last executing test programs: 20.45806519s ago: executing program 4 (id=273): ioctl$VHOST_SET_OWNER(0xffffffffffffffff, 0xaf01, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x850}, 0x4040080) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x4048015}, 0xc000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) getsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x6, 0x0, &(0x7f0000000500)) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_PREPARE(r3, 0x4140, 0x0) rmdir(&(0x7f0000000040)='./cgroup/../file0\x00') socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f00000007c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x650, 0x0, 0x428, 0x428, 0xd0, 0x2e0, 0x580, 0x580, 0x580, 0x580, 0x580, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x5}}}, {{@ipv6={@mcast1, @local, [], [], 'macvtap0\x00', 'ip6tnl0\x00', {}, {}, 0x11}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv6=@private1}}}, {{@ipv6={@mcast2, @loopback, [], [], 'pim6reg0\x00', 'syzkaller0\x00'}, 0x0, 0x100, 0x128, 0x0, {}, [@common=@unspec=@connmark={{0x30}}, @common=@inet=@socket1={{0x28}}]}, @common=@unspec=@MARK={0x28}}, {{@uncond, 0x0, 0x120, 0x148, 0x0, {}, [@common=@frag={{0x30}}, @common=@hbh={{0x48}}]}, @inet=@DSCP={0x28, 'DSCP\x00', 0x0, {0x80}}}, {{@uncond, 0x0, 0x118, 0x158, 0x0, {}, [@common=@dst={{0x48}, {0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}}, @common=@ipv6header={{0x28}, {0x2, 0x8, 0x1}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv6=@remote}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x6b0) 19.765009323s ago: executing program 4 (id=275): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x58, 0x0, 0x48, 0x0, &(0x7f0000000000)='\x00', 0x0}, 0x48) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MTU={0x8, 0x4, 0x44}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000840)={r3, @in6={{0xa, 0x4e23, 0xe84, @empty, 0x129}}, 0x2, 0x2, 0x0, 0x2, 0x5, 0x8, 0x4}, 0x9c) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000001c000000000000000000000104000000200000000500000001000004040000000100000001000000000000001800000002000004080000001300000002000000000000000100000001000000200000000076616c006270665f7370696e5f6c6f636b006c6f636b0066"], 0x0, 0x80}, 0x28) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="02000000040000000800", @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000010000000000000", @ANYRES32=0x0, @ANYRES32=r6, @ANYBLOB="010000000300000000"], 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000001bc0)={0x0, 0x0, 0x0, 0x0, 0x3, r7, 0x4}, 0x38) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r8 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r10 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r10, 0x4000000000000, 0x40, &(0x7f0000000780)=@raw={'raw\x00', 0x4001, 0x3, 0x380, 0x1e8, 0xb, 0x148, 0x0, 0x148, 0x2e8, 0x240, 0x240, 0x2e8, 0x215, 0x3, 0x0, {[{{@ip={@remote, @local, 0x0, 0x0, 'ip6gretap0\x00', 'veth0\x00', {}, {}, 0x11}, 0x2e8, 0x180, 0x1e8, 0x0, {0xff0f000000000000}, [@common=@inet=@multiport={{0x50}, {0x2, 0xb, [0x4e20, 0x4e23, 0x4e22, 0x4e24, 0x4e24, 0x4e24, 0x4e22, 0x4e23, 0x4e21, 0x4e20, 0x3, 0x4e22, 0x4e23, 0xeac, 0x4e23], [0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1]}}, @common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "d40b98e613e5c0d53fa5668bfbd8659b9ba9affcbed065733d0012e401764f592fc2c2bfb0e657e39980dd3655cfdfebceab664ab18605949120401237b982613cbdde69fbfbd40e9505ea3909a03f93f0be8cd9870b50e1d8a655f0a2cc7dba129d9af19184e11feeab1ddd11aa07abfef2f0ace242261fac91893e25989bb2", 0x4, 0x8a119efdab096be9}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'syz0\x00', 'syz1\x00'}}}, {{@ip={@broadcast, @broadcast, 0x0, 0x0, 'team0\x00', 'netpci0\x00'}, 0xec010000, 0x98, 0x100, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x3, 0x8, 0x1, '\x00', 'syz0\x00', {0x8}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3e0) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r9, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe, 0xa93}}}]}, 0x38}}, 0x0) 17.487882029s ago: executing program 4 (id=280): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1001}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd0a, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x0, 0x4}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=@newtfilter={0x40, 0x2c, 0xd27, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, r2, {0xe}, {}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0x8}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8810}, 0x0) 16.184711081s ago: executing program 4 (id=283): sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = socket(0x1d, 0x2, 0x6) socketpair$unix(0x1, 0x5, 0x0, 0x0) setsockopt$RDS_CANCEL_SENT_TO(r1, 0x6a, 0x1, 0x0, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59) connect$inet6(r4, &(0x7f0000000200)={0xa, 0x4e22, 0xb6, @ipv4={'\x00', '\xff\xff', @local}, 0xc4ca}, 0x1c) bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$OCFS2_IOC_INFO(0xffffffffffffffff, 0x80106f05, &(0x7f000000c140)={&(0x7f000000bf80)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=@freeinode={{0x4f32494e, 0x8, 0x10, 0x100000001}, [{0x8000000000000000, 0x4}, {0x9, 0x8000000000000001}, {0xb7, 0x6}, {0xffffffff, 0x3}, {0x2f4, 0x40}, {0x1000, 0x98e}, {0x1, 0x6}, {0x2, 0x2}, {0x7}, {0xc, 0xffffffff80000000}, {0x800000000000, 0x1c}, {0xffffffffffffffff, 0x4}, {0x9, 0x9}, {0xe8b0, 0x3aac00200000000}, {0x69b7, 0x5f}, {0x0, 0x5}, {0xa, 0x2}, {0x7fff}, {0x7, 0x4}, {0x7ff, 0xffffffffffffffff}, {0x1ff, 0x100000001}, {0xa2e, 0xe}, {0x30fe, 0x1}, {0x8, 0x4}, {0xff, 0x2}, {0xfb9, 0x1}, {0x6, 0x8}, {0x1, 0xfffffffffffffffc}, {0x7, 0x5}, {0x2, 0xffffffffffff7fff}, {0x9, 0x8}, {0x59f, 0x5ff5}, {0x7fff, 0x7}, {0x8, 0x3}, {0xc1d, 0x4077d962}, {0x139b, 0x1089}, {0x5, 0x81}, {0x0, 0x3}, {0x8, 0xb}, {0x5, 0x1}, {0x4a82, 0xb}, {0x200, 0x405}, {0x1c508f61, 0x1a5b5e17}, {0xc, 0x7fffffff}, {0xff, 0x7d71}, {0x8000000000000001}, {0x10, 0x6}, {0x7, 0x8}, {0x5, 0x200}, {0xfffffffffffffffb, 0x5}, {0x7f, 0x6}, {0x80000001, 0x1}, {0x70, 0x9}, {0x1, 0x1}, {0x3, 0x2}, {0x81, 0x5}, {0x5, 0x9}, {0x8, 0x101}, {0x3, 0x7}, {0x9, 0x3}, {0x180, 0x59f}, {0xffff, 0x2}, {0x5}, {0x7, 0x80000000}, {0x10, 0x7fffffff}, {0x9, 0x9}, {0x1, 0x6}, {0x76, 0xfffffffffffffffc}, {0x40, 0x6}, {0x100000000, 0x200}, {0x4, 0x8}, {0x0, 0xf}, {0xd9, 0x63da50e0}, {0x2, 0xa987}, {0xf, 0xf800000000000000}, {0x8, 0xf405}, {0x2, 0x4}, {0x0, 0x80000001}, {0x2, 0x9}, {0x0, 0x2}, {0x5, 0x4}, {0x5, 0x7}, {0x2, 0x80000000}, {0x400000000000, 0xdb6}, {0x34c0}, {0x94, 0xfffffffffffffffa}, {0x0, 0xead5}, {0x7ff, 0x8001}, {0x5, 0x2}, {0xffffffffffff7fff}, {0xa, 0x1}, {0x0, 0x99}, {0xb9, 0x8001}, {0x7, 0x6de}, {0x2}, {0xfffffffffffffff7, 0x99b1}, {0x6, 0x4}, {0xda, 0x5}, {0x2, 0x8}, {0xd8, 0x4}, {0x8, 0xb6ea}, {0x4, 0xc27}, {0x2, 0x8000000000000000}, {0x3, 0x1}, {0x4, 0x6}, {0x2125, 0x10001}, {0x0, 0x7}, {0x0, 0x80}, {0x2, 0xfffffc0000000000}, {0x4e9a, 0x7}, {0x10001, 0x8}, {0x7fff, 0x200}, {0x5, 0x3}, {0x7, 0x3}, {0x100, 0x3}, {0x8, 0x5}, {0x3, 0x8000000000000000}, {0x4, 0x200}, {0x5, 0x5}, {0x2, 0x6}, {0x9, 0x9}, {0xa, 0x5}, {0x7, 0xd97}, {0xff, 0x5173}, {0x2}, {0x1, 0x81}, {0x6, 0x1ff}, {0x401, 0x6}, {0x9, 0x140000000000}, {0x26, 0x7}, {0x4, 0x6}, {0x0, 0xa}, {0x3}, {0xb, 0x5}, {0x9, 0x7}, {0x7, 0x1}, {0x1, 0x1}, {0x1e12, 0x5}, {0x5, 0x4}, {0x3, 0x6}, {0x5, 0x3}, {0x4003, 0xffffffff}, {0x1, 0x5}, {0x100000000, 0x3}, {0x90a6, 0x9}, {0x9, 0x107}, {0xf, 0x80000000}, {0x9, 0x101}, {0x9, 0x7fff}, {0x0, 0x1}, {0x6, 0x40}, {0xffffffffffffffff, 0x10001}, {0x7, 0x6}, {0x200}, {0x3, 0xffff}, {0x5, 0x793}, {0x6, 0x100000000}, {0x3, 0xda}, {0xb0, 0xffffffff}, {0x6, 0x2}, {0xd, 0x2}, {0x4, 0x1}, {0x6, 0xa}, {0x5d, 0x8001}, {0x38, 0x5f0}, {0x4, 0x7}, {0xffffffff, 0x5a2}, {0x1, 0x2}, {0x8, 0x1}, {0xe9, 0xfffffffffffff7b6}, {0x8e, 0x7fff}, {0x80000000, 0x8000000000000001}, {0xffffffff, 0xfda9}, {0xe5, 0xffffffffffffff41}, {0x24, 0x8}, {0x5, 0x4}, {0x187, 0xa2}, {0xd6, 0xffffffffffffffa3}, {0x1, 0xa807}, {0x3723, 0x6}, {0xfffffffffffff801, 0xa9}, {}, {0x2, 0xfffffffffffffffa}, {0x10001, 0x8000000000}, {0xfffffffffffff000, 0x3}, {0x3, 0xf9e}, {0x2321, 0x8}, {0x7ff}, {0x10001, 0xffffffff}, {0x5, 0x3}, {0x7ff, 0x9}, {0x2, 0x3e}, {0x3bd14045, 0x8001}, {0xff, 0x9}, {0x8, 0xffff}, {0x575, 0x2}, {0x3, 0x2}, {0x1, 0xe}, {0x5, 0xe}, {0x7, 0x9c}, {0x3ff, 0x8001}, {0x8, 0xffffffffffff0001}, {0x0, 0x7}, {0x3, 0x1}, {0xfffffffffffffffb, 0x4}, {0x7, 0x9}, {0x7, 0x8001}, {0x3ff, 0x7}, {0xf, 0xe6a}, {0x8, 0x1}, {0x10000, 0x5}, {0x7, 0x6}, {0xfffffffffffffffe, 0xb5}, {0x7, 0xdd1}, {0xffff, 0x66e}, {0x0, 0x4}, {0xd26f, 0x30580c97}, {0x8001, 0xf6}, {0x6, 0x800}, {0xcaa, 0x5}, {0x9, 0xb}, {0x0, 0xb12}, {0x7, 0x8}, {0xfaa, 0x6}, {0x8, 0x5}, {0xfffffffffffff801, 0x951}, {0x7, 0x101}, {0x7, 0x910000}, {0x2, 0x5b}, {0xa8, 0x8}, {0x619, 0x1}, {0x8, 0xfffffffffffff775}, {0x3, 0x3}, {0x1ff, 0x8}, {0x1901, 0x80000000}, {0xfff, 0x1}, {0x2, 0x868}, {0x2ef, 0x2}, {0x10000, 0x8000000000000000}, {0x3, 0xfffffffffffffffc}, {0x1, 0x1}, {0x7, 0x7}, {0x57, 0x7}, {0x401, 0x6}, {0x5, 0x73}, {0x80000001, 0xc91}, {0x800, 0x7ff}, {0x777b, 0x9}, {0xb3, 0x8}, {0x4, 0x1}, {0x7, 0x6}, {0xd5}, {0x3, 0x401}, {0x1, 0x2}, {0x2, 0xfffffffffffff27a}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x32}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000380)={0x8, 0x4d, 0x2ba8}) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000380)={0x200, 0x4f, 0x4, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000180)={r6}) 15.061666043s ago: executing program 0 (id=286): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000180)=0x19ce, 0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000040)=0x0) prlimit64(r2, 0xe, &(0x7f0000000380)={0x7, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r0, &(0x7f00000000c0)="3f03fe7f0302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c153cfdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0xc9, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) socket$inet6_mptcp(0xa, 0x1, 0x106) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000b00), 0x0, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x3) 13.107989585s ago: executing program 1 (id=293): socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) socket$inet(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) pipe(&(0x7f0000000040)={0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000640)={r0, &(0x7f0000000000), &(0x7f0000000600)=@udp=r1, 0x2}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000010000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000000850000003300000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r2, r4}, 0x14) syz_emit_ethernet(0x46, &(0x7f0000000700)={@local, @remote, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, '\x00', 0x10, 0x2b, 0x0, @private2, @local, {[], {0x2100, 0x0, 0x10, 0x0, @gue={{0x2, 0x1, 0x3, 0x6, 0x100, @val=0x80}}}}}}}}, 0x0) 12.288334173s ago: executing program 2 (id=294): r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x20080, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000180)=0x6f) r1 = dup2(r0, r0) ioctl$SNDCTL_DSP_SPEED(r1, 0xc0045002, &(0x7f00000001c0)=0x1) read$FUSE(r1, &(0x7f00000063c0)={0x2020}, 0x2020) 12.118504481s ago: executing program 1 (id=296): ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(0xffffffffffffffff, 0xc1105511, &(0x7f0000000040)={0xa, 0x0, 0x3d, 0x10000, 'syz1\x00', 0x5}) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=ANY=[@ANYBLOB='\\]\x00r', @ANYRES16, @ANYBLOB="010000000000000000001400000008000200fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000900fc000000080011000700000008000e008000", @ANYRES32], 0x5c}, 0x1, 0x0, 0x0, 0x10044800}, 0x40090) r0 = add_key$user(&(0x7f00000001c0), &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000240)="166ec4b16abf8d77", 0x8, 