffc, @loopback}, 0x1c) listen(r1, 0x4) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000080)={0x0, 0x4}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000040)={0x0, 0x7}, 0x8) sendmmsg$inet6(r0, &(0x7f0000000980)=[{{&(0x7f00000000c0)={0xa, 0x4e23, 0x1, @loopback, 0x1}, 0x1c, &(0x7f0000000580)=[{&(0x7f0000001680)="89", 0x1}], 0x1}}], 0x1, 0x20000000) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000240)=ANY=[], 0x10) 1.824739247s ago: executing program 7 (id=2598): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000080)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa1286dd6001044800183aff00000000000000000000000000000001fe80000000000e0000000000000000aa8800907800000000fe8000000000000000000000000000bb"], 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000b40)={'vcan0\x00'}) ioctl(r0, 0x3b94, &(0x7f00000000c0)) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SNDCTL_DSP_STEREO(r4, 0xc0045003, &(0x7f00000001c0)=0x1) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r6, {0x2, 0x4e23, @broadcast}, 0x80002, 0x0, 0x4}}, 0x2e) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000280)={0x1c, r8, 0x1, 0x70bd29, 0x0, {0x7}, [@L2TP_ATTR_LNS_MODE={0x5, 0x14, 0xe}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x0) 829.199912ms ago: executing program 7 (id=2599): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./gadget/dummy_udc\x00', 0x902, 0x4) write(r0, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100000001", 0x1f) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040), 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r1, 0x0, 0x0) 654.005781ms ago: executing program 2 (id=2584): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x0) syz_emit_ethernet(0x7e, &(0x7f0000000300)={@local, @local, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x48, 0x11, 0x0, @remote, @local, {[], {0x4e20, 0xe22, 0x48, 0x0, @wg=@cookie={0x3, 0x2, "88c73b21f267636d01dbe5712c1c941e1cdafbbb43f09c28", "e13808ca72381f41e5fff9620915b6f78670dfaf9a2038083179cf6b7931c9b4"}}}}}}}, 0x0) 488.702109ms ago: executing program 7 (id=2600): r0 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) r1 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x20000) mkdir(&(0x7f0000000000)='./proc\x00', 0x1ff) r2 = syz_open_dev$sndpcmc(&(0x7f0000000080), 0x0, 0x0) fcntl$setstatus(r2, 0x4, 0x42000) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0) readlinkat(0xffffffffffffff9c, 0x0, &(0x7f0000000200)=""/128, 0x80) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./tracing/uprobe_events\x00', 0x401, 0x90) write(r3, &(0x7f00000002c0)='p:-est/event1 ./file0:0x0 @', 0x1b) ioctl$BLKGETDISKSEQ(r1, 0x80081280, &(0x7f0000000180)) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='source\x00', &(0x7f0000000080)='0.0.0.0:0:/\x00', 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x220008d0}, 0x0) syz_emit_ethernet(0xfdef, &(0x7f00000000c0)={@broadcast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0xfde1, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @local}, @redirect={0x8, 0x0, 0x0, @loopback, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local, @multicast1}}}}}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r4, &(0x7f0000000000)='3', 0x4e) syz_open_dev$vbi(&(0x7f0000000000), 0x2, 0x2) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) 472.716691ms ago: executing program 2 (id=2601): io_uring_setup(0x2a8d, &(0x7f0000000240)={0x0, 0x86a1, 0x2, 0x3, 0x1ff}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240), 0x48103, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) getpid() openat$sysfs(0xffffffffffffff9c, 0x0, 0x122102, 0x0) times(0xfffffffffffffffe) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_CONTROL(r2, 0xc0185500, 0x0) sendmsg$nl_route(r1, 0x0, 0x4054) setns(0xc9, 0x0) r3 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r3, 0x114, 0x8, &(0x7f0000000200), 0x4) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETSW(r4, 0x5403, &(0x7f0000000000)={0x3, 0x8, 0xd, 0x0, 0x16, "bae9b23b2225cb76ef3ebbbf666395606aed1a"}) socketpair$unix(0x1, 0x2, 0x0, 0x0) io_uring_setup(0x5ba8, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="380000003f000500010000000000000001010000000000000f0001006f76732d73797374656d00000800020000000000080009002a000000"], 0x38}}, 0x0) 0s ago: executing program 2 (id=2602): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x2007, &(0x7f0000000980)=0x0) r2 = eventfd2(0x3, 0x80000) io_pgetevents(r1, 0x2, 0x2, &(0x7f0000000380)=[{}, {}], 0x0, 0x0) io_submit(r1, 0x1, &(0x7f0000000280)=[&(0x7f0000000000)={0x1802, 0x0, 0x0, 0x5, 0x0, r0, 0x0, 0x0, 0x0, 0x0, 0x1, r2}]) io_destroy(r1) kernel console output (not intermixed with test programs): act the performance. Setting the MTU to 1560 would solve the problem. [ 988.171833][T14744] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 988.245705][T14744] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 988.277871][T14744] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 988.321322][T14744] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 988.611515][T14744] hsr_slave_0: entered promiscuous mode [ 988.640885][T14744] hsr_slave_1: entered promiscuous mode [ 988.665746][T14744] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 988.676198][T14744] Cannot create hsr debugfs directory [ 993.002376][T14877] warn_alloc: 1 callbacks suppressed [ 993.002391][T14877] syz.1.2440: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz1,mems_allowed=0-1 [ 993.023654][T14877] CPU: 0 PID: 14877 Comm: syz.1.2440 Not tainted syzkaller #0 [ 993.031127][T14877] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 993.041191][T14877] Call Trace: [ 993.044483][T14877] [ 993.047424][T14877] dump_stack_lvl+0x18c/0x250 [ 993.052125][T14877] ? show_regs_print_info+0x20/0x20 [ 993.057342][T14877] ? load_image+0x420/0x420 [ 993.061880][T14877] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 993.068314][T14877] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 993.074830][T14877] warn_alloc+0x246/0x340 [ 993.079168][T14877] ? stack_trace_save+0xaa/0x100 [ 993.084139][T14877] ? zone_watermark_ok_safe+0x230/0x230 [ 993.089733][T14877] ? kasan_set_track+0x5f/0x70 [ 993.094506][T14877] ? kasan_set_track+0x4e/0x70 [ 993.099280][T14877] ? __kasan_kmalloc+0x8f/0xa0 [ 993.104091][T14877] ? xsk_init_queue+0xad/0x100 [ 993.108869][T14877] ? xsk_setsockopt+0x413/0x750 [ 993.113749][T14877] ? do_sock_setsockopt+0x175/0x1a0 [ 993.119148][T14877] ? __x64_sys_setsockopt+0x182/0x200 [ 993.124554][T14877] __vmalloc_node_range+0x129/0x1320 [ 993.129878][T14877] ? free_vm_area+0x50/0x50 [ 993.134402][T14877] vmalloc_user+0x74/0x80 [ 993.138748][T14877] ? xskq_create+0xbf/0x170 [ 993.143290][T14877] xskq_create+0xbf/0x170 [ 993.147655][T14877] xsk_init_queue+0xad/0x100 [ 993.152300][T14877] xsk_setsockopt+0x413/0x750 [ 993.157023][T14877] ? xsk_poll+0x670/0x670 [ 993.161389][T14877] ? __fget_files+0x28/0x460 [ 993.166009][T14877] ? bpf_lsm_socket_setsockopt+0x9/0x10 [ 993.171603][T14877] ? security_socket_setsockopt+0x7e/0xa0 [ 993.177339][T14877] ? xsk_poll+0x670/0x670 [ 993.181680][T14877] do_sock_setsockopt+0x175/0x1a0 [ 993.186731][T14877] ? __fdget+0x180/0x210 [ 993.191013][T14877] __x64_sys_setsockopt+0x182/0x200 [ 993.196266][T14877] do_syscall_64+0x55/0xb0 [ 993.200724][T14877] ? clear_bhb_loop+0x40/0x90 [ 993.205443][T14877] ? clear_bhb_loop+0x40/0x90 [ 993.210182][T14877] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 993.216101][T14877] RIP: 0033:0x7feff539e159 [ 993.220534][T14877] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 993.240158][T14877] RSP: 002b:00007feff62db028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 993.248603][T14877] RAX: ffffffffffffffda RBX: 00007feff5626180 RCX: 00007feff539e159 [ 993.256599][T14877] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000006 [ 993.264603][T14877] RBP: 00007feff543506b R08: 0000000000000004 R09: 0000000000000000 [ 993.272586][T14877] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 993.280573][T14877] R13: 00007feff5626218 R14: 00007feff5626180 R15: 00007ffc01efb588 [ 993.288567][T14877] [ 993.298737][T14877] Mem-Info: [ 993.301926][T14877] active_anon:9727 inactive_anon:0 isolated_anon:0 [ 993.301926][T14877] active_file:18568 inactive_file:40325 isolated_file:0 [ 993.301926][T14877] unevictable:768 dirty:123 writeback:0 [ 993.301926][T14877] slab_reclaimable:11336 slab_unreclaimable:93040 [ 993.301926][T14877] mapped:29328 shmem:4257 pagetables:616 [ 993.301926][T14877] sec_pagetables:0 bounce:0 [ 993.301926][T14877] kernel_misc_reclaimable:0 [ 993.301926][T14877] free:1333438 free_pcp:3342 free_cma:0 [ 993.348850][T14877] Node 0 active_anon:38908kB inactive_anon:0kB active_file:74272kB inactive_file:161100kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:117312kB dirty:488kB writeback:0kB shmem:15492kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:10896kB pagetables:2464kB sec_pagetables:0kB all_unreclaimable? no [ 993.381703][T14877] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 993.412008][T14877] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 993.439995][T14877] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 993.445808][T14877] Node 0 DMA32 free:1411552kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:38872kB inactive_anon:0kB active_file:74272kB inactive_file:160268kB unevictable:1536kB writepending:484kB present:3129332kB managed:2586800kB mlocked:0kB bounce:0kB free_pcp:4156kB local_pcp:4156kB free_cma:0kB [ 993.476229][T14877] lowmem_reserve[]: 0 0 0 0 0 [ 993.480951][T14877] Node 0 Normal free:4kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:36kB inactive_anon:0kB active_file:0kB inactive_file:832kB unevictable:0kB writepending:4kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 993.622460][T14877] lowmem_reserve[]: 0 0 0 0 0 [ 993.627248][T14877] Node 1 Normal free:3906836kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:4kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:9184kB local_pcp:9184kB free_cma:0kB [ 993.656651][T14877] lowmem_reserve[]: 0 0 0 0 0 [ 993.661382][T14877] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 993.674089][T14877] Node 0 DMA32: 457*4kB (U) 646*8kB (UME) 2139*16kB (UME) 1993*32kB (UME) 845*64kB (UME) 207*128kB (UME) 102*256kB (UME) 69*512kB (UME) 33*1024kB (UME) 8*2048kB (M) 272*4096kB (M) = 1411300kB [ 993.693149][T14877] Node 0 Normal: 1*4kB (M) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 4kB [ 993.705057][T14877] Node 1 Normal: 235*4kB (UE) 51*8kB (UE) 35*16kB (UE) 257*32kB (UE) 96*64kB (UME) 27*128kB (UME) 6*256kB (UE) 3*512kB (UME) 1*1024kB (E) 2*2048kB (UE) 947*4096kB (M) = 3906836kB [ 993.723824][T14877] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 993.733472][T14877] Node 0 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 993.742831][T14877] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 993.752432][T14877] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 993.761731][T14877] 63150 total pagecache pages [ 993.766459][T14877] 0 pages in swap cache [ 993.770643][T14877] Free swap = 124676kB [ 993.922757][T14877] Total swap = 124996kB [ 993.928034][T14877] 2097051 pages RAM [ 993.931859][T14877] 0 pages HighMem/MovableOnly [ 993.936601][T14877] 416965 pages reserved [ 993.940761][T14877] 0 pages cma reserved [ 994.367414][ T1288] ieee802154 phy0 wpan0: encryption failed: -22 [ 994.383458][ T1288] ieee802154 phy1 wpan1: encryption failed: -22 [ 994.920163][T14744] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 994.973509][T14744] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 995.022952][T14744] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 995.070142][T14744] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 996.550636][T14744] 8021q: adding VLAN 0 to HW filter on device bond0 [ 996.598971][T14744] 8021q: adding VLAN 0 to HW filter on device team0 [ 996.634693][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 996.641900][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 996.690650][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 996.697903][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 997.363886][T14744] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 997.530189][T14744] veth0_vlan: entered promiscuous mode [ 997.590589][T14744] veth1_vlan: entered promiscuous mode [ 997.716587][T14744] veth0_macvtap: entered promiscuous mode [ 997.751603][T14744] veth1_macvtap: entered promiscuous mode [ 997.913820][T14744] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 997.976042][T14744] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 999.873842][T14744] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 999.935837][T14744] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 999.982938][T14744] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1000.025122][T14744] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1000.066963][T14744] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1001.412474][T14130] Bluetooth: hci0: command 0x0406 tx timeout [ 1001.508876][T14744] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1001.576541][T14744] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1003.641814][T14744] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1003.703262][T14744] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1003.745443][T14744] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1003.776891][T14744] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1003.825091][T14744] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1003.869627][T14744] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1003.920001][T14744] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1003.988015][T14744] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1004.039576][T14744] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1007.783693][ T1079] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1007.791736][ T1079] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1007.995233][T13516] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1008.034391][T13516] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1011.584810][T14961] qnx6: wrong signature (magic) at position (0x2000) - will try alternative position (0x0000). [ 1011.595476][T14961] qnx6: wrong signature (magic) in superblock #1. [ 1011.601923][T14961] qnx6: unable to read the first superblock [ 1011.686846][T14130] Bluetooth: hci5: command 0x0406 tx timeout [ 1012.522354][T14966] warn_alloc: 1 callbacks suppressed [ 1012.522370][T14966] syz.1.2457: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz1,mems_allowed=0-1 [ 1012.542717][T14966] CPU: 0 PID: 14966 Comm: syz.1.2457 Not tainted syzkaller #0 [ 1012.550194][T14966] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1012.560271][T14966] Call Trace: [ 1012.563559][T14966] [ 1012.566503][T14966] dump_stack_lvl+0x18c/0x250 [ 1012.571204][T14966] ? show_regs_print_info+0x20/0x20 [ 1012.576420][T14966] ? load_image+0x420/0x420 [ 1012.580940][T14966] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 1012.587373][T14966] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 1012.593887][T14966] warn_alloc+0x246/0x340 [ 1012.598228][T14966] ? stack_trace_save+0xaa/0x100 [ 1012.603184][T14966] ? zone_watermark_ok_safe+0x230/0x230 [ 1012.608747][T14966] ? kasan_set_track+0x5f/0x70 [ 1012.616077][T14966] ? kasan_set_track+0x4e/0x70 [ 1012.620865][T14966] ? __kasan_kmalloc+0x8f/0xa0 [ 1012.625655][T14966] ? xsk_init_queue+0xad/0x100 [ 1012.630438][T14966] ? xsk_setsockopt+0x413/0x750 [ 1012.635305][T14966] ? do_sock_setsockopt+0x175/0x1a0 [ 1012.640550][T14966] ? __x64_sys_setsockopt+0x182/0x200 [ 1012.645950][T14966] __vmalloc_node_range+0x129/0x1320 [ 1012.651292][T14966] ? free_vm_area+0x50/0x50 [ 1012.655866][T14966] vmalloc_user+0x74/0x80 [ 1012.660223][T14966] ? xskq_create+0xbf/0x170 [ 1012.664750][T14966] xskq_create+0xbf/0x170 [ 1012.669123][T14966] xsk_init_queue+0xad/0x100 [ 