last executing test programs: 11m3.789930788s ago: executing program 32 (id=70): syz_usb_connect(0x0, 0x2e, &(0x7f0000000280)=ANY=[@ANYBLOB], 0x0) r0 = openat$dsp(0xffffffffffffff9c, 0x0, 0x2002, 0x0) mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3, 0x12, r0, 0x0) ioctl$SNDCTL_DSP_GETOPTR(r0, 0x5008, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x3, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r1, 0x40405514, &(0x7f0000000000)={0x6, 0x4, 0x0, 0x6, '\x00', 0xfffffffd}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 10m13.607466118s ago: executing program 33 (id=142): r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000200)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006d7061746830") ioctl(r0, 0xc138fd09, &(0x7f0000000300)="0400000000000000000000009001000038010000010000000000000000000000000000000000000000000000000000006d70617468300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000580000006d756c74697061746800000000") ioctl(r0, 0xc138fd04, &(0x7f0000000700)="040000000000000000000000380100003801000000f0ff000000000000000000000000000000000000000000000000006d7061746830") 10m5.962570293s ago: executing program 4 (id=206): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f00000002c0)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1a7) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000300)='./mnt\x00', 0x0, 0x40, 0x0) r0 = open$dir(&(0x7f0000000040)='./mnt\x00', 0x0, 0x2) renameat2(r0, &(0x7f0000000140)='./mnt\x00', r0, &(0x7f0000000180)='./dev\x00', 0x2) 10m5.243190099s ago: executing program 4 (id=209): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = userfaultfd(0x80801) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/power/state\x00', 0x1, 0x15) write(r1, &(0x7f0000000180)='test', 0x4) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x10, 0x16, &(0x7f0000000780)=ANY=[], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r2, 0xc138fd03, &(0x7f0000000200)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006d7061746830") ioctl(r2, 0xc138fd09, &(0x7f0000000300)="0400000000000000000000009001000038010000010000000000000000000000000000000000000000000000000000006d70617468300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000580000006d756c74697061746800000000") 10m4.931307232s ago: executing program 4 (id=212): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_MPATH(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0500000000000000000018000000", @ANYRES32=r2, @ANYBLOB="3ad0e9d5a5a58f4ca9fa23f7509a01"], 0x28}}, 0x0) 10m4.440018732s ago: executing program 4 (id=217): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, 0x0, 0x44080) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_udp(0x2, 0x2, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x88}, 0x400000e0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) r5 = openat(0xffffffffffffff9c, 0x0, 0x40042, 0x1) flock(r5, 0x2) syz_io_uring_setup(0x7463, &(0x7f0000000540)={0x0, 0xd127, 0x800, 0x3, 0x2083, 0x0, 0x0}, &(0x7f0000000180), &(0x7f0000000140), &(0x7f0000000100)=0x0) syz_ublk_add_dev(r5, 0x0, 0x0, r6, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@any_dev={0x4, 0x4e4, 0x0, 0x0, 0x1000, 0x9, r4, 0x0, 0xa4}}}, &(0x7f0000000300)=0x0) socket$inet6_tcp(0xa, 0x1, 0x0) syz_ublk_setup_queues(0xffffffffffffffff, r7, 0x0, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x800, 0x0, 0x6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c84, 0x8000, 0x3, 0xbab}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2ced, 0x2, 0x1, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x20ec4b, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 10m3.444097823s ago: executing program 4 (id=218): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc_mnt/net/rpc/auth.unix.ip/flush\x00', 0x2, 0x0) write(r1, &(0x7f0000000400)='1\n', 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x2008000, 0x0, 0xfffffffffffffe93, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) clock_gettime(0x6, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r4, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x30, 0x0, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r5}}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xff8e}]}, 0x30}}, 0x20000000) 10m0.558232217s ago: executing program 4 (id=222): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="1c00000002030300000000000000010002200000080001000142356aa0cd7560452ffc05f13e2761d2175c8f9f56c06839807d7919991acf9edd2113cc8a9c1d71"], 0x1c}}, 0x40000) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000b40)=ANY=[@ANYBLOB="2000000002038306000000000000000000000000090002000001002102"], 0x20}, 0x1, 0x0, 0x0, 0x40684b5}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0xe, 0x4, 0x298, 0xffffffff, 0x0, 0xd0, 0x168, 0xffffffff, 0xffffffff, 0xd0, 0x168, 0x200, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0, 0x0, {}, [@common=@unspec=@time={{0x38}, {0x0, 0x7fffffff, 0x0, 0x1517f, 0xffffffff, 0xfe}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffc}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x1000) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x68, 0x0, 0x0, 0x1, 0x0, @remote, @local}, @time_exceeded={0x3, 0x0, 0x0, 0x3, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, @broadcast=0xac14140a, @multicast1}}}}}}, 0x0) writev(0xffffffffffffffff, &(0x7f00000003c0)=[{&(0x7f0000000380)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fdd411efc40800040000000000000000", 0x39}], 0x1) 9m43.621234642s ago: executing program 34 (id=222): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="1c00000002030300000000000000010002200000080001000142356aa0cd7560452ffc05f13e2761d2175c8f9f56c06839807d7919991acf9edd2113cc8a9c1d71"], 0x1c}}, 0x40000) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000b40)=ANY=[@ANYBLOB="2000000002038306000000000000000000000000090002000001002102"], 0x20}, 0x1, 0x0, 0x0, 0x40684b5}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0xe, 0x4, 0x298, 0xffffffff, 0x0, 0xd0, 0x168, 0xffffffff, 0xffffffff, 0xd0, 0x168, 0x200, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0, 0x0, {}, [@common=@unspec=@time={{0x38}, {0x0, 0x7fffffff, 0x0, 0x1517f, 0xffffffff, 0xfe}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffc}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x1000) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x68, 0x0, 0x0, 0x1, 0x0, @remote, @local}, @time_exceeded={0x3, 0x0, 0x0, 0x3, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, @broadcast=0xac14140a, @multicast1}}}}}}, 0x0) writev(0xffffffffffffffff, &(0x7f00000003c0)=[{&(0x7f0000000380)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fdd411efc40800040000000000000000", 0x39}], 0x1) 9m38.323779494s ago: executing program 35 (id=234): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, 0x0, 0x0) 4m54.564965917s ago: executing program 7 (id=887): r0 = mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mount$overlay(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x121047f, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) socketpair$unix(0x1, 0x1, 0x0, 0x0) timer_settime(0x0, 0x1, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_add_dev(r1, 0x0, r0, 0x0, &(0x7f0000000080)={0x2e, 0x8, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000000)=@new_dev={0x1, 0xb38, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x14}}}, &(0x7f0000000140)=0x0) syz_ublk_setup_queues(r2, r3, 0x0, &(0x7f0000000500)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1bee, 0x80000, 0x1000002, 0x141, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffffff, 0x100, 0x0, 0x8004146, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2e8b, 0x1000, 0xffffffff, 0x2fd, 0x0, r2}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2, 0x2, 0x2, 0xc5, 0x0, r2}}], 0x1, 0x0, 0x0) 4m51.736390468s ago: executing program 7 (id=890): ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f0000000340)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400ff0160291d000905", @ANYRES8, @ANYBLOB="7ba9"], 0x0) syz_open_dev$audion(&(0x7f00000002c0), 0x3, 0x1) close_range(r0, 0xffffffffffffffff, 0x0) 4m48.107083823s ago: executing program 7 (id=895): ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000380)={[0x3, 0x6, 0x4, 0x1, 0x102000000000002, 0x80000009, 0x400002004c8, 0x10001, 0x100000000003, 0xffffffff, 0xffffffffffffffff, 0x7fffffffffffffff, 0xd0b, 0x4, 0xffffffffffffff51, 0x50fd24f7], 0x60000, 0xc42d4}) r0 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440)={'syz', 0x3}, &(0x7f0000000340), 0xf2, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000480)={r0, r0, r0}, 0x0, 0x0, &(0x7f0000000000)={0x0}) 4m47.759032293s ago: executing program 7 (id=898): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000011c0), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$BATADV_CMD_GET_VLAN(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x4000000) mount(0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$uinput_user_dev(r2, &(0x7f0000000a00)={'syz0\x00', {0x8, 0x7, 0x5, 0x1}, 0x3f, [0x9, 0x2, 0x8, 0x6, 0x2, 0x400, 0x80000000, 0x0, 0x8, 0x0, 0x6, 0xc, 0xfffffffb, 0x39, 0x747d5e13, 0x8, 0xeffffb9a, 0xfffffffc, 0x4, 0xfffffffb, 0x2004, 0x3, 0x3, 0xf252, 0x80, 0x800, 0x300000, 0x7, 0xe, 0x4623f, 0xfffffffe, 0x0, 0x1ff, 0x8000, 0x1, 0xb, 0x401, 0x3, 0x7, 0x8da8, 0x2, 0x2, 0x2, 0x4, 0xe, 0x4, 0x3, 0x6, 0x4, 0x9, 0x1, 0x19df, 0x8, 0x2, 0x9, 0xffffffff, 0x7fffffff, 0x6, 0xe9, 0x5, 0x40, 0x8, 0x8, 0x5], [0x8, 0x1e, 0x3, 0x8000, 0xfffffffe, 0x3, 0x0, 0x25, 0x7, 0xfffffffc, 0x4, 0x7fff, 0x72c, 0x1c32, 0x8, 0x5, 0x10000, 0x400, 0x8001, 0x1ff, 0x1, 0x297, 0x5, 0x0, 0x6, 0x4, 0x0, 0x3ff, 0x0, 0xfffffffe, 0x0, 0x0, 0x10, 0x0, 0xfffffffd, 0x4, 0x5, 0xffffffff, 0x6, 0x5, 0x800, 0xbfff, 0x100, 0x196, 0xfffffff9, 0x2, 0x0, 0x2, 0x401, 0xffff, 0x3, 0x379, 0x1, 0xe, 0x5, 0x7, 0x6, 0xb4, 0x800001, 0x1, 0x8, 0x6, 0x200, 0x3], [0x401, 0xc584, 0xfffb, 0xcd5, 0x7, 0x1f, 0x404, 0x4, 0x8, 0x10, 0x9b2, 0x10, 0xe8b, 0x5, 0x0, 0x48, 0x3f92, 0x1000, 0x45ae, 0x11, 0x1, 0xfffffff9, 0xe58, 0x1000, 0x80040101, 0x4, 0x4, 0x5, 0x200003, 0x2, 0x5, 0xffff, 0x9, 0x8001, 0x3, 0x4, 0x3, 0x4, 0x3, 0x6d7e, 0x3, 0x8, 0x3, 0x1, 0x6, 0x9, 0x956, 0x0, 0x3ff, 0x3, 0xcac, 0x100fffd, 0x3005, 0x1, 0x4, 0xea, 0x9, 0x20000005, 0x3, 0xd9, 0x0, 0x7d, 0x401, 0x5], [0x108e, 0xffff, 0x2003, 0xa, 0x88, 0x2, 0xffff8b7f, 0x4, 0x50, 0x2, 0x763, 0xb, 0x404, 0x0, 0x5, 0x3, 0x7f, 0x5, 0x3fa6, 0x4, 0x0, 0x5, 0x6, 0x63, 0xe47, 0x1, 0x1654, 0x4, 0x200, 0x2851, 0x3b, 0x20000002, 0x5, 0x80000000, 0xa80a, 0x65f413f9, 0x4, 0x20008, 0x8a8, 0x6, 0x98, 0x409, 0x3, 0x4, 0x4, 0x10, 0x4, 0x5, 0x7fff, 0x2, 0xfffffff8, 0xcf, 0x1, 0x200, 0x7, 0x4edf, 0xfffffffd, 0x4, 0xf, 0x8002, 0xf, 0xf, 0x136, 0x2]}, 0x45c) ioctl$UI_DEV_CREATE(r2, 0x5501) write$input_event(r2, &(0x7f0000000000)={{0x77359400}, 0x15, 0x0, 0xfa000000}, 0xfe4f) 4m46.447950978s ago: executing program 7 (id=902): r0 = socket$l2tp(0x2, 0x2, 0x73) getsockname(r0, 0x0, &(0x7f00000000c0)) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000180), 0x400, 0x0) mount$tmpfs(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x420, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) fcntl$dupfd(r1, 0x0, r1) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000000880)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) r2 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x80, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000640)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0xb, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r6) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r8 = openat$cgroup_pressure(r7, &(0x7f0000000040)='cpu.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r8, &(0x7f0000000080)={'some', 0x20, 0x2000000005, 0x20, 0x10000000fffff}, 0x2f) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYRES32], 0x18}, 0x1, 0x0, 0x0, 0x10}, 0x4809) r9 = openat$cgroup_procs(r7, &(0x7f0000000840)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r9, &(0x7f0000002980), 0x12) 4m46.019450535s ago: executing program 7 (id=906): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) syz_io_uring_setup(0xefd, &(0x7f0000000400)={0x0, 0x0, 0x10000, 0x3, 0x55}, 0x0, 0x0, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4000, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000), 0x20000328) 4m44.920354157s ago: executing program 8 (id=910): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="010000000000000000000100000008000100000000000400048008000c8004000b800800020001000000a80008801c0007800800050000000000080006000000000008000600ca00000024000780080006009c0000000800050000000000080005000000000008000500000000000c000780080006003a00000014000780ebfd06000000000000000600780000004400078008000500000009"], 0xd8}}, 0x0) 4m43.801203314s ago: executing program 8 (id=912): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000011c0), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$BATADV_CMD_GET_VLAN(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x4000000) mount(0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$uinput_user_dev(r2, &(0x7f0000000a00)={'syz0\x00', {0x8, 0x7, 0x5, 0x1}, 0x3f, [0x9, 0x2, 0x8, 0x6, 0x2, 0x400, 0x80000000, 0x0, 0x8, 0x0, 0x6, 0xc, 0xfffffffb, 0x39, 0x747d5e13, 0x8, 0xeffffb9a, 0xfffffffc, 0x4, 0xfffffffb, 0x2004, 0x3, 0x3, 0xf252, 0x80, 0x800, 0x300000, 0x7, 0xe, 0x4623f, 0xfffffffe, 0x0, 0x1ff, 0x8000, 0x1, 0xb, 0x401, 0x3, 0x7, 0x8da8, 0x2, 0x2, 0x2, 0x4, 0xe, 0x4, 0x3, 0x6, 0x4, 0x9, 0x1, 0x19df, 0x8, 0x2, 0x9, 0xffffffff, 0x7fffffff, 0x6, 0xe9, 0x5, 0x40, 0x8, 0x8, 0x5], [0x8, 0x1e, 0x3, 0x8000, 0xfffffffe, 0x3, 0x0, 0x25, 0x7, 0xfffffffc, 0x4, 0x7fff, 0x72c, 0x1c32, 0x8, 0x5, 0x10000, 0x400, 0x8001, 0x1ff, 0x1, 0x297, 0x5, 0x0, 0x6, 0x4, 0x0, 0x3ff, 0x0, 0xfffffffe, 0x0, 0x0, 0x10, 0x0, 0xfffffffd, 0x4, 0x5, 0xffffffff, 0x6, 0x5, 0x800, 0xbfff, 0x100, 0x196, 0xfffffff9, 0x2, 0x0, 0x2, 0x401, 0xffff, 0x3, 0x379, 0x1, 0xe, 0x5, 0x7, 0x6, 0xb4, 0x800001, 0x1, 0x8, 0x6, 0x200, 0x3], [0x401, 0xc584, 0xfffb, 0xcd5, 0x7, 0x1f, 0x404, 0x4, 0x8, 0x10, 0x9b2, 0x10, 0xe8b, 0x5, 0x0, 0x48, 0x3f92, 0x1000, 0x45ae, 0x11, 0x1, 0xfffffff9, 0xe58, 0x1000, 0x80040101, 0x4, 0x4, 0x5, 0x200003, 0x2, 0x5, 0xffff, 0x9, 0x8001, 0x3, 0x4, 0x3, 0x4, 0x3, 0x6d7e, 0x3, 0x8, 0x3, 0x1, 0x6, 0x9, 0x956, 0x0, 0x3ff, 