0xfffffffffffffffe) r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r0, r1, r0}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) add_key$user(&(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 12.010246687s ago: executing program 2 (id=297): ioctl$VHOST_SET_OWNER(0xffffffffffffffff, 0xaf01, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="900000000001010400000000141a00000200ffff0800074000000001240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e02010c00028005000100000000002c000e800c000280040001"], 0x90}}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x4048015}, 0xc000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) getsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x6, 0x0, &(0x7f0000000500)) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_PREPARE(r3, 0x4140, 0x0) rmdir(&(0x7f0000000040)='./cgroup/../file0\x00') socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f00000007c0)=@mangle={'mangle\x00', 0x64, 0x6, 0x650, 0x0, 0x428, 0x428, 0xd0, 0x2e0, 0x580, 0x580, 0x580, 0x580, 0x580, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x5}}}, {{@ipv6={@mcast1, @local, [], [], 'macvtap0\x00', 'ip6tnl0\x00', {}, {}, 0x11}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv6=@private1}}}, {{@ipv6={@mcast2, @loopback, [], [], 'pim6reg0\x00', 'syzkaller0\x00'}, 0x0, 0x100, 0x128, 0x0, {}, [@common=@unspec=@connmark={{0x30}}, @common=@inet=@socket1={{0x28}}]}, @common=@unspec=@MARK={0x28}}, {{@uncond, 0x0, 0x120, 0x148, 0x0, {}, [@common=@frag={{0x30}}, @common=@hbh={{0x48}}]}, @inet=@DSCP={0x28, 'DSCP\x00', 0x0, {0x80}}}, {{@uncond, 0x0, 0x118, 0x158, 0x0, {}, [@common=@dst={{0x48}, {0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}}, @common=@ipv6header={{0x28}, {0x2, 0x8, 0x1}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv6=@remote}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x6b0) 11.323777729s ago: executing program 2 (id=298): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$kcm(0x29, 0x5, 0x0) write$cgroup_pressure(r1, &(0x7f0000000140)={'full'}, 0xfffffdef) 8.619713176s ago: executing program 1 (id=301): socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x80000000000000a, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000080), 0x1400, 0x0) epoll_create1(0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/diskstats\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) socket$inet6_udp(0xa, 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) userfaultfd(0x1) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000640)='/sys/power/pm_test', 0x88002, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x1000, @multicast2}, {0x2, 0x4e23, @rand_addr=0x64010100}, 0x1d7, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0x8, 0x8}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r1], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000000), 0xd) 8.618542045s ago: executing program 0 (id=302): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000005c0)={{{@in=@initdev, @in=@multicast2}}, {{@in6=@dev}, 0x0, @in=@local}}, &(0x7f0000000400)=0xffffffffffffff4c) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10000050}, 0x20048810) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x6, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_int(r1, 0x29, 0x31, 0x0, 0x0) r2 = syz_open_dev$sg(0x0, 0x0, 0x8002) r3 = fcntl$dupfd(r2, 0x0, r2) write$sndseq(r3, &(0x7f0000000200)=[{0x0, 0x0, 0x0, 0x0, @tick, {0x20}, {}, @ext={0x0, 0x0}}], 0x1c) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) 7.815545933s ago: executing program 3 (id=303): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_rdma(0x10, 0x3, 0x14) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000001180)={'wlan1\x00'}) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000100)='./file1\x00', 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PAUSE_SET(r2, &(0x7f00000013c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000007c0)={0x34, r3, 0x401, 0x70bd25, 0x25dfdbf9, {}, [@ETHTOOL_A_PAUSE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}, @ETHTOOL_A_PAUSE_TX={0x5}]}, 0x34}}, 0x14008080) 5.660098174s ago: executing program 0 (id=304): r0 = syz_usb_connect(0x5, 0x58, &(0x7f0000000000)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x2, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0x39, 0xd8, 0x1, 0x1a, 0xda, 0xa8, 0x8, [], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x7, 0x9, 0x80}}]}}, {{0x9, 0x4, 0xe4, 0x5, 0x3, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a, [@generic={0x7, 0x5, "d15b89f26d"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x7a, 0xa, 0x84}}]}}]}}]}}, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, &(0x7f0000000bc0)={0x24, 0x0, &(0x7f0000000b00)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c01}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000011c0)={0x24, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001600)={0x24, 0x0, &(0x7f0000000180)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xfcff}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f00000001c0)={0x40, 0x8, 0x8, "fde61e0ee4a63b9e"}, 0x0, 0x0, 0x0, 0x0}) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f00000009c0)={0x1c, &(0x7f0000000300)={0x20, 0x13, 0x4, "0d718785"}, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(r0) 5.615966396s ago: executing program 1 (id=305): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x130) seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x1, &(0x7f00000000c0)={0x0, 0x0}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_sctp(0x2, 0x1, 0x84) bpf$PROG_LOAD(0x5, 0x0, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x400) ppoll(0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000240)={[0xfffffffffffff801]}, 0x8) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x0, 0x80) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r1, 0x40086602, 0x0) 5.385334317s ago: executing program 3 (id=306): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000300)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002abd7000fedbdf253b00000008000300", @ANYRES32=r2, @ANYBLOB="4b0033008000e100ffffffffffff080211000000505050505050"], 0x68}, 0x1, 0x0, 0x0, 0x8014}, 0x0) 4.46402237s ago: executing program 2 (id=307): r0 = syz_open_procfs(0x0, &(0x7f0000000c80)='fdinfo\x00') syz_emit_vhci(0x0, 0x4) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) socket$inet_udp(0x2, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r2, 0x0, 0xd2, 0x0, 0x0) getdents64(r0, &(0x7f0000002440)=""/181, 0xb5) mkdir(0x0, 0x0) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl(r3, 0x890b, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) setns(0xc9, 0x0) r4 = socket$netlink(0x10, 0x3, 0x8) writev(r4, 0x0, 0x0) 4.371413504s ago: executing program 3 (id=308): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000040)=ANY=[@ANYBLOB="28000000070601030000000000000000010000050900020073797a3100000000050001000700dd"], 0x28}, 0x1, 0x0, 0x0, 0x40091}, 0x20000080) recvmsg(r0, &(0x7f0000000d40)={0x0, 0x0, 0x0}, 0x0) 4.182475923s ago: executing program 1 (id=309): munmap(&(0x7f0000001000/0x2000)=nil, 0x2000) r0 = syz_open_dev$vbi(&(0x7f00000001c0), 0x1, 0x2) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) r1 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) sendfile(r1, r1, 0x0, 0x23d1) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000300)={0x0, 0x38, &(0x7f0000000180)=[@in6={0xa, 0x4e22, 0x3, @remote, 0x40}, @in6={0xa, 0x4e22, 0x0, @private1, 0x80000001}]}, &(0x7f0000000200)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r3, 0x84, 0x71, &(0x7f0000000100)={r5, 0x1}, 0x8) r6 = syz_open_procfs(0x0, &(0x7f0000000000)='pagemap\x00') pread64(r6, &(0x7f0000001240)=""/102400, 0x19000, 0x1000000300) openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/tcp_recovery\x00', 0x1, 0x0) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000004000000060000000500000000100000", @ANYRES32, @ANYBLOB="ffffffff00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="e4ffffffffffff13010000000000000000000000320000b400000000"], 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000240)={r1, r6}, 0xc) r8 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x103201, 0x0) write$P9_RSTATu(r8, &(0x7f0000000500)=ANY=[@ANYBLOB="6502000002fd0a4f0524010100001f00000000000000000000000000000000000000000000000c00000001040000000000007dff0a6e6f6465767b65766f03d38b9200000000000000000000000000280070673effeb09b5351f5bde054000000000187899a916638814e5708103b494e1000000000000000002000800ac00f8f669fb716dcf315ecaf385409ace5b9408678c2c3b9e1d52c36cde7ba4a440b4b0b4f174a666a8529a451b3407dbdab2884baf050000000000000047ec21cabff20f9c1cbe36f4fd1a4cc280e8e289da649a3700398641631d44f4a39b1191937a280e8d881c0081ca9fc220d115ac8e2f184b9a61758d26772ab0f2044d8ef0263ddd97d3c427b3a532efab1d1ce32ca7c1fc231af48408e02b255028b7c9bb85396f4d8af0eb95fc0ecc99f780e22c016f6465762f6eb17b2300f9daa5ee1c2642d979a3fde5f475daf03b1172d97badc7095afd76fe4f0441f7f7741eac030000ecff0ee63f96e9b76989310000dba0c2f7f09ff53c1ad66e2d070198019f30118447aa9a74f51685f506ae89480687826779644d5c91b84ff2e1cbbd2482929a0d8972b5cf732ea5b0d723859dba3f93aed3b42ee7cac07de09d1d68a60333a882467d2b31aacdf9188549b1125d6c4c9b18c2fb56c57d7dc626e4390796a1eb48274669ab13f8b11d146059f310e2634d593fec65d529f382066664df244e4c90570a70049f399f061f75b7f97ce1fe11ea919609d51a41dd3de304bd7c7ed0a456f0ae12516105c9ce887df5a6e0b6a77d596cf88ba6e5c6397c7d5021d7989528fd1739e1c2d87fff00"/604, @ANYRES32=r7, @ANYRES8=r3, @ANYRES32=0x0], 0xfd85) fcntl$dupfd(r0, 0x0, r0) 4.098450308s ago: executing program 3 (id=310): munmap(&(0x7f0000001000/0x2000)=nil, 0x2000) r0 = syz_open_dev$vbi(&(0x7f00000001c0), 0x1, 0x2) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/mpls/platform_labels\x00', 0x2, 0x0) sendfile(r1, r1, 0x0, 0x23d1) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{0x0}], 0x1) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000300)={0x0, 0x38, &(0x7f0000000180)=[@in6={0xa, 0x4e22, 0x3, @remote, 0x40}, @in6={0xa, 0x4e22, 0x0, @private1, 0x80000001}]}, &(0x7f0000000200)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f0000000900)=@assoc_value={r4}, 0x8) r5 = syz_open_procfs(0x0, &(0x7f0000000000)='pagemap\x00') pread64(r5, &(0x7f0000001240)=""/102400, 0x19000, 0x1000000300) openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/tcp_recovery\x00', 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xd, &(0x7f0000000040)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x36, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000240)={r1, r5}, 0xc) r6 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x103201, 0x0) write$P9_RSTATu(r6, &(0x7f0000000500)=ANY=[@ANYBLOB="6502000002fd0a4f0524010100001f00000000000000000000000000000000000000000000000c00000001040000000000007dff0a6e6f6465767b65766f03d38b9200000000000000000000000000280070673effeb09b5351f5bde054000000000187899a916638814e5708103b494e1000000000000000002000800ac00f8f669fb716dcf315ecaf385409ace5b9408678c2c3b9e1d52c36cde7ba4a440b4b0b4f174a666a8529a451b3407dbdab2884baf050000000000000047ec21cabff20f9c1cbe36f4fd1a4cc280e8e289da649a3700398641631d44f4a39b1191937a280e8d881c0081ca9fc220d115ac8e2f184b9a61758d26772ab0f2044d8ef0263ddd97d3c427b3a532efab1d1ce32ca7c1fc231af48408e02b255028b7c9bb85396f4d8af0eb95fc0ecc99f780e22c016f6465762f6eb17b2300f9daa5ee1c2642d979a3fde5f475daf03b1172d97badc7095afd76fe4f0441f7f7741eac030000ecff0ee63f96e9b76989310000dba0c2f7f09ff53c1ad66e2d070198019f30118447aa9a74f51685f506ae89480687826779644d5c91b84ff2e1cbbd2482929a0d8972b5cf732ea5b0d723859dba3f93aed3b42ee7cac07de09d1d68a60333a882467d2b31aacdf9188549b1125d6c4c9b18c2fb56c57d7dc626e4390796a1eb48274669ab13f8b11d146059f310e2634d593fec65d529f382066664df244e4c90570a70049f399f061f75b7f97ce1fe11ea919609d51a41dd3de304bd7c7ed0a456f0ae12516105c9ce887df5a6e0b6a77d596cf88ba6e5c6397c7d5021d7989528fd1739e1c2d87fff00"/604, @ANYRES32, @ANYRES8=r3, @ANYRES32=0x0], 0xfd85) fcntl$dupfd(r0, 0x0, r0) 4.04364362s