1012.673735][T14966] xsk_setsockopt+0x413/0x750 [ 1012.678425][T14966] ? xsk_poll+0x670/0x670 [ 1012.682770][T14966] ? __fget_files+0x28/0x460 [ 1012.687402][T14966] ? bpf_lsm_socket_setsockopt+0x9/0x10 [ 1012.692963][T14966] ? security_socket_setsockopt+0x7e/0xa0 [ 1012.698691][T14966] ? xsk_poll+0x670/0x670 [ 1012.703057][T14966] do_sock_setsockopt+0x175/0x1a0 [ 1012.708100][T14966] ? __fdget+0x180/0x210 [ 1012.712359][T14966] __x64_sys_setsockopt+0x182/0x200 [ 1012.717595][T14966] do_syscall_64+0x55/0xb0 [ 1012.722027][T14966] ? clear_bhb_loop+0x40/0x90 [ 1012.726732][T14966] ? clear_bhb_loop+0x40/0x90 [ 1012.731425][T14966] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1012.737339][T14966] RIP: 0033:0x7feff539e159 [ 1012.741763][T14966] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1012.761395][T14966] RSP: 002b:00007feff62db028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1012.769913][T14966] RAX: ffffffffffffffda RBX: 00007feff5626180 RCX: 00007feff539e159 [ 1012.777894][T14966] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000006 [ 1012.785919][T14966] RBP: 00007feff543506b R08: 0000000000000004 R09: 0000000000000000 [ 1012.793918][T14966] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1012.801906][T14966] R13: 00007feff5626218 R14: 00007feff5626180 R15: 00007ffc01efb588 [ 1012.809903][T14966] [ 1012.814958][T14966] Mem-Info: [ 1012.818106][T14966] active_anon:37342 inactive_anon:0 isolated_anon:0 [ 1012.818106][T14966] active_file:18568 inactive_file:40334 isolated_file:0 [ 1012.818106][T14966] unevictable:768 dirty:72 writeback:0 [ 1012.818106][T14966] slab_reclaimable:11306 slab_unreclaimable:93896 [ 1012.818106][T14966] mapped:27262 shmem:31989 pagetables:554 [ 1012.818106][T14966] sec_pagetables:0 bounce:0 [ 1012.818106][T14966] kernel_misc_reclaimable:0 [ 1012.818106][T14966] free:1302220 free_pcp:6171 free_cma:0 [ 1012.863426][T14966] Node 0 active_anon:149368kB inactive_anon:0kB active_file:74272kB inactive_file:161136kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:109048kB dirty:284kB writeback:0kB shmem:126420kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:10640kB pagetables:2216kB sec_pagetables:0kB all_unreclaimable? no [ 1012.897540][T14966] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 1012.927915][T14966] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1012.955038][T14966] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 1012.960804][T14966] Node 0 DMA32 free:1286424kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:149332kB inactive_anon:0kB active_file:74272kB inactive_file:160304kB unevictable:1536kB writepending:284kB present:3129332kB managed:2586800kB mlocked:0kB bounce:0kB free_pcp:15724kB local_pcp:15724kB free_cma:0kB [ 1012.992581][T14966] lowmem_reserve[]: 0 0 0 0 0 [ 1012.997319][T14966] Node 0 Normal free:4kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:36kB inactive_anon:0kB active_file:0kB inactive_file:832kB unevictable:0kB writepending:0kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1013.025418][T14966] lowmem_reserve[]: 0 0 0 0 0 [ 1013.030155][T14966] Node 1 Normal free:3907092kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:4kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:8960kB local_pcp:8960kB free_cma:0kB [ 1013.252331][T14966] lowmem_reserve[]: 0 0 0 0 0 [ 1013.257149][T14966] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1013.269923][T14966] Node 0 DMA32: 436*4kB (UE) 565*8kB (UM) 918*16kB (UE) 1442*32kB (UME) 410*64kB (UE) 95*128kB (UE) 21*256kB (UE) 22*512kB (UME) 33*1024kB (UME) 8*2048kB (M) 272*4096kB (M) = 1286424kB [ 1013.289918][T14966] Node 0 Normal: 1*4kB (M) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 4kB [ 1013.301864][T14966] Node 1 Normal: 235*4kB (UE) 51*8kB (UE) 35*16kB (UE) 253*32kB (UE) 98*64kB (UME) 27*128kB (UME) 7*256kB (UE) 3*512kB (UME) 1*1024kB (E) 2*2048kB (UE) 947*4096kB (M) = 3907092kB [ 1013.319769][T14966] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1013.329375][T14966] Node 0 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 1013.338721][T14966] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1013.348315][T14966] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1013.357705][T14966] 90319 total pagecache pages [ 1013.362463][T14966] 0 pages in swap cache [ 1013.366632][T14966] Free swap = 124676kB [ 1013.370876][T14966] Total swap = 124996kB [ 1013.502354][T14966] 2097051 pages RAM [ 1013.506225][T14966] 0 pages HighMem/MovableOnly [ 1013.510908][T14966] 416965 pages reserved [ 1013.515139][T14966] 0 pages cma reserved [ 1021.776488][ T8] usb 4-1: new high-speed USB device number 116 using dummy_hcd [ 1023.152363][ T8] usb 4-1: Using ep0 maxpacket: 32 [ 1023.189571][ T8] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 1023.242617][ T8] usb 4-1: config 0 has no interface number 0 [ 1023.282534][ T8] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1023.339355][ T8] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1023.402108][ T8] usb 4-1: Product: syz [ 1023.432525][ T8] usb 4-1: Manufacturer: syz [ 1023.437180][ T8] usb 4-1: SerialNumber: syz [ 1023.507099][ T8] usb 4-1: config 0 descriptor?? [ 1023.573960][ T8] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1023.862769][ T8] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 1023.967176][ T8] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 1025.185461][ C0] usb 4-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 1025.221517][ T6202] usb 4-1: USB disconnect, device number 116 [ 1025.346201][ T6202] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 1025.495591][ T6202] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 1025.520014][T14130] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1025.531984][T14130] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1025.552901][T14130] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1025.579877][T14130] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1025.587548][T14130] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 1025.596237][T14130] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1026.918440][ T6202] quatech2 4-1:0.51: device disconnected [ 1028.642366][T15044] warn_alloc: 1 callbacks suppressed [ 1028.642381][T15044] syz.1.2476: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz1,mems_allowed=0-1 [ 1028.662805][T15044] CPU: 0 PID: 15044 Comm: syz.1.2476 Not tainted syzkaller #0 [ 1028.670284][T15044] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1028.680347][T15044] Call Trace: [ 1028.683657][T15044] [ 1028.686601][T15044] dump_stack_lvl+0x18c/0x250 [ 1028.691299][T15044] ? show_regs_print_info+0x20/0x20 [ 1028.696510][T15044] ? load_image+0x420/0x420 [ 1028.701029][T15044] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 1028.707583][T15044] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 1028.714119][T15044] warn_alloc+0x246/0x340 [ 1028.718469][T15044] ? stack_trace_save+0xaa/0x100 [ 1028.723425][T15044] ? zone_watermark_ok_safe+0x230/0x230 [ 1028.728987][T15044] ? kasan_set_track+0x5f/0x70 [ 1028.733785][T15044] ? kasan_set_track+0x4e/0x70 [ 1028.738561][T15044] ? __kasan_kmalloc+0x8f/0xa0 [ 1028.743337][T15044] ? xsk_init_queue+0xad/0x100 [ 1028.748150][T15044] ? xsk_setsockopt+0x413/0x750 [ 1028.753022][T15044] ? do_sock_setsockopt+0x175/0x1a0 [ 1028.758256][T15044] ? __x64_sys_setsockopt+0x182/0x200 [ 1028.763666][T15044] __vmalloc_node_range+0x129/0x1320 [ 1028.769030][T15044] ? free_vm_area+0x50/0x50 [ 1028.773554][T15044] vmalloc_user+0x74/0x80 [ 1028.777916][T15044] ? xskq_create+0xbf/0x170 [ 1028.782434][T15044] xskq_create+0xbf/0x170 [ 1028.786781][T15044] xsk_init_queue+0xad/0x100 [ 1028.791382][T15044] xsk_setsockopt+0x413/0x750 [ 1028.796091][T15044] ? xsk_poll+0x670/0x670 [ 1028.800434][T15044] ? __fget_files+0x28/0x460 [ 1028.805042][T15044] ? bpf_lsm_socket_setsockopt+0x9/0x10 [ 1028.810601][T15044] ? security_socket_setsockopt+0x7e/0xa0 [ 1028.816325][T15044] ? xsk_poll+0x670/0x670 [ 1028.820684][T15044] do_sock_setsockopt+0x175/0x1a0 [ 1028.825741][T15044] ? __fdget+0x180/0x210 [ 1028.829995][T15044] __x64_sys_setsockopt+0x182/0x200 [ 1028.835210][T15044] do_syscall_64+0x55/0xb0 [ 1028.839640][T15044] ? clear_bhb_loop+0x40/0x90 [ 1028.844330][T15044] ? clear_bhb_loop+0x40/0x90 [ 1028.849018][T15044] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1028.854923][T15044] RIP: 0033:0x7feff539e159 [ 1028.859350][T15044] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1028.878980][T15044] RSP: 002b:00007feff62db028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1028.887405][T15044] RAX: ffffffffffffffda RBX: 00007feff5626180 RCX: 00007feff539e159 [ 1028.895401][T15044] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000007 [ 1028.903397][T15044] RBP: 00007feff543506b R08: 0000000000000004 R09: 0000000000000000 [ 1028.911403][T15044] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1028.919385][T15044] R13: 00007feff5626218 R14: 00007feff5626180 R15: 00007ffc01efb588 [ 1028.927399][T15044] [ 1028.931958][T15044] Mem-Info: [ 1028.935132][T15044] active_anon:38015 inactive_anon:0 isolated_anon:0 [ 1028.935132][T15044] active_file:18568 inactive_file:40342 isolated_file:0 [ 1028.935132][T15044] unevictable:768 dirty:116 writeback:0 [ 1028.935132][T15044] slab_reclaimable:11239 slab_unreclaimable:94768 [ 1028.935132][T15044] mapped:25376 shmem:32454 pagetables:556 [ 1028.935132][T15044] sec_pagetables:0 bounce:0 [ 1028.935132][T15044] kernel_misc_reclaimable:0 [ 1028.935132][T15044] free:1295064 free_pcp:3491 free_cma:0 [ 1028.982109][T15044] Node 0 active_anon:152060kB inactive_anon:0kB active_file:74272kB inactive_file:161168kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:101504kB dirty:460kB writeback:0kB shmem:128280kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:10672kB pagetables:2224kB sec_pagetables:0kB all_unreclaimable? no [ 1029.014730][T15044] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 1029.045232][T15044] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1029.073528][T15044] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 1029.079302][T15044] Node 0 DMA32 free:1257544kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:152024kB inactive_anon:0kB active_file:74272kB inactive_file:160336kB unevictable:1536kB writepending:456kB present:3129332kB managed:2586800kB mlocked:0kB bounce:0kB free_pcp:5260kB local_pcp:5260kB free_cma:0kB [ 1029.109806][T15044] lowmem_reserve[]: 0 0 0 0 0 [ 1029.185077][T14130] Bluetooth: hci2: command tx timeout [ 1029.242338][T15044] Node 0 Normal free:4kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:36kB inactive_anon:0kB active_file:0kB inactive_file:832kB unevictable:0kB writepending:4kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1029.270302][T15044] lowmem_reserve[]: 0 0 0 0 0 [ 1029.275090][T15044] Node 1 Normal free:3907348kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:4kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:8704kB local_pcp:8704kB free_cma:0kB [ 1029.304662][T15044] lowmem_reserve[]: 0 0 0 0 0 [ 1029.309384][T15044] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1029.322054][T15044] Node 0 DMA32: 2*4kB (UM) 40*8kB (UME) 122*16kB (UME) 910*32kB (UME) 743*64kB (UME) 190*128kB (UME) 39*256kB (UME) 35*512kB (UME) 4*1024kB (UME) 3*2048kB (M) 272*4096kB (M) = 1255528kB [ 1029.340532][T15044] Node 0 Normal: 1*4kB (M) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 4kB [ 1029.352443][T15044] Node 1 Normal: 235*4kB (UE) 51*8kB (UE) 35*16kB (UE) 253*32kB (UE) 100*64kB (UME) 28*128kB (UME) 7*256kB (UE) 3*512kB (UME) 1*1024kB (E) 2*2048kB (UE) 947*4096kB (M) = 3907348kB [ 1029.371603][T15044] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1029.381236][T15044] Node 0 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 1029.390571][T15044] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1029.552325][T15044] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1029.562810][T15044] 91364 total pagecache pages [ 1029.567517][T15044] 0 pages in swap cache [ 1029.571692][T15044] Free swap = 124676kB [ 1029.576056][T15044] Total swap = 124996kB [ 1029.580216][T15044] 2097051 pages RAM [ 1029.584057][T15044] 0 pages HighMem/MovableOnly [ 1029.588733][T15044] 416965 pages reserved [ 1029.592932][T15044] 0 pages cma reserved [ 1029.923893][ T11] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1030.375993][ T11] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1030.436474][T14130] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1030.447933][T14130] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1030.456586][T14130] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1030.473321][T14130] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1030.481079][T14130] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 1030.490743][T14130] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1030.936777][ T11] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1031.112665][ T8] usb 2-1: new high-speed USB device number 123 using dummy_hcd [ 1031.154938][ T11] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1031.205122][T14130] Bluetooth: hci2: command tx timeout [ 1031.325661][ T8] usb 2-1: Using ep0 maxpacket: 32 [ 1031.360736][ T8] usb 2-1: config 0 has an invalid interface number: 51 but max is 0 [ 1031.406899][ T8] usb 2-1: config 0 has no interface number 0 [ 1031.471068][ T8] usb 2-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1031.542556][ T8] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1031.550697][ T8] usb 2-1: Product: syz [ 1031.618664][ T8] usb 2-1: Manufacturer: syz [ 1031.669298][ T8] usb 2-1: SerialNumber: syz [ 1031.719927][ T8] usb 2-1: config 0 descriptor?? [ 1031.804656][ T8] quatech2 2-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1031.918020][T15022] chnl_net:caif_netlink_parms(): no params data found [ 1031.987619][ T8] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 1032.126307][ T8] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 1032.175775][ C0] usb 2-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 1032.308431][ T8] usb 2-1: USB disconnect, device number 123 [ 1032.399136][ T8] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 1032.516552][ T8] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 1032.567655][T14130] Bluetooth: hci3: command tx timeout [ 1032.608482][ T8] quatech2 2-1:0.51: device disconnected [ 1032.650459][T15077] block device autoloading is deprecated and will be removed. [ 1032.901606][T15050] chnl_net:caif_netlink_parms(): no params data found [ 1033.282594][T14130] Bluetooth: hci2: command tx timeout [ 1035.269281][T14130] Bluetooth: hci3: command tx timeout [ 1035.370927][T14130] Bluetooth: hci2: command tx timeout [ 1035.623521][T15022] bridge0: port 1(bridge_slave_0) entered blocking state [ 1035.655359][T15022] bridge0: port 1(bridge_slave_0) entered disabled state [ 1035.684205][T15022] bridge_slave_0: entered allmulticast mode [ 1035.747094][T15022] bridge_slave_0: entered promiscuous mode [ 1035.793785][T15022] bridge0: port 2(bridge_slave_1) entered blocking state [ 1035.800951][T15022] bridge0: port 2(bridge_slave_1) entered disabled state [ 1035.868268][T15022] bridge_slave_1: entered allmulticast mode [ 1036.930441][T15022] bridge_slave_1: entered promiscuous mode [ 1037.085653][ T8] usb 4-1: new high-speed USB device number 117 using dummy_hcd [ 1037.286585][T14130] Bluetooth: hci3: command tx timeout [ 1037.292424][ T8] usb 4-1: Using ep0 maxpacket: 32 [ 1037.322854][ T8] usb 4-1: config 0 has an invalid interface number: 51 but max is 0 [ 1037.366655][ T8] usb 4-1: config 0 has no interface number 0 [ 1037.394387][ T8] usb 4-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1037.437543][ T8] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1037.486966][ T8] usb 4-1: Product: syz [ 1037.506505][ T8] usb 4-1: Manufacturer: syz [ 1037.511158][ T8] usb 4-1: SerialNumber: syz [ 