0x3, 0xcac, 0x100fffd, 0x3005, 0x1, 0x4, 0xea, 0x9, 0x20000005, 0x3, 0xd9, 0x0, 0x7d, 0x401, 0x5], [0x108e, 0xffff, 0x2003, 0xa, 0x88, 0x2, 0xffff8b7f, 0x4, 0x50, 0x2, 0x763, 0xb, 0x404, 0x0, 0x5, 0x3, 0x7f, 0x5, 0x3fa6, 0x4, 0x0, 0x5, 0x6, 0x63, 0xe47, 0x1, 0x1654, 0x4, 0x200, 0x2851, 0x3b, 0x20000002, 0x5, 0x80000000, 0xa80a, 0x65f413f9, 0x4, 0x20008, 0x8a8, 0x6, 0x98, 0x409, 0x3, 0x4, 0x4, 0x10, 0x4, 0x5, 0x7fff, 0x2, 0xfffffff8, 0xcf, 0x1, 0x200, 0x7, 0x4edf, 0xfffffffd, 0x4, 0xf, 0x8002, 0xf, 0xf, 0x136, 0x2]}, 0x45c) ioctl$UI_DEV_CREATE(r2, 0x5501) write$input_event(r2, &(0x7f0000000000)={{0x77359400}, 0x15, 0x0, 0xfa000000}, 0xfe4f) 4m43.352847464s ago: executing program 8 (id=913): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./mysys\x00', 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x38, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x4, 0x7, 0xe1, 0x81, 0x9, 0xd9, 0x40, 0x41, 0xfb, 0x1, 0xc, 0x2, 0x2, 0x41, 0x1, 0xf0}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x5, 0x20, 0x3, 0x2, 0x106c, 0x100, 0x8000000000000001, 0x80000004000080, 0x380000, 0x2000008, 0x8, 0x4, 0x0, 0x8000], 0x1, 0x3c4210}) quotactl$Q_SETQUOTA(0xffffffff80000800, &(0x7f0000000040)=@loop={'/dev/loop', 0x0}, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 4m42.419523593s ago: executing program 8 (id=914): r0 = socket(0x10, 0x3, 0x40) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x6) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) socket(0x10, 0x803, 0x0) socket$netlink(0x10, 0x3, 0x4) r2 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000040)={'bridge0\x00', &(0x7f0000000080)=@ethtool_rxfh={0x2c, 0x0, 0x0, 0x0, 0x3}}) set_mempolicy(0x8006, &(0x7f0000000180)=0xfff, 0x5) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) setns(0xc9, 0x0) setns(0xc9, 0x0) listen(r0, 0x4) r3 = socket(0x8, 0x5, 0x5) ioctl$VFAT_IOCTL_READDIR_BOTH(r3, 0x400261f3, &(0x7f0000000000)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) socket$kcm(0x10, 0x2, 0x4) 4m41.967922964s ago: executing program 8 (id=917): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) getpid() mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc_mnt/net/rpc/auth.unix.ip/flush\x00', 0x2, 0x0) write(r1, &(0x7f0000000400)='1\n', 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x2008000, 0x0, 0xfffffffffffffe93, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) clock_gettime(0x6, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r4, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x30, 0x0, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r5}}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xff8e}]}, 0x30}}, 0x20000000) 4m38.588034368s ago: executing program 6 (id=924): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, 0x0, 0x0) 4m38.047940017s ago: executing program 8 (id=925): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./mysys\x00', 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x38, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x4, 0x7, 0xe1, 0x81, 0x9, 0xd9, 0x40, 0x41, 0xfb, 0x1, 0xc, 0x2, 0x2, 0x41, 0x1, 0xf0}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x5, 0x20, 0x3, 0x2, 0x106c, 0x100, 0x8000000000000001, 0x80000004000080, 0x380000, 0x2000008, 0x8, 0x4, 0x0, 0x8000], 0x1, 0x3c4210}) quotactl$Q_SETQUOTA(0xffffffff80000800, &(0x7f0000000040)=@loop={'/dev/loop', 0x0}, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 4m37.261757886s ago: executing program 6 (id=926): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./dev\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000200)="0400000000000000000000003801000038") ioctl(r0, 0xc138fd09, &(0x7f0000000300)="0400000000000000000000009001000038010000010000000000000000000000000000000000000000000000000000006d706174683000"/175) 4m36.971352055s ago: executing program 6 (id=927): r0 = socket(0x10, 0x3, 0x40) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x6) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) socket(0x10, 0x803, 0x0) socket$netlink(0x10, 0x3, 0x4) r2 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000040)={'bridge0\x00', &(0x7f0000000080)=@ethtool_rxfh={0x2c, 0x0, 0x0, 0x0, 0x3}}) set_mempolicy(0x8006, &(0x7f0000000180)=0xfff, 0x5) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) setns(0xc9, 0x0) setns(0xc9, 0x0) listen(r0, 0x4) r3 = socket(0x8, 0x5, 0x5) ioctl$VFAT_IOCTL_READDIR_BOTH(r3, 0x400261f3, &(0x7f0000000000)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) socket$kcm(0x10, 0x2, 0x4) 4m35.837409224s ago: executing program 6 (id=930): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="58000000020603000000000000000000000000000c000300686173683a69700005000400000000000900020073797a31000000001400078008001340000017e5080012400000000905000500020000000500010006"], 0x58}}, 0x4c8d0) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=ANY=[@ANYBLOB="44000000090601020000000000000000000000000900020073797a310000000005000100070000001c0007800c00018008000140fffffffe0c00028008000140", @ANYBLOB="5f29e21e12333f6bf8210abc0b3779191d2f5eb33aba5617fd3fca286b090d5b2edca617786e2de7d84f97e5f1becf74cc5698b6a587d8e376fc6498072c7d2260a9617a37486a8e3f6e8a1964c11cd79cc5c2f4974176767a9d013053e426d45a11763b898fa71869c9a0c400a7d2ebe1823c76ba299b00d787663273174ee7645d403fba2a4f0ba3d938136765f68463811958bb37043ba9941e7b8abd1c3d3a9ec87b7ef1a2"], 0x44}, 0x1, 0x0, 0x0, 0x40080}, 0x4000050) r1 = syz_open_dev$evdev(&(0x7f0000000880), 0x1, 0x101002) ioctl$EVIOCRMFF(r1, 0x40044581, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000380)={0x200, 0x51, 0xeed3}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x0, 0x248, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x7, 0x8, 0x155f, 0x10000006, 0x4, 0x2dcd, 0x1, 0xb4, 0xfa97, 0xa2b9, 0x6, 0x7, 0xe5, 0x4, 0xfc000000, 0x403, 0xbbf, 0x3, 0xfffffff9, 0x8, 0xd, 0x800, 0x3, 0x6, 0x4, 0x100002, 0xc7, 0x5d6, 0x8001, 0x8a, 0x79, 0x2, 0xf05, 0x2, 0x91, 0x129, 0x4, 0x16, 0xc, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x5, 0x1ff, 0xa9, 0xff, 0x0, 0x2, 0x6, 0x3, 0x1000000, 0x489, 0x7ff, 0x4, 0x80000001, 0xffffffff, 0x6, 0x6], [0x9, 0x3, 0x6, 0xfffffff7, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x7ff, 0x2, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0x1, 0x4, 0x1c, 0x7, 0x1, 0x77, 0x3, 0x8, 0xffffff7f, 0x6, 0x6, 0x4c2336d3, 0x4, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0xa, 0xab00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3ff, 0x1fc, 0x1, 0x7fff, 0x67b3, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0xa0, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0xc, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x2, 0x48d, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x9, 0x41, 0x6, 0xee48, 0x2000004, 0x1, 0x10, 0x5, 0x9, 0x5, 0x0, 0x9, 0x3, 0xc7, 0xfff, 0x100008, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x4, 0x97f7, 0x3, 0x200000d, 0x3, 0x6, 0x7, 0xdd81, 0x8, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0xa, 0x6, 0x7ffe, 0x28, 0x5, 0xd500, 0x8, 0x3, 0x9, 0x3, 0x10000, 0xfffffffd, 0x5, 0xfffffffe], [0xc, 0x6, 0x5, 0x1af8, 0xbfc, 0x9, 0x9, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x7, 0x21, 0x4000009, 0x81, 0x7, 0x9d87, 0x4, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x6, 0x80008001, 0x7777, 0x1, 0xa0, 0x100, 0xd8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xea1, 0x428, 0x3, 0x6, 0xfffffff9, 0x4, 0x9, 0x9, 0x4, 0x463f, 0x0, 0xdab, 0x1, 0x8, 0x13fff, 0x101, 0x11]}, 0x45c) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_PANTHOR_BO_SET_LABEL(0xffffffffffffffff, 0xc010644d, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)='!+@\x00'}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) syz_usb_connect(0x5, 0x24, &(0x7f0000000400)=ANY=[@ANYBLOB="12010000fe857108480b0730644f010203010902120001000000000904"], 0x0) r4 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r4, 0x707, &(0x7f0000000040)={&(0x7f00000004c0)=[{0x4, 0x0, 0x0, 0x0}], 0x1}) r5 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r6, 0x4090ae82, &(0x7f0000000500)={[0x800000000000035, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0xfffffffffffffffa, 0x5, 0x400000000f2, 0x101, 0x7fdfffffffffe, 0xa, 0x5, 0xa, 0x7, 0xfffffffffffffff8, 0x9, 0x20000000000000b], 0x25000, 0x304}) r7 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/module/kvm_intel/parameters/vmentry_l1d_flush\x00', 0x2, 0x108) write(r7, &(0x7f0000000300)='a', 0x1) ioctl$KVM_RUN(r6, 0xae80, 0x0) r8 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r9 = dup(r8) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r10, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r8, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r10, 0xae80, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYRES8=r11], 0x5c}}, 0x0) 4m31.721242217s ago: executing program 6 (id=935): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc_mnt/net/rpc/auth.unix.ip/flush\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)='1\n', 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x2008000, 0x0, 0xfffffffffffffe93, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) clock_gettime(0x6, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x30, 0x0, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r4}}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xff8e}]}, 0x30}}, 0x20000000) 4m30.603403073s ago: executing program 36 (id=906): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) syz_io_uring_setup(0xefd, &(0x7f0000000400)={0x0, 0x0, 0x10000, 0x3, 0x55}, 0x0, 0x0, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4000, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000), 0x20000328) 4m30.070061161s ago: executing program 6 (id=938): ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x40046109, &(0x7f0000000300)={0xd0, 0x2, 0x0, 0x8}) ioctl$CEC_S_MODE(0xffffffffffffffff, 0x40046109, &(0x7f0000000080)=0x2) 4m21.276839929s ago: executing program 37 (id=925): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000100)='./mysys\x00', 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text16={0x10, 0x0}], 0x1, 0x38, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x4, 0x7, 0xe1, 0x81, 0x9, 0xd9, 0x40, 0x41, 0xfb, 0x1, 0xc, 0x2, 0x2, 0x41, 0x1, 0xf0}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x5, 0x20, 0x3, 0x2, 0x106c, 0x100, 0x8000000000000001, 0x80000004000080, 0x380000, 0x2000008, 0x8, 0x4, 0x0, 0x8000], 0x1, 0x3c4210}) quotactl$Q_SETQUOTA(0xffffffff80000800, &(0x7f0000000040)=@loop={'/dev/loop', 0x0}, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 4m14.243537762s ago: executing program 38 (id=938): ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x40046109, &(0x7f0000000300)={0xd0, 0x2, 0x0, 0x8}) ioctl$CEC_S_MODE(0xffffffffffffffff, 0x40046109, &(0x7f0000000080)=0x2) 2m28.139838232s ago: executing program 3 (id=1142): openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000100), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() syz_ublk_setup_io_uring(0x2b95, &(0x7f0000000000)={0x0, 0x30b3, 0x24000, 0x0, 0x306}, 0x0, &(0x7f0000000180), &(0x7f00000001c0)) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x3) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) write$cgroup_type(r0, 0x0, 0x0) mremap(&(0x7f000000d000/0x2000)=nil, 0xfffffffffffffe74, 0x1000, 0x0, &(0x7f0000007000/0x1000)=nil) r3 = syz_open_procfs(0x0, 0x0) read$FUSE(r3, &(0x7f0000002700)={0x2020}, 0x2020) r4 = syz_genetlink_get_family_id$smc(&(0x7f0000000040), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000840)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002dbd7000fbdbdf25020000000900010073797a320000000014000200766c61"], 0x34}, 0x1, 0x0, 0x0, 0x4008011}, 0x4) 2m27.412828659s ago: executing program 3 (id=1144): mkdir(&(0x7f0000000400)='./my_sys\x00', 0x1ff) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x28}, 0x1, 0x0, 0x0, 0x14881}, 0x800) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(0xffffffffffffffff, 0x84, 0x20, &(0x7f0000000000), &(0x7f0000000040)=0x4) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4000000) r1 = fsopen(&(0x7f0000000180)='ntfs3\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000240)='uid', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) memfd_create(&(0x7f0000000b00)='\x103q}2[\xe0\x9a\xee\xaf\x03\x97\x9et\v\"|Ma\x86\xe7\xc0\x14\x9f\xb9h\xb1\x96\xe7=I\x860S6\xb5\xa8\xc2\x95Je%\xfeG\'\b\x00\x00\x00\x00\x00\x00\x00\x1c\xa6\xab\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94k\xcd\t\x00\x90k\xd6\x05\xb6&\xd0\x9daA\xc5\x9c_\xd4\x18,\f\xd4s\xb2\x99/\xc0\x9a\xf2Oc\xc0c\x03gB!\xb0\xb8n\x01\x9bT\x95\x10\x86\xe8$\x7f\r[\xf9\x0e1v\xb1\n\x88\v\x95uy\xb5:`\x8b\nC\x18A;\xaa%\xaf\xc7\xa3\xac\xa2D\xb5\xe2\xe1\xdc(\xfd\x05\x9fB\x84O\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1a\xa0\x17\xe3\xac\xe9\xc9\xa7\x8a\x1b\x03\"&\xac\xcap>\xccZ\x01\xbc\x18\xc1\xb9\xe9\v\x8b\x9c\xb4Q\xd4\x96EV<>\x99\xca\xb3\xe0\xc4tL\xed\xf5W\xbd#\xcf\x8a\x84\xed\x9f/\xd4\xbb\xea;-Dp\xf8\xd0F\x90\xf8\x92Ip6\xf4\x16\xe8\x14\xe0\x92!\x92-F\xe2\x14D\x91\xa8b\x04\xdd\x1d\a\xdc\xe0\x18\x85{\x80Q\xf6k\x96\xfaQ\x9fW\vO\xf0\xe4O\\\xceS\xe2\x05\x049d\x06#\x88\xc3\xdf\x85O\x1c\xc3\xad?r\xd7\x0e\x00\xd7\x83\xb0\x88\x9c\xf6Y-F\x98\xdd\x9c~\xfd\x95\xc3\xb6lC\xaa\"Y\xa2K\xecz\x84:*\xf5Y\xd1\x9b1\xbd\x9b\x15\xd4\xec\x02o\x01&\xaa\x90w\xc4\xc7\x8en\xb5\x1ag\xab&?\xbe\xcb\xe8v\xa8\xe0\xa4\x81sW\xacf\x149\xd2}\xef\x03Ga\x9a$4\x8c\xa5!p\x83\x05\x96%\x02%\xabj\n\b\xc8NC\x91}&y\xd3\xe1\xeep\'\xc5\xab\x19GsX5\x8c\n\x9fh\xee;4\xb1%V\xe0\xa9\x8e\xf30:\xd8\x18N~G\x139\xcaf2\x02F1\xc6\x82\x00E\xae\x9d\x17\x871N:\xb4\xea \x8e\xdelP\x83\x1f\'\xe2\xd6\xc0\xc3\xfc\xc9677u\xf3RUP@o>\xee\xb8\xa3\t\x02\xb7\\,\xebK\xed\x1b\xc9e\xb3\x16\xce\x9bI\xdb\xfa\x82\x85\t\x9bg\xd0s\xe2\f{\x8cp~;\xf8\x96\xf2\x91\x06\x89\xa6D\xce\xac\x03\xc1\x83\xd1\xe6 |\xa75\xd7\x80t\xfc\xf8\xd2\x12N\x1cB7^\xfd4\xae\xb0VFw\b!\xae\x1baTv\xc0z\x19\xc5\xc8w\xba\x97N\x9a`\x8f\xfc\x9ee\xf9\x00\x1cQA\x14]\r\xd4\"\xc2\x12GD\xdb{\x88\xaa\x81\xc8\xa2\xdeI\xa2\xbel\x0e\xec\x17fNI\x05\xff\x8d\xf4_\x1a\vqA\xb7\x0ed<\x98\xee\xb8\x19\xec\x9f\xee\xe1_\xacG\x8b\xa3\xc3\x13\x80\x0f\xf4I\xdeAwG\xbdkno\xa2\b\x126\x97\x9b\xf9|P\xd94\v\x15\xcb\xc0\x9d\x11\xf3\x18\xae!2\x1b\x12\xa9\xc8~\xb7S\x94\xb5\xc7;\xa90D>s\xe9\xa4N\xf8\xdb\xab\xa0\x94~\xa1]b\xa4\xe5\xe2e\x1c\x8b\xd2\xc7Md\x93\x02\xd8\xb0,\xeb\x03\xaa\v\xed\x9bR\x8a\x80\xc2\x1f\x17ej\x973wv\x83a\xe06\x96\xde\xbc%Uh;H\xf8S\xf1\xa1g\x02\xc4\xc3\xa4\xa8\x96\t\xfex\xa2?