ago: executing program 4 (id=311): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x654000, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x2, &(0x7f0000000000)=0x80000000000003) socketpair$unix(0x1, 0x5, 0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59) connect$inet6(r4, &(0x7f0000000200)={0xa, 0x4e22, 0xb7, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f0000000040), 0x1e) 2.299885692s ago: executing program 4 (id=312): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3f8, 0x0, 0x32}, 0x9c) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmsg$TIPC_NL_PUBL_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[], 0x50}, 0x1, 0x0, 0x0, 0x4008080}, 0x8000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x187) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={0x0, 0x58}, 0x1, 0x0, 0x0, 0x44000880}, 0x4080) mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1000000) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) mount(&(0x7f0000000140)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='ufs\x00', 0x2208004, 0x0) io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xa90d, 0x1f480, 0x2, 0x254}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0) write(r2, &(0x7f0000000400)='wusb3801 0x4a\x00', 0xe) 1.985730396s ago: executing program 2 (id=313): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_rdma(0x10, 0x3, 0x14) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000100)='./file1\x00', 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PAUSE_SET(r3, &(0x7f00000013c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000007c0)={0x34, r4, 0x401, 0x70bd25, 0x25dfdbf9, {}, [@ETHTOOL_A_PAUSE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}, @ETHTOOL_A_PAUSE_TX={0x5}]}, 0x34}}, 0x14008080) open(&(0x7f0000000040)='./bus\x00', 0x24040, 0x10) truncate(&(0x7f0000000000)='./bus\x00', 0x946e) sendmsg$NL80211_CMD_SET_KEY(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000001280)={&(0x7f00000011c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002abd7000fcdbdf25f5ffffff07000300", @ANYRES32, @ANYBLOB="04006e8004000a00"], 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x4000001) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="d800000000000000f9ffffffffffffff00000000000000000200000000000000020000000000000000010000000000000300000008000000060000000000000005000000000000000400000000000000fc0000000000008003000000000000000000000000000000ffffff7f58000000040000000090000009000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="010000000100000000000000000000000000200037050000000000002b000000008000003a2d285cc980000009c30000f3397cd86d4d928d14d3a461b60245898556c20600000000002b133b0801000000000000886dae6e90aa285a457bd0cc08a2d7afc36ad27f031b85e90e90462537989ea72438208cca11a78a3e363ff39c38d219e8021f4f7a6f1c1e854196ab34f70c824b392a33e4a37df232c8c1"], 0x0, 0x0, 0x0}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x2) ioctl(r5, 0x40104d05, &(0x7f0000000a00)) 1.949978198s ago: executing program 0 (id=314): socketpair$unix(0x1, 0x1, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) 1.949152328s ago: executing program 3 (id=315): openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) io_setup(0x8, &(0x7f0000000600)) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000000c0)) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r0, 0x0, 0x33, &(0x7f0000000000)=0x80000000, 0x4) bind$l2tp(r0, &(0x7f0000000240)={0x2, 0x0, @loopback, 0x5}, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8001, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x4c0142, 0x161) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0) sendfile(r3, r3, 0x0, 0x200000) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r4, 0x0, 0x33, &(0x7f0000000000)=0x80000000, 0x4) bind$inet(r4, &(0x7f00000001c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x14}}, 0x10) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000002740), 0x101002) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x42202) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00'}) ioctl$BTRFS_IOC_START_SYNC(r5, 0x80089418, &(0x7f0000000000)) r6 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r6, 0x0, 0x0) r7 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r7, &(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x2, 0x1, 0x0, {0xa, 0x4e21, 0xfff, @empty, 0x7ff}}}, 0x32) getsockopt(r7, 0x111, 0x4, 0x0, &(0x7f0000000540)) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r5, 0xc0505350, &(0x7f00000013c0)={{0x40, 0x5}, {0x10, 0x7}, 0x6, 0x1, 0xb}) 1.942765568s ago: executing program 1 (id=316): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$radio(&(0x7f0000001800), 0x2, 0x2) readv(r3, &(0x7f0000000a00)=[{&(0x7f0000000500)=""/237, 0xed}], 0x1) 1.798866125s ago: executing program 0 (id=317): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xb, 0xa2b9, 0x6, 0x6, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0x101c0, 0xd, 0x0, 0x6, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x0, 0x8a, 0x79, 0x2, 0x10080, 0xfffffffe, 0x83f4, 0x129, 0x1, 0x16, 0x8, 0x5, 0x401, 0x1, 0x405, 0x0, 0x81, 0x9, 0xf9a6, 0xa9, 0xff, 0x0, 0x2, 0x2, 0x2, 0x7, 0x489, 0x7ff, 0x4, 0x4007b, 0xffffffff, 0x1, 0x2], [0x9, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0x2, 0xb, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0xfffffffe, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x7, 0x46, 0xf1, 0x7, 0xab00060, 0x2, 0x9, 0xffff7fff, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x67af, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x3ff], [0x2, 0xfffffffe, 0x9, 0xc, 0x0, 0x2e6bf783, 0x80000001, 0x5, 0x40000005, 0x491, 0x9, 0x200026, 0x7f, 0x403, 0x102, 0x1, 0x41, 0x6, 0xee4e, 0x2000104, 0x1, 0x9, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x100006, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x9, 0x77, 0x9, 0x6, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x3, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x4, 0x6, 0x80008001, 0x7777, 0x1, 0x2, 0x100, 0xd8ce, 0x80000000, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x2, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x5, 0x8, 0x13fff, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$NFNL_MSG_CTHELPER_DEL(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x44800}, 0x4004054) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x2000000035, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x5, 0xf2, 0xd, 0x7fffffffffffe, 0xcd3, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0xc], 0x25000, 0x304}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 381.482781ms ago: executing program 2 (id=318): r0 = socket$nl_generic(0x10, 0x3, 0x10) socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000000340)=""/71) 119.832044ms ago: executing program 0 (id=319): r0 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) socket$igmp(0x2, 0x3, 0x2) r1 = socket(0x10, 0x803, 0x0) preadv(0xffffffffffffffff, &(0x7f00000004c0), 0x0, 0xa3, 0xd) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000300)=[{0x0}, {0x0}, {&(0x7f00000006c0)=""/118, 0x76}, {&(0x7f0000000980)=""/73, 0x49}, {&(0x7f00000007c0)=""/154, 0x9a}, {&(0x7f00000001c0)=""/17, 0x11}], 0x6, &(0x7f0000001fc0)=""/191, 0xbf}}], 0x1, 0x0, &(0x7f0000003700)={0x77359400}) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) r3 = socket$kcm(0x23, 0x5, 0x0) listen(r3, 0x800) r4 = socket$kcm(0x10, 0x2, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000c00), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ABORT_SCAN(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)={0x1c, r5, 0xd9b2794f6a139537, 0x0, 0xe7030000, {{}, {@val={0x8, 0x3, r8}, @void}}}, 0x1c}}, 0x0) sendmsg$inet(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000f00)=[{&(0x7f0000000200)="5c00000014006b05c84e21000ab16d6e230675f811000000440002005817d30461bc24eeb556a7ef595105ea1698fa51f60a64c9f408000000e786a6d0bdbdc3d44bd70011b6c0504bb9189d9193e9bd00"/92, 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x240040c4) r9 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x5, &(0x7f0000000040)=0x24, 0x5) connect$phonet_pipe(r9, &(0x7f0000000040)={0x23, 0x0, 0x58}, 0x10) r10 = accept4(r3, 0x0, 0x0, 0x80000) syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r10) write(r2, 0x0, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001400), 0x2, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8041, 0x0) ioctl$VIDIOC_G_INPUT(r0, 0x80045626, &(0x7f00000001c0)) 0s ago: executing program 3 (id=320): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe, 0xa93}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newtfilter={0x50, 0x2c, 0xf3f, 0x70bd27, 0x25dddbb9, {0x0, 0x0, 0x0, r2, {0x2, 0x3da48c8682330ab8}, {}, {0x7, 0xfffa}}, [@filter_kind_options=@f_basic={{0xa}, {0x20, 0x2, [@TCA_BASIC_EMATCHES={0x1c, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}, @TCA_EMATCH_TREE_LIST={0x10, 0x2, 0x0, 0x1, [@TCF_EM_IPT={0xc, 0x2, 0x0, 0x0, {{0x3, 0x9, 0x5}}}]}]}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x200058c0}, 0x4004880) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.49' (ED25519) to the list of known hosts. [ 61.360563][ T4173] cgroup: Unknown subsys name 'net' [ 61.471506][ T4173] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 63.022126][ T4173] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 64.357775][ T4185] chnl_net:caif_netlink_parms(): no params data found [ 64.507159][ T4185] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.515292][ T4185] bridge0: port 1(bridge_slave_0) entered disabled state [ 64.523890][ T4185] device bridge_slave_0 entered promiscuous mode [ 64.537825][ T4185] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.545282][ T4185] bridge0: port 2(bridge_slave_1) entered disabled state [ 64.555215][ T4185] device bridge_slave_1 entered promiscuous mode [ 64.598579][ T4197] chnl_net:caif_netlink_parms(): no params data found [ 64.642464][ T4187] chnl_net:caif_netlink_parms(): no params data found [ 64.656754][ T4185] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 64.685448][ T4185] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 64.724237][ T4195] chnl_net:caif_netlink_parms(): no params data found [ 64.738215][ T4186] chnl_net:caif_netlink_parms(): no params data found [ 64.772422][ T4185] team0: Port device team_slave_0 added [ 64.822008][ T4185] team0: Port device team_slave_1 added [ 64.862149][ T4197] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.869261][ T4197] bridge0: port 1(bridge_slave_0) entered disabled state [ 64.877902][ T4197] device bridge_slave_0 entered promiscuous mode [ 64.885544][ T4187] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.893051][ T4187] bridge0: port 1(bridge_slave_0) entered disabled state [ 64.900894][ T4187] device bridge_slave_0 entered promiscuous mode [ 64.915728][ T4187] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.923094][ T4187] bridge0: port 2(bridge_slave_1) entered disabled state [ 64.931474][ T4187] device bridge_slave_1 entered promiscuous mode [ 64.947486][ T4197] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.954791][ T4197] bridge0: port 2(bridge_slave_1) entered disabled state [ 64.963538][ T4197] device bridge_slave_1 entered promiscuous mode [ 64.971718][ T4185] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 64.978694][ T4185] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 65.004837][ T4185] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 65.048841][ T4186] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.056104][ T4186] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.064419][ T4186] device bridge_slave_0 entered promiscuous mode [ 65.072495][ T4185] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 65.079476][ T4185] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 65.106031][ T4185] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 65.136378][ T4186] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.143676][ T4186] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.152163][ T4186] device bridge_slave_1 entered promiscuous mode [ 65.165446][ T4187] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.174935][ T4195] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.182660][ T4195] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.190545][ T4195] device bridge_slave_0 entered promiscuous mode [ 65.200661][ T4197] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.213611][ T4197] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.245265][ T4187] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.256710][ T4197] team0: Port device team_slave_0 added [ 65.263096][ T4195] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.270183][ T4195] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.278605][ T4195] device bridge_slave_1 entered promiscuous mode [ 65.307948][ T4197] team0: Port device team_slave_1 added [ 65.321365][ T4186] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.352298][ T4187] team0: Port device team_slave_0 added [ 65.378897][ T4186] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.399674][ T4185] device hsr_slave_0 entered promiscuous mode [ 65.406875][ T4185] device hsr_slave_1 entered promiscuous mode [ 65.416006][ T4187] team0: Port device team_slave_1 added [ 65.422731][ T4197] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 65.429808][ T4197] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 65.456237][ T4197] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 65.469887][ T4195] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.497822][ T4197] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 65.505133][ T4197] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 65.531552][ T4197] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 65.545546][ T4195] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.564815][ T4186] team0: Port device team_slave_0 added [ 65.592807][ T4186] team0: Port device team_slave_1 added [ 65.612131][ T4187] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 65.619135][ T4187] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 65.645731][ T4187] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 65.658551][ T4187] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 65.665838][ T4187] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 65.692061][ T4187] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 65.717802][ T4195] team0: Port device team_slave_0 added [ 65.740137][ T4186] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 65.747308][ T4186] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 65.773647][ T4186] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 65.786284][ T4195] team0: Port device team_slave_1 added [ 65.810697][ T4186] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 65.818775][ T4186] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 65.845283][ T4186] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 65.888896][ T4197] device hsr_slave_0 entered promiscuous mode [ 65.896006][ T4197] device hsr_slave_1 entered promiscuous mode [ 65.903851][ T4197] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 65.912203][ T4197] Cannot create hsr debugfs directory [ 65.933638][ T4187] device hsr_slave_0 entered promiscuous mode [ 65.940651][ T4187] device hsr_slave_1 entered promiscuous mode [ 65.947747][ T4187] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 65.955642][ T4187] Cannot create hsr debugfs directory [ 65.973059][ T4195] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 65.980062][ T4195] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.006640][ T4195] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 66.044922][ T4186] device hsr_slave_0 entered promiscuous mode [ 66.052033][ T4186] device hsr_slave_1 entered promiscuous mode [ 66.058702][ T4186] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 66.066320][ T4186] Cannot create hsr debugfs directory [ 66.077462][ T4195] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 66.084772][ T4195] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 66.110913][ T4195] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 66.132252][ T2286] Bluetooth: hci2: command 0x0409 tx timeout [ 66.201396][ T4188] Bluetooth: hci1: command 0x0409 tx timeout [ 66.207685][ T4188] Bluetooth: hci4: command 0x0409 tx timeout [ 66.214451][ T4188] Bluetooth: hci3: command 0x0409 tx timeout [ 66.220570][ T4188] Bluetooth: hci0: command 0x0409 tx timeout [ 66.250088][ T4195] device hsr_slave_0 entered promiscuous mode [ 66.257151][ T4195] device hsr_slave_1 entered promiscuous mode [ 66.264683][ T4195] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 66.273414][ T4195] Cannot create hsr debugfs directory [ 66.468580][ T4185] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 66.480405][ T4185] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 66.504821][ T4185] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 66.516567][ T4185] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 66.584598][ T4187] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 66.595917][ T4187] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 66.606996][ T4187] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 66.616438][ T4187] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 66.699658][ T4197] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 66.721527][ T4197] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 66.742702][ T4197] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 66.759737][ T4197] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 66.806583][ T4185] 8021q: adding VLAN 0 to HW filter on device bond0 [ 66.814761][ T4186] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 66.827822][ T4186] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 66.858417][ T4186] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 66.868009][ T4186] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 66.884069][ T4187] 8021q: adding VLAN 0 to HW filter on device bond0 [ 66.897113][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 66.907345][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 66.924715][ T4185] 8021q: adding VLAN 0 to HW filter on device team0 [ 66.953633][ T4187] 8021q: adding VLAN 0 to HW filter on device team0 [ 66.961353][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 66.969268][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 66.986919][ T4195] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 67.000413][ T4195] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 67.012604][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 67.021531][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 67.031065][ T154] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.038438][ T154] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.048573][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 67.057832][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 67.066899][ T154] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.074066][ T154] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.082226][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 67.090891][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 67.099712][ T154] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.106842][ T154] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.114970][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 67.123573][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 67.145041][ T4195] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 67.170641][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 67.180035][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 67.189443][ T154] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.196582][ T154] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.206018][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 67.215475][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 67.224789][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 67.235710][ T4195] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 67.246490][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 67.275465][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 67.287594][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 67.296616][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 67.306030][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 67.315857][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 67.326181][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 67.336276][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 67.346009][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 67.376932][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 67.386231][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 67.397808][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 67.407256][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 67.417413][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 67.426410][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 67.443231][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 67.452418][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 67.460827][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 67.470614][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 67.499709][ T4187] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 67.516188][ T4185] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 67.563990][ T4197] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.615547][ T4186] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.639628][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 67.651619][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 67.678094][ T4195] 8021q: adding VLAN 0 to HW filter on device bond0 [ 67.688001][ T4197] 8021q: adding VLAN 0 to HW filter on device team0 [ 67.705521][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 67.714818][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 67.738332][ T4195] 8021q: adding VLAN 0 to HW filter on device team0 [ 67.751743][ T4186] 8021q: adding VLAN 0 to HW filter on device team0 [ 67.769691][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 67.778395][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 67.786977][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 67.796370][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 67.822139][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.829258][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.846365][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 67.858976][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 67.867920][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.875158][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.912959][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 67.921781][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 67.930526][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 67.940474][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 67.947631][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 67.958003][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 67.967287][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 67.976552][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 67.983777][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 67.993802][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 68.003515][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 68.012640][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 68.021511][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 68.028605][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 68.036801][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 