1037.547717][T15022] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1037.560113][ T8] usb 4-1: config 0 descriptor?? [ 1037.601763][ T8] quatech2 4-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1037.631566][T15022] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1037.667331][T15050] bridge0: port 1(bridge_slave_0) entered blocking state [ 1037.687232][T15050] bridge0: port 1(bridge_slave_0) entered disabled state [ 1037.724432][T15050] bridge_slave_0: entered allmulticast mode [ 1037.764537][T15050] bridge_slave_0: entered promiscuous mode [ 1037.805498][ T8] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 1037.877797][ T8] usb 4-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 1038.023029][ C0] usb 4-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 1038.035674][T13609] usb 4-1: USB disconnect, device number 117 [ 1038.044170][T15050] bridge0: port 2(bridge_slave_1) entered blocking state [ 1038.073730][T15050] bridge0: port 2(bridge_slave_1) entered disabled state [ 1038.080975][T15050] bridge_slave_1: entered allmulticast mode [ 1038.114493][T13609] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 1038.164983][T15050] bridge_slave_1: entered promiscuous mode [ 1038.201848][T13609] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 1038.288001][T13609] quatech2 4-1:0.51: device disconnected [ 1038.506414][T15022] team0: Port device team_slave_0 added [ 1038.595388][T15022] team0: Port device team_slave_1 added [ 1038.616198][T15050] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1038.677207][T15050] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1038.988884][ T11] hsr_slave_0: left promiscuous mode [ 1039.062571][ T11] hsr_slave_1: left promiscuous mode [ 1039.099461][ T11] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1039.142441][ T11] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1039.183277][ T11] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1039.191597][ T11] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1039.398120][T14130] Bluetooth: hci3: command tx timeout [ 1039.424878][ T11] bridge_slave_1: left allmulticast mode [ 1039.430573][ T11] bridge_slave_1: left promiscuous mode [ 1039.952357][T15145] warn_alloc: 1 callbacks suppressed [ 1039.952372][T15145] syz.3.2491: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz3,mems_allowed=0-1 [ 1039.972731][T15145] CPU: 0 PID: 15145 Comm: syz.3.2491 Not tainted syzkaller #0 [ 1039.980203][T15145] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1039.990274][T15145] Call Trace: [ 1039.993567][T15145] [ 1039.996504][T15145] dump_stack_lvl+0x18c/0x250 [ 1040.001209][T15145] ? show_regs_print_info+0x20/0x20 [ 1040.006421][T15145] ? load_image+0x420/0x420 [ 1040.010939][T15145] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 1040.017471][T15145] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 1040.024007][T15145] warn_alloc+0x246/0x340 [ 1040.028363][T15145] ? stack_trace_save+0xaa/0x100 [ 1040.033319][T15145] ? zone_watermark_ok_safe+0x230/0x230 [ 1040.038881][T15145] ? kasan_set_track+0x5f/0x70 [ 1040.043654][T15145] ? kasan_set_track+0x4e/0x70 [ 1040.048426][T15145] ? __kasan_kmalloc+0x8f/0xa0 [ 1040.053202][T15145] ? xsk_init_queue+0xad/0x100 [ 1040.057992][T15145] ? xsk_setsockopt+0x413/0x750 [ 1040.062857][T15145] ? do_sock_setsockopt+0x175/0x1a0 [ 1040.068070][T15145] ? __x64_sys_setsockopt+0x182/0x200 [ 1040.073459][T15145] __vmalloc_node_range+0x129/0x1320 [ 1040.078786][T15145] ? free_vm_area+0x50/0x50 [ 1040.083321][T15145] vmalloc_user+0x74/0x80 [ 1040.087666][T15145] ? xskq_create+0xbf/0x170 [ 1040.092202][T15145] xskq_create+0xbf/0x170 [ 1040.096555][T15145] xsk_init_queue+0xad/0x100 [ 1040.101160][T15145] xsk_setsockopt+0x413/0x750 [ 1040.105850][T15145] ? xsk_poll+0x670/0x670 [ 1040.110197][T15145] ? __fget_files+0x28/0x460 [ 1040.114826][T15145] ? bpf_lsm_socket_setsockopt+0x9/0x10 [ 1040.120386][T15145] ? security_socket_setsockopt+0x7e/0xa0 [ 1040.126127][T15145] ? xsk_poll+0x670/0x670 [ 1040.130472][T15145] do_sock_setsockopt+0x175/0x1a0 [ 1040.135514][T15145] ? __fdget+0x180/0x210 [ 1040.139792][T15145] __x64_sys_setsockopt+0x182/0x200 [ 1040.145008][T15145] do_syscall_64+0x55/0xb0 [ 1040.149438][T15145] ? clear_bhb_loop+0x40/0x90 [ 1040.154127][T15145] ? clear_bhb_loop+0x40/0x90 [ 1040.158831][T15145] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1040.164756][T15145] RIP: 0033:0x7f00de59e159 [ 1040.169185][T15145] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1040.188804][T15145] RSP: 002b:00007f00df442028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1040.197229][T15145] RAX: ffffffffffffffda RBX: 00007f00de826180 RCX: 00007f00de59e159 [ 1040.205215][T15145] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000007 [ 1040.213198][T15145] RBP: 00007f00de63506b R08: 0000000000000004 R09: 0000000000000000 [ 1040.221179][T15145] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1040.229178][T15145] R13: 00007f00de826218 R14: 00007f00de826180 R15: 00007ffd76231658 [ 1040.237181][T15145] [ 1040.241744][T15145] Mem-Info: [ 1040.245025][T15145] active_anon:14405 inactive_anon:0 isolated_anon:0 [ 1040.245025][T15145] active_file:18568 inactive_file:40346 isolated_file:0 [ 1040.245025][T15145] unevictable:768 dirty:85 writeback:0 [ 1040.245025][T15145] slab_reclaimable:11190 slab_unreclaimable:95868 [ 1040.245025][T15145] mapped:27393 shmem:8851 pagetables:579 [ 1040.245025][T15145] sec_pagetables:0 bounce:0 [ 1040.245025][T15145] kernel_misc_reclaimable:0 [ 1040.245025][T15145] free:1320317 free_pcp:9500 free_cma:0 [ 1040.290183][T15145] Node 0 active_anon:57620kB inactive_anon:0kB active_file:74272kB inactive_file:161184kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:109572kB dirty:336kB writeback:0kB shmem:33868kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:10928kB pagetables:2316kB sec_pagetables:0kB all_unreclaimable? no [ 1040.323440][T15145] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 1040.353697][T15145] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1040.380808][T15145] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 1040.386628][T15145] Node 0 DMA32 free:1358556kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:57584kB inactive_anon:0kB active_file:74272kB inactive_file:160352kB unevictable:1536kB writepending:332kB present:3129332kB managed:2586800kB mlocked:0kB bounce:0kB free_pcp:29296kB local_pcp:29296kB free_cma:0kB [ 1040.418333][T15145] lowmem_reserve[]: 0 0 0 0 0 [ 1040.552342][T15145] Node 0 Normal free:4kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:36kB inactive_anon:0kB active_file:0kB inactive_file:832kB unevictable:0kB writepending:4kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1040.579154][T15145] lowmem_reserve[]: 0 0 0 0 0 [ 1040.583912][T15145] Node 1 Normal free:3907348kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:4kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:8704kB local_pcp:8704kB free_cma:0kB [ 1040.613280][T15145] lowmem_reserve[]: 0 0 0 0 0 [ 1040.618095][T15145] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1040.631605][T15145] Node 0 DMA32: 5121*4kB (UME) 2903*8kB (UME) 1620*16kB (UME) 581*32kB (UME) 433*64kB (UME) 158*128kB (UME) 107*256kB (UME) 62*512kB (UME) 32*1024kB (UME) 8*2048kB (M) 272*4096kB (M) = 1358556kB [ 1040.650907][T15145] Node 0 Normal: 1*4kB (M) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 4kB [ 1040.662818][T15145] Node 1 Normal: 235*4kB (UE) 51*8kB (UE) 35*16kB (UE) 253*32kB (UE) 100*64kB (UME) 28*128kB (UME) 7*256kB (UE) 3*512kB (UME) 1*1024kB (E) 2*2048kB (UE) 947*4096kB (M) = 3907348kB [ 1040.681044][T15145] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1040.690718][T15145] Node 0 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 1040.700055][T15145] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1040.822326][T15145] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1040.832486][T15145] 67765 total pagecache pages [ 1040.837168][T15145] 0 pages in swap cache [ 1040.841325][T15145] Free swap = 124676kB [ 1040.845644][T15145] Total swap = 124996kB [ 1040.849803][T15145] 2097051 pages RAM [ 1040.853641][T15145] 0 pages HighMem/MovableOnly [ 1040.858323][T15145] 416965 pages reserved [ 1040.862567][T15145] 0 pages cma reserved [ 1041.250964][ T11] bridge0: port 2(bridge_slave_1) entered disabled state [ 1041.279151][ T11] bridge_slave_0: left allmulticast mode [ 1041.308122][ T11] bridge_slave_0: left promiscuous mode [ 1041.365500][ T11] bridge0: port 1(bridge_slave_0) entered disabled state [ 1041.490633][ T11] veth1_macvtap: left promiscuous mode [ 1041.526837][ T11] veth0_macvtap: left promiscuous mode [ 1041.556070][ T11] veth1_vlan: left promiscuous mode [ 1041.579417][ T11] veth0_vlan: left promiscuous mode [ 1041.813434][ T6202] usb 4-1: new high-speed USB device number 118 using dummy_hcd [ 1041.973034][ T6202] usb 4-1: device descriptor read/64, error -71 [ 1042.252619][ T6202] usb 4-1: new high-speed USB device number 119 using dummy_hcd [ 1042.432453][ T6202] usb 4-1: device descriptor read/64, error -71 [ 1042.567712][ T6202] usb usb4-port1: attempt power cycle [ 1043.004585][ T6202] usb 4-1: new high-speed USB device number 120 using dummy_hcd [ 1043.072731][ T6202] usb 4-1: device descriptor read/8, error -71 [ 1043.372472][ T6202] usb 4-1: new high-speed USB device number 121 using dummy_hcd [ 1043.403064][ T6202] usb 4-1: device descriptor read/8, error -71 [ 1043.549360][ T6202] usb usb4-port1: unable to enumerate USB device [ 1043.688495][ T11] team0 (unregistering): Port device team_slave_1 removed [ 1043.846451][ T11] team0 (unregistering): Port device team_slave_0 removed [ 1043.993388][ T11] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1044.130123][ T11] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1045.136920][ T11] bond0 (unregistering): Released all slaves [ 1045.310615][T15050] team0: Port device team_slave_0 added [ 1045.355272][T15022] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1045.401479][T15022] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1045.505899][T15022] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1047.209096][T15022] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1047.543571][T15022] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1047.681800][T15022] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1047.746772][T15050] team0: Port device team_slave_1 added [ 1047.932564][ T6202] usb 4-1: new high-speed USB device number 122 using dummy_hcd [ 1049.181271][T15213] overlayfs: failed to resolve './file0': -2 [ 1049.624047][ T6202] usb 4-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 1049.650857][T14130] Bluetooth: Wrong link type (-71) [ 1049.664434][ T6202] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1049.717277][T15050] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1049.737588][ T6202] usb 4-1: config 0 descriptor?? [ 1049.756583][T15050] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1049.865118][T15050] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1049.913223][T15050] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1049.951641][T15050] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1050.045021][T15050] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1050.138227][T15022] hsr_slave_0: entered promiscuous mode [ 1050.169032][T15022] hsr_slave_1: entered promiscuous mode [ 1050.199114][T15022] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1050.234812][ T6202] [drm] Initialized udl 0.0.1 20120220 for 4-1:0.0 on minor 2 [ 1050.282674][T15022] Cannot create hsr debugfs directory [ 1050.308886][ T6202] [drm] Initialized udl on minor 2 [ 1050.457068][ T6202] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1050.508719][ T6202] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 1050.529584][T15224] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2500'. [ 1050.542131][T15050] hsr_slave_0: entered promiscuous mode [ 1050.560061][ T8] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1050.575049][ T6202] usb 4-1: USB disconnect, device number 122 [ 1050.611756][ T8] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 1050.639644][T15050] hsr_slave_1: entered promiscuous mode [ 1050.704232][T15050] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1050.711886][T15050] Cannot create hsr debugfs directory [ 1050.899229][ T11] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1051.092389][ T8] usb 2-1: new high-speed USB device number 124 using dummy_hcd [ 1051.103600][ T11] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1051.286157][ T8] usb 2-1: device descriptor read/64, error -71 [ 1051.336691][ T11] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1051.555225][ T11] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1051.582673][ T8] usb 2-1: new high-speed USB device number 125 using dummy_hcd [ 1052.814110][ T8] usb 2-1: device descriptor read/64, error -71 [ 1052.962774][ T8] usb usb2-port1: attempt power cycle [ 1053.392427][ T8] usb 2-1: new high-speed USB device number 126 using dummy_hcd [ 1053.463365][ T8] usb 2-1: device descriptor read/8, error -71 [ 1053.779607][ T8] usb 2-1: new high-speed USB device number 127 using dummy_hcd [ 1053.872411][ T8] usb 2-1: device descriptor read/8, error -71 [ 1054.007959][ T8] usb usb2-port1: unable to enumerate USB device [ 1054.730005][ T1288] ieee802154 phy0 wpan0: encryption failed: -22 [ 1054.794516][ T1288] ieee802154 phy1 wpan1: encryption failed: -22 [ 1055.642229][T15254] overlayfs: failed to resolve './file0': -2 [ 1056.013216][T14130] Bluetooth: Wrong link type (-71) [ 1058.687052][T15266] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2507'. [ 1062.988979][T15293] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2515'. [ 1063.086857][T15022] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1063.153578][T15022] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1063.256939][T15297] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000 [ 1063.518686][T15022] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1063.604682][T15022] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1064.105503][T14130] Bluetooth: hci0: unexpected event for opcode 0x200c [ 1064.419689][ T11] hsr_slave_0: left promiscuous mode [ 1064.442123][ T11] hsr_slave_1: left promiscuous mode [ 1064.467886][ T28] audit: type=1800 audit(1790943331.308:7): pid=15317 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2513" name=08 dev="sda1" ino=2065 res=0 errno=0 [ 1064.508276][ T11] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1064.542678][ T11] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1064.598615][ T11] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1064.664965][ T11] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1064.711070][ T11] bridge_slave_1: left allmulticast mode [ 1064.757156][ T11] bridge_slave_1: left promiscuous mode [ 1064.794369][ T11] bridge0: port 2(bridge_slave_1) entered disabled state [ 1064.851015][ T11] bridge_slave_0: left allmulticast mode [ 1064.891834][ T11] bridge_slave_0: left promiscuous mode [ 1064.927181][ T11] bridge0: port 1(bridge_slave_0) entered disabled state [ 1065.077410][ T11] veth1_macvtap: left promiscuous mode [ 1065.107538][ T11] veth0_macvtap: left promiscuous mode [ 1065.142632][ T11] veth1_vlan: left promiscuous mode [ 1065.161990][ T11] veth0_vlan: left promiscuous mode [ 1065.816204][T15334] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2522'. [ 1068.079088][T15341] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000 [ 1068.374135][T13609] IPVS: starting estimator thread 0... [ 1068.490232][T15346] IPVS: using max 27 ests per chain, 64800 per kthread [ 1069.019469][T13609] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 