\xcb\\Y\x1e\xfe\xca\xa0i\x80O\x11\xac\xb7$\xdb\xbc\xb0\xcb\xacqU\xb5*\x00\x00\x00\x00\x00\x00\x00\f\xda\xf8oV\x89\xd3\x1f\x99+\xe5T\x8eM4\x1c\xc6\x7f\xd4\xf2\xcc\xd3\x94\xca\xd4\x00\x00\x00\x00\x00\x00\x00\x00\x00~A9\xf6IBu\x0e\x00\x9e\xa2\xd0\x92\xd1\xbc\xb8\tJ\xa1\aN\x87\x95\xbb\xa9s\xab\x90\x06\xc6!p\x9e?~\xf9\xe6\xae*\v\xa3\xd9gxKN\'z]*\x93\xf7\b\x91\xd0\xff\xd9\xc6a\xb5q\x9c\xa1Go\xd58\x93\xe0,\x9f\xe4\xa9\xd9A\x9e\x95e\x98\xd0V\x9d\xed\x97\xf1\xc5\xce\xf5\x90!d\x9a\xd8\x10\xbbx\r8\xff\x8bNUK\xebA\xe5\x92f\xc4\xd1\xa8\x15\xbf\xb5iW\xdb.kbf*\x89\xf0\xecq m-~\xbbf?\xec=\xd2\xe2\x1e\x8d/o\xcd\xc8x\xdb\xe6\xd0W\xca\xc5kz\x8e9\xfa\x86\x0f\x96p', 0x2) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000000)=0x15) ioctl$TCSETS(r3, 0x404c4701, &(0x7f0000000040)={0x1, 0xffffffff, 0x0, 0xff, 0x12, "ccd800000000eeff00001000000000008000"}) ioctl$TIOCVHANGUP(r3, 0x5437, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000240)={'#! ', './my_sys/bus/pci/devices/0000:00:01.0/config'}, 0x30) r4 = socket$packet(0x11, 0x2, 0x300) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f0000000180)=r5, 0x4) r6 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x40002) write$FUSE_WRITE(r6, &(0x7f0000000040)={0x18, 0x0, 0x0, {0x10000}}, 0x10) read$FUSE(r6, 0x0, 0x0) 2m24.571615694s ago: executing program 3 (id=1145): dup(0xffffffffffffffff) socket$kcm(0xa, 0x3, 0x73) r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r0, 0x0, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0xffffffff000) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x437, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_PRIORITY={0x6}, @IFLA_BR_VLAN_FILTERING={0x5}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4040010}, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000400), 0x109000, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000100)=0xe) io_uring_register$IORING_REGISTER_PBUF_RING(0xffffffffffffffff, 0x16, &(0x7f0000000740)={&(0x7f0000002000)={[{0x0, 0x0, 0x3}, {0x0}, {0x0, 0x0, 0xfffe}, {0x0}]}, 0x4}, 0x1) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0001, 0x0) ioctl$PPPIOCATTCHAN(r3, 0x40047438, &(0x7f0000000340)=0x1) write$ppp(r3, &(0x7f0000000080)="0adfc5", 0x3) 2m24.273822794s ago: executing program 3 (id=1147): r0 = syz_open_dev$sg(&(0x7f0000000010), 0x0, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={0x0, 0x0}, 0x28) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000210)={0x53, 0xfffffffffffffffc, 0x6, 0x20, @buffer={0x0, 0x200, &(0x7f0000000610)=""/512}, &(0x7f0000000310)='(\x00\x00\x00\x00\x00', 0x0, 0x3e8, 0x0, 0x0, 0x0}) 2m23.328506956s ago: executing program 3 (id=1148): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc_mnt/net/rpc/auth.unix.ip/flush\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)='1\n', 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x2008000, 0x0, 0xfffffffffffffe93, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) clock_gettime(0x6, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x30, 0x0, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r4}}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xff8e}]}, 0x30}}, 0x20000000) 2m16.417594123s ago: executing program 3 (id=1162): openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$uinput_user_dev(r1, &(0x7f0000000a00)={'syz0\x00', {0x8, 0x7, 0x5, 0x1}, 0x3f, [0x9, 0x2, 0x8, 0x6, 0x2, 0x400, 0x80000000, 0x0, 0x8, 0x0, 0x6, 0xc, 0xfffffffb, 0x39, 0x747d5e13, 0x8, 0xeffffb9a, 0xfffffffc, 0x4, 0xfffffffb, 0x2004, 0x3, 0x3, 0xf252, 0x80, 0x800, 0x300000, 0x7, 0xe, 0x4623f, 0xfffffffe, 0x0, 0x1ff, 0x8000, 0x1, 0xb, 0x401, 0x3, 0x7, 0x8da8, 0x2, 0x2, 0x2, 0x4, 0xe, 0x4, 0x3, 0x6, 0x4, 0x9, 0x1, 0x19df, 0x8, 0x2, 0x9, 0xffffffff, 0x7fffffff, 0x6, 0xe9, 0x5, 0x40, 0x8, 0x8, 0x5], [0x8, 0x1e, 0x3, 0x8000, 0xfffffffe, 0x3, 0x0, 0x25, 0x7, 0xfffffffc, 0x4, 0x7fff, 0x72c, 0x1c32, 0x8, 0x5, 0x10000, 0x400, 0x8001, 0x1ff, 0x1, 0x297, 0x5, 0x0, 0x6, 0x4, 0x0, 0x3ff, 0x0, 0xfffffffe, 0x0, 0x0, 0x10, 0x0, 0xfffffffd, 0x4, 0x5, 0xffffffff, 0x6, 0x5, 0x800, 0xbfff, 0x100, 0x196, 0xfffffff9, 0x2, 0x0, 0x2, 0x401, 0xffff, 0x3, 0x379, 0x1, 0xe, 0x5, 0x7, 0x6, 0xb4, 0x800001, 0x1, 0x8, 0x6, 0x200, 0x3], [0x401, 0xc584, 0xfffb, 0xcd5, 0x7, 0x1f, 0x404, 0x4, 0x8, 0x10, 0x9b2, 0x10, 0xe8b, 0x5, 0x0, 0x48, 0x3f92, 0x1000, 0x45ae, 0x11, 0x1, 0xfffffff9, 0xe58, 0x1000, 0x80040101, 0x4, 0x4, 0x5, 0x200003, 0x2, 0x5, 0xffff, 0x9, 0x8001, 0x3, 0x4, 0x3, 0x4, 0x3, 0x6d7e, 0x3, 0x8, 0x3, 0x1, 0x6, 0x9, 0x956, 0x0, 0x3ff, 0x3, 0xcac, 0x100fffd, 0x3005, 0x1, 0x4, 0xea, 0x9, 0x20000005, 0x3, 0xd9, 0x0, 0x7d, 0x401, 0x5], [0x108e, 0xffff, 0x2003, 0xa, 0x88, 0x2, 0xffff8b7f, 0x4, 0x50, 0x2, 0x763, 0xb, 0x404, 0x0, 0x5, 0x3, 0x7f, 0x5, 0x3fa6, 0x4, 0x0, 0x5, 0x6, 0x63, 0xe47, 0x1, 0x1654, 0x4, 0x200, 0x2851, 0x3b, 0x20000002, 0x5, 0x80000000, 0xa80a, 0x65f413f9, 0x4, 0x20008, 0x8a8, 0x6, 0x98, 0x409, 0x3, 0x4, 0x4, 0x10, 0x4, 0x5, 0x7fff, 0x2, 0xfffffff8, 0xcf, 0x1, 0x200, 0x7, 0x4edf, 0xfffffffd, 0x4, 0xf, 0x8002, 0xf, 0xf, 0x136, 0x2]}, 0x45c) ioctl$UI_DEV_CREATE(r1, 0x5501) write$input_event(r1, &(0x7f0000000000)={{0x77359400}, 0x15, 0x0, 0xfa000000}, 0xfe4f) 2m16.38426842s ago: executing program 9 (id=1163): r0 = bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x16, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="85000000070000006a0a00ff000000000c00000000000000950000000000000018100000", @ANYRES32, @ANYBLOB="000000000000000005000000000000009500000000000000b1f8306e05d1e4aab009c16b5c05077115d0749619ca39f89974785ae0619b77c6585f678ac92a3b6b4148f56b43c3dd75d75f97c8f92f60a2def458df05e2fbfb3e849b2b3cffd4f29446ae60dd76654b2639b2bc14350706214a6ab7a712d4317fbc3ca01d0d3ed6110b3775903141a5091a4d3db8eb335414fbdb288aba73aaf6d18000a3a2a069cf7f9402e1425bb6bc370576aa1faea0fe222671ecf99038fce8dba53dcb11f87cca"], &(0x7f0000000140)='GPL\x00', 0x2, 0xffa0, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0x1e, 0x10, 0x0, 0x1e}, 0x2d) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000002c0)={@ifindex, r0, 0x11}, 0xa) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000002c0)=ANY=[], 0x10) setns(0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000840)={r2, @in6={{0xa, 0x4e20, 0xe84, @private0={0xfc, 0x0, '\x00', 0x1}, 0x129}}, 0x2, 0x2, 0x10, 0x0, 0x5, 0x8, 0x4}, 0x9c) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r3, 0xc058534f, &(0x7f00000001c0)={{0xf}, 0x1, 0x0, 0x2}) r4 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000001080)=0x4) setsockopt$inet_sctp_SCTP_MAXSEG(r4, 0x84, 0xd, 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r5 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f0000000200)={'wlan0\x00', 0x1}) r6 = syz_open_dev$video(&(0x7f0000000000), 0x7, 0x181a80) ioctl$VIDIOC_G_FMT(r6, 0xc0d05604, &(0x7f0000000140)={0x9, @raw_data="aa1d33c716d5b6c598bb846045a4bcde20fce0759b5c056dddb296fe6a83dba0fddded3748767a86464e2d891fd2233e2e34bc803b4b8da2533af7268e8114063e523749d15906dd6b2b142a27f2a2422a49a8d947ddcabfc37cb266e3ba7058137740598d04828e74eb7b413ec0847036eca4215e1f2e40b6ec95e1a190fb73954b3ada9faf3ef4d77d6cffe617982304db80ebb456edb8117402076cea30bccfc83eddbac4c369c3528b552ad400"}) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c0000001700010026bd7000ffdbdf250b00000008000100ff"], 0x1c}, 0x1, 0x0, 0x0, 0x48c1}, 0x0) 2m15.19917895s ago: executing program 9 (id=1165): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./dev\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r0, 0xc138fd03, &(0x7f0000000200)="0400000000000000000000003801000038") ioctl(r0, 0xc138fd09, &(0x7f0000000300)="0400000000000000000000009001000038010000010000000000000000000000000000000000000000000000000000006d70617468300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000580000006d756c746970617468000000") 2m14.877309955s ago: executing program 9 (id=1167): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)={0x30, 0x30, 0x30}}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x50, 0x0, &(0x7f0000000580)="b3185d7bb56f70f003360fa8bf71ac3086aedebf6fff904f92849a7a07395ee7f0e4cb1d78001c08a0ab73ffcf5ad07693727980eea946e6cba1723e81bfa5c3688803c8a124dcb27df7938e7ddfdd52"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 2m13.41630803s ago: executing program 9 (id=1169): bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdir(&(0x7f0000000400)='./my_sys\x00', 0x1ff) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x28}, 0x1, 0x0, 0x0, 0x14881}, 0x800) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(0xffffffffffffffff, 0x84, 0x20, &(0x7f0000000000), &(0x7f0000000040)=0x4) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4000000) r1 = fsopen(&(0x7f0000000180)='ntfs3\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000240)='uid', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000180)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) memfd_create(&(0x7f0000000b00)='\x103q}2[\xe0\x9a\xee\xaf\x03\x97\x9et\v\"|Ma\x86\xe7\xc0\x14\x9f\xb9h\xb1\x96\xe7=I\x860S6\xb5\xa8\xc2\x95Je%\xfeG\'\b\x00\x00\x00\x00\x00\x00\x00\x1c\xa6\xab\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94k\xcd\t\x00\x90k\xd6\x05\xb6&\xd0\x9daA\xc5\x9c_\xd4\x18,\f\xd4s\xb2\x99/\xc0\x9a\xf2Oc\xc0c\x03gB!\xb0\xb8n\x01\x9bT\x95\x10\x86\xe8$\x7f\r[\xf9\x0e1v\xb1\n\x88\v\x95uy\xb5:`\x8b\nC\x18A;\xaa%\xaf\xc7\xa3\xac\xa2D\xb5\xe2\xe1\xdc(\xfd\x05\x9fB\x84O\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1a\xa0\x17\xe3\xac\xe9\xc9\xa7\x8a\x1b\x03\"&\xac\xcap>\xccZ\x01\xbc\x18\xc1\xb9\xe9\v\x8b\x9c\xb4Q\xd4\x96EV<>\x99\xca\xb3\xe0\xc4tL\xed\xf5W\xbd#\xcf\x8a\x84\xed\x9f/\xd4\xbb\xea;-Dp\xf8\xd0F\x90\xf8\x92Ip6\xf4\x16\xe8\x14\xe0\x92!\x92-F\xe2\x14D\x91\xa8b\x04\xdd\x1d\a\xdc\xe0\x18\x85{\x80Q\xf6k\x96\xfaQ\x9fW\vO\xf0\xe4O\\\xceS\xe2\x05\x049d\x06#\x88\xc3\xdf\x85O\x1c\xc3\xad?r\xd7\x0e\x00\xd7\x83\xb0\x88\x9c\xf6Y-F\x98\xdd\x9c~\xfd\x95\xc3\xb6lC\xaa\"Y\xa2K\xecz\x84:*\xf5Y\xd1\x9b1\xbd\x9b\x15\xd4\xec\x02o\x01&\xaa\x90w\xc4\xc7\x8en\xb5\x1ag\xab&?\xbe\xcb\xe8v\xa8\xe0\xa4\x81sW\xacf\x149\xd2}\xef\x03Ga\x9a$4\x8c\xa5!p\x83\x05\x96%\x02%\xabj\n\b\xc8NC\x91}&y\xd3\xe1\xeep\'\xc5\xab\x19GsX5\x8c\n\x9fh\xee;4\xb1%V\xe0\xa9\x8e\xf30:\xd8\x18N~G\x139\xcaf2\x02F1\xc6\x82\x00E\xae\x9d\x17\x871N:\xb4\xea \x8e\xdelP\x83\x1f\'\xe2\xd6\xc0\xc3\xfc\xc9677u\xf3RUP@o>\xee\xb8\xa3\t\x02\xb7\\,\xebK\xed\x1b\xc9e\xb3\x16\xce\x9bI\xdb\xfa\x82\x85\t\x9bg\xd0s\xe2\f{\x8cp~;\xf8\x96\xf2\x91\x06\x89\xa6D\xce\xac\x03\xc1\x83\xd1\xe6 |\xa75\xd7\x80t\xfc\xf8\xd2\x12N\x1cB7^\xfd4\xae\xb0VFw\b!\xae\x1baTv\xc0z\x19\xc5\xc8w\xba\x97N\x9a`\x8f\xfc\x9ee\xf9\x00\x1cQA\x14]\r\xd4\"\xc2\x12GD\xdb{\x88\xaa\x81\xc8\xa2\xdeI\xa2\xbel\x0e\xec\x17fNI\x05\xff\x8d\xf4_\x1a\vqA\xb7\x0ed<\x98\xee\xb8\x19\xec\x9f\xee\xe1_\xacG\x8b\xa3\xc3\x13\x80\x0f\xf4I\xdeAwG\xbdkno\xa2\b\x126\x97\x9b\xf9|P\xd94\v\x15\xcb\xc0\x9d\x11\xf3\x18\xae!2\x1b\x12\xa9\xc8~\xb7S\x94\xb5\xc7;\xa90D>s\xe9\xa4N\xf8\xdb\xab\xa0\x94~\xa1]b\xa4\xe5\xe2e\x1c\x8b\xd2\xc7Md\x93\x02\xd8\xb0,\xeb\x03\xaa\v\xed\x9bR\x8a\x80\xc2\x1f\x17ej\x973wv\x83a\xe06\x96\xde\xbc%Uh;H\xf8S\xf1\xa1g\x02\xc4\xc3\xa4\xa8\x96\t\xfex\xa2?\xcb\\Y\x1e\xfe\xca\xa0i\x80O\x11\xac\xb7$\xdb\xbc\xb0\xcb\xacqU\xb5*\x00\x00\x00\x00\x00\x00\x00\f\xda\xf8oV\x89\xd3\x1f\x99+\xe5T\x8eM4\x1c\xc6\x7f\xd4\xf2\xcc\xd3\x94\xca\xd4\x00\x00\x00\x00\x00\x00\x00\x00\x00~A9\xf6IBu\x0e\x00\x9e\xa2\xd0\x92\xd1\xbc\xb8\tJ\xa1\aN\x87\x95\xbb\xa9s\xab\x90\x06\xc6!p\x9e?~\xf9\xe6\xae*\v\xa3\xd9gxKN\'z]*\x93\xf7\b\x91\xd0\xff\xd9\xc6a\xb5q\x9c\xa1Go\xd58\x93\xe0,\x9f\xe4\xa9\xd9A\x9e\x95e\x98\xd0V\x9d\xed\x97\xf1\xc5\xce\xf5\x90!d\x9a\xd8\x10\xbbx\r8\xff\x8bNUK\xebA\xe5\x92f\xc4\xd1\xa8\x15\xbf\xb5iW\xdb.kbf*\x89\xf0\xecq m-~\xbbf?\xec=\xd2\xe2\x1e\x8d/o\xcd\xc8x\xdb\xe6\xd0W\xca\xc5kz\x8e9\xfa\x86\x0f\x96p', 0x2) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000000)=0x15) ioctl$TCSETS(r3, 0x404c4701, &(0x7f0000000040)={0x1, 0xffffffff, 0x0, 0xff, 0x12, "ccd800000000eeff00001000000000008000"}) ioctl$TIOCVHANGUP(r3, 0x5437, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000240)={'#! ', './my_sys/bus/pci/devices/0000:00:01.0/config'}, 0x30) r4 = socket$packet(0x11, 0x2, 0x300) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f0000000180)=r5, 0x4) r6 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000), 0x40002) write$FUSE_WRITE(r6, &(0x7f0000000040)={0x18, 0x0, 0x0, {0x10000}}, 0x10) read$FUSE(r6, 0x0, 0x0) 2m10.39996774s ago: executing program 9 (id=1172): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc_mnt/net/rpc/auth.unix.ip/flush\x00', 0x2, 0x0) write(r0, &(0x7f0000000400)='1\n', 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x2008000, 0x0, 0xfffffffffffffe93, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) clock_gettime(0x6, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x30, 0x0, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r4}}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xff8e}]}, 0x30}}, 0x20000000) 2m7.43377206s ago: executing program 9 (id=1176): dup(0xffffffffffffffff) socket$kcm(0xa, 0x3, 0x73) r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r0, 0x0, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0xffffffff000) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x437, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_PRIORITY={0x6}, @IFLA_BR_VLAN_FILTERING={0x5}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4040010}, 0x0) 2m1.245886192s ago: executing program 39 (id=1162): openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$uinput_user_dev(r1, &(0x7f0000000a00)={'syz0\x00', {0x8, 0x7, 0x5, 0x1}, 0x3f, [0x9, 0x2, 0x8, 0x6, 0x2, 0x400, 0x80000000, 0x0, 0x8, 0x0, 0x6, 0xc, 0xfffffffb, 0x39, 0x747d5e13, 0x8, 0xeffffb9a, 0xfffffffc, 0x4, 0xfffffffb, 0x2004, 0x3, 0x3, 0xf252, 0x80, 0x800, 0x300000, 0x7, 0xe, 0x4623f, 0xfffffffe, 0x0, 0x1ff, 0x8000, 0x1, 0xb, 0x401, 0x3, 0x7, 0x8da8, 0x2, 0x2, 0x2, 0x4, 0xe, 0x4, 0x3, 0x6, 0x4, 0x9, 0x1, 0x19df, 0x8, 0x2, 0x9, 0xffffffff, 0x7fffffff, 0x6, 0xe9, 0x5, 0x40, 0x8, 0x8, 0x5], [0x8, 0x1e, 0x3, 0x8000, 0xfffffffe, 0x3, 0x0, 0x25, 0x7, 0xfffffffc, 0x4, 0x7fff, 0x72c, 0x1c32, 0x8, 0x5, 0x10000, 0x400, 0x8001, 0x1ff, 0x1, 0x297, 0x5, 0x0, 0x6, 0x4, 0x0, 0x3ff, 0x0, 0xfffffffe, 0x0, 0x0, 0x10, 