68.048387][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 68.058031][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 68.065158][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 68.074427][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 68.083717][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 68.093021][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 68.103238][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 68.113015][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 68.133617][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 68.143477][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 68.152964][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 68.163152][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 68.173228][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 68.183114][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 68.191955][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 68.202198][ T4188] Bluetooth: hci2: command 0x041b tx timeout [ 68.202522][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 68.234219][ T4187] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 68.250242][ T4197] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 68.268123][ T4197] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 68.281586][ T4188] Bluetooth: hci0: command 0x041b tx timeout [ 68.294319][ T4188] Bluetooth: hci3: command 0x041b tx timeout [ 68.316271][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 68.325144][ T4188] Bluetooth: hci4: command 0x041b tx timeout [ 68.332107][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 68.339491][ T4188] Bluetooth: hci1: command 0x041b tx timeout [ 68.349322][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 68.357232][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 68.365747][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 68.374226][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 68.382091][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 68.390614][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 68.401233][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 68.410787][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 68.419828][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 68.429476][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 68.438488][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 68.449177][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 68.458007][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 68.466874][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 68.475851][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 68.484529][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 68.494976][ T4185] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 68.514149][ T4186] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 68.529388][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 68.538786][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 68.554762][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 68.570255][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 68.599657][ T4195] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 68.621174][ T4195] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 68.657006][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 68.675931][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 68.692177][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 68.702834][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 68.753554][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 68.763871][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 68.801495][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 68.818648][ T4185] device veth0_vlan entered promiscuous mode [ 68.844496][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 68.860914][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 68.889322][ T4185] device veth1_vlan entered promiscuous mode [ 68.912504][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 68.920619][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 68.940754][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 68.986354][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 68.996212][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 69.006384][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 69.047688][ T4187] device veth0_vlan entered promiscuous mode [ 69.058363][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 69.073498][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 69.088203][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 69.097495][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 69.110464][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 69.123176][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 69.139280][ T4197] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.158128][ T4185] device veth0_macvtap entered promiscuous mode [ 69.166607][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 69.176459][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 69.184504][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 69.194624][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 69.204193][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 69.218562][ T4187] device veth1_vlan entered promiscuous mode [ 69.232887][ T4186] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.258065][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 69.266835][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 69.275433][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 69.283966][ T4185] device veth1_macvtap entered promiscuous mode [ 69.302537][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 69.310683][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 69.320593][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 69.330736][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 69.348516][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 69.357904][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 69.373841][ T4195] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 69.400105][ T4185] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 69.426803][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 69.437129][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 69.447237][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 69.456174][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 69.465271][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 69.474063][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 69.487680][ T4185] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 69.499667][ T4187] device veth0_macvtap entered promiscuous mode [ 69.513729][ T4186] device veth0_vlan entered promiscuous mode [ 69.523577][ T4187] device veth1_macvtap entered promiscuous mode [ 69.531457][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 69.540936][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 69.551982][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 69.560701][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 69.570366][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 69.578967][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 69.587811][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 69.600167][ T4185] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.610019][ T4185] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.619082][ T4185] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.628201][ T4185] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.642273][ T4197] device veth0_vlan entered promiscuous mode [ 69.659388][ T4197] device veth1_vlan entered promiscuous mode [ 69.680566][ T4186] device veth1_vlan entered promiscuous mode [ 69.688805][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 69.697715][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 69.706123][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 69.737411][ T4187] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 69.748945][ T4187] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 69.762850][ T4187] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 69.783792][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 69.792929][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 69.802327][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 69.812227][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 69.838189][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 69.846974][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 69.857476][ T4187] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 69.869134][ T4187] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 69.880676][ T4187] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 69.907490][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 69.923672][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 69.936332][ T4187] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.946236][ T4187] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.955652][ T4187] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.964764][ T4187] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.980541][ T4186] device veth0_macvtap entered promiscuous mode [ 70.004543][ T4197] device veth0_macvtap entered promiscuous mode [ 70.019696][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 70.029248][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 70.042758][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 70.052531][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 70.060868][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 70.069846][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 70.078937][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 70.088144][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 70.100585][ T4186] device veth1_macvtap entered promiscuous mode [ 70.124372][ T4195] device veth0_vlan entered promiscuous mode [ 70.134626][ T4197] device veth1_macvtap entered promiscuous mode [ 70.175996][ T4195] device veth1_vlan entered promiscuous mode [ 70.207056][ T4197] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 70.218881][ T4197] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.229224][ T4197] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 70.239983][ T4197] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.252045][ T4197] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.260966][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 70.273525][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.284364][ T4229] Bluetooth: hci2: command 0x040f tx timeout [ 70.288305][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 70.302718][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.313175][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 70.323933][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.336218][ T4186] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.358929][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 70.367581][ T4229] Bluetooth: hci1: command 0x040f tx timeout [ 70.373885][ T4229] Bluetooth: hci4: command 0x040f tx timeout [ 70.376646][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 70.380115][ T4229] Bluetooth: hci3: command 0x040f tx timeout [ 70.394025][ T4229] Bluetooth: hci0: command 0x040f tx timeout [ 70.403138][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 70.411411][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 70.419482][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 70.428486][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 70.437436][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 70.447360][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 70.458953][ T4197] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 70.469696][ T4197] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.479577][ T4197] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 70.490239][ T4197] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.502591][ T4197] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.515646][ T4254] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.529382][ T4254] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.539184][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 70.550606][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.562124][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 70.573168][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.583359][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 70.594456][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 70.607121][ T4186] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.622169][ T4186] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.630939][ T4186] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.640066][ T4186] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.649240][ T4186] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.660785][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 70.669213][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 70.678675][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 70.697010][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 70.706213][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 70.715364][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 70.724361][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 70.739178][ T4197] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.748275][ T4197] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.757398][ T4197] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.767596][ T4197] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.793901][ T4195] device veth0_macvtap entered promiscuous mode [ 70.831317][ T4254] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.839375][ T4254] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.853014][ T4195] device veth1_macvtap entered promiscuous mode [ 70.883839][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 70.894991][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 70.966701][ T4254] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.987647][ T4254] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.993930][ T4195] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 71.013469][ T4195] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.026344][ T4195] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 71.040693][ T4195] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.054018][ T4195] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 71.068789][ T4195] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.078947][ T4195] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 71.090743][ T4195] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.104313][ T4195] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.123224][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 71.131641][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 71.140463][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 71.162380][ T4195] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 71.215578][ T4195] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.227947][ T4195] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 71.241869][ T4195] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.258267][ T4195] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 71.269215][ T4195] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.279385][ T4195] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 71.291199][ T4195] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 71.309104][ T4195] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.331172][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 71.340360][ T1419] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.347318][ T1419] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.371826][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 71.386764][ T4195] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.406976][ T4195] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.418500][ T4195] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.430531][ T4195] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.491974][ T154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.500283][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.774235][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 71.898412][ T4238] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.972730][ T4238] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.140236][ T4254] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 72.296822][ T4238] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.366171][ T4266] Bluetooth: hci2: command 0x0419 tx timeout [ 72.431720][ T4238] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.441748][ T21] Bluetooth: hci0: command 0x0419 tx timeout [ 72.447881][ T21] Bluetooth: hci3: command 0x0419 tx timeout [ 72.454405][ T21] Bluetooth: hci4: command 0x0419 tx timeout [ 72.460515][ T21] Bluetooth: hci1: command 0x0419 tx timeout [ 72.487041][ T4238] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 72.520706][ T155] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.550674][ T155] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.584394][ T4254] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.603485][ T4254] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.630263][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 72.638902][ T1455] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 72.669785][ T4254] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.680381][ T4254] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.714455][ T4254] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.827076][ T4254] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.835045][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 72.958113][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 73.855995][ T4289] ip_tables: iptables: counters copy to user failed while replacing table [ 73.931046][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 73.951047][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 73.961038][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 74.351080][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 74.361065][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 74.371076][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 74.381070][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 74.391068][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 74.401059][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 74.411060][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #18a!!! [ 75.141207][ T4188] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 76.640217][ T4301] binder: 4297:4301 ioctl c0306201 0 returned -14 [ 77.491536][ T4298] FAULT_INJECTION: forcing a failure. [ 77.491536][ T4298] name failslab, interval 1, probability 0, space 0, times 1 [ 77.543846][ T4298] CPU: 0 PID: 4298 Comm: syz.3.4 Not tainted syzkaller #0 [ 77.551121][ T4298] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 77.561229][ T4298] Call Trace: [ 77.564547][ T4298] [ 77.567503][ T4298] dump_stack_lvl+0x188/0x250 [ 77.572232][ T4298] ? verify_lock_unused+0x140/0x140 [ 77.577503][ T4298] ? show_regs_print_info+0x20/0x20 [ 77.582742][ T4298] ? load_image+0x410/0x410 [ 77.587286][ T4298] ? aa_get_newest_label+0xf5/0x5a0 [ 77.592514][ T4298] ? end_current_label_crit_section+0x170/0x170 [ 77.598795][ T4298] should_fail+0x383/0x4b0 [ 77.603257][ T4298] should_failslab+0x5/0x20 [ 77.607791][ T4298] slab_pre_alloc_hook+0x51/0xc0 [ 77.612889][ T4298] kmem_cache_alloc_trace+0x47/0x290 [ 77.618231][ T4298] ? cap_convert_nscap+0x3f1/0x550 [ 77.623464][ T4298] ? privileged_wrt_inode_uidgid+0x1d3/0x230 [ 77.629489][ T4298] cap_convert_nscap+0x3f1/0x550 [ 77.634469][ T4298] vfs_setxattr+0x10f/0x2e0 [ 77.639049][ T4298] ? xattr_permission+0x510/0x510 [ 77.644115][ T4298] ? _copy_from_user+0x111/0x170 [ 77.649100][ T4298] ? setxattr+0x22b/0x360 [ 77.653475][ T4298] setxattr+0x2cb/0x360 [ 77.657683][ T4298] ? path_setxattr+0x290/0x290 [ 77.662519][ T4298] ? __mnt_want_write+0x1e2/0x260 [ 77.667588][ T4298] path_setxattr+0x147/0x290 [ 77.672217][ T4298] ? simple_xattr_list_add+0xf0/0xf0 [ 77.677548][ T4298] ? lock_chain_count+0x20/0x20 [ 77.682451][ T4298] __x64_sys_lsetxattr+0xb4/0xd0 [ 77.687429][ T4298] do_syscall_64+0x4c/0xa0 [ 77.690755][ T4188] usb 1-1: device descriptor read/all, error -71 [ 77.691879][ T4298] ? clear_bhb_loop+0x30/0x80 [ 77.691921][ T4298] ? clear_bhb_loop+0x30/0x80 [ 77.707634][ T4298] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 77.713589][ T4298] RIP: 0033:0x7f8666ba2159 [ 77.718041][ T4298] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 77.737678][ T4298] RSP: 002b:00007f8664dfa028 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd [ 77.746136][ T4298] RAX: ffffffffffffffda RBX: 00007f8666e29fa0 RCX: 00007f8666ba2159 [ 77.754146][ T4298] RDX: 0000200000000280 RSI: 00002000000001c0 RDI: 0000200000000100 [ 77.762176][ T4298] RBP: 00007f8666c3903b R08: 0000000000000001 R09: 0000000000000000 [ 77.770186][ T4298] R10: 0000000000000018 R11: 0000000000000246 R12: 0000000000000000 [ 77.778192][ T4298] R13: 00007f8666e2a038 R14: 00007f8666e29fa0 R15: 00007ffeb0b8cd68 [ 77.786233][ T4298] [ 78.057910][ T26] audit: type=1326 audit(1789147999.217:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4304 comm="syz.1.10" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f30025c1159 code=0x7ffc0000 [ 78.420562][ T4310] zero sized request [ 78.755634][ T26] audit: type=1326 audit(1789147999.217:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4304 comm="syz.1.10" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f30025c1159 code=0x7ffc0000 [ 78.780670][ T26] audit: type=1326 audit(1789147999.217:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4304 comm="syz.1.10" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f30025c1159 code=0x7ffc0000 [ 78.849278][ T26] audit: type=1326 audit(1789147999.217:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4304 comm="syz.1.10" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=186 compat=0 ip=0x7f30025c1159 code=0x7ffc0000 [ 78.907001][ T26] audit: type=1326 audit(1789147999.217:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4304 comm="syz.1.10" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f30025c1159 code=0x7ffc0000 [ 78.997868][ T26] audit: type=1326 audit(1789147999.217:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4304 comm="syz.1.10" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f30025c1159 code=0x7ffc0000 [ 79.087319][ T26] audit: type=1326 audit(1789147999.217:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4304 comm="syz.1.10" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f30025c1159 code=0x7ffc0000 [ 79.349990][ T26] audit: type=1326 audit(1789147999.217:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4304 comm="syz.1.10" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=222 compat=0 ip=0x7f30025c1159 code=0x7ffc0000 [ 80.375066][ T26] audit: type=1326 audit(1789147999.217:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4304 comm="syz.1.10" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f30025c1159 code=0x7ffc0000 [ 80.419628][ T26] audit: type=1326 audit(1789147999.217:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4304 comm="syz.1.10" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f30025c1159 code=0x7ffc0000 [ 83.281856][ T4334] syz.0.18 (4334) used greatest stack depth: 20176 bytes left [ 83.331719][ T4342] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 