1070.363312][T13609] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1070.395674][T13609] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1070.426501][T13609] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1070.467352][T13609] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1070.551252][T13609] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1070.572435][T13609] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1070.580484][T13609] usb 2-1: Product: syz [ 1070.639682][T13609] usb 2-1: Manufacturer: syz [ 1070.674949][T13609] cdc_wdm 2-1:1.0: skipping garbage [ 1070.712833][T13609] cdc_wdm 2-1:1.0: skipping garbage [ 1070.753390][T13609] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 1070.759355][T13609] cdc_wdm 2-1:1.0: Unknown control protocol [ 1070.901795][T13609] usb 2-1: USB disconnect, device number 2 [ 1071.462764][T13609] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 1071.674039][T13609] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1071.702406][T13609] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1071.751334][T13609] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1071.805847][T13609] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1071.862517][T13609] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1071.904531][T13609] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1071.958237][T13609] usb 2-1: Product: syz [ 1071.975883][T13609] usb 2-1: Manufacturer: syz [ 1072.000648][T13609] cdc_wdm 2-1:1.0: skipping garbage [ 1072.028896][T13609] cdc_wdm 2-1:1.0: skipping garbage [ 1072.055158][T13609] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 1072.088535][ T11] team0 (unregistering): Port device team_slave_1 removed [ 1072.098771][T13609] cdc_wdm 2-1:1.0: Unknown control protocol [ 1072.196592][T13609] usb 2-1: USB disconnect, device number 3 [ 1072.401851][T15381] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2530'. [ 1072.508904][ T11] team0 (unregistering): Port device team_slave_0 removed [ 1072.807490][ T11] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1075.123280][ T11] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1076.816071][T13544] usb 4-1: new high-speed USB device number 123 using dummy_hcd [ 1077.040635][T13544] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1077.059712][T13544] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1077.132370][T13544] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1077.177144][T13544] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1077.256044][T13544] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1077.284608][T13544] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1077.341942][T13544] usb 4-1: Product: syz [ 1077.362142][T13544] usb 4-1: Manufacturer: syz [ 1077.414862][T13544] cdc_wdm 4-1:1.0: skipping garbage [ 1077.420139][T13544] cdc_wdm 4-1:1.0: skipping garbage [ 1077.477426][T13544] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 1077.514733][T13544] cdc_wdm 4-1:1.0: Unknown control protocol [ 1077.652833][T13544] usb 4-1: USB disconnect, device number 123 [ 1078.212495][T13544] usb 4-1: new high-speed USB device number 124 using dummy_hcd [ 1078.429539][T13544] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1078.456463][T13544] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1078.504831][T13544] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1078.552864][T13544] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1078.590178][T15427] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2538'. [ 1078.617826][T13544] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1078.635859][T13544] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1078.691441][T13544] usb 4-1: Product: syz [ 1078.703700][T13544] usb 4-1: Manufacturer: syz [ 1078.738488][T13544] cdc_wdm 4-1:1.0: skipping garbage [ 1078.755909][T13544] cdc_wdm 4-1:1.0: skipping garbage [ 1078.790813][T13544] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 1078.821365][T13544] cdc_wdm 4-1:1.0: Unknown control protocol [ 1079.198563][ T11] bond0 (unregistering): Released all slaves [ 1079.281565][T15439] gadgetfs: bound to dummy_udc driver [ 1079.758132][ C0] cdc_wdm 4-1:1.0: unknown notification 21 received: index 40500 len 60065 [ 1079.767023][ C0] cdc_wdm 4-1:1.0: unknown notification 163 received: index 40728 len 8081 [ 1080.021690][T13544] usb 4-1: USB disconnect, device number 124 [ 1081.639725][T15050] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1081.796580][T15050] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1081.955559][T15050] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1082.073451][T15050] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1084.649195][T15050] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1084.793902][T15050] 8021q: adding VLAN 0 to HW filter on device team0 [ 1084.905872][ T2998] bridge0: port 1(bridge_slave_0) entered blocking state [ 1084.913078][ T2998] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1084.984044][ T2998] bridge0: port 2(bridge_slave_1) entered blocking state [ 1084.991207][ T2998] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1085.028878][T15476] gadgetfs: bound to dummy_udc driver [ 1085.046161][T12339] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1085.072822][T12339] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1085.081352][T12339] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1085.090674][T12339] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1085.099381][T12339] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 1085.106909][T12339] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1085.452468][ T6193] usb 1-1: new full-speed USB device number 55 using dummy_hcd [ 1085.460299][ C0] gadgetfs: connected [ 1085.506311][ T6193] gadgetfs: disconnected [ 1086.984622][T15050] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1087.218275][T12339] Bluetooth: hci1: command tx timeout [ 1087.646829][T15474] chnl_net:caif_netlink_parms(): no params data found [ 1088.137720][T15523] gadgetfs: bound to dummy_udc driver [ 1088.393411][T14130] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1088.405470][T14130] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1088.416337][T14130] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1088.426127][T14130] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1088.434460][T14130] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 1088.444615][T14130] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1088.581934][T15474] bridge0: port 1(bridge_slave_0) entered blocking state [ 1088.622898][T15529] gadgetfs: suspended from state 2 [ 1088.636458][ T8] usb 1-1: new full-speed USB device number 56 using dummy_hcd [ 1088.662588][T15474] bridge0: port 1(bridge_slave_0) entered disabled state [ 1088.669896][T15474] bridge_slave_0: entered allmulticast mode [ 1088.746524][T15474] bridge_slave_0: entered promiscuous mode [ 1088.784877][T12339] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1088.797330][T12339] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1088.806522][T12339] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1088.834791][T12339] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1088.842918][T12339] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 1088.850143][T12339] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1089.127582][T15474] bridge0: port 2(bridge_slave_1) entered blocking state [ 1089.149949][T15474] bridge0: port 2(bridge_slave_1) entered disabled state [ 1089.172623][T15474] bridge_slave_1: entered allmulticast mode [ 1089.192990][T15474] bridge_slave_1: entered promiscuous mode [ 1089.286169][T14130] Bluetooth: hci1: command tx timeout [ 1089.384478][T15474] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1089.449432][T15474] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1089.813104][T15474] team0: Port device team_slave_0 added [ 1089.904136][T15474] team0: Port device team_slave_1 added [ 1089.991087][ T2998] hsr_slave_0: left promiscuous mode [ 1090.013242][ T2998] hsr_slave_1: left promiscuous mode [ 1090.042883][ T2998] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1090.062571][ T2998] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1090.093822][ T2998] bridge_slave_1: left allmulticast mode [ 1090.099527][ T2998] bridge_slave_1: left promiscuous mode [ 1090.152904][ T2998] bridge0: port 2(bridge_slave_1) entered disabled state [ 1090.184276][ T2998] bridge_slave_0: left allmulticast mode [ 1090.189980][ T2998] bridge_slave_0: left promiscuous mode [ 1090.223175][ T2998] bridge0: port 1(bridge_slave_0) entered disabled state [ 1090.493726][T14130] Bluetooth: hci0: command tx timeout [ 1090.963191][T14130] Bluetooth: hci2: command tx timeout [ 1090.995804][ T2998] team0 (unregistering): Port device team_slave_1 removed [ 1091.012779][T12339] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1091.028409][T12339] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1091.037516][T12339] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1091.046394][T12339] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1091.055912][T12339] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 1091.063744][T12339] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1091.130333][ T2998] team0 (unregistering): Port device team_slave_0 removed [ 1091.172108][ T2998] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1091.227797][ T2998] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1091.364476][T12339] Bluetooth: hci1: command tx timeout [ 1091.408449][ T2998] bond0 (unregistering): Released all slaves [ 1091.650395][T15474] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1091.683431][T15474] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1091.756296][T15474] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1091.787817][T15474] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1091.805193][T15474] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1091.869112][T15474] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1092.100428][T15474] hsr_slave_0: entered promiscuous mode [ 1092.124456][T15474] hsr_slave_1: entered promiscuous mode [ 1092.143233][T15474] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1092.150860][T15474] Cannot create hsr debugfs directory [ 1092.538345][T15528] chnl_net:caif_netlink_parms(): no params data found [ 1092.562778][T12339] Bluetooth: hci0: command tx timeout [ 1092.689164][T15534] chnl_net:caif_netlink_parms(): no params data found [ 1092.866729][ T2998] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1093.043500][T12339] Bluetooth: hci2: command tx timeout [ 1093.122599][T12339] Bluetooth: hci3: command tx timeout [ 1093.148495][ T2998] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1093.432163][ T2998] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1093.452501][T12339] Bluetooth: hci1: command tx timeout [ 1093.612096][ T2998] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1093.660413][T15528] bridge0: port 1(bridge_slave_0) entered blocking state [ 1093.671292][T15528] bridge0: port 1(bridge_slave_0) entered disabled state [ 1093.689677][T15528] bridge_slave_0: entered allmulticast mode [ 1093.700870][T15528] bridge_slave_0: entered promiscuous mode [ 1093.729697][T15556] chnl_net:caif_netlink_parms(): no params data found [ 1093.817369][T15528] bridge0: port 2(bridge_slave_1) entered blocking state [ 1093.832118][T15528] bridge0: port 2(bridge_slave_1) entered disabled state [ 1093.845462][T15528] bridge_slave_1: entered allmulticast mode [ 1093.852969][T15528] bridge_slave_1: entered promiscuous mode [ 1094.040133][T15534] bridge0: port 1(bridge_slave_0) entered blocking state [ 1094.054286][T15534] bridge0: port 1(bridge_slave_0) entered disabled state [ 1094.061558][T15534] bridge_slave_0: entered allmulticast mode [ 1094.076537][T15534] bridge_slave_0: entered promiscuous mode [ 1094.107863][T15528] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1094.138704][T15528] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1094.196607][T15534] bridge0: port 2(bridge_slave_1) entered blocking state [ 1094.207114][T15534] bridge0: port 2(bridge_slave_1) entered disabled state [ 1094.217589][T15534] bridge_slave_1: entered allmulticast mode [ 1094.231072][T15534] bridge_slave_1: entered promiscuous mode [ 1094.432074][T15528] team0: Port device team_slave_0 added [ 1094.442191][T15528] team0: Port device team_slave_1 added [ 1094.464999][T15534] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1094.504209][T15556] bridge0: port 1(bridge_slave_0) entered blocking state [ 1094.511532][T15556] bridge0: port 1(bridge_slave_0) entered disabled state [ 1094.524744][T15556] bridge_slave_0: entered allmulticast mode [ 1094.531816][T15556] bridge_slave_0: entered promiscuous mode [ 1094.643685][T12339] Bluetooth: hci0: command tx timeout [ 1094.652021][T15528] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1094.665771][T15528] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1094.699712][T15528] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1094.714319][T15534] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1094.746142][T15556] bridge0: port 2(bridge_slave_1) entered blocking state [ 1094.756908][T15556] bridge0: port 2(bridge_slave_1) entered disabled state [ 1094.766760][T15556] bridge_slave_1: entered allmulticast mode [ 1094.777015][T15556] bridge_slave_1: entered promiscuous mode [ 1094.837717][T15528] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1094.849923][T15528] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1094.882200][T15528] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1094.936061][T15534] team0: Port device team_slave_0 added [ 1095.047453][T15534] team0: Port device team_slave_1 added [ 1095.101138][T15556] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1095.123881][T12339] Bluetooth: hci2: command tx timeout [ 1095.159105][T15474] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1095.184211][T15556] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1095.202755][T12339] Bluetooth: hci3: command tx timeout [ 1095.218318][T15528] hsr_slave_0: entered promiscuous mode [ 1095.225522][T15528] hsr_slave_1: entered promiscuous mode [ 1095.231729][T15528] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1095.244793][T15528] Cannot create hsr debugfs directory [ 1095.271106][T15474] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1095.299357][T15474] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1095.351341][T15534] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1095.366315][T15534] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1095.398827][T15534] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1095.411393][T15474] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1095.466690][T15534] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1095.482048][T15534] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1095.515359][T15534] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1095.541003][T15556] team0: Port device team_slave_0 added [ 1095.624851][T15556] team0: Port device team_slave_1 added [ 1095.756261][T15534] hsr_slave_0: entered promiscuous mode [ 1095.771065][T15534] hsr_slave_1: entered promiscuous mode [ 1095.780470][T15534] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1095.790932][T15534] Cannot create hsr debugfs directory [ 1095.870409][T15556] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1095.882173][T15556] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1095.915683][T15556] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1095.987784][ T2998] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1096.042920][T15556] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1096.049920][T15556] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1096.082143][T15556] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1096.169539][ T2998] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1096.265506][ T2998] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1096.361695][ T2998] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1096.432003][T15556] hsr_slave_0: entered promiscuous mode [ 1096.445128][T15556] hsr_slave_1: entered promiscuous mode [ 1096.451379][T15556] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1096.464726][T15556] Cannot create hsr debugfs directory [ 1096.727918][T12339] Bluetooth: hci0: command tx timeout [ 1097.009164][T15474] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1097.204206][T12339] Bluetooth: hci2: command tx timeout [ 1097.282675][T12339] Bluetooth: hci3: command tx timeout [ 1097.618719][T15474] 8021q: adding VLAN 0 to HW filter on device team0 [ 1097.746035][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 1097.753267][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1097.909042][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 1097.916277][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1098.337479][T15474] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1098.358329][T15528] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1098.509568][T15528] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1098.701120][T15528] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1098.729408][T15528] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1099.271956][T15474] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1099.363222][T12339] Bluetooth: hci3: command tx timeout [ 1099.686247][ T2998] hsr_slave_0: left promiscuous mode [ 1099.708494][ T2998] hsr_slave_1: left promiscuous mode [ 1099.717068][ T2998] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1099.745871][ T2998] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1099.764106][ T2998] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1099.771573][ T2998] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1099.805630][ T2998] bridge_slave_1: left allmulticast mode [ 1099.811359][ T2998] bridge_slave_1: left promiscuous mode [ 1099.821035][ T2998] bridge0: port 2(bridge_slave_1) entered disabled state [ 1099.835915][ T2998] bridge_slave_0: left allmulticast mode [ 1099.841629][ T2998] bridge_slave_0: left promiscuous mode [ 1099.856187][ T2998] bridge0: port 1(bridge_slave_0) entered disabled state [ 1099.876189][ T2998] hsr_slave_0: left promiscuous mode [ 1099.882226][ T2998] hsr_slave_1: left promiscuous mode [ 1099.891587][ T2998] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1099.909205][ T2998] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1099.918263][ T2998] bridge_slave_1: left allmulticast mode [ 1099.936040][ T2998] bridge_slave_1: left promiscuous mode [ 1099.941826][ T2998] bridge0: port 2(bridge_slave_1) entered disabled state [ 1099.959987][ T2998] bridge_slave_0: left allmulticast mode [ 1099.966813][ T2998] bridge_slave_0: left promiscuous mode [ 1099.977869][ T2998] bridge0: port 1(bridge_slave_0) entered disabled state [ 1099.998888][ T2998] hsr_slave_0: left promiscuous mode [ 1100.005902][ T2998] hsr_slave_1: left promiscuous mode [ 1100.012004][ T2998] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1100.026472][ T2998] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1100.036755][ T2998] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1100.048146][ T2998] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1100.057999][ T2998] bridge_slave_1: left allmulticast mode [ 1100.069310][ T2998] bridge_slave_1: left promiscuous mode [ 1100.076843][ T2998] bridge0: port 2(bridge_slave_1) entered disabled state [ 1100.092172][ T2998] bridge_slave_0: left allmulticast mode [ 1100.100180][ T2998] bridge_slave_0: left promiscuous mode [ 1100.109952][ T2998] bridge0: port 1(bridge_slave_0) entered disabled state [ 1100.182164][ T2998] veth1_macvtap: left promiscuous mode [ 1100.193176][ T2998] veth0_macvtap: left promiscuous mode [ 1100.198841][ T2998] veth1_vlan: left promiscuous mode [ 1100.209469][ T2998] veth0_vlan: left promiscuous mode [ 1100.217320][ T2998] veth1_macvtap: left promiscuous mode [ 1100.228185][ T2998] veth0_macvtap: left promiscuous mode [ 1100.233999][ T2998] veth1_vlan: left promiscuous mode [ 1100.239300][ T2998] veth0_vlan: left promiscuous mode [ 1101.471830][ T2998] team0 (unregistering): Port device team_slave_1 removed [ 1101.553051][ T2998] team0 (unregistering): Port device team_slave_0 removed [ 1101.637379][ T2998] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1101.716341][ T2998] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1102.319361][ T2998] bond0 (unregistering): Released all slaves [ 1102.794482][ T2998] team0 (unregistering): Port device team_slave_1 removed [ 1102.870379][ T2998] team0 (unregistering): Port device team_slave_0 removed [ 1102.943317][ T2998] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1103.027629][ T2998] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1103.559336][ T2998] bond0 (unregistering): Released all slaves [ 1104.511158][ T2998] team0 (unregistering): Port device team_slave_1 removed [ 1104.589016][ T2998] team0 (unregistering): Port device team_slave_0 removed [ 1104.665970][ T2998] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1104.749398][ T2998] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1105.330365][ T2998] bond0 (unregistering): Released all slaves [ 1105.616003][T15534] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1105.674761][T15534] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1105.726178][T15528] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1105.799244][T15534] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1105.967651][T15534] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1106.016573][T15528] 8021q: adding VLAN 0 to HW filter on device team0 [ 1106.106576][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 1106.113860][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1106.151873][ T2985] bridge0: port 2(bridge_slave_1) entered blocking state [ 1106.159155][ T2985] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1106.237303][T15474] veth0_vlan: entered promiscuous mode [ 1106.298362][T15474] veth1_vlan: entered promiscuous mode [ 1106.452104][T15528] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1106.516728][T15528] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1106.716453][T15556] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 1106.751695][T15556] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 1106.823248][T15556] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 1106.862612][T15556] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 1106.956358][T15474] veth0_macvtap: entered promiscuous mode [ 1107.029177][T15474] veth1_macvtap: entered promiscuous mode [ 1107.199492][T15474] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1107.258193][T15534] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1107.276038][ T2998] IPVS: stop unused estimator thread 0... [ 1107.317650][T15474] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1107.395809][T15534] 8021q: adding VLAN 0 to HW filter on device team0 [ 1107.415237][T15528] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1107.434710][T15474] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1107.464009][T15474] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1107.485867][T15474] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1107.509202][T15474] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1107.545752][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 1107.552964][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1107.609105][T15556] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1107.669966][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 1107.677177][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1107.828433][T15556] 8021q: adding VLAN 0 to HW filter on device team0 [ 1107.876737][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 1107.883959][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1107.946917][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 1107.954137][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1108.038721][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1108.074483][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1108.228656][ T1079] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1108.308236][ T1079] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1108.421735][T15528] veth0_vlan: entered promiscuous mode [ 1108.524797][T15528] veth1_vlan: entered promiscuous mode [ 1108.677716][T15528] veth0_macvtap: entered promiscuous mode [ 1108.769305][T15528] veth1_macvtap: entered promiscuous mode [ 1108.850138][T15528] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1108.894329][T15528] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1108.936798][T15528] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1109.020003][T15528] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1109.058342][T15528] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1109.083902][T15528] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1109.129828][T15528] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1109.163555][T15528] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1109.185707][T15528] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1109.201137][T15528] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1109.224331][T15642] gadgetfs: bound to dummy_udc driver [ 1109.296557][T15534] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1109.359208][T15556] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1109.522608][T13544] usb 1-1: new full-speed USB device number 57 using dummy_hcd [ 1109.567486][ C0] gadgetfs: connected [ 1109.582129][T13544] gadgetfs: disconnected [ 1109.663217][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1109.671098][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1109.742147][T15644] gadgetfs: suspended from state 2 [ 1109.874685][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1109.929666][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1109.992815][T13544] usb 1-1: device not accepting address 57, error -71 [ 1110.615187][T12839] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 1110.635988][ T2998] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1110.860627][T12839] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1110.902508][T12839] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1110.925217][ T2998] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1110.955902][T12839] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1111.006028][T12839] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1111.102690][T12839] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1111.112156][T12839] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1111.150000][ T2998] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1111.169954][T12839] usb 6-1: Product: syz [ 1111.193460][T12839] usb 6-1: Manufacturer: syz [ 1111.216146][T12839] cdc_wdm 6-1:1.0: skipping garbage [ 1111.278961][T15534] veth0_vlan: entered promiscuous mode [ 1111.288708][T12839] cdc_wdm 6-1:1.0: skipping garbage [ 1111.312956][T12839] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 1111.318923][T12839] cdc_wdm 6-1:1.0: Unknown control protocol [ 1111.406864][ T2998] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1111.445315][T12839] usb 6-1: USB disconnect, device number 8 [ 1111.590745][T15534] veth1_vlan: entered promiscuous mode [ 1111.633163][T15556] veth0_vlan: entered promiscuous mode [ 1111.756680][T15556] veth1_vlan: entered promiscuous mode [ 1111.821932][T15534] veth0_macvtap: entered promiscuous mode [ 1111.950960][T15534] veth1_macvtap: entered promiscuous mode [ 1112.003158][T12839] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 1112.055755][T15556] veth0_macvtap: entered promiscuous mode [ 1112.112085][T15534] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1112.172348][T15534] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1112.182223][T15534] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1112.231609][T12839] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1112.250339][T12839] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1112.272353][T15534] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1112.299393][T12839] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1112.313978][T15534] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1112.356664][T12839] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1112.372055][T14130] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1112.388861][T14130] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1112.397481][T14130] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1112.413239][T14130] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1112.420751][T14130] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 1112.429802][T14130] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1112.510213][T15534] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1112.534162][T12839] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1112.552950][T12839] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1112.561087][T15534] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1112.588561][T12839] usb 6-1: Product: syz [ 1112.596543][T15534] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1112.610965][T12839] usb 6-1: Manufacturer: syz [ 1112.636864][T12839] cdc_wdm 6-1:1.0: skipping garbage [ 1112.649601][T15534] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1112.659678][T12839] cdc_wdm 6-1:1.0: skipping garbage [ 1112.676341][T12839] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 1112.687471][T15534] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1112.704904][T12839] cdc_wdm 6-1:1.0: Unknown control protocol [ 1112.730901][T15556] veth1_macvtap: entered promiscuous mode [ 1112.758283][T15534] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1112.820857][T15534] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1112.846944][T15534] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1112.870430][T15534] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1113.231101][T15556] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1113.259594][T15556] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1113.279360][T15556] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1113.294984][T15556] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1113.305994][T15556] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1113.319017][T15556] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1113.334974][T15556] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1113.401866][T15556] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1113.456660][T15556] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1113.483685][T15556] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1113.508135][T15556] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1113.535246][T15556] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1113.576824][T15556] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1113.624420][T15556] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1113.632829][ C0] cdc_wdm 6-1:1.0: unknown notification 21 received: index 40500 len 60065 [ 1113.642380][ C0] cdc_wdm 6-1:1.0: unknown notification 163 received: index 40728 len 8081 [ 1113.814719][T15556] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1113.840715][T15556] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1113.864841][T15556] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1113.878771][T13544] usb 6-1: USB disconnect, device number 9 [ 1113.912742][T15556] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1114.139604][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1114.192502][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1114.488336][T12339] Bluetooth: hci1: command tx timeout [ 1115.862728][ T1079] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1115.870652][ T1079] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1116.096648][T13516] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1116.153279][T13516] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1116.176596][ T1288] ieee802154 phy0 wpan0: encryption failed: -22 [ 1116.186328][ T1288] ieee802154 phy1 wpan1: encryption failed: -22 [ 1116.567695][T12339] Bluetooth: hci1: command tx timeout [ 1116.816488][T15680] chnl_net:caif_netlink_parms(): no params data found [ 1116.868486][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1116.932907][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1116.991125][ T2998] hsr_slave_0: left promiscuous mode [ 1117.034468][ T2998] hsr_slave_1: left promiscuous mode [ 1117.050439][T15721] gadgetfs: bound to dummy_udc driver [ 1117.072810][ T2998] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1117.080281][ T2998] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1117.167033][ T2998] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1117.197376][ T2998] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1117.243331][ T2998] bridge_slave_1: left allmulticast mode [ 1117.249041][ T2998] bridge_slave_1: left promiscuous mode [ 1117.288114][ T2998] bridge0: port 2(bridge_slave_1) entered disabled state [ 1117.362840][T13545] usb 1-1: new full-speed USB device number 59 using dummy_hcd [ 1117.370789][ C0] gadgetfs: connected [ 1117.384306][ T2998] bridge_slave_0: left allmulticast mode [ 1117.390033][ T2998] bridge_slave_0: left promiscuous mode [ 1117.400311][T13545] gadgetfs: disconnected [ 1117.439589][ T2998] bridge0: port 1(bridge_slave_0) entered disabled state [ 1117.654098][ T2998] veth1_macvtap: left promiscuous mode [ 1117.659694][ T2998] veth0_macvtap: left promiscuous mode [ 1117.695278][ T2998] veth1_vlan: left promiscuous mode [ 1117.700672][ T2998] veth0_vlan: left promiscuous mode [ 1118.539964][T15735] NILFS (nullb0): couldn't find nilfs on the device [ 1118.643907][T12339] Bluetooth: hci1: command tx timeout [ 1119.655686][ T2998] team0 (unregistering): Port device team_slave_1 removed [ 1119.729715][ T2998] team0 (unregistering): Port device team_slave_0 removed [ 1119.820151][ T2998] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1119.901308][ T2998] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1120.473418][ T2998] bond0 (unregistering): Released all slaves [ 1120.727313][T12339] Bluetooth: hci1: command tx timeout [ 1121.038942][T15680] bridge0: port 1(bridge_slave_0) entered blocking state [ 1121.098169][T15680] bridge0: port 1(bridge_slave_0) entered disabled state [ 1121.152000][T15680] bridge_slave_0: entered allmulticast mode [ 1121.190841][T15680] bridge_slave_0: entered promiscuous mode [ 1121.247239][T15680] bridge0: port 2(bridge_slave_1) entered blocking state [ 1121.301763][T15680] bridge0: port 2(bridge_slave_1) entered disabled state [ 1121.336331][T15680] bridge_slave_1: entered allmulticast mode [ 1121.357654][T15680] bridge_slave_1: entered promiscuous mode [ 1121.382711][T12839] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 1121.505463][T15680] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1121.584613][T15680] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1121.610134][T12839] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1121.652065][T12839] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1121.719360][T12839] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1121.782404][T12839] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1121.806102][T15680] team0: Port device team_slave_0 added [ 1122.021206][T12839] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1122.037410][T15680] team0: Port device team_slave_1 added [ 1122.118914][T12839] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1122.167631][T12839] usb 6-1: Product: syz [ 1122.205303][T12839] usb 6-1: Manufacturer: syz [ 1122.243549][T12839] cdc_wdm 6-1:1.0: skipping garbage [ 1122.284058][T12839] cdc_wdm 6-1:1.0: skipping garbage [ 1122.331192][T12839] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 1122.359485][T15765] gadgetfs: bound to dummy_udc driver [ 1122.371154][T12839] cdc_wdm 6-1:1.0: Unknown control protocol [ 1122.397547][ T2998] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1122.480592][T12839] usb 6-1: USB disconnect, device number 10 [ 1122.571275][T15680] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1122.635329][T15680] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1122.694535][ T8] usb 1-1: new full-speed USB device number 60 using dummy_hcd [ 1122.702454][ C0] gadgetfs: connected [ 1122.742395][ T8] gadgetfs: disconnected [ 1122.800913][T15680] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1122.940164][ T2998] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1123.035302][T15680] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1123.072563][T12839] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 1123.093125][T15680] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1123.181514][T15680] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1123.208732][T14130] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1123.225385][T14130] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1123.237219][T14130] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1123.246251][T14130] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1123.255031][T14130] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 1123.263902][T14130] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1123.313225][T12839] usb 6-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1123.321901][T12839] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1123.374015][T12839] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1123.408468][T12839] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1123.442029][T12839] usb 6-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1123.468152][T12839] usb 6-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1123.501214][T12839] usb 6-1: Product: syz [ 1123.507787][ T2998] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1123.521411][T12839] usb 6-1: Manufacturer: syz [ 1123.543271][T12839] cdc_wdm 6-1:1.0: skipping garbage [ 1123.548568][T12839] cdc_wdm 6-1:1.0: skipping garbage [ 1123.615455][T12839] cdc_wdm 6-1:1.0: cdc-wdm0: USB WDM device [ 1123.653413][T12839] cdc_wdm 6-1:1.0: Unknown control protocol [ 1123.824113][ T2998] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1123.918520][T15680] hsr_slave_0: entered promiscuous mode [ 1123.948053][T15680] hsr_slave_1: entered promiscuous mode [ 1124.407240][ C0] cdc_wdm 6-1:1.0: wdm_int_callback - 0 bytes [ 1125.375997][T14130] Bluetooth: hci2: command tx timeout [ 1125.461697][T12339] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1125.477112][T12339] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1125.487575][T12339] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1125.500123][T12339] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1125.508568][T12339] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 1125.518010][T12339] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1125.753308][T12839] usb 6-1: USB disconnect, device number 11 [ 1126.740728][T15774] chnl_net:caif_netlink_parms(): no params data found [ 1127.287286][T15774] bridge0: port 1(bridge_slave_0) entered blocking state [ 1127.305568][T15774] bridge0: port 1(bridge_slave_0) entered disabled state [ 1127.325290][T15774] bridge_slave_0: entered allmulticast mode [ 1127.339324][T15774] bridge_slave_0: entered promiscuous mode [ 1127.378538][ T2998] hsr_slave_0: left promiscuous mode [ 1127.399571][ T2998] hsr_slave_1: left promiscuous mode [ 1127.420713][ T2998] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1127.438696][ T2998] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1127.534135][T12339] Bluetooth: hci2: command tx timeout [ 1127.559940][ T2998] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1127.590442][ T2998] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1127.603378][T12339] Bluetooth: hci3: command tx timeout [ 1127.623048][ T2998] bridge_slave_1: left allmulticast mode [ 1127.628753][ T2998] bridge_slave_1: left promiscuous mode [ 1127.852159][ T2998] bridge0: port 2(bridge_slave_1) entered disabled state [ 1127.896656][ T2998] bridge_slave_0: left allmulticast mode [ 1127.920336][ T2998] bridge_slave_0: left promiscuous mode [ 1127.945692][ T2998] bridge0: port 1(bridge_slave_0) entered disabled state [ 1128.021417][T15834] gadgetfs: bound to dummy_udc driver [ 1128.039244][ T2998] veth1_macvtap: left promiscuous mode [ 1128.068747][ T2998] veth0_macvtap: left promiscuous mode [ 1128.096150][ T2998] veth1_vlan: left promiscuous mode [ 1128.101531][ T2998] veth0_vlan: left promiscuous mode [ 1128.323336][T13545] usb 1-1: new full-speed USB device number 61 using dummy_hcd [ 1128.331170][ C0] gadgetfs: connected [ 1128.344791][T13545] gadgetfs: disconnected [ 1129.396112][ T2998] team0 (unregistering): Port device team_slave_1 removed [ 1129.474620][ T2998] team0 (unregistering): Port device team_slave_0 removed [ 1129.546257][ T2998] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1129.604857][T12339] Bluetooth: hci2: command tx timeout [ 1129.627605][ T2998] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1129.682397][T12339] Bluetooth: hci3: command tx timeout [ 1130.167961][ T2998] bond0 (unregistering): Released all slaves [ 1130.327346][T15774] bridge0: port 2(bridge_slave_1) entered blocking state [ 1130.346873][T15774] bridge0: port 2(bridge_slave_1) entered disabled state [ 1130.358121][T15774] bridge_slave_1: entered allmulticast mode [ 1130.365462][T15774] bridge_slave_1: entered promiscuous mode [ 1130.422652][T15680] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 1130.512356][T15680] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 1130.548714][T15680] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 1130.662068][T15680] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 1130.714295][T15774] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1130.765998][T15774] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1131.064510][T15774] team0: Port device team_slave_0 added [ 1131.076395][T15796] chnl_net:caif_netlink_parms(): no params data found [ 1131.175443][T15774] team0: Port device team_slave_1 added [ 1131.399443][T15774] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1131.426005][T15774] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1131.518334][T15774] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1131.575923][T15774] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1131.603676][T15774] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1131.685594][T12339] Bluetooth: hci2: command tx timeout [ 1131.712580][T15774] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1131.767527][T12339] Bluetooth: hci3: command tx timeout [ 1131.856606][ T2998] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1132.133933][ T2998] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1132.288070][T14130] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1132.299982][T14130] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1132.312501][T14130] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1132.320270][T14130] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1132.328994][T14130] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 1132.337268][T14130] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1132.374223][ T2998] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1132.420102][T15774] hsr_slave_0: entered promiscuous mode [ 1132.446226][T15774] hsr_slave_1: entered promiscuous mode [ 1132.467046][T15774] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1132.486132][T15774] Cannot create hsr debugfs directory [ 1132.596294][ T2998] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1132.670987][T15796] bridge0: port 1(bridge_slave_0) entered blocking state [ 1132.694449][T15796] bridge0: port 1(bridge_slave_0) entered disabled state [ 1132.701736][T15796] bridge_slave_0: entered allmulticast mode [ 1132.735392][T15796] bridge_slave_0: entered promiscuous mode [ 1132.816608][T15796] bridge0: port 2(bridge_slave_1) entered blocking state [ 1132.835808][T15796] bridge0: port 2(bridge_slave_1) entered disabled state [ 1132.852809][T15796] bridge_slave_1: entered allmulticast mode [ 1132.872516][T15796] bridge_slave_1: entered promiscuous mode [ 1132.938539][T15680] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1132.994520][T15796] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1133.096852][T15796] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1133.149953][T15680] 8021q: adding VLAN 0 to HW filter on device team0 [ 1133.264455][ T1079] bridge0: port 1(bridge_slave_0) entered blocking state [ 1133.271629][ T1079] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1133.295993][T15796] team0: Port device team_slave_0 added [ 1133.344575][ T1079] bridge0: port 2(bridge_slave_1) entered blocking state [ 1133.351751][ T1079] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1133.370113][T15796] team0: Port device team_slave_1 added [ 1133.536408][T15796] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1133.551743][T15796] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1133.600844][T15796] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1133.701343][ T2998] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1133.815682][T15796] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1133.835349][T15796] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1133.872051][T14130] Bluetooth: hci3: command tx timeout [ 1133.902631][T15796] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1133.999280][ T2998] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1134.176931][ T2998] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1134.399290][ T2998] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1134.411829][T14130] Bluetooth: hci0: command tx timeout [ 1134.450016][T15680] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1134.474225][T15680] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1134.535139][T15796] hsr_slave_0: entered promiscuous mode [ 1134.554315][T15796] hsr_slave_1: entered promiscuous mode [ 1134.572732][T15796] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1134.580340][T15796] Cannot create hsr debugfs directory [ 1135.086200][T15862] chnl_net:caif_netlink_parms(): no params data found [ 1135.959374][T15680] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1136.437234][T15774] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1136.486672][T14130] Bluetooth: hci0: command tx timeout [ 1136.534279][T15862] bridge0: port 1(bridge_slave_0) entered blocking state [ 1136.541471][T15862] bridge0: port 1(bridge_slave_0) entered disabled state [ 1136.602934][T15862] bridge_slave_0: entered allmulticast mode [ 1136.610041][T15862] bridge_slave_0: entered promiscuous mode [ 1136.683282][T15862] bridge0: port 2(bridge_slave_1) entered blocking state [ 1136.690481][T15862] bridge0: port 2(bridge_slave_1) entered disabled state [ 1136.778342][T15862] bridge_slave_1: entered allmulticast mode [ 1136.804663][T15862] bridge_slave_1: entered promiscuous mode [ 1137.076604][T15774] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1137.126663][T15774] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1137.168727][T15774] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1137.918753][T15862] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1137.954206][T15862] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1138.408105][T15862] team0: Port device team_slave_0 added [ 1138.435046][T15862] team0: Port device team_slave_1 added [ 1138.549812][T15680] veth0_vlan: entered promiscuous mode [ 1138.565139][T14130] Bluetooth: hci0: command tx timeout [ 