0x0, 0xfffffffd, 0x4, 0x5, 0xffffffff, 0x6, 0x5, 0x800, 0xbfff, 0x100, 0x196, 0xfffffff9, 0x2, 0x0, 0x2, 0x401, 0xffff, 0x3, 0x379, 0x1, 0xe, 0x5, 0x7, 0x6, 0xb4, 0x800001, 0x1, 0x8, 0x6, 0x200, 0x3], [0x401, 0xc584, 0xfffb, 0xcd5, 0x7, 0x1f, 0x404, 0x4, 0x8, 0x10, 0x9b2, 0x10, 0xe8b, 0x5, 0x0, 0x48, 0x3f92, 0x1000, 0x45ae, 0x11, 0x1, 0xfffffff9, 0xe58, 0x1000, 0x80040101, 0x4, 0x4, 0x5, 0x200003, 0x2, 0x5, 0xffff, 0x9, 0x8001, 0x3, 0x4, 0x3, 0x4, 0x3, 0x6d7e, 0x3, 0x8, 0x3, 0x1, 0x6, 0x9, 0x956, 0x0, 0x3ff, 0x3, 0xcac, 0x100fffd, 0x3005, 0x1, 0x4, 0xea, 0x9, 0x20000005, 0x3, 0xd9, 0x0, 0x7d, 0x401, 0x5], [0x108e, 0xffff, 0x2003, 0xa, 0x88, 0x2, 0xffff8b7f, 0x4, 0x50, 0x2, 0x763, 0xb, 0x404, 0x0, 0x5, 0x3, 0x7f, 0x5, 0x3fa6, 0x4, 0x0, 0x5, 0x6, 0x63, 0xe47, 0x1, 0x1654, 0x4, 0x200, 0x2851, 0x3b, 0x20000002, 0x5, 0x80000000, 0xa80a, 0x65f413f9, 0x4, 0x20008, 0x8a8, 0x6, 0x98, 0x409, 0x3, 0x4, 0x4, 0x10, 0x4, 0x5, 0x7fff, 0x2, 0xfffffff8, 0xcf, 0x1, 0x200, 0x7, 0x4edf, 0xfffffffd, 0x4, 0xf, 0x8002, 0xf, 0xf, 0x136, 0x2]}, 0x45c) ioctl$UI_DEV_CREATE(r1, 0x5501) write$input_event(r1, &(0x7f0000000000)={{0x77359400}, 0x15, 0x0, 0xfa000000}, 0xfe4f) 1m50.989501985s ago: executing program 40 (id=1176): dup(0xffffffffffffffff) socket$kcm(0xa, 0x3, 0x73) r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r0, 0x0, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0xffffffff000) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x437, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_PRIORITY={0x6}, @IFLA_BR_VLAN_FILTERING={0x5}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4040010}, 0x0) 1m33.650102774s ago: executing program 0 (id=1225): socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$WG_CMD_SET_DEVICE(r0, 0x0, 0x20008040) r1 = socket$inet(0x2, 0x1, 0x0) r2 = socket$inet(0x2, 0x1, 0x6) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f00000001c0)={0x6, @loopback, 0x1500, 0x0, 'lc\x00', 0x3d, 0x0, 0x36}, 0x2c) connect(r2, &(0x7f0000000200)=@in={0x2, 0x1500, @loopback}, 0x10) 1m32.777042487s ago: executing program 0 (id=1226): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) fcntl$setownex(r0, 0xf, &(0x7f00000000c0)={0x3}) io_setup(0x2, &(0x7f0000002400)=0x0) io_cancel(r1, 0x0, 0x0) r2 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000080)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r2, &(0x7f0000000640)='asymmetric\x00', &(0x7f00000004c0)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r3 = getpgrp(0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r5 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r5, 0x1, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_buf(r7, 0x29, 0x18, 0x0, 0x0) sched_setaffinity(r5, 0x8, &(0x7f0000000080)=0x7) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r9, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x4}, 0x1c) listen(r9, 0xfffffffc) r10 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r10, 0x0, 0x0) r11 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r11, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) close_range(r8, 0xffffffffffffffff, 0x0) 1m29.79726074s ago: executing program 0 (id=1230): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 1m28.384990591s ago: executing program 0 (id=1231): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x5, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000040)={0x11, 0x1, 0x0, "ad2896b02ca8b044d00dc81345c4b935bab32cecd875596364ab192cb8b873aa"}) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000040)=0x920, 0x12) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) ioctl$KVM_TDX_INIT_MEM_REGION(0xffffffffffffffff, 0xc008aeba, &(0x7f0000000040)={0x3, 0x1, 0x0}) syz_clone3(&(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f0000000040), 0x2}, 0xa0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) openat$comedi(0xffffffffffffff9c, 0x0, 0x88000, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f0000000180), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='quota,grpquota_block_hardlimit=3']) chdir(&(0x7f0000000100)='./file0\x00') setresuid(0x0, 0xee00, 0x0) symlink(&(0x7f0000000940)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000500)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x103042, 0x0) 1m27.008942255s ago: executing program 0 (id=1233): openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000100), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() syz_ublk_setup_io_uring(0x2b95, &(0x7f0000000000)={0x0, 0x30b3, 0x24000, 0x0, 0x306}, 0x0, &(0x7f0000000180), &(0x7f00000001c0)) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x3) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) mremap(&(0x7f000000d000/0x2000)=nil, 0xfffffffffffffe74, 0x1000, 0x0, &(0x7f0000007000/0x1000)=nil) r1 = syz_open_procfs(0x0, 0x0) read$FUSE(r1, &(0x7f0000002700)={0x2020}, 0x2020) r2 = syz_genetlink_get_family_id$smc(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000840)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fbdbdf25020000000900010073797a320000000014000200766c61"], 0x34}, 0x1, 0x0, 0x0, 0x4008011}, 0x4) 1m26.78113032s ago: executing program 0 (id=1234): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) socket$nl_xfrm(0x10, 0x3, 0x6) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f00000055c0), 0x400023c, 0x300, 0x0) 1m11.485355962s ago: executing program 41 (id=1234): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) socket$nl_xfrm(0x10, 0x3, 0x6) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f00000055c0), 0x400023c, 0x300, 0x0) 15.445254918s ago: executing program 1 (id=1330): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f0000000400)='1\n', 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x2008000, 0x0, 0xfffffffffffffe93, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) clock_gettime(0x6, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x30, 0x0, 0x1, 0xfffffffd, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r4}}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xff8e}]}, 0x30}}, 0x20000000) 13.436684247s ago: executing program 1 (id=1333): r0 = socket$inet6(0x10, 0x2, 0x0) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000480)="55000000200009afb72d13b2a4a2719302000000030b43026c26236925000400fe7f00000000000000003942cfd8880f0000bd2dca8a9848a3c728f1c46b7b31afdc1338d509a9a1f8baeb1898000000000100005a", 0x55}], 0x1}, 0x4000) write(r0, &(0x7f0000000040)="1c00000021002551071c0165ff00fc0202000000fe100f000ee1000c", 0x1c) 10.448087091s ago: executing program 1 (id=1337): bpf$MAP_CREATE(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) read$msr(r3, 0x0, 0x0) sched_setaffinity(r2, 0x8, &(0x7f00000002c0)=0x80000000000003) readahead(0xffffffffffffffff, 0x80000000, 0x7) 9.261803718s ago: executing program 5 (id=1339): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000010340)=ANY=[@ANYBLOB="0b000000080000000c0000000000008001"], 0x48) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000500)={r1}, 0x4) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000030000000200000002"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0x19, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000002000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000b7080000000000007b8af8ff00000000b7080000060000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r2}, 0xc) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000000a80)={{{@in=@private, @in=@private}}, {{@in=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000740)=0xe8) prctl$PR_SCHED_CORE(0x4d, 0x1, 0x0, 0x0, 0x0) timer_create(0x1, 0x0, &(0x7f0000bbdffc)) timer_create(0x0, 0x0, &(0x7f0000bbdffc)) socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x2, 0x1, 0x0, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(0xffffffffffffffff, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0xfbb, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f00000000c0)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xffbffffe, 0x257, 0x0, r4}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x100, 0x1000000, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffff8, 0x1000, 0x0, 0x146, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x4, 0x1, 0x2, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8000, 0x1, 0x2}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, r8, '\x00', {0x3, 0x5, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x12, 0x4, 0x0, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sock_addr=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r12 = userfaultfd(0x801) ioctl$UFFDIO_API(r12, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x80}) munmap(&(0x7f0000f8d000/0x2000)=nil, 0x2000) ioctl$UFFDIO_REGISTER(r12, 0xc018aa09, &(0x7f0000000040)={{&(0x7f0000f8d000/0x1000)=nil, 0x1000}}) openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) open(0x0, 0x0, 0x6c) openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) 9.180056084s ago: executing program 1 (id=1340): mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) r0 = syz_open_dev$radio(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000100)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0}) write$binfmt_script(r0, &(0x7f0000000640)={'#! ', './file0', [{0x20, '\xd5\xdbj5@\t\x95b8\x9d\xae>\x94\xc8\x0e\x8dE\xaa\x88\xaf;7 h\xc1\x1a\f\xad\xda\xb8E\x13}\xc6\xb5G\xc5\x03\xa3\xee\xd8E{u\xf5|\x88\x0e;o;\xb9\xd7v\x85\xe4\x8a\xe1\xcb\x16/\xbd\xbc\xeb\xbe\xaaT\'DQIx,\xdb8ew\x85!>\x80\x8e\xf5\xc1\xe0\x84%\xca\x0e\xf1\xef\ap\xca\xaa\x87\x80\xf8\xa6yx\x815B\xfd\xba\x94\n\xc9\vga\x90A\xfd\xc0U\xdd\xba\x1aN0\x97O\x92\xcc#\x93\b\x80\xc1/\xcb\xe90\x16\xd1\xef\xad\x97\xeds\xb1\x1d\xa3\x8f\xa6\x8c\xe7^\xb3\xccV;\xc4\xfe\xb1\x93\x1f\x83\x87%\xe2\xcf\xac\x16\xda\xf8\"\x81R\xf3\xbeg\xa6\x9e\x93q\xf7\xa8b)y\xf2.\x9d\x81*L\xbdX|\x88\xa5f_\xfdzz!\xed\xbe\x94\x93\xb4l\x8dT\x94\xd0\n'}], 0xa, "1cc0024e868c5e5976e645a73168e79cacc09ae543063b091a6a9490602e3069ade4f8af40d1d393192d0446ed9cd732748250e0d139a39ff488184b93a348fb63235a686c1cf2ecd88b1791781e5bb179582e4034261b1a7401f516e46a2951270b1045dcb3daf6dd25f875e6ea8865148c142ee039cbe7dbda353eacc4bfb6306e599bec6a67954a387f24d45e2d1c8085f69f8dfebe10ab0f9a638f62a3f97c5a407c5f591fcde02017f3f54e568b343851f2774f13ace647954708e69083d901bd220e4989526e754da03e8c91b1fb238c95ac78e507b9e95cd6165efa7ef25cd7854fc68f8e1adf918925ebe5abab0b376252ffedad6b81f4e921f4dc18e5f71b51a3eae386e4f89511ed298ee701732d91556feef809ae94c11b6c76f167d6e4d644d1742387018a522b23ed9dce56ebc57f5fb9c5cac8a7d6f6af9d2f2f1dcf8cae2bba7a25eb6162f7925c3b8cfe96cdcdc1fd69509a067207f6cb135a7e95ebda71b7005aa8363903ec18dac3f514a3c7240fb90845b4f801ce67c4c2ed6bae0555b3f1e4023e8f8d60c987904a4bba54c6c1e0deb9a49e995642d0270e97780346c466aca3d3c0bf1f547c8d7e92f4fac7cfde"}, 0x297) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) pivot_root(&(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000100)='./cgroup\x00') read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) ftruncate(0xffffffffffffffff, 0x8800000) accept4$unix(0xffffffffffffffff, 0x0, 0x0, 0x1000) sched_setaffinity(r3, 0x47, &(0x7f0000000200)=0x7) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, 0x0, 0x0) 7.819163305s ago: executing program 1 (id=1341): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, 0x0, 0x0) sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7) io_setup(0x5, &(0x7f0000000240)) r4 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SPEED(r4, 0xc0045002, &(0x7f00000001c0)) read$dsp(r4, &(0x7f0000000280)=""/189, 0xbd) r5 = inotify_init() inotify_add_watch(r5, 0x0, 0xa50003d1) 6.53622253s ago: executing program 2 (id=1343): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./dev\x00', &(0x7f0000000180)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/mapper/control\x00', 0x2, 0x0) ioctl(r0, 0xc138fd09, &(0x7f0000000300)="0400000000000000000000009001000038010000010000000000000000000000000000000000000000000000000000006d70617468300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000580000006d756c74697061746800000000000000322071756575655f6d6f64652062696f2030203120312072") 6.514929814s ago: executing program 5 (id=1344): r0 = socket$rxrpc(0x21, 0x2, 0x2) process_madvise(0xffffffffffffffff, 0x0, 0x0, 0x9, 0x0) bind$rxrpc(r0, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) listen(r0, 0xa) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_emit_ethernet(0x36, &(0x7f00000000c0)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1d}, @void, {@ipv6={0x86dd, @generic={0xc, 0x6, "370c89", 0x0, 0x2b, 0x1, @ipv4={'\x00', '\xff\xff', @empty}, @local}}}}, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f00000000c0)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000240)={{0x3, 0x0, 0x0, 0x0, 0xee00, 0xa0, 0xff}, 0x0, 0x0, 0x3, 0x2, 0xffffffffffff8c17, 0x2, 0x3, 0x3aa, 0x8000, 0x1, r1}) listen(r0, 0x0) 6.380673691s ago: executing program 2 (id=1345): openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000100), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) syz_ublk_setup_io_uring(0x2b95, &(0x7f0000000000)={0x0, 0x30b3, 0x24000, 0x0, 0x306}, 0x0, &(0x7f0000000180), &(0x7f00000001c0)) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) mremap(&(0x7f000000d000/0x2000)=nil, 0xfffffffffffffe74, 0x1000, 0x0, &(0x7f0000007000/0x1000)=nil) r1 = syz_open_procfs(0x0, 0x0) read$FUSE(r1, &(0x7f0000002700)={0x2020}, 0x2020) r2 = syz_genetlink_get_family_id$smc(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000840)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fbdbdf25020000000900010073797a320000000014000200766c61"], 0x34}, 0x1, 0x0, 0x0, 0x4008011}, 0x4) 5.1294863s ago: executing program 2 (id=1346): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000003100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a3200000000140000001100019e"], 0x7c}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003040)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWFLOWTABLE={0x48, 0x16, 0xa, 0x801, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x1c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'geneve0\x00'}]}]}]}], {0x14}}, 0x70}}, 0x24040884) 3.896224895s ago: executing program 5 (id=1347): syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) dup(0xffffffffffffffff) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x53) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_pressure(r0, &(0x7f0000000040)='cpu.