85.265740][ T4359] zero sized request [ 86.823407][ T2856] cfg80211: failed to load regulatory.db [ 90.591148][ T4418] nvme_fabrics: missing parameter 'transport=%s' [ 90.611100][ T4418] nvme_fabrics: missing parameter 'nqn=%s' [ 92.635005][ T150] block nbd3: Attempted send on invalid socket [ 92.643034][ T150] blk_update_request: I/O error, dev nbd3, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 92.660230][ T4442] isofs_fill_super: bread failed, dev=nbd3, iso_blknum=16, block=32 [ 94.678875][ T4470] zero sized request [ 98.531100][ T2286] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 98.892058][ T150] block nbd2: Attempted send on invalid socket [ 98.898292][ T150] blk_update_request: I/O error, dev nbd2, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 99.691398][ T4508] isofs_fill_super: bread failed, dev=nbd2, iso_blknum=16, block=32 [ 100.580007][ T4509] overlayfs: missing 'lowerdir' [ 100.961407][ T2286] usb 2-1: device descriptor read/all, error -71 [ 103.249395][ T4512] zero sized request [ 104.095044][ T4528] netlink: 16 bytes leftover after parsing attributes in process `syz.1.65'. [ 105.598631][ T4523] process 'syz.2.64' launched './file0' with NULL argv: empty string added [ 106.062130][ T4559] overlayfs: missing 'lowerdir' [ 108.237669][ T4583] zero sized request [ 109.211897][ T4592] nvme_fabrics: missing parameter 'nqn=%s' [ 109.329381][ T4596] zero sized request [ 113.378611][ T4613] netlink: 'syz.3.74': attribute type 13 has an invalid length. [ 113.386334][ T4613] netlink: 'syz.3.74': attribute type 17 has an invalid length. [ 113.414867][ T4613] gretap0: refused to change device tx_queue_len [ 113.421630][ T4613] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 114.145009][ T4625] overlayfs: missing 'lowerdir' [ 116.304688][ T4631] batman_adv: batadv0: Adding interface: syzkaller0 [ 116.321078][ T4631] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 116.449603][ T4631] batman_adv: batadv0: Interface activated: syzkaller0 [ 116.501735][ T4628] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 116.584491][ T4628] batman_adv: batadv0: Removing interface: syzkaller0 [ 117.468971][ T4648] netlink: 16 bytes leftover after parsing attributes in process `syz.1.91'. [ 117.483153][ T4648] netlink: 12 bytes leftover after parsing attributes in process `syz.1.91'. [ 117.535347][ T4650] Zero length message leads to an empty skb [ 118.986160][ T4656] nvme_fabrics: missing parameter 'nqn=%s' [ 122.269941][ T4707] zero sized request [ 124.161254][ T4718] nvme_fabrics: missing parameter 'nqn=%s' [ 125.880265][ T4729] ======================================================= [ 125.880265][ T4729] WARNING: The mand mount option has been deprecated and [ 125.880265][ T4729] and is ignored by this kernel. Remove the mand [ 125.880265][ T4729] option from the mount to silence this warning. [ 125.880265][ T4729] ======================================================= [ 125.915496][ T4729] tmpfs: Unknown parameter 'usrquota' [ 126.699698][ T4745] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 126.708944][ T4745] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 127.917558][ T264] block nbd3: Attempted send on invalid socket [ 127.923981][ T264] blk_update_request: I/O error, dev nbd3, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 127.941089][ T4751] isofs_fill_super: bread failed, dev=nbd3, iso_blknum=16, block=32 [ 128.981951][ T4762] nvme_fabrics: unknown parameter or missing value 'n' in ctrl creation request [ 130.745801][ T4779] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 130.755403][ T4779] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 132.763647][ T1419] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.770177][ T1419] ieee802154 phy1 wpan1: encryption failed: -22 [ 134.921350][ T4806] nvme_fabrics: unknown parameter or missing value 'n' in ctrl creation request [ 134.986482][ T4808] jffs2: notice: (4808) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 135.176906][ T4801] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 135.188488][ T4801] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 135.202551][ T4801] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 135.212923][ T4801] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 135.228126][ T4801] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 135.237819][ T4801] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 135.247725][ T4801] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 135.346236][ T4817] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 135.355482][ T4817] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 137.901138][ T4824] usb 4-1: new full-speed USB device number 2 using dummy_hcd [ 137.939201][ C0] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 137.949797][ C0] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 137.959961][ C0] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 137.970249][ C0] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 137.980517][ C0] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 137.990763][ C0] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 138.001666][ C0] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 138.011853][ C0] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 138.022088][ C0] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 138.032261][ C0] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 138.561429][ T4824] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 138.901275][ T4824] usb 4-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 138.933617][ T4824] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 138.984864][ T4824] usb 4-1: Product: syz [ 139.056944][ T4824] usb 4-1: config 0 descriptor?? [ 139.104571][ T4824] usb 4-1: can't set config #0, error -71 [ 139.171522][ T4824] usb 4-1: USB disconnect, device number 2 [ 139.511400][ T4861] nvme_fabrics: unknown parameter or missing value 'n' in ctrl creation request [ 139.813196][ T4869] overlayfs: missing 'lowerdir' [ 140.620040][ T4871] zero sized request [ 140.797381][ T4868] overlayfs: conflicting lowerdir path [ 140.838606][ T4863] netlink: 48 bytes leftover after parsing attributes in process `syz.2.146'. [ 141.562051][ T4824] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 142.121940][ T4824] usb 5-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 142.149846][ T4824] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 142.168110][ T4888] syz.1.154 uses obsolete (PF_INET,SOCK_PACKET) [ 142.174909][ T4824] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 142.227045][ T4824] usb 5-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 142.270332][ T4824] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 142.307784][ T4824] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 142.400082][ T4824] usb 5-1: invalid MIDI out EP 0 [ 142.567051][ T4824] snd-usb-audio: probe of 5-1:27.0 failed with error -22 [ 142.628759][ T4824] usb 5-1: USB disconnect, device number 2 [ 142.838663][ T4897] udevd[4897]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 144.251556][ T4917] overlayfs: missing 'lowerdir' [ 144.734569][ T4923] zero sized request [ 146.081930][ T4942] tmpfs: Unknown parameter 'grpquota/#/msr' [ 148.223566][ T4959] overlayfs: missing 'lowerdir' [ 149.188924][ T4956] netlink: 'syz.1.175': attribute type 1 has an invalid length. [ 150.100451][ T4956] netlink: 4 bytes leftover after parsing attributes in process `syz.1.175'. [ 153.129333][ T150] block nbd4: Attempted send on invalid socket [ 153.135717][ T150] blk_update_request: I/O error, dev nbd4, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 153.148128][ T5024] isofs_fill_super: bread failed, dev=nbd4, iso_blknum=16, block=32 [ 153.305402][ T5030] zero sized request [ 153.985627][ T5048] jffs2: notice: (5048) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 154.050793][ T5047] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 154.068231][ T5047] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 154.084498][ T5047] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 154.289762][ T5053] comedi comedi0: pcmda12: I/O port conflict (0x8,16) [ 154.298929][ T5047] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 154.342406][ T5047] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 154.424104][ T5047] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 154.442569][ T5047] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 154.626728][ T5057] overlayfs: missing 'workdir' [ 155.561708][ C1] sctp_transport_update_pmtu: 9 callbacks suppressed [ 155.561728][ C1] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 156.985612][ T5066] x_tables: duplicate underflow at hook 2 [ 157.015831][ C1] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 157.026062][ C1] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 157.036491][ C1] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 157.046646][ C1] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 157.056813][ C1] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 157.066954][ C1] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 157.077064][ C1] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 157.087458][ C1] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 157.097531][ C1] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 157.535858][ T5078] zero sized request [ 158.609258][ T264] block nbd2: Attempted send on invalid socket [ 158.615529][ T264] blk_update_request: I/O error, dev nbd2, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 159.387964][ T5083] isofs_fill_super: bread failed, dev=nbd2, iso_blknum=16, block=32 [ 160.466081][ T26] kauditd_printk_skb: 384 callbacks suppressed [ 160.466093][ T26] audit: type=1800 audit(1789148081.637:396): pid=5089 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.196" name=8006 dev="sda1" ino=2047 res=0 errno=0 [ 162.133174][ T5105] netlink: 4476 bytes leftover after parsing attributes in process `syz.4.200'. [ 164.045179][ T5116] overlayfs: failed to resolve './file1': -2 [ 164.105638][ T5117] zero sized request [ 164.964278][ T5120] jffs2: notice: (5120) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 165.027972][ T5119] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 165.044014][ T5119] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 165.060580][ T5119] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 165.181067][ T5119] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 165.204723][ T5119] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 165.214500][ T5119] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 165.225225][ T5119] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 165.670132][ T5130] overlayfs: failed to resolve './file2': -2 [ 165.897451][ T5136] overlayfs: overlapping lowerdir path [ 165.915534][ T5136] overlayfs: missing 'lowerdir' [ 166.629151][ T26] audit: type=1800 audit(1789148087.797:397): pid=5142 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.211" name=8006 dev="sda1" ino=2047 res=0 errno=0 [ 167.126470][ T5143] overlayfs: missing 'workdir' [ 167.465858][ T264] block nbd4: Attempted send on invalid socket [ 167.472135][ T264] blk_update_request: I/O error, dev nbd4, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 167.491206][ T5144] isofs_fill_super: bread failed, dev=nbd4, iso_blknum=16, block=32 [ 170.410985][ C0] sched: RT throttling activated [ 170.682354][ T5167] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 173.756193][ T5182] overlayfs: missing 'workdir' [ 176.450069][ T150] block nbd4: Attempted send on invalid socket [ 176.456816][ T150] blk_update_request: I/O error, dev nbd4, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 176.469666][ T5260] isofs_fill_super: bread failed, dev=nbd4, iso_blknum=16, block=32 [ 179.750738][ T5277] overlayfs: failed to resolve './file1': -2 [ 179.814134][ T5278] zero sized request [ 181.294307][ T5285] 9pnet: p9_errstr2errno: server reported unknown error [ 181.457995][ T5290] FAULT_INJECTION: forcing a failure. [ 181.457995][ T5290] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 181.561043][ T5290] CPU: 1 PID: 5290 Comm: syz.4.239 Not tainted syzkaller #0 [ 181.568405][ T5290] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 181.578660][ T5290] Call Trace: [ 181.581981][ T5290] [ 181.584943][ T5290] dump_stack_lvl+0x188/0x250 [ 181.589674][ T5290] ? show_regs_print_info+0x20/0x20 [ 181.594922][ T5290] ? load_image+0x410/0x410 [ 181.599470][ T5290] ? __lock_acquire+0x7b50/0x7b50 [ 181.604528][ T5290] ? vb2_core_reqbufs+0x8e4/0xf30 [ 181.609585][ T5290] ? __vb2_init_fileio+0x2c2/0xc50 [ 181.614732][ T5290] should_fail+0x383/0x4b0 [ 181.619189][ T5290] prepare_alloc_pages+0x1e3/0x5b0 [ 181.624341][ T5290] __alloc_pages+0x11b/0x480 [ 181.628970][ T5290] ? zone_statistics+0x170/0x170 [ 181.633959][ T5290] __vmalloc_node_range+0x4b1/0x8b0 [ 181.639218][ T5290] vmalloc_user+0x70/0x80 [ 181.643576][ T5290] ? vb2_vmalloc_alloc+0xec/0x330 [ 181.648670][ T5290] vb2_vmalloc_alloc+0xec/0x330 [ 181.653572][ T5290] ? vb2_common_vm_close+0x140/0x140 [ 181.658887][ T5290] __vb2_queue_alloc+0x737/0x1390 [ 181.663970][ T5290] vb2_core_reqbufs+0x8e4/0xf30 [ 181.668859][ T5290] ? vb2_verify_memory_type+0x570/0x570 [ 181.674455][ T5290] __vb2_init_fileio+0x2c2/0xc50 [ 181.679445][ T5290] ? verify_lock_unused+0x140/0x140 [ 181.684677][ T5290] __vb2_perform_fileio+0x346/0x1580 [ 181.690013][ T5290] vb2_fop_write+0x231/0x340 [ 181.694635][ T5290] v4l2_write+0x193/0x2b0 [ 181.699019][ T5290] ? v4l2_read+0x2b0/0x2b0 [ 181.703468][ T5290] vfs_write+0x304/0xd70 [ 181.707752][ T5290] ? file_end_write+0x250/0x250 [ 181.712646][ T5290] ? __fget_files+0x402/0x470 [ 181.717372][ T5290] ? __fdget_pos+0x1e2/0x370 [ 181.721991][ T5290] ? ksys_write+0x70/0x260 [ 181.726443][ T5290] ksys_write+0x153/0x260 [ 181.730805][ T5290] ? __ia32_sys_read+0x80/0x80 [ 181.735607][ T5290] ? lockdep_hardirqs_on+0x94/0x140 [ 181.740843][ T5290] do_syscall_64+0x4c/0xa0 [ 181.745292][ T5290] ? clear_bhb_loop+0x30/0x80 [ 181.750000][ T5290] ? clear_bhb_loop+0x30/0x80 [ 181.754709][ T5290] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 181.761006][ T5290] RIP: 0033:0x7f7c7329a159 [ 181.765452][ T5290] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 181.785087][ T5290] RSP: 002b:00007f7c714f2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 181.793549][ T5290] RAX: ffffffffffffffda RBX: 00007f7c73521fa0 RCX: 00007f7c7329a159 [ 181.801547][ T5290] RDX: 00000000fffffd9d RSI: 0000200000000100 RDI: 0000000000000005 [ 181.809552][ T5290] RBP: 00007f7c7333103b R08: 0000000000000000 R09: 0000000000000000 [ 181.817549][ T5290] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 181.825548][ T5290] R13: 00007f7c73522038 R14: 00007f7c73521fa0 R15: 00007ffdeb00ce38 [ 181.833569][ T5290] [ 185.001220][ T4233] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 185.401795][ T4233] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid maxpacket 30968, setting to 64 [ 185.631472][ T4233] usb 4-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ac.7e [ 185.665481][ T4233] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 185.715066][ T4233] usb 4-1: Product: syz [ 185.750746][ T4233] usb 4-1: Manufacturer: syz [ 185.760566][ T4233] usb 4-1: SerialNumber: syz [ 185.811709][ T4233] usb 4-1: config 0 descriptor?? [ 185.852114][ T5318] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 185.871872][ T4233] hub 4-1:0.0: bad descriptor, ignoring hub [ 185.879606][ T4233] hub: probe of 4-1:0.0 failed with error -5 [ 186.562713][ T4233] input: syz syz as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input5 [ 187.007414][ T264] block nbd2: Attempted send on invalid socket [ 187.013861][ T264] blk_update_request: I/O error, dev nbd2, sector 64 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 187.648191][ T5336] isofs_fill_super: bread failed, dev=nbd2, iso_blknum=16, block=32 [ 189.423211][ T4233] usb 4-1: USB disconnect, device number 3 [ 191.356953][ T4229] Bluetooth: hci0: command 0x0406 tx timeout [ 191.363269][ T4229] Bluetooth: hci2: command 0x0406 tx timeout [ 191.369387][ T4229] Bluetooth: hci3: command 0x0406 tx timeout [ 191.375538][ T4229] Bluetooth: hci4: command 0x0406 tx timeout [ 191.381703][ T4229] Bluetooth: hci1: command 0x0406 tx timeout [ 192.861838][ T5390] netlink: 48 bytes leftover after parsing attributes in process `syz.1.269'. [ 193.612101][ T5397] netlink: 20 bytes leftover after parsing attributes in process `syz.3.272'. [ 194.232457][ T1419] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.238819][ T1419] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.773561][ T5412] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 195.790495][ T5412] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 195.808911][ T5412] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 196.141887][ T5412] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 196.209858][ T5412] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 196.261931][ T5412] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 196.313979][ T5412] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 196.641207][ T4822] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 197.001403][ T4822] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 197.551292][ T4822] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 197.701264][ T4822] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 197.724998][ T4822] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 197.785823][ T4822] usb 4-1: SerialNumber: syz [ 197.875654][ T4822] usb 4-1: 0:2 : does not exist [ 199.178509][ T4822] usb 4-1: USB disconnect, device number 4 [ 199.488882][ T5451] jffs2: notice: (5451) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 209.652678][ T4627] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 209.931249][ T4627] usb 1-1: Using ep0 maxpacket: 32 [ 210.101664][ T4627] usb 1-1: unable to get BOS descriptor or descriptor too short [ 210.251586][ T4627] usb 1-1: config 14 has an invalid interface number: 57 but max is 1 [ 210.261075][ T4627] usb 1-1: config 14 has an invalid interface number: 228 but max is 1 [ 210.269804][ T4627] usb 1-1: config 14 has no interface number 0 [ 210.280083][ T4627] usb 1-1: config 14 has no interface number 1 [ 210.291216][ T4627] usb 1-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 210.303189][ T4627] usb 1-1: config 14 interface 228 altsetting 5 has an invalid endpoint with address 0xD1, skipping [ 210.327919][ T4627] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 210.350203][ T4627] usb 1-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 210.365309][ T4627] usb 1-1: config 14 interface 57 has no altsetting 0 [ 210.378816][ T4627] usb 1-1: config 14 interface 228 has no altsetting 0 [ 212.211186][ T4627] usb 1-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 212.224808][ T4627] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 212.311375][ T4627] usb 1-1: can't set config #14, error -71 [ 212.327326][ T4627] usb 1-1: USB disconnect, device number 4 [ 212.615189][ T5548] zero sized request [ 214.023772][ T5556] netlink: 'syz.0.319': attribute type 2 has an invalid length. [ 214.128572][ T5558] ------------[ cut here ]------------ [ 214.157480][ T5558] kernel BUG at net/phonet/socket.c:213! [ 214.187464][ T5558] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 214.193601][ T5558] CPU: 0 PID: 5558 Comm: syz.0.319 Not tainted syzkaller #0 [ 214.200917][ T5558] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 214.211019][ T5558] RIP: 0010:pn_socket_sendmsg+0x223/0x230 [ 214.216779][ T5558] Code: 41 5f 5d c3 e8 3e ab b0 00 89 d9 80 e1 07 fe c1 38 c1 0f 8c 0f ff ff ff 48 89 df e8 57 74 ae f8 e9 02 ff ff ff e8 9d 46 69 f8 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 90 55 48 89 e5 41 57 41 56 41 [ 214.236409][ T5558] RSP: 0018:ffffc90003d87c40 EFLAGS: 00010287 [ 214.242506][ T5558] RAX: ffffffff890fc903 RBX: 0000000000000000 RCX: 0000000000080000 [ 214.250510][ T5558] RDX: ffffc9000d402000 RSI: 000000000000012c RDI: 000000000000012d [ 214.258501][ T5558] RBP: ffffc90003d87cf0 R08: ffff88813fe22407 R09: 1ffff11027fc4480 [ 214.266535][ T5558] R10: dffffc0000000000 R11: ffffed1027fc4481 R12: dffffc0000000000 [ 214.274540][ T5558] R13: ffff888062ef6000 R14: ffff88801f9d0640 R15: 1ffff920007b0f8c [ 214.282544][ T5558] FS: 00007f7264a0d6c0(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000 [ 214.291509][ T5558] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 214.298123][ T5558] CR2: 00007f7264a0bfa8 CR3: 000000002361d000 CR4: 00000000003506f0 [ 214.306123][ T5558] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 214.314119][ T5558] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 214.322133][ T5558] Call Trace: [ 214.325435][ T5558] [ 214.328391][ T5558] ? pn_socket_ioctl+0x340/0x340 [ 214.333354][ T5558] ? apparmor_socket_sendmsg+0x88/0x230 [ 214.339073][ T5558] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 214.344393][ T5558] ? security_socket_sendmsg+0x7c/0xa0 [ 214.349887][ T5558] __sys_sendto+0x46d/0x620 [ 214.354429][ T5558] ? __ia32_sys_getpeername+0x80/0x80 [ 214.359848][ T5558] ? lock_chain_count+0x20/0x20 [ 214.364736][ T5558] __x64_sys_sendto+0xda/0xf0 [ 214.369458][ T5558] do_syscall_64+0x4c/0xa0 [ 214.373904][ T5558] ? clear_bhb_loop+0x30/0x80 [ 214.378629][ T5558] ? clear_bhb_loop+0x30/0x80 [ 214.383332][ T5558] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 214.389292][ T5558] RIP: 0033:0x7f726679698e [ 214.393748][ T5558] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 214.413471][ T5558] RSP: 002b:00007f7264a0be88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 214.421990][ T5558] RAX: ffffffffffffffda RBX: 00007f7264a0d6c0 RCX: 00007f726679698e [ 214.429996][ T5558] RDX: 0000000000000020 RSI: 00007f7264a0c000 RDI: 000000000000000c [ 214.438001][ T5558] RBP: 0000000000000000 R08: 00007f7264a0bf04 R09: 000000000000000c [ 214.446000][ T5558] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000c [ 214.454004][ T5558] R13: 00007f7264a0bf58 R14: 00007f7264a0c000 R15: 0000000000000000 [ 214.462014][ T5558] [ 214.465062][ T5558] Modules linked in: [ 214.574467][ T5565] i2c i2c-0: new_device: Instantiated device wusb3801 at 0x4a [ 215.285547][ T5558] ---[ end trace 22a0684fb9d12219 ]--- [ 215.291142][ T5558] RIP: 0010:pn_socket_sendmsg+0x223/0x230 [ 215.297607][ T5558] Code: 41 5f 5d c3 e8 3e ab b0 00 89 d9 80 e1 07 fe c1 38 c1 0f 8c 0f ff ff ff 48 89 df e8 57 74 ae f8 e9 02 ff ff ff e8 9d 46 69 f8 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 90 55 48 89 e5 41 57 41 56 41 [ 215.317514][ T5558] RSP: 0018:ffffc90003d87c40 EFLAGS: 00010287 [ 215.325714][ T5558] RAX: ffffffff890fc903 RBX: 0000000000000000 RCX: 0000000000080000 [ 215.333859][ T5558] RDX: ffffc9000d402000 RSI: 000000000000012c RDI: 000000000000012d [ 215.344551][ T5558] RBP: ffffc90003d87cf0 R08: ffff88813fe22407 R09: 1ffff11027fc4480 [ 215.353053][ T5558] R10: dffffc0000000000 R11: ffffed1027fc4481 R12: dffffc0000000000 [ 215.363112][ T5558] R13: ffff888062ef6000 R14: ffff88801f9d0640 R15: 1ffff920007b0f8c [ 215.371176][ T5558] FS: 00007f7264a0d6c0(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000 [ 215.380152][ T5558] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 215.388850][ T5558] CR2: 0000200000005000 CR3: 000000002361d000 CR4: 00000000003506e0 [ 215.398424][ T5558] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 215.409243][ T5558] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 215.417342][ T5558] Kernel panic - not syncing: Fatal exception [ 215.423723][ T5558] Kernel Offset: disabled [ 215.428097][ T5558] Rebooting in 86400 seconds..