1138.607589][T15862] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1138.628644][T15862] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1138.684559][T15862] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1138.823602][T15862] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1138.830612][T15862] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1138.917023][T15862] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1139.069499][T15774] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1139.097254][T15680] veth1_vlan: entered promiscuous mode [ 1139.168254][T15796] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 1139.310552][T15796] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 1139.335887][T15796] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 1139.381033][T15774] 8021q: adding VLAN 0 to HW filter on device team0 [ 1139.439752][T15796] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 1139.471027][T15862] hsr_slave_0: entered promiscuous mode [ 1139.497214][T15862] hsr_slave_1: entered promiscuous mode [ 1139.513355][T15862] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1139.520977][T15862] Cannot create hsr debugfs directory [ 1139.640549][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 1139.647759][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1139.724112][ T2998] hsr_slave_0: left promiscuous mode [ 1139.745688][ T2998] hsr_slave_1: left promiscuous mode [ 1139.768175][ T2998] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1139.786823][ T2998] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1139.808854][ T2998] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1139.833140][ T2998] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1139.861109][ T2998] bridge_slave_1: left allmulticast mode [ 1139.875540][ T2998] bridge_slave_1: left promiscuous mode [ 1139.881332][ T2998] bridge0: port 2(bridge_slave_1) entered disabled state [ 1139.908927][ T2998] bridge_slave_0: left allmulticast mode [ 1139.932566][ T2998] bridge_slave_0: left promiscuous mode [ 1139.949235][ T2998] bridge0: port 1(bridge_slave_0) entered disabled state [ 1139.982173][ T2998] hsr_slave_0: left promiscuous mode [ 1139.999106][ T2998] hsr_slave_1: left promiscuous mode [ 1140.013242][ T2998] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1140.020708][ T2998] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1140.065603][ T2998] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1140.086080][ T2998] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1140.107515][ T2998] bridge_slave_1: left allmulticast mode [ 1140.113653][ T2998] bridge_slave_1: left promiscuous mode [ 1140.119449][ T2998] bridge0: port 2(bridge_slave_1) entered disabled state [ 1140.160975][ T2998] bridge_slave_0: left allmulticast mode [ 1140.180382][ T2998] bridge_slave_0: left promiscuous mode [ 1140.199403][ T2998] bridge0: port 1(bridge_slave_0) entered disabled state [ 1140.313629][ T2998] veth1_macvtap: left promiscuous mode [ 1140.319215][ T2998] veth0_macvtap: left promiscuous mode [ 1140.342036][ T2998] veth1_vlan: left promiscuous mode [ 1140.354285][ T2998] veth0_vlan: left promiscuous mode [ 1140.377312][ T2998] veth1_macvtap: left promiscuous mode [ 1140.393693][ T2998] veth0_macvtap: left promiscuous mode [ 1140.406868][ T2998] veth1_vlan: left promiscuous mode [ 1140.425437][ T2998] veth0_vlan: left promiscuous mode [ 1140.649386][T14130] Bluetooth: hci0: command tx timeout [ 1142.613214][ T2998] team0 (unregistering): Port device team_slave_1 removed [ 1142.779792][ T2998] team0 (unregistering): Port device team_slave_0 removed [ 1142.927457][ T2998] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1143.077573][ T2998] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1144.194144][ T2998] bond0 (unregistering): Released all slaves [ 1145.945616][ T2998] team0 (unregistering): Port device team_slave_1 removed [ 1146.108276][ T2998] team0 (unregistering): Port device team_slave_0 removed [ 1146.268107][ T2998] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1146.403956][ T2998] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1147.554254][ T2998] bond0 (unregistering): Released all slaves [ 1147.816007][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 1147.823242][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1147.874571][T15680] veth0_macvtap: entered promiscuous mode [ 1147.920825][T15680] veth1_macvtap: entered promiscuous mode [ 1148.008632][T15680] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1148.078668][T15680] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1148.213157][T15680] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1148.221915][T15680] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1148.263492][T15680] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1148.283714][T15680] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1149.146889][T15796] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1149.208840][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1149.272606][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1149.410312][T15796] 8021q: adding VLAN 0 to HW filter on device team0 [ 1149.495434][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 1149.502654][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1149.611630][ T2998] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1149.624570][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 1149.631732][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1149.654881][ T2998] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1149.727145][T15774] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1149.836991][T15862] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1149.917545][T15862] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1151.654798][T15862] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1151.801332][T16095] ALSA: mixer_oss: invalid OSS volume 'PHlâ6žžqÓ†ØÈÌONEOUT' [ 1151.823672][T16095] ALSA: mixer_oss: invalid index 137438 [ 1151.876345][T15862] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1152.104823][T15774] veth0_vlan: entered promiscuous mode [ 1152.196332][T15774] veth1_vlan: entered promiscuous mode [ 1152.468258][T15774] veth0_macvtap: entered promiscuous mode [ 1152.509564][T15862] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1152.611665][T15774] veth1_macvtap: entered promiscuous mode [ 1152.681773][T15774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1152.742462][T15774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1152.787204][T15774] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1153.096681][T15796] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1153.140753][T15862] 8021q: adding VLAN 0 to HW filter on device team0 [ 1153.199934][T15774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1153.263359][T15774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1153.311080][T15774] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1153.327971][T16120] gadgetfs: bound to dummy_udc driver [ 1153.357666][T15774] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1153.427617][T15774] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1153.472520][T15774] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1153.481280][T15774] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1153.560351][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 1153.567579][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1153.614195][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 1153.621502][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1153.652664][ T6202] usb 1-1: new full-speed USB device number 62 using dummy_hcd [ 1153.660477][ C0] gadgetfs: connected [ 1153.670810][ T6202] gadgetfs: disconnected [ 1154.149476][T15862] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1154.201019][T15862] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1154.447028][ T2998] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1154.583239][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1154.591121][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1154.847451][ T2998] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1155.084386][ T2998] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1155.169612][T15796] veth0_vlan: entered promiscuous mode [ 1155.338162][ T2998] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1155.404347][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1155.471696][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1155.487312][T15796] veth1_vlan: entered promiscuous mode [ 1155.537868][T15862] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1155.881620][T15796] veth0_macvtap: entered promiscuous mode [ 1156.214177][T12339] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1156.227603][T12339] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1156.240341][T12339] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1156.256770][T12339] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1156.265334][T12339] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 1156.275565][T12339] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1156.344198][T15796] veth1_macvtap: entered promiscuous mode [ 1156.413847][T15862] veth0_vlan: entered promiscuous mode [ 1156.532055][T15796] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1156.697386][T15796] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1156.737082][T15796] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1156.787923][T15796] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1156.834894][T15796] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1157.000882][T15796] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1157.027651][T15796] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1157.060151][T15796] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1157.083919][T15796] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1157.113793][T15796] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1157.136348][T15862] veth1_vlan: entered promiscuous mode [ 1157.192599][T13609] usb 1-1: new high-speed USB device number 63 using dummy_hcd [ 1157.246710][T15796] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1157.275154][T15796] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1157.297024][T15796] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1157.318260][T15796] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1157.404407][T13609] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1157.423336][T13609] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0 [ 1157.483927][T13609] usb 1-1: New USB device found, idVendor=0681, idProduct=0005, bcdDevice= 1.00 [ 1157.550166][T13609] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1157.629206][T13609] idmouse 1-1:1.0: Siemens ID Mouse FingerTIP Sensor Driver now attached [ 1157.748030][T15862] veth0_macvtap: entered promiscuous mode [ 1157.917445][T15862] veth1_macvtap: entered promiscuous mode [ 1158.063047][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1158.108237][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1158.322978][T12339] Bluetooth: hci1: command tx timeout [ 1158.366518][T15862] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1158.403089][T15862] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1158.428397][T15862] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1158.452593][T15862] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1158.480654][T15862] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1158.501944][T15862] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1158.528792][T15862] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1158.627304][ T2998] hsr_slave_0: left promiscuous mode [ 1158.648292][ T2998] hsr_slave_1: left promiscuous mode [ 1158.664329][ T2998] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1158.682039][ T2998] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1158.716576][ T2998] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1158.736186][ T2998] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1158.758741][ T2998] bridge_slave_1: left allmulticast mode [ 1158.773452][ T2998] bridge_slave_1: left promiscuous mode [ 1158.789657][ T2998] bridge0: port 2(bridge_slave_1) entered disabled state [ 1158.810673][ T2998] bridge_slave_0: left allmulticast mode [ 1158.830727][ T2998] bridge_slave_0: left promiscuous mode [ 1158.840954][ T2998] bridge0: port 1(bridge_slave_0) entered disabled state [ 1158.946276][ T2998] veth1_macvtap: left promiscuous mode [ 1158.951904][ T2998] veth0_macvtap: left promiscuous mode [ 1158.972163][ T2998] veth1_vlan: left promiscuous mode [ 1158.981024][ T2998] veth0_vlan: left promiscuous mode [ 1159.338977][T14441] usb 1-1: USB disconnect, device number 63 [ 1159.359717][T14441] idmouse 1-1:1.0: disconnected [ 1160.010779][T16194] gadgetfs: bound to dummy_udc driver [ 1160.110889][ T2998] team0 (unregistering): Port device team_slave_1 removed [ 1160.223338][ T2998] team0 (unregistering): Port device team_slave_0 removed [ 1160.283420][ T8] usb 1-1: new full-speed USB device number 64 using dummy_hcd [ 1160.291260][ C0] gadgetfs: connected [ 1160.309736][ T8] gadgetfs: disconnected [ 1160.415130][T12339] Bluetooth: hci1: command tx timeout [ 1160.429471][ T2998] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1160.510251][ T2998] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1161.067400][ T2998] bond0 (unregistering): Released all slaves [ 1161.189274][T16155] chnl_net:caif_netlink_parms(): no params data found [ 1161.275343][T15862] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1161.286916][T15862] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1161.301268][T15862] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1161.312011][T15862] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1161.328253][T15862] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1161.400359][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1161.433405][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1161.449479][T15862] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1161.495913][T15862] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1161.505104][T15862] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1161.532425][T15862] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1162.270336][T16155] bridge0: port 1(bridge_slave_0) entered blocking state [ 1162.336580][T16155] bridge0: port 1(bridge_slave_0) entered disabled state [ 1162.378109][T16155] bridge_slave_0: entered allmulticast mode [ 1162.456848][T16155] bridge_slave_0: entered promiscuous mode [ 1162.484230][T12339] Bluetooth: hci1: command tx timeout [ 1162.502194][T16155] bridge0: port 2(bridge_slave_1) entered blocking state [ 1162.535264][T16155] bridge0: port 2(bridge_slave_1) entered disabled state [ 1162.567445][T16155] bridge_slave_1: entered allmulticast mode [ 1162.604394][T16155] bridge_slave_1: entered promiscuous mode [ 1162.644994][ T2985] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1162.713885][ T2985] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1162.863702][T16155] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1163.109889][ T2998] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1163.178880][T16155] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1163.819519][ T2998] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1163.886458][T16155] team0: Port device team_slave_0 added [ 1163.908100][T14130] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1163.920007][T14130] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1163.929622][T14130] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1163.938779][T14130] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1163.950643][T14130] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 1163.958352][T14130] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1163.997329][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1164.028232][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1164.136241][ T2998] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1164.189037][T16155] team0: Port device team_slave_1 added [ 1164.231337][T16234] gadgetfs: bound to dummy_udc driver [ 1164.407455][ T2998] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1164.540144][T16155] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1164.547343][T12839] usb 1-1: new full-speed USB device number 65 using dummy_hcd [ 1164.562995][T14130] Bluetooth: hci1: command tx timeout [ 1164.583212][ C0] gadgetfs: connected [ 1164.587307][T16155] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1164.613621][T12839] gadgetfs: disconnected [ 1164.807001][ C0] gadgetfs: connected [ 1164.826109][T12839] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 1164.888682][T16236] gadgetfs: suspended from state 3 [ 1164.896436][T12839] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= 1.00 [ 1164.906510][T16155] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1164.931498][T12839] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1164.969805][T16155] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1164.978783][T16236] gadgetfs: disconnected [ 1165.017494][T12839] usb 1-1: can't set config #1, error -71 [ 1165.029640][T16155] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1165.091781][T12839] usb 1-1: USB disconnect, device number 65 [ 1165.098479][T15796] ================================================================== [ 1165.106615][T15796] BUG: KASAN: slab-use-after-free in __mutex_lock+0xfc/0xc80 [ 1165.114046][T15796] Read of size 8 at addr ffff88805e40f460 by task syz-executor/15796 [ 1165.122165][T15796] [ 1165.124542][T15796] CPU: 0 PID: 15796 Comm: syz-executor Not tainted syzkaller #0 [ 1165.132177][T15796] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1165.142240][T15796] Call Trace: [ 1165.145527][T15796] [ 1165.148480][T15796] dump_stack_lvl+0x18c/0x250 [ 1165.153198][T15796] ? __lock_acquire+0x7d80/0x7d80 [ 1165.158238][T15796] ? show_regs_print_info+0x20/0x20 [ 1165.163453][T15796] ? load_image+0x420/0x420 [ 1165.167991][T15796] ? __virt_addr_valid+0x10c/0x380 [ 1165.173115][T15796] ? __virt_addr_valid+0x10c/0x380 [ 1165.178242][T15796] ? __virt_addr_valid+0x10c/0x380 [ 1165.183366][T15796] print_report+0xa8/0x210 [ 1165.187814][T15796] ? __mutex_lock+0xfc/0xc80 [ 1165.192430][T15796] kasan_report+0x117/0x150 [ 1165.196944][T15796] ? tomoyo_check_open_permission+0x384/0x460 [ 1165.203063][T15796] ? __mutex_lock+0xfc/0xc80 [ 1165.207661][T15796] __mutex_lock+0xfc/0xc80 [ 1165.212173][T15796] ? end_current_label_crit_section+0x170/0x170 [ 1165.218446][T15796] ? ep_open+0x4e/0x270 [ 1165.222626][T15796] ? mutex_lock_nested+0x20/0x20 [ 1165.227564][T15796] ? apparmor_file_open+0x5ab/0x760 [ 1165.232774][T15796] ? apparmor_inode_getattr+0x2c0/0x2c0 [ 1165.238329][T15796] ? __rwlock_init+0x150/0x150 [ 1165.243109][T15796] ep_open+0x4e/0x270 [ 1165.247126][T15796] ? do_dentry_open+0x86f/0x14b0 [ 1165.252080][T15796] do_dentry_open+0x880/0x14b0 [ 1165.256861][T15796] ? ep_ioctl+0x1c0/0x1c0 [ 1165.261207][T15796] path_openat+0x284f/0x3270 [ 1165.265816][T15796] ? do_sys_openat2+0xda/0x1d0 [ 1165.270616][T15796] ? __x64_sys_openat+0x139/0x160 [ 1165.275729][T15796] ? verify_lock_unused+0x140/0x140 [ 1165.280966][T15796] ? do_filp_open+0x430/0x430 [ 1165.285670][T15796] do_filp_open+0x1f2/0x430 [ 1165.290185][T15796] ? vfs_tmpfile+0x620/0x620 [ 1165.294792][T15796] ? _raw_spin_unlock+0x28/0x40 [ 1165.299654][T15796] ? alloc_fd+0x590/0x640 [ 1165.304023][T15796] do_sys_openat2+0x134/0x1d0 [ 1165.308734][T15796] ? do_sys_open+0xe0/0xe0 [ 1165.313182][T15796] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1165.319183][T15796] ? fsnotify_link_count+0xf0/0xf0 [ 1165.324324][T15796] ? lock_chain_count+0x20/0x20 [ 1165.329198][T15796] __x64_sys_openat+0x139/0x160 [ 1165.334066][T15796] do_syscall_64+0x55/0xb0 [ 1165.338520][T15796] ? clear_bhb_loop+0x40/0x90 [ 1165.343232][T15796] ? clear_bhb_loop+0x40/0x90 [ 1165.347922][T15796] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1165.353832][T15796] RIP: 0033:0x7efd5955e98e [ 1165.358256][T15796] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1165.377881][T15796] RSP: 002b:00007ffe39a15928 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1165.386306][T15796] RAX: ffffffffffffffda RBX: 0000555556ec6500 RCX: 00007efd5955e98e [ 1165.394290][T15796] RDX: 0000000000000000 RSI: 00007ffe39a15a90 RDI: ffffffffffffff9c [ 1165.402351][T15796] RBP: 00007ffe39a15a90 R08: 0000000000000000 R09: 0000000000000000 [ 1165.410337][T15796] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe39a16b80 [ 1165.418323][T15796] R13: 00007efd596344bb R14: 0000555556ec64e8 R15: 0000000000000006 [ 1165.426316][T15796] [ 1165.429348][T15796] [ 1165.431701][T15796] Allocated by task 16234: [ 1165.436135][T15796] kasan_set_track+0x4e/0x70 [ 1165.440759][T15796] __kasan_kmalloc+0x8f/0xa0 [ 1165.445358][T15796] gadgetfs_bind+0x25f/0x830 [ 1165.449953][T15796] gadget_bind_driver+0x2b3/0x770 [ 1165.455012][T15796] really_probe+0x247/0xae0 [ 1165.459540][T15796] __driver_probe_device+0x1f5/0x390 [ 1165.464833][T15796] driver_probe_device+0x4f/0x420 [ 1165.469863][T15796] __driver_attach+0x444/0x6d0 [ 1165.474638][T15796] bus_for_each_dev+0x235/0x2b0 [ 1165.479522][T15796] bus_add_driver+0x340/0x630 [ 1165.484232][T15796] driver_register+0x23a/0x310 [ 1165.489025][T15796] usb_gadget_register_driver_owner+0xf9/0x270 [ 1165.495224][T15796] dev_config+0xe49/0x1260 [ 1165.499677][T15796] vfs_write+0x299/0x9a0 [ 1165.503974][T15796] ksys_write+0x151/0x260 [ 1165.508343][T15796] do_syscall_64+0x55/0xb0 [ 1165.512788][T15796] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1165.518701][T15796] [ 1165.521033][T15796] Freed by task 16236: [ 1165.525104][T15796] kasan_set_track+0x4e/0x70 [ 1165.529707][T15796] kasan_save_free_info+0x28/0x40 [ 1165.534743][T15796] ____kasan_slab_free+0x126/0x1f0 [ 1165.539865][T15796] slab_free_freelist_hook+0x130/0x1a0 [ 1165.545334][T15796] __kmem_cache_free+0xba/0x1f0 [ 1165.550281][T15796] destroy_ep_files+0x280/0x340 [ 1165.555138][T15796] gadgetfs_unbind+0x109/0x2b0 [ 1165.559933][T15796] gadget_unbind_driver+0x1bf/0x3e0 [ 1165.565148][T15796] device_release_driver_internal+0x408/0x6f0 [ 1165.571224][T15796] driver_detach+0x1f3/0x2d0 [ 1165.575820][T15796] bus_remove_driver+0x221/0x2f0 [ 1165.580767][T15796] usb_gadget_unregister_driver+0x4e/0x70 [ 1165.586504][T15796] dev_release+0x86/0x200 [ 1165.590841][T15796] __fput+0x221/0x940 [ 1165.594847][T15796] task_work_run+0x1d4/0x260 [ 1165.599454][T15796] do_exit+0x986/0x2530 [ 1165.603646][T15796] __ia32_sys_exit+0x0/0x40 [ 1165.608152][T15796] do_syscall_64+0x55/0xb0 [ 1165.612580][T15796] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1165.618480][T15796] [ 1165.620809][T15796] Last potentially related work creation: [ 1165.626525][T15796] kasan_save_stack+0x3e/0x60 [ 1165.631211][T15796] __kasan_record_aux_stack+0xaf/0xc0 [ 1165.636596][T15796] call_rcu+0x153/0x900 [ 1165.640784][T15796] fib6_del+0x1163/0x1590 [ 1165.645203][T15796] fib6_clean_node+0x290/0x540 [ 1165.649979][T15796] fib6_walk_continue+0x67f/0x8d0 [ 1165.655016][T15796] fib6_walk+0x149/0x270 [ 1165.659265][T15796] __fib6_clean_all+0x27e/0x3e0 [ 1165.664165][T15796] rt6_disable_ip+0x12a/0x860 [ 1165.668853][T15796] addrconf_ifdown+0x160/0x18a0 [ 1165.673733][T15796] addrconf_notify+0x6c6/0x1010 [ 1165.678594][T15796] notifier_call_chain+0x18f/0x380 [ 1165.683719][T15796] dev_close_many+0x2a6/0x410 [ 1165.688464][T15796] unregister_netdevice_many_notify+0x4bf/0x1910 [ 1165.694815][T15796] default_device_exit_batch+0x962/0xa00 [ 1165.700550][T15796] cleanup_net+0x785/0xb00 [ 1165.705001][T15796] process_scheduled_works+0xa60/0x1600 [ 1165.710558][T15796] worker_thread+0xa5e/0xfe0 [ 1165.715182][T15796] kthread+0x2fa/0x390 [ 1165.719259][T15796] ret_from_fork+0x48/0x80 [ 1165.723686][T15796] ret_from_fork_asm+0x11/0x20 [ 1165.728484][T15796] [ 1165.730812][T15796] Second to last potentially related work creation: [ 1165.737397][T15796] kasan_save_stack+0x3e/0x60 [ 1165.742083][T15796] __kasan_record_aux_stack+0xaf/0xc0 [ 1165.747500][T15796] call_rcu+0x153/0x900 [ 1165.751672][T15796] __ip6_del_rt+0x111/0x170 [ 1165.756193][T15796] ip6_del_rt+0xc2/0x110 [ 1165.760449][T15796] __ipv6_ifa_notify+0x5ed/0xb40 [ 1165.765401][T15796] addrconf_ifdown+0xe5d/0x18a0 [ 1165.770262][T15796] addrconf_notify+0x6c6/0x1010 [ 1165.775120][T15796] notifier_call_chain+0x18f/0x380 [ 1165.780241][T15796] dev_close_many+0x2a6/0x410 [ 1165.784928][T15796] unregister_netdevice_many_notify+0x4bf/0x1910 [ 1165.791275][T15796] default_device_exit_batch+0x962/0xa00 [ 1165.797010][T15796] cleanup_net+0x785/0xb00 [ 1165.801461][T15796] process_scheduled_works+0xa60/0x1600 [ 1165.807016][T15796] worker_thread+0xa5e/0xfe0 [ 1165.811617][T15796] kthread+0x2fa/0x390 [ 1165.815690][T15796] ret_from_fork+0x48/0x80 [ 1165.820119][T15796] ret_from_fork_asm+0x11/0x20 [ 1165.824919][T15796] [ 1165.827251][T15796] The buggy address belongs to the object at ffff88805e40f400 [ 1165.827251][T15796] which belongs to the cache kmalloc-512 of size 512 [ 1165.841383][T15796] The buggy address is located 96 bytes inside of [ 1165.841383][T15796] freed 512-byte region [ffff88805e40f400, ffff88805e40f600) [ 1165.855112][T15796] [ 1165.857473][T15796] The buggy address belongs to the physical page: [ 1165.863986][T15796] page:ffffea0001790300 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88805e40c400 pfn:0x5e40c [ 1165.875451][T15796] head:ffffea0001790300 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1165.884405][T15796] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 1165.892393][T15796] page_type: 0xffffffff() [ 1165.896728][T15796] raw: 00fff00000000840 ffff888017c41c80 ffffea000196fe10 ffffea000178a810 [ 1165.905317][T15796] raw: ffff88805e40c400 0000000000100009 00000001ffffffff 0000000000000000 [ 1165.913912][T15796] page dumped because: kasan: bad access detected [ 1165.920339][T15796] page_owner tracks the page as allocated [ 1165.926058][T15796] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 34, tgid 34 (kworker/u4:2), ts 87861125385, free_ts 29695461475 [ 1165.947082][T15796] post_alloc_hook+0x1c1/0x200 [ 1165.951864][T15796] get_page_from_freelist+0x2181/0x22a0 [ 1165.957416][T15796] __alloc_pages+0x1f0/0x460 [ 1165.962013][T15796] alloc_slab_page+0x5d/0x180 [ 1165.966700][T15796] new_slab+0x87/0x2d0 [ 1165.970773][T15796] ___slab_alloc+0xc5c/0x12f0 [ 1165.975451][T15796] __kmem_cache_alloc_node+0x11f/0x250 [ 1165.980923][T15796] __kmalloc+0xa7/0x240 [ 1165.985118][T15796] fib6_info_alloc+0x30/0xf0 [ 1165.989720][T15796] ip6_route_info_create+0x455/0x1260 [ 1165.995110][T15796] addrconf_f6i_alloc+0x1fa/0x440 [ 1166.000139][T15796] ipv6_add_addr+0x5a4/0x10d0 [ 1166.004867][T15796] addrconf_add_linklocal+0x273/0x6d0 [ 1166.010256][T15796] addrconf_addr_gen+0x50e/0x620 [ 1166.015225][T15796] addrconf_init_auto_addrs+0x720/0xac0 [ 1166.020795][T15796] addrconf_notify+0xb62/0x1010 [ 1166.025673][T15796] page last free stack trace: [ 1166.030364][T15796] free_unref_page_prepare+0x7d7/0x8f0 [ 1166.035830][T15796] free_unref_page+0x32/0x2e0 [ 1166.040512][T15796] free_contig_range+0xa1/0x150 [ 1166.045378][T15796] destroy_args+0x7d/0x840 [ 1166.049904][T15796] debug_vm_pgtable+0x411/0x440 [ 1166.054761][T15796] do_one_initcall+0x242/0x790 [ 1166.059539][T15796] do_initcall_level+0x13d/0x1f0 [ 1166.064499][T15796] do_initcalls+0x69/0xd0 [ 1166.069031][T15796] kernel_init_freeable+0x3d9/0x560 [ 1166.074243][T15796] kernel_init+0x1d/0x1c0 [ 1166.078603][T15796] ret_from_fork+0x48/0x80 [ 1166.083030][T15796] ret_from_fork_asm+0x11/0x20 [ 1166.087804][T15796] [ 1166.090131][T15796] Memory state around the buggy address: [ 1166.095763][T15796] ffff88805e40f300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1166.103831][T15796] ffff88805e40f380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1166.112005][T15796] >ffff88805e40f400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1166.120165][T15796] ^ [ 1166.127367][T15796] ffff88805e40f480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1166.135432][T15796] ffff88805e40f500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1166.143494][T15796] ================================================================== [ 1166.196284][T16155] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1166.252391][T14130] Bluetooth: hci2: command tx timeout [ 1166.273975][T16155] hsr_slave_0: entered promiscuous mode [ 1166.385455][T16155] hsr_slave_1: entered promiscuous mode [ 1167.457560][T15796] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1167.464818][T15796] CPU: 0 PID: 15796 Comm: syz-executor Not tainted syzkaller #0 [ 1167.472458][T15796] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1167.482525][T15796] Call Trace: [ 1167.485811][T15796] [ 1167.488759][T15796] dump_stack_lvl+0x18c/0x250 [ 1167.493458][T15796] ? show_regs_print_info+0x20/0x20 [ 1167.498672][T15796] ? load_image+0x420/0x420 [ 1167.503191][T15796] panic+0x2ca/0x720 [ 1167.507100][T15796] ? bpf_jit_dump+0xd0/0xd0 [ 1167.511633][T15796] ? _raw_spin_unlock_irqrestore+0x111/0x120 [ 1167.517647][T15796] ? _raw_spin_unlock+0x40/0x40 [ 1167.522503][T15796] ? print_memory_metadata+0x314/0x400 [ 1167.527970][T15796] ? __mutex_lock+0xfc/0xc80 [ 1167.532565][T15796] check_panic_on_warn+0x84/0xa0 [ 1167.537512][T15796] ? __mutex_lock+0xfc/0xc80 [ 1167.542109][T15796] end_report+0x6f/0x130 [ 1167.546367][T15796] kasan_report+0x128/0x150 [ 1167.550883][T15796] ? tomoyo_check_open_permission+0x384/0x460 [ 1167.556966][T15796] ? __mutex_lock+0xfc/0xc80 [ 1167.561565][T15796] __mutex_lock+0xfc/0xc80 [ 1167.565988][T15796] ? end_current_label_crit_section+0x170/0x170 [ 1167.572240][T15796] ? ep_open+0x4e/0x270 [ 1167.576403][T15796] ? mutex_lock_nested+0x20/0x20 [ 1167.581344][T15796] ? apparmor_file_open+0x5ab/0x760 [ 1167.586554][T15796] ? apparmor_inode_getattr+0x2c0/0x2c0 [ 1167.592112][T15796] ? __rwlock_init+0x150/0x150 [ 1167.596896][T15796] ep_open+0x4e/0x270 [ 1167.600883][T15796] ? do_dentry_open+0x86f/0x14b0 [ 1167.605833][T15796] do_dentry_open+0x880/0x14b0 [ 1167.610607][T15796] ? ep_ioctl+0x1c0/0x1c0 [ 1167.614943][T15796] path_openat+0x284f/0x3270 [ 1167.619546][T15796] ? do_sys_openat2+0xda/0x1d0 [ 1167.624320][T15796] ? __x64_sys_openat+0x139/0x160 [ 1167.629359][T15796] ? verify_lock_unused+0x140/0x140 [ 1167.634568][T15796] ? do_filp_open+0x430/0x430 [ 1167.639262][T15796] do_filp_open+0x1f2/0x430 [ 1167.643776][T15796] ? vfs_tmpfile+0x620/0x620 [ 1167.648409][T15796] ? _raw_spin_unlock+0x28/0x40 [ 1167.653267][T15796] ? alloc_fd+0x590/0x640 [ 1167.657615][T15796] do_sys_openat2+0x134/0x1d0 [ 1167.662307][T15796] ? do_sys_open+0xe0/0xe0 [ 1167.666734][T15796] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1167.672731][T15796] ? fsnotify_link_count+0xf0/0xf0 [ 1167.677877][T15796] ? lock_chain_count+0x20/0x20 [ 1167.682763][T15796] __x64_sys_openat+0x139/0x160 [ 1167.687629][T15796] do_syscall_64+0x55/0xb0 [ 1167.692078][T15796] ? clear_bhb_loop+0x40/0x90 [ 1167.696769][T15796] ? clear_bhb_loop+0x40/0x90 [ 1167.701544][T15796] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1167.707448][T15796] RIP: 0033:0x7efd5955e98e [ 1167.711870][T15796] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1167.731490][T15796] RSP: 002b:00007ffe39a15928 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1167.740001][T15796] RAX: ffffffffffffffda RBX: 0000555556ec6500 RCX: 00007efd5955e98e [ 1167.747981][T15796] RDX: 0000000000000000 RSI: 00007ffe39a15a90 RDI: ffffffffffffff9c [ 1167.755979][T15796] RBP: 00007ffe39a15a90 R08: 0000000000000000 R09: 0000000000000000 [ 1167.763956][T15796] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe39a16b80 [ 1167.771952][T15796] R13: 00007efd596344bb R14: 0000555556ec64e8 R15: 0000000000000006 [ 1167.779935][T15796] [ 1167.783037][T15796] Kernel Offset: disabled [ 1167.787407][T15796] Rebooting in 86400 seconds..