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r1, &(0x7f0000000080)={'some', 0x20, 0x2000000005, 0x20, 0x10000000fffff}, 0x2f) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x4809) r2 = openat$cgroup_procs(r0, &(0x7f0000000840)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, 0x0, 0x0) 3.557281832s ago: executing program 5 (id=1348): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x0, 0x0}) rseq(&(0x7f0000001080)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000001, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@gettaction={0x20, 0x32, 0x200, 0x70bd2a, 0x25dfdbfb, {}, [@action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1}}]}, 0x20}, 0x1, 0x0, 0x0, 0x400c004}, 0x24048840) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x4, 0x0, 0x0) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, 0x0) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) kcmp(0x0, 0x0, 0x5, 0xffffffffffffffff, 0xffffffffffffffff) getpid() timer_create(0x0, &(0x7f00000001c0)={0x0, 0x2e, 0x800000000004, @thr={&(0x7f0000000040)="ac08c11be10e3d8286dde48e950415832db604e5d45f8ecb11658fc140dc3fec222a6b9e912349", &(0x7f0000000300)}}, &(0x7f0000bbdffc)=0x0) timer_settime(r1, 0x1, 0x0, 0x0) finit_module(0xffffffffffffffff, 0x0, 0x2) syz_open_dev$sg(0x0, 0x0, 0x2082) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) set_tid_address(0x0) mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x0, 0x0}) mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='dir0/tracing_on\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)='0', 0x1) 3.555620373s ago: executing program 2 (id=1349): mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) r0 = syz_open_dev$radio(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000100)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0}) write$binfmt_script(r0, &(0x7f0000000640)={'#! ', './file0', [{0x20, '\xd5\xdbj5@\t\x95b8\x9d\xae>\x94\xc8\x0e\x8dE\xaa\x88\xaf;7 h\xc1\x1a\f\xad\xda\xb8E\x13}\xc6\xb5G\xc5\x03\xa3\xee\xd8E{u\xf5|\x88\x0e;o;\xb9\xd7v\x85\xe4\x8a\xe1\xcb\x16/\xbd\xbc\xeb\xbe\xaaT\'DQIx,\xdb8ew\x85!>\x80\x8e\xf5\xc1\xe0\x84%\xca\x0e\xf1\xef\ap\xca\xaa\x87\x80\xf8\xa6yx\x815B\xfd\xba\x94\n\xc9\vga\x90A\xfd\xc0U\xdd\xba\x1aN0\x97O\x92\xcc#\x93\b\x80\xc1/\xcb\xe90\x16\xd1\xef\xad\x97\xeds\xb1\x1d\xa3\x8f\xa6\x8c\xe7^\xb3\xccV;\xc4\xfe\xb1\x93\x1f\x83\x87%\xe2\xcf\xac\x16\xda\xf8\"\x81R\xf3\xbeg\xa6\x9e\x93q\xf7\xa8b)y\xf2.\x9d\x81*L\xbdX|\x88\xa5f_\xfdzz!\xed\xbe\x94\x93\xb4l\x8dT\x94\xd0\n'}], 0xa, "1cc0024e868c5e5976e645a73168e79cacc09ae543063b091a6a9490602e3069ade4f8af40d1d393192d0446ed9cd732748250e0d139a39ff488184b93a348fb63235a686c1cf2ecd88b1791781e5bb179582e4034261b1a7401f516e46a2951270b1045dcb3daf6dd25f875e6ea8865148c142ee039cbe7dbda353eacc4bfb6306e599bec6a67954a387f24d45e2d1c8085f69f8dfebe10ab0f9a638f62a3f97c5a407c5f591fcde02017f3f54e568b343851f2774f13ace647954708e69083d901bd220e4989526e754da03e8c91b1fb238c95ac78e507b9e95cd6165efa7ef25cd7854fc68f8e1adf918925ebe5abab0b376252ffedad6b81f4e921f4dc18e5f71b51a3eae386e4f89511ed298ee701732d91556feef809ae94c11b6c76f167d6e4d644d1742387018a522b23ed9dce56ebc57f5fb9c5cac8a7d6f6af9d2f2f1dcf8cae2bba7a25eb6162f7925c3b8cfe96cdcdc1fd69509a067207f6cb135a7e95ebda71b7005aa8363903ec18dac3f514a3c7240fb90845b4f801ce67c4c2ed6bae0555b3f1e4023e8f8d60c987904a4bba54c6c1e0deb9a49e995642d0270e97780346c466aca3d3c0bf1f547c8d7e92f4fac7cfde"}, 0x297) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) pivot_root(&(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000100)='./cgroup\x00') read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) ftruncate(0xffffffffffffffff, 0x8800000) accept4$unix(0xffffffffffffffff, 0x0, 0x0, 0x1000) sched_setaffinity(r3, 0x47, &(0x7f0000000200)=0x7) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, 0x0, 0x0) 1.419084788s ago: executing program 2 (id=1350): r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r1, 0x0, 0x0, 0x0, &(0x7f0000000240)={0x11, 0x888e, 0x0, 0x1, 0x0, 0x6, @random="08021100"}, 0x14) 1.092220122s ago: executing program 1 (id=1351): r0 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r0, 0x0) landlock_restrict_self(r0, 0x8) landlock_restrict_self(r0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet6(r1, &(0x7f0000002080)=[{{&(0x7f0000000000)={0xa, 0x4e24, 0x6, @ipv4={'\x00', '\xff\xff', @local}, 0x8}, 0x1c, 0x0, 0x0, &(0x7f0000000400)=[@pktinfo={{0x24, 0x29, 0x32, {@private2}}}], 0x28}}], 0x1, 0xc800) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f00000000c0)) sendmsg$NFC_CMD_DEV_UP(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x1c}}, 0x4008054) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='file0\x00', 0x42, 0x1ff) ftruncate(r4, 0xf4240) mkdir(&(0x7f0000000180)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./config\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000240)='./config/usb_gadget/g1\x00', 0x1ff) r5 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/usb_gadget/g1/functions/mass_storage.0/lun.0/file\x00', 0x2, 0x0) write(r5, &(0x7f00000003c0)='file0', 0x5) 976.571575ms ago: executing program 5 (id=1352): r0 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f0000000000)=0x2) 568.631056ms ago: executing program 5 (id=1353): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000010340)=ANY=[@ANYBLOB="0b000000080000000c0000000000008001"], 0x48) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000500)={r1}, 0x4) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="05000000030000000200000002"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0x19, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000002000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000b7080000000000007b8af8ff00000000b7080000060000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r2}, 0xc) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000000a80)={{{@in=@private, @in=@private}}, {{@in=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000000740)=0xe8) prctl$PR_SCHED_CORE(0x4d, 0x1, 0x0, 0x0, 0x0) timer_create(0x1, 0x0, &(0x7f0000bbdffc)) timer_create(0x0, 0x0, &(0x7f0000bbdffc)) socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x2, 0x1, 0x0, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(0xffffffffffffffff, r5, r6, r7, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0xfbb, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f00000000c0)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f0000000180)={0x0, 0xfffffffe, 0x0, 0xffbffffe, 0x257, 0x0, r4}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x100, 0x1000000, 0x10000004}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfffffff8, 0x1000, 0x0, 0x146, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x4, 0x1, 0x2, 0x0, r4}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x8000, 0x1, 0x2}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x0, r8, '\x00', {0x3, 0x5, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x12, 0x4, 0x0, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @cgroup_sock_addr=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r12 = userfaultfd(0x801) ioctl$UFFDIO_API(r12, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x80}) munmap(&(0x7f0000f8d000/0x2000)=nil, 0x2000) ioctl$UFFDIO_REGISTER(r12, 0xc018aa09, &(0x7f0000000040)={{&(0x7f0000f8d000/0x1000)=nil, 0x1000}}) openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) open(0x0, 0x0, 0x6c) openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) 0s ago: executing program 2 (id=1354): openat$vmci(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000100), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) syz_ublk_setup_io_uring(0x2b95, &(0x7f0000000000)={0x0, 0x30b3, 0x24000, 0x0, 0x306}, 0x0, &(0x7f0000000180), &(0x7f00000001c0)) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) mremap(&(0x7f000000d000/0x2000)=nil, 0xfffffffffffffe74, 0x1000, 0x0, &(0x7f0000007000/0x1000)=nil) r1 = syz_open_procfs(0x0, 0x0) read$FUSE(r1, &(0x7f0000002700)={0x2020}, 0x2020) r2 = syz_genetlink_get_family_id$smc(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000840)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fbdbdf25020000000900010073797a320000000014000200766c61"], 0x34}, 0x1, 0x0, 0x0, 0x4008011}, 0x4) kernel console output (not intermixed with test programs): NGE): veth0_vlan: link becomes ready [ 560.940629][ T4509] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 560.961152][ T5732] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 560.979913][ T5732] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 560.997438][ T4509] usb 1-1: device descriptor read/8, error -71 [ 561.118608][ T8448] device veth0_vlan entered promiscuous mode [ 561.169041][ T8448] device veth1_vlan entered promiscuous mode [ 561.290948][ T4509] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 561.358683][ T4509] usb 1-1: device descriptor read/8, error -71 [ 561.480587][ T4509] usb usb1-port1: unable to enumerate USB device [ 561.616386][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 561.636581][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 561.673242][ T8448] device veth0_macvtap entered promiscuous mode [ 561.893139][ T8652] netlink: 92 bytes leftover after parsing attributes in process `syz.0.980'. [ 561.932196][ T8652] FAULT_INJECTION: forcing a failure. [ 561.932196][ T8652] name failslab, interval 1, probability 0, space 0, times 0 [ 561.976976][ T8652] CPU: 0 PID: 8652 Comm: syz.0.980 Not tainted syzkaller #0 [ 561.984343][ T8652] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 561.994412][ T8652] Call Trace: [ 561.997688][ T8652] [ 562.000634][ T8652] dump_stack_lvl+0x188/0x24e [ 562.005340][ T8652] ? __alloc_skb+0xf9/0x7d0 [ 562.009851][ T8652] ? show_regs_print_info+0x12/0x12 [ 562.015062][ T8652] ? load_image+0x410/0x410 [ 562.019577][ T8652] ? __kasan_kmalloc+0x8e/0xa0 [ 562.024343][ T8652] ? verify_lock_unused+0x140/0x140 [ 562.029546][ T8652] should_fail_ex+0x390/0x4c0 [ 562.034243][ T8652] should_failslab+0x5/0x20 [ 562.038753][ T8652] slab_pre_alloc_hook+0x59/0x300 [ 562.043792][ T8652] kmem_cache_alloc+0x56/0x2f0 [ 562.048566][ T8652] ? skb_clone+0x1e7/0x370 [ 562.052982][ T8652] skb_clone+0x1e7/0x370 [ 562.057223][ T8652] __netlink_deliver_tap+0x3e4/0x7e0 [ 562.062518][ T8652] ? netlink_deliver_tap+0x2e/0x1b0 [ 562.067735][ T8652] netlink_deliver_tap+0x19c/0x1b0 [ 562.072848][ T8652] netlink_sendskb+0x64/0x130 [ 562.077526][ T8652] netlink_ack+0xcd1/0x1160 [ 562.082042][ T8652] ? netlink_dump+0xcd0/0xcd0 [ 562.086721][ T8652] ? rcu_is_watching+0x11/0xa0 [ 562.091491][ T8652] ? trace_contention_end+0x5f/0x170 [ 562.096792][ T8652] netlink_rcv_skb+0x26d/0x440 [ 562.101552][ T8652] ? xfrm_netlink_rcv+0x90/0x90 [ 562.106475][ T8652] ? netlink_ack+0x1160/0x1160 [ 562.111256][ T8652] xfrm_netlink_rcv+0x75/0x90 [ 562.115932][ T8652] netlink_unicast+0x7ad/0x920 [ 562.120699][ T8652] netlink_sendmsg+0x8ad/0xbd0 [ 562.125468][ T8652] ? netlink_getsockopt+0x550/0x550 [ 562.130675][ T8652] ? apparmor_socket_sendmsg+0x8a/0x330 [ 562.136244][ T8652] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 562.141537][ T8652] ? security_socket_sendmsg+0x7c/0xa0 [ 562.147011][ T8652] ? netlink_getsockopt+0x550/0x550 [ 562.152221][ T8652] ____sys_sendmsg+0x5ed/0x9a0 [ 562.157008][ T8652] ? __sys_sendmsg_sock+0x30/0x30 [ 562.162040][ T8652] ? __import_iovec+0x306/0x510 [ 562.166918][ T8652] ? import_iovec+0x6f/0xa0 [ 562.171440][ T8652] ___sys_sendmsg+0x2a2/0x360 [ 562.176129][ T8652] ? __sys_sendmsg+0x2a0/0x2a0 [ 562.180941][ T8652] __se_sys_sendmsg+0x1c3/0x2b0 [ 562.185802][ T8652] ? __x64_sys_sendmsg+0x80/0x80 [ 562.190764][ T8652] ? lockdep_hardirqs_on+0x94/0x140 [ 562.195976][ T8652] do_syscall_64+0x4c/0xa0 [ 562.200407][ T8652] ? clear_bhb_loop+0x60/0xb0 [ 562.205098][ T8652] ? clear_bhb_loop+0x60/0xb0 [ 562.209782][ T8652] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 562.215692][ T8652] RIP: 0033:0x7f6bb1d9e159 [ 562.220115][ T8652] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 562.239753][ T8652] RSP: 002b:00007f6bb2b9e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 562.248191][ T8652] RAX: ffffffffffffffda RBX: 00007f6bb2025fa0 RCX: 00007f6bb1d9e159 [ 562.256180][ T8652] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004 [ 562.264165][ T8652] RBP: 00007f6bb1e3506b R08: 0000000000000000 R09: 0000000000000000 [ 562.272145][ T8652] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 562.280124][ T8652] R13: 00007f6bb2026038 R14: 00007f6bb2025fa0 R15: 00007ffc1aa6a378 [ 562.288134][ T8652] [ 562.417275][ T4405] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 562.431336][ T8448] device veth1_macvtap entered promiscuous mode [ 562.459532][ T8659] device-mapper: ioctl: name not supplied when creating device [ 562.804848][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.811242][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 562.969412][ T8448] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 563.008001][ T8448] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 563.023806][ T8448] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 563.036252][ T8448] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 563.053085][ T8448] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 563.066818][ T8448] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 563.079083][ T8448] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 563.095906][ T8448] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 563.110961][ T8448] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 563.128256][ T8448] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 563.167437][ T8448] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 563.200408][ T22] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 563.228953][ T5732] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 563.261485][ T5732] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 563.292878][ T8448] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 563.349725][ T8448] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 564.060317][ T22] usb 10-1: Using ep0 maxpacket: 16 [ 564.510735][ T22] usb 10-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 564.519934][ T22] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 564.528415][ T8448] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 564.534495][ T22] usb 10-1: Product: syz [ 564.550984][ T22] usb 10-1: Manufacturer: syz [ 564.570183][ T22] usb 10-1: SerialNumber: syz [ 564.580180][ T8448] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 564.590512][ T8448] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 564.620276][ T8448] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 564.630542][ T8448] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 564.682395][ T8448] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 564.715914][ T8448] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 564.750181][ T8448] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 564.807514][ T22] usb 10-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 564.871072][ T8448] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 564.878810][ T22] usb 10-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 564.892187][ T22] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 564.911527][ T22] usb 10-1: media controller created [ 564.947272][ T22] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 565.007189][ T22] zl10353_read_register: readreg error (reg=127, ret==-32) [ 565.057292][ T22] dvb_usb_gl861: probe of 10-1:157.0 failed with error -5 [ 565.074477][ T22] usb 10-1: USB disconnect, device number 2 [ 565.267918][ T4438] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 565.309582][ T4438] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 565.327386][ T8448] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 565.380986][ T8448] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 565.395947][ T8448] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 565.417740][ T8448] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 567.860541][ T8475] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 567.874517][ T8475] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 567.989688][ T8475] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 568.100520][ T8512] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 568.137400][ T8512] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 568.153066][ T8153] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci5/hci5:201' [ 568.163234][ T8153] CPU: 1 PID: 8153 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 568.170801][ T8153] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 568.180854][ T8153] Workqueue: hci5 hci_rx_work [ 568.185609][ T8153] Call Trace: [ 568.188881][ T8153] [ 568.191807][ T8153] dump_stack_lvl+0x188/0x24e [ 568.196563][ T8153] ? show_regs_print_info+0x12/0x12 [ 568.201777][ T8153] ? load_image+0x410/0x410 [ 568.206318][ T8153] sysfs_create_dir_ns+0x26a/0x290 [ 568.211499][ T8153] ? __lock_acquire+0x7c40/0x7c40 [ 568.216526][ T8153] ? sysfs_warn_dup+0xa0/0xa0 [ 568.221220][ T8153] ? do_raw_spin_unlock+0x11d/0x230 [ 568.226468][ T8153] kobject_add_internal+0x617/0xca0 [ 568.231733][ T8153] kobject_add+0x160/0x230 [ 568.236191][ T8153] ? kobject_init+0x1c0/0x1c0 [ 568.240905][ T8153] ? __raw_spin_lock_init+0x41/0x100 [ 568.246221][ T8153] ? klist_children_get+0x50/0x50 [ 568.251280][ T8153] ? get_device_parent+0x121/0x3e0 [ 568.256494][ T8153] device_add+0x470/0x1050 [ 568.260949][ T8153] hci_conn_add_sysfs+0xd1/0x1e0 [ 568.265960][ T8153] le_conn_complete_evt+0xf93/0x15c0 [ 568.271278][ T8153] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 568.277544][ T8153] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 568.283200][ T8153] ? mutex_unlock+0x10/0x10 [ 568.287716][ T8153] ? skb_pull_data+0xec/0x1f0 [ 568.292427][ T8153] hci_le_enh_conn_complete_evt+0x185/0x460 [ 568.298340][ T8153] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 568.304770][ T8153] ? hci_remote_host_features_evt+0x230/0x230 [ 568.310846][ T8153] hci_event_packet+0x7b3/0x1290 [ 568.315800][ T8153] ? lock_chain_count+0x20/0x20 [ 568.320668][ T8153] ? bis_list+0x280/0x280 [ 568.325015][ T8153] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 568.330929][ T8153] ? kcov_remote_start+0x50f/0x810 [ 568.336052][ T8153] ? lockdep_hardirqs_on+0x94/0x140 [ 568.341266][ T8153] ? hci_send_to_monitor+0x9c/0x4a0 [ 568.346479][ T8153] hci_rx_work+0x3eb/0xd40 [ 568.350910][ T8153] ? _raw_spin_unlock+0x40/0x40 [ 568.355778][ T8153] ? process_one_work+0x7b4/0x1160 [ 568.360957][ T8153] process_one_work+0x8ab/0x1160 [ 568.365916][ T8153] ? worker_detach_from_pool+0x240/0x240 [ 568.371567][ T8153] ? _raw_spin_lock_irq+0xb7/0xf0 [ 568.376604][ T8153] ? _raw_spin_lock_irqsave+0x100/0x100 [ 568.382162][ T8153] ? wq_worker_running+0x97/0x190 [ 568.387194][ T8153] worker_thread+0xaf5/0x12a0 [ 568.391889][ T8153] ? _raw_spin_unlock_irqrestore+0xbc/0x120 [ 568.397793][ T8153] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 568.403730][ T8153] kthread+0x29d/0x330 [ 568.407849][ T8153] ? worker_clr_flags+0x1a0/0x1a0 [ 568.412882][ T8153] ? kthread_blkcg+0xd0/0xd0 [ 568.417478][ T8153] ret_from_fork+0x1f/0x30 [ 568.421961][ T8153] [ 568.435010][ T8153] kobject_add_internal failed for hci5:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 568.448598][ T8153] Bluetooth: hci5: failed to register connection device [ 568.492770][ T8512] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 568.527162][ T8512] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 568.583455][ T4438] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 568.595367][ T4438] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 568.603324][ T58] device hsr_slave_0 left promiscuous mode [ 568.619881][ T58] device hsr_slave_1 left promiscuous mode [ 568.639170][ T58] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 568.675634][ T58] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 568.761177][ T58] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 568.768659][ T58] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 568.768997][ T8687] device-mapper: ioctl: name not supplied when creating device [ 568.860712][ T58] device bridge_slave_1 left promiscuous mode [ 568.880626][ T58] bridge0: port 2(bridge_slave_1) entered disabled state [ 568.895444][ T58] device bridge_slave_0 left promiscuous mode [ 568.905490][ T58] bridge0: port 1(bridge_slave_0) entered disabled state [ 568.960952][ T58] device hsr_slave_0 left promiscuous mode [ 568.967522][ T58] device hsr_slave_1 left promiscuous mode [ 568.974075][ T58] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 569.000536][ T58] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 569.011327][ T58] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 569.018788][ T58] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 569.021031][ T8689] hugetlbfs: Bad value '<' for mount option 'nr_inodes' [ 569.021031][ T8689] [ 569.047365][ T58] device bridge_slave_1 left promiscuous mode [ 569.060297][ T58] bridge0: port 2(bridge_slave_1) entered disabled state [ 569.325121][ T8694] sctp: [Deprecated]: syz.5.994 (pid 8694) Use of int in max_burst socket option. [ 569.325121][ T8694] Use struct sctp_assoc_value instead [ 569.341859][ T58] device veth1_macvtap left promiscuous mode [ 569.348546][ T58] device veth0_macvtap left promiscuous mode [ 569.354884][ T58] device veth1_vlan left promiscuous mode [ 569.360968][ T58] device veth0_vlan left promiscuous mode [ 569.378486][ T58] device veth1_macvtap left promiscuous mode [ 569.388793][ T58] device veth0_macvtap left promiscuous mode [ 569.407986][ T58] device veth1_vlan left promiscuous mode [ 569.550410][ T58] device veth0_vlan left promiscuous mode [ 570.713056][ T8710] Set syz1 is full, maxelem 6117 reached [ 570.800353][ T22] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 570.993667][ T22] usb 10-1: Using ep0 maxpacket: 8 [ 571.004740][ T22] usb 10-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 571.014492][ T22] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 571.023000][ T22] usb 10-1: Product: syz [ 571.028004][ T22] usb 10-1: Manufacturer: syz [ 571.033265][ T22] usb 10-1: SerialNumber: syz [ 571.047313][ T22] usb 10-1: config 0 descriptor?? [ 571.056016][ T22] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 571.064325][ T22] pctv452e: pctv452e_power_ctrl: 1 [ 571.064325][ T22] [ 571.071972][ T22] usb 10-1: selecting invalid altsetting 3 [ 571.077811][ T22] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 571.077811][ T22] [ 571.088910][ T22] dvb-usb: bulk message failed: -22 (5/0) [ 571.097511][ T22] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 571.107609][ T22] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 571.116851][ T22] usb 10-1: media controller created [ 571.123639][ T22] dvb-usb: bulk message failed: -22 (8/0) [ 571.137899][ T22] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 571.147680][ T22] dvb-usb: MAC address reading failed. [ 571.179411][ T22] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 571.274342][ T8710] dvb-usb: bulk message failed: -22 (7/0) [ 571.288287][ T8710] pctv452e: I2C error -22; AA 02 08 00 00 -> aa 02 31 03 08 00 00 [ 571.307832][ T22] DVB: Unable to find symbol stb0899_attach() [ 571.314341][ T22] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 571.330345][ T58] team0 (unregistering): Port device team_slave_1 removed [ 571.428245][ T58] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 571.451348][ T22] rc_core: IR keymap rc-tt-1500 not found [ 571.457092][ T22] Registered IR keymap rc-empty [ 571.463541][ T22] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.9/usb10/10-1/rc/rc0 [ 571.484515][ T22] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.9/usb10/10-1/rc/rc0/input28 [ 571.508137][ T58] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 571.521989][ T22] dvb-usb: schedule remote query interval to 100 msecs. [ 571.528989][ T22] pctv452e: pctv452e_power_ctrl: 0 [ 571.528989][ T22] [ 571.540518][ T22] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 571.630289][ T2188] dvb-usb: bulk message failed: -22 (4/0) [ 571.638480][ T2188] dvb-usb: error -22 while querying for an remote control event. [ 571.764245][ T22] dvb-usb: bulk message failed: -22 (4/0) [ 571.771390][ T22] dvb-usb: error -22 while querying for an remote control event. [ 571.882902][ T22] dvb-usb: bulk message failed: -22 (4/0) [ 571.888709][ T22] dvb-usb: error -22 while querying for an remote control event. [ 571.897454][ T4322] usb 10-1: USB disconnect, device number 3 [ 571.963167][ T4322] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 572.027979][ T58] bond0 (unregistering): Released all slaves [ 572.620007][ T58] team0 (unregistering): Port device team_slave_1 removed [ 572.682040][ T58] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 572.728035][ T58] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 572.943950][ T7] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 573.015199][ T58] bond0 (unregistering): Released all slaves [ 573.123889][ T8475] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 573.170222][ T7] usb 10-1: Using ep0 maxpacket: 8 [ 573.178497][ T7] usb 10-1: config 0 has an invalid interface number: 1 but max is 0 [ 573.216361][ T7] usb 10-1: config 0 has no interface number 0 [ 573.249747][ T7] usb 10-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 573.298424][ T7] usb 10-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 573.353830][ T7] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 574.667934][ T7] usb 10-1: config 0 descriptor?? [ 574.691640][ T7] iowarrior 10-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 574.823139][ T8512] 8021q: adding VLAN 0 to HW filter on device bond0 [ 574.907565][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 574.931225][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 574.939825][ T8153] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 574.950068][ T8153] CPU: 0 PID: 8153 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 574.957651][ T8153] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 574.967722][ T8153] Workqueue: hci1 hci_rx_work [ 574.972426][ T8153] Call Trace: [ 574.975711][ T8153] [ 574.978649][ T8153] dump_stack_lvl+0x188/0x24e [ 574.983344][ T8153] ? show_regs_print_info+0x12/0x12 [ 574.988555][ T8153] ? load_image+0x410/0x410 [ 574.993081][ T8153] sysfs_create_dir_ns+0x26a/0x290 [ 574.998212][ T8153] ? __lock_acquire+0x7c40/0x7c40 [ 575.003251][ T8153] ? sysfs_warn_dup+0xa0/0xa0 [ 575.007942][ T8153] ? do_raw_spin_unlock+0x11d/0x230 [ 575.013151][ T8153] kobject_add_internal+0x617/0xca0 [ 575.018368][ T8153] kobject_add+0x160/0x230 [ 575.022799][ T8153] ? kobject_init+0x1c0/0x1c0 [ 575.027493][ T8153] ? __raw_spin_lock_init+0x41/0x100 [ 575.032783][ T8153] ? klist_children_get+0x50/0x50 [ 575.037817][ T8153] ? get_device_parent+0x121/0x3e0 [ 575.042944][ T8153] device_add+0x470/0x1050 [ 575.047376][ T8153] hci_conn_add_sysfs+0xd1/0x1e0 [ 575.052328][ T8153] le_conn_complete_evt+0xf93/0x15c0 [ 575.057642][ T8153] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 575.063912][ T8153] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 575.069556][ T8153] ? mutex_unlock+0x10/0x10 [ 575.074065][ T8153] ? skb_pull_data+0xec/0x1f0 [ 575.078757][ T8153] hci_le_enh_conn_complete_evt+0x185/0x460 [ 575.084668][ T8153] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 575.091097][ T8153] ? hci_remote_host_features_evt+0x230/0x230 [ 575.097176][ T8153] hci_event_packet+0x7b3/0x1290 [ 575.102130][ T8153] ? lock_chain_count+0x20/0x20 [ 575.106990][ T8153] ? bis_list+0x280/0x280 [ 575.111327][ T8153] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 575.117235][ T8153] ? kcov_remote_start+0x50f/0x810 [ 575.122357][ T8153] ? lockdep_hardirqs_on+0x94/0x140 [ 575.127572][ T8153] ? hci_send_to_monitor+0x9c/0x4a0 [ 575.132790][ T8153] hci_rx_work+0x3eb/0xd40 [ 575.137219][ T8153] ? _raw_spin_unlock+0x40/0x40 [ 575.142088][ T8153] ? process_one_work+0x7b4/0x1160 [ 575.147219][ T8153] process_one_work+0x8ab/0x1160 [ 575.152181][ T8153] ? worker_detach_from_pool+0x240/0x240 [ 575.157824][ T8153] ? _raw_spin_lock_irq+0xb7/0xf0 [ 575.162857][ T8153] ? _raw_spin_lock_irqsave+0x100/0x100 [ 575.168421][ T8153] ? wq_worker_running+0x97/0x190 [ 575.173452][ T8153] worker_thread+0xaf5/0x12a0 [ 575.178150][ T8153] ? _raw_spin_unlock_irqrestore+0xbc/0x120 [ 575.184054][ T8153] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 575.189970][ T8153] kthread+0x29d/0x330 [ 575.194045][ T8153] ? worker_clr_flags+0x1a0/0x1a0 [ 575.199079][ T8153] ? kthread_blkcg+0xd0/0xd0 [ 575.203682][ T8153] ret_from_fork+0x1f/0x30 [ 575.208132][ T8153] [ 575.225670][ T8153] kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 575.239156][ T8153] Bluetooth: hci1: failed to register connection device [ 575.313713][ T8512] 8021q: adding VLAN 0 to HW filter on device team0 [ 576.736161][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 576.753510][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 576.801755][ T7428] bridge0: port 1(bridge_slave_0) entered blocking state [ 576.808950][ T7428] bridge0: port 1(bridge_slave_0) entered forwarding state [ 576.849187][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 576.876380][ T22] usb 10-1: USB disconnect, device number 4 [ 576.887101][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 576.940838][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 576.989118][ T7428] bridge0: port 2(bridge_slave_1) entered blocking state [ 576.996328][ T7428] bridge0: port 2(bridge_slave_1) entered forwarding state [ 577.217476][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 577.232755][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 577.274682][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 577.345476][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 577.689098][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 577.921311][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 577.976428][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 578.008364][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 578.068704][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 578.101217][ T5732] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 578.110872][ T5732] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 578.133280][ T8512] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 578.150335][ T7] usb 1-1: new high-speed USB device number 37 using dummy_hcd [ 578.360323][ T7] usb 1-1: Using ep0 maxpacket: 8 [ 578.371868][ T7] usb 1-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 578.400440][ T7] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 578.409959][ T8761] device-mapper: ioctl: name not supplied when creating device [ 578.420582][ T7] usb 1-1: Product: syz [ 578.424801][ T7] usb 1-1: Manufacturer: syz [ 578.429416][ T7] usb 1-1: SerialNumber: syz [ 578.531011][ T7] usb 1-1: config 0 descriptor?? [ 578.586034][ T7] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 578.610448][ T7] pctv452e: pctv452e_power_ctrl: 1 [ 578.610448][ T7] [ 578.632071][ T7] usb 1-1: selecting invalid altsetting 3 [ 578.645091][ T7] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 578.645091][ T7] [ 578.670238][ T7] dvb-usb: bulk message failed: -22 (5/0) [ 578.705268][ T7] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 578.742749][ T8751] dvb-usb: bulk message failed: -22 (7/0) [ 578.762602][ T7] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 578.771338][ T8751] pctv452e: I2C error -22; AA 01 08 00 00 -> aa 01 31 03 08 00 00 [ 578.794699][ T26] audit: type=1326 audit(1790817701.294:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8766 comm="syz.9.1008" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f04e899e159 code=0x7ffc0000 [ 578.830339][ T7] usb 1-1: media controller created [ 578.835676][ T7] dvb-usb: bulk message failed: -22 (8/0) [ 578.866139][ T26] audit: type=1326 audit(1790817701.294:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8766 comm="syz.9.1008" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f04e899e159 code=0x7ffc0000 [ 578.908849][ T7] pctv452e: I2C error -22; AA 02 A0 01 14 -> aa 02 31 04 a0 01 14 [ 578.933754][ T8771] capability: warning: `syz.5.1009' uses deprecated v2 capabilities in a way that may be insecure [ 578.944697][ T7] dvb-usb: MAC address reading failed. [ 578.983854][ T26] audit: type=1326 audit(1790817701.344:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8766 comm="syz.9.1008" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f04e899e159 code=0x7ffc0000 [ 579.008232][ T7] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 579.917527][ T26] audit: type=1326 audit(1790817701.344:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8766 comm="syz.9.1008" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f04e899e159 code=0x7ffc0000 [ 580.140218][ T26] audit: type=1326 audit(1790817701.364:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8766 comm="syz.9.1008" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7f04e899e159 code=0x7ffc0000 [ 580.164261][ T7] DVB: Unable to find symbol stb0899_attach() [ 580.170842][ T7] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 580.259107][ T4405] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 580.287206][ T4405] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 580.332829][ T26] audit: type=1326 audit(1790817701.364:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8766 comm="syz.9.1008" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f04e899e159 code=0x7ffc0000 [ 580.333174][ T8512] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 580.458251][ T26] audit: type=1326 audit(1790817701.364:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8766 comm="syz.9.1008" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f04e899e159 code=0x7ffc0000 [ 580.580344][ T7] rc_core: IR keymap rc-tt-1500 not found [ 580.586234][ T7] Registered IR keymap rc-empty [ 580.593810][ T26] audit: type=1326 audit(1790817701.364:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8766 comm="syz.9.1008" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f04e899e159 code=0x7ffc0000 [ 580.629028][ T26] audit: type=1326 audit(1790817701.364:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8766 comm="syz.9.1008" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f04e899e159 code=0x7ffc0000 [ 580.633587][ T7] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 580.728701][ T7] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input29 [ 582.051649][ T7] dvb-usb: schedule remote query interval to 100 msecs. [ 582.058679][ T7] pctv452e: pctv452e_power_ctrl: 0 [ 582.058679][ T7] [ 582.081842][ T7] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 582.130273][ T26] audit: type=1326 audit(1790817701.364:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8766 comm="syz.9.1008" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f04e899e159 code=0x7ffc0000 [ 582.170359][ T7] usb 1-1: USB disconnect, device number 37 [ 582.285332][ T4414] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 582.322958][ T4414] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 582.362777][ T7] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 582.433847][ T4438] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 582.450993][ T4438] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 582.518523][ T4438] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 582.560093][ T4438] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 582.597806][ T8512] device veth0_vlan entered promiscuous mode [ 582.686308][ T8512] device veth1_vlan entered promiscuous mode [ 582.814678][ T4438] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 582.833032][ T4438] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 583.114301][ T4438] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 583.185699][ T4438] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 583.232859][ T8512] device veth0_macvtap entered promiscuous mode [ 583.269659][ T8512] device veth1_macvtap entered promiscuous mode [ 583.274168][ T8817] device-mapper: ioctl: name not supplied when creating device [ 583.301558][ T4414] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 583.311393][ T4414] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 583.339352][ T8512] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 583.368340][ T8512] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 583.388672][ T8512] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 583.417185][ T8512] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 583.530232][ T8512] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 583.546349][ T8512] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 583.570175][ T8512] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 583.601315][ T8512] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 583.649869][ T8512] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 583.938731][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 584.156931][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 584.265501][ T8512] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 584.330169][ T8512] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 584.340554][ T8512] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 584.400323][ T8512] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 584.457647][ T8512] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 584.644985][ T8512] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 584.716225][ T8512] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 584.760556][ T4292] Bluetooth: Wrong link type (-22) [ 584.770108][ T8512] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 584.829856][ T8512] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 584.900420][ T8832] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1019'. [ 584.911051][ T4404] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 586.242194][ T4404] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 586.313587][ T8512] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 586.322746][ T4292] Bluetooth: hci4: command 0x1003 tx timeout [ 586.330695][ T8153] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 586.407316][ T8512] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 586.416357][ T22] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 586.507754][ T8512] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 586.560453][ T8512] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 586.640496][ T22] usb 4-1: Using ep0 maxpacket: 8 [ 586.647737][ T22] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 586.676907][ T22] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 586.703024][ T22] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 586.730175][ T22] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 586.750405][ T22] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 586.780247][ T22] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 586.799678][ T22] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 586.913032][ T6874] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 586.980264][ T6874] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 587.029711][ T6874] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 587.073114][ T22] usb 4-1: usb_control_msg returned -32 [ 587.078728][ T22] usbtmc 4-1:16.0: can't read capabilities [ 587.137667][ T4412] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 587.170468][ T4412] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 587.201830][ T4406] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 587.496298][ T8855] netlink: 4 bytes leftover after parsing attributes in process `syz.2.958'. [ 587.914226][ T8839] usbtmc 4-1:16.0: usb_control_msg returned -32 [ 588.280247][ T4324] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 588.413037][ T8875] device-mapper: ioctl: name not supplied when creating device [ 588.470314][ T4324] usb 6-1: Using ep0 maxpacket: 8 [ 588.483173][ T4324] usb 6-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 588.550221][ T4324] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 588.776165][ T4324] usb 6-1: Product: syz [ 588.851752][ T4324] usb 6-1: Manufacturer: syz [ 588.873788][ T4324] usb 6-1: SerialNumber: syz [ 588.911264][ T4324] usb 6-1: config 0 descriptor?? [ 588.952970][ T4324] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 588.995868][ T4324] pctv452e: pctv452e_power_ctrl: 1 [ 588.995868][ T4324] [ 589.130234][ T4324] usb 6-1: selecting invalid altsetting 3 [ 589.136031][ T4324] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 589.136031][ T4324] [ 589.155496][ T4324] dvb-usb: bulk message failed: -22 (5/0) [ 589.163635][ T4324] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 589.174171][ T4324] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 589.187355][ T4324] usb 6-1: media controller created [ 589.192911][ T4324] dvb-usb: bulk message failed: -22 (8/0) [ 589.204666][ T4324] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 589.218902][ T4324] dvb-usb: MAC address reading failed. [ 589.236277][ T4324] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 589.352779][ T2188] usb 4-1: USB disconnect, device number 9 [ 590.062460][ T4324] DVB: Unable to find symbol stb0899_attach() [ 590.068592][ T4324] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 590.450380][ T4324] rc_core: IR keymap rc-tt-1500 not found [ 590.459014][ T4324] Registered IR keymap rc-empty [ 590.544726][ T8907] sctp: [Deprecated]: syz.5.1033 (pid 8907) Use of int in max_burst socket option. [ 590.544726][ T8907] Use struct sctp_assoc_value instead [ 592.144100][ T4324] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.5/usb6/6-1/rc/rc0 [ 592.177946][ T4324] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.5/usb6/6-1/rc/rc0/input30 [ 592.200967][ T4324] dvb-usb: schedule remote query interval to 100 msecs. [ 592.208075][ T4324] pctv452e: pctv452e_power_ctrl: 0 [ 592.208075][ T4324] [ 592.216333][ T4324] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 592.228523][ T4324] usb 6-1: USB disconnect, device number 15 [ 592.501100][ T4324] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 592.836233][ T8919] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1036'. [ 592.990537][ T8923] device-mapper: ioctl: name not supplied when creating device [ 593.740278][ T4509] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 595.423011][ T8951] sctp: [Deprecated]: syz.0.1046 (pid 8951) Use of int in max_burst socket option. [ 595.423011][ T8951] Use struct sctp_assoc_value instead [ 595.480282][ T4509] usb 6-1: Using ep0 maxpacket: 8 [ 596.231549][ T4509] usb 6-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 596.310358][ T4509] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 596.390325][ T4509] usb 6-1: Product: syz [ 596.394578][ T4509] usb 6-1: Manufacturer: syz [ 596.431285][ T4509] usb 6-1: SerialNumber: syz [ 596.477222][ T4509] usb 6-1: config 0 descriptor?? [ 597.423490][ T4509] usb 6-1: can't set config #0, error -71 [ 597.579151][ T4509] usb 6-1: USB disconnect, device number 16 [ 597.623847][ T8965] comedi comedi2: rti802: I/O port conflict (0x1,4) [ 599.034693][ T8973] device-mapper: ioctl: name not supplied when creating device [ 599.115725][ T8975] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1053'. [ 599.303468][ T8153] Bluetooth: Wrong link type (-22) [ 599.309138][ T8153] Bluetooth: hci1: link tx timeout [ 599.314623][ T8153] Bluetooth: hci1: killing stalled connection 10:aa:aa:aa:aa:aa [ 599.324019][ T8153] Bluetooth: hci1: link tx timeout [ 599.329248][ T8153] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 599.414138][ T8982] raw_sendmsg: syz.5.1055 forgot to set AF_INET. Fix it! [ 599.692887][ T8980] ipt_CLUSTERIP: Please specify destination IP [ 600.046601][ T8989] sctp: [Deprecated]: syz.2.1058 (pid 8989) Use of int in max_burst socket option. [ 600.046601][ T8989] Use struct sctp_assoc_value instead [ 600.928428][ T8991] binder: 8990:8991 ioctl c0306201 0 returned -14 [ 600.996039][ T8995] loop2: detected capacity change from 0 to 7 [ 601.027033][ T8509] Dev loop2: unable to read RDB block 7 [ 601.042956][ T8509] loop2: unable to read partition table [ 601.059999][ T8509] loop2: partition table beyond EOD, truncated [ 601.103544][ T8995] Dev loop2: unable to read RDB block 7 [ 601.117852][ T8995] loop2: unable to read partition table [ 601.140594][ T8995] loop2: partition table beyond EOD, truncated [ 601.174491][ T8995] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 603.210307][ T127] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 603.430230][ T127] usb 4-1: Using ep0 maxpacket: 8 [ 603.450453][ T127] usb 4-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 603.459552][ T127] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 603.543180][ T127] usb 4-1: Product: syz [ 603.547400][ T127] usb 4-1: Manufacturer: syz [ 603.609122][ T127] usb 4-1: SerialNumber: syz [ 603.649131][ T127] usb 4-1: config 0 descriptor?? [ 603.729128][ T127] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 603.795853][ T127] pctv452e: pctv452e_power_ctrl: 1 [ 603.795853][ T127] [ 603.840402][ T127] usb 4-1: selecting invalid altsetting 3 [ 603.846192][ T127] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 603.846192][ T127] [ 604.540676][ T127] dvb-usb: bulk message failed: -22 (5/0) [ 604.585184][ T127] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 604.633092][ T127] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 604.656169][ T127] usb 4-1: media controller created [ 604.693527][ T127] dvb-usb: bulk message failed: -22 (8/0) [ 604.721629][ T127] pctv452e: I2C error -22; AA 01 A0 01 14 -> aa 01 31 04 a0 01 14 [ 604.749546][ T127] dvb-usb: MAC address reading failed. [ 604.787647][ T127] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 605.156138][ T127] DVB: Unable to find symbol stb0899_attach() [ 605.167448][ T127] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 605.590491][ T127] rc_core: IR keymap rc-tt-1500 not found [ 605.596327][ T127] Registered IR keymap rc-empty [ 605.613958][ T127] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 605.754015][ T127] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input31 [ 605.770029][ T127] dvb-usb: schedule remote query interval to 100 msecs. [ 605.777413][ T127] pctv452e: pctv452e_power_ctrl: 0 [ 605.777413][ T127] [ 605.785025][ T127] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 605.811876][ T127] usb 4-1: USB disconnect, device number 10 [ 606.113810][ T9034] netlink: 12 bytes leftover after parsing attributes in process `syz.9.1066'. [ 606.377461][ T127] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 606.774712][ T9034] team0: Port device team_slave_0 removed [ 607.014634][ T9047] device-mapper: ioctl: name not supplied when creating device [ 607.540457][ T9057] sctp: [Deprecated]: syz.3.1069 (pid 9057) Use of int in max_burst socket option. [ 607.540457][ T9057] Use struct sctp_assoc_value instead [ 607.610918][ T8153] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 607.617581][ T4292] Bluetooth: hci4: command 0x1003 tx timeout [ 611.460995][ T9078] netlink: 4 bytes leftover after parsing attributes in process `syz.9.1077'. [ 611.782938][ T9085] loop2: detected capacity change from 0 to 7 [ 611.821756][ T9086] Dev loop2: unable to read RDB block 7 [ 611.827393][ T9086] loop2: unable to read partition table [ 611.854680][ T9086] loop2: partition table beyond EOD, truncated [ 611.944922][ T9085] Dev loop2: unable to read RDB block 7 [ 611.953742][ T9085] loop2: unable to read partition table [ 611.959588][ T9085] loop2: partition table beyond EOD, truncated [ 612.036168][ T9085] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 612.106849][ T3639] Dev loop2: unable to read RDB block 7 [ 612.143499][ T3639] loop2: unable to read partition table [ 612.166367][ T3639] loop2: partition table beyond EOD, truncated [ 612.465484][ T9101] sctp: [Deprecated]: syz.0.1083 (pid 9101) Use of int in max_burst socket option. [ 612.465484][ T9101] Use struct sctp_assoc_value instead [ 615.678815][ T9116] device-mapper: ioctl: name not supplied when creating device [ 619.210720][ T8153] Bluetooth: Wrong link type (-22) [ 621.038585][ T9163] input: syz0 as /devices/virtual/input/input32 [ 621.861999][ T9168] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1091'. [ 622.795042][ T9170] sctp: [Deprecated]: syz.9.1097 (pid 9170) Use of int in max_burst socket option. [ 622.795042][ T9170] Use struct sctp_assoc_value instead [ 623.291550][ T9172] device-mapper: ioctl: name not supplied when creating device [ 624.247704][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.254544][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.300942][ T22] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 624.688248][ T22] usb 1-1: Using ep0 maxpacket: 32 [ 624.702254][ T22] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 624.720215][ T22] usb 1-1: config 0 has no interface number 0 [ 624.735080][ T22] usb 1-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 624.750170][ T22] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 624.760517][ T22] usb 1-1: Product: syz [ 624.764721][ T22] usb 1-1: Manufacturer: syz [ 624.876186][ T22] usb 1-1: SerialNumber: syz [ 624.977193][ T22] usb 1-1: config 0 descriptor?? [ 625.035551][ T22] usb 1-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 625.095605][ T22] usb 1-1: selecting invalid altsetting 1 [ 625.103832][ T22] usb 1-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 625.197395][ T22] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 625.307289][ T22] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 625.340341][ T22] usb 1-1: media controller created [ 625.428104][ T22] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 626.583124][ T9178] usb 1-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 626.692997][ T22] usb 1-1: dvb_usb_ce6230: usb_control_msg() failed=-32 [ 626.710409][ T22] zl10353_read_register: readreg error (reg=127, ret==-32) [ 626.876417][ T22] usb 1-1: USB disconnect, device number 38 [ 627.159633][ T9218] sctp: [Deprecated]: syz.5.1109 (pid 9218) Use of int in max_burst socket option. [ 627.159633][ T9218] Use struct sctp_assoc_value instead [ 630.435234][ T9234] input: syz0 as /devices/virtual/input/input33 [ 632.706347][ T9240] device-mapper: ioctl: name not supplied when creating device [ 636.483656][ T4292] Bluetooth: hci5: Ignoring HCI_Connection_Complete for existing connection [ 636.780711][ T9262] FAULT_INJECTION: forcing a failure. [ 636.780711][ T9262] name failslab, interval 1, probability 0, space 0, times 0 [ 636.813824][ T9262] CPU: 1 PID: 9262 Comm: syz.9.1119 Not tainted syzkaller #0 [ 636.821261][ T9262] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 636.831419][ T9262] Call Trace: [ 636.834707][ T9262] [ 636.837646][ T9262] dump_stack_lvl+0x188/0x24e [ 636.842346][ T9262] ? show_regs_print_info+0x12/0x12 [ 636.847553][ T9262] ? load_image+0x410/0x410 [ 636.852075][ T9262] ? __might_sleep+0xd0/0xd0 [ 636.856678][ T9262] ? __lock_acquire+0x7c40/0x7c40 [ 636.861717][ T9262] should_fail_ex+0x390/0x4c0 [ 636.866410][ T9262] should_failslab+0x5/0x20 [ 636.870920][ T9262] slab_pre_alloc_hook+0x59/0x300 [ 636.875953][ T9262] ? __register_sysctl_table+0x9b0/0xed0 [ 636.881631][ T9262] __kmem_cache_alloc_node+0x4f/0x270 [ 636.887014][ T9262] ? __register_sysctl_table+0x9b0/0xed0 [ 636.892661][ T9262] __kmalloc+0xa3/0x240 [ 636.896834][ T9262] __register_sysctl_table+0x9b0/0xed0 [ 636.902308][ T9262] setup_mq_sysctls+0x4d1/0x560 [ 636.907169][ T9262] copy_ipcs+0x2fc/0x500 [ 636.911419][ T9262] create_new_namespaces+0x212/0x700 [ 636.916739][ T9262] unshare_nsproxy_namespaces+0x116/0x160 [ 636.922471][ T9262] ksys_unshare+0x4f6/0x8e0 [ 636.926988][ T9262] ? sighand_ctor+0x40/0x40 [ 636.931497][ T9262] ? lock_chain_count+0x20/0x20 [ 636.936371][ T9262] ? syscall_enter_from_user_mode+0x21/0x80 [ 636.942281][ T9262] __x64_sys_unshare+0x34/0x40 [ 636.947056][ T9262] do_syscall_64+0x4c/0xa0 [ 636.951477][ T9262] ? clear_bhb_loop+0x60/0xb0 [ 636.956158][ T9262] ? clear_bhb_loop+0x60/0xb0 [ 636.960846][ T9262] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 636.966748][ T9262] RIP: 0033:0x7f04e899e159 [ 636.971169][ T9262] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 636.990798][ T9262] RSP: 002b:00007f04e98f8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 636.999245][ T9262] RAX: ffffffffffffffda RBX: 00007f04e8c25fa0 RCX: 00007f04e899e159 [ 637.007232][ T9262] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000004a000200 [ 637.015214][ T9262] RBP: 00007f04e8a3506b R08: 0000000000000000 R09: 0000000000000000 [ 637.023190][ T9262] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 637.031188][ T9262] R13: 00007f04e8c26038 R14: 00007f04e8c25fa0 R15: 00007ffc701f4008 [ 637.039183][ T9262] [ 637.132060][ T9262] sysctl could not get directory: /fs -12 [ 637.168819][ T9262] CPU: 0 PID: 9262 Comm: syz.9.1119 Not tainted syzkaller #0 [ 637.176268][ T9262] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 637.186362][ T9262] Call Trace: [ 637.189673][ T9262] [ 637.192631][ T9262] dump_stack_lvl+0x188/0x24e [ 637.197351][ T9262] ? show_regs_print_info+0x12/0x12 [ 637.202589][ T9262] ? slab_free_freelist_hook+0x133/0x1b0 [ 637.208261][ T9262] ? __register_sysctl_table+0xe35/0xed0 [ 637.213937][ T9262] ? __kmem_cache_free+0xb6/0x200 [ 637.219009][ T9262] __register_sysctl_table+0xe3a/0xed0 [ 637.224519][ T9262] setup_mq_sysctls+0x4d1/0x560 [ 637.229410][ T9262] copy_ipcs+0x2fc/0x500 [ 637.233687][ T9262] create_new_namespaces+0x212/0x700 [ 637.239025][ T9262] unshare_nsproxy_namespaces+0x116/0x160 [ 637.244795][ T9262] ksys_unshare+0x4f6/0x8e0 [ 637.249362][ T9262] ? sighand_ctor+0x40/0x40 [ 637.253907][ T9262] ? lock_chain_count+0x20/0x20 [ 637.258808][ T9262] ? syscall_enter_from_user_mode+0x21/0x80 [ 637.264749][ T9262] __x64_sys_unshare+0x34/0x40 [ 637.269553][ T9262] do_syscall_64+0x4c/0xa0 [ 637.274004][ T9262] ? clear_bhb_loop+0x60/0xb0 [ 637.278715][ T9262] ? clear_bhb_loop+0x60/0xb0 [ 637.283427][ T9262] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 637.289359][ T9262] RIP: 0033:0x7f04e899e159 [ 637.293805][ T9262] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 637.313454][ T9262] RSP: 002b:00007f04e98f8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 637.321913][ T9262] RAX: ffffffffffffffda RBX: 00007f04e8c25fa0 RCX: 00007f04e899e159 [ 637.329926][ T9262] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000004a000200 [ 637.337961][ T9262] RBP: 00007f04e8a3506b R08: 0000000000000000 R09: 0000000000000000 [ 637.345972][ T9262] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 637.353980][ T9262] R13: 00007f04e8c26038 R14: 00007f04e8c25fa0 R15: 00007ffc701f4008 [ 637.362001][ T9262] [ 640.935652][ T9293] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1111'. [ 641.562149][ T9299] input: syz0 as /devices/virtual/input/input34 [ 643.431007][ T9305] size and base must be multiples of 4 kiB [ 643.436896][ T9305] CPU: 1 PID: 9305 Comm: syz.0.1128 Not tainted syzkaller #0 [ 643.444299][ T9305] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 643.454380][ T9305] Call Trace: [ 643.457682][ T9305] [ 643.460643][ T9305] dump_stack_lvl+0x188/0x24e [ 643.465368][ T9305] ? show_regs_print_info+0x12/0x12 [ 643.470605][ T9305] ? load_image+0x410/0x410 [ 643.475160][ T9305] ? __might_fault+0xa6/0x120 [ 643.479869][ T9305] ? __might_fault+0xc2/0x120 [ 643.484581][ T9305] ? __might_fault+0xa6/0x120 [ 643.489298][ T9305] mtrr_del+0x81/0xb0 [ 643.493349][ T9305] mtrr_ioctl+0x998/0x1140 [ 643.497816][ T9305] ? mtrr_close+0x1f0/0x1f0 [ 643.502372][ T9305] ? __fget_files+0x28/0x460 [ 643.507015][ T9305] ? mtrr_close+0x1f0/0x1f0 [ 643.511571][ T9305] proc_reg_unlocked_ioctl+0x1cb/0x2b0 [ 643.517097][ T9305] ? proc_reg_poll+0x280/0x280 [ 643.521901][ T9305] __se_sys_ioctl+0xfa/0x170 [ 643.526534][ T9305] do_syscall_64+0x4c/0xa0 [ 643.530982][ T9305] ? clear_bhb_loop+0x60/0xb0 [ 643.535695][ T9305] ? clear_bhb_loop+0x60/0xb0 [ 643.540415][ T9305] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 643.546340][ T9305] RIP: 0033:0x7f6bb1d9e159 [ 643.550763][ T9305] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 643.570378][ T9305] RSP: 002b:00007f6bb2b9e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 643.578800][ T9305] RAX: ffffffffffffffda RBX: 00007f6bb2025fa0 RCX: 00007f6bb1d9e159 [ 643.586787][ T9305] RDX: 0000200000000140 RSI: 0000000040104d04 RDI: 0000000000000003 [ 643.594778][ T9305] RBP: 00007f6bb1e3506b R08: 0000000000000000 R09: 0000000000000000 [ 643.602760][ T9305] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 643.610737][ T9305] R13: 00007f6bb2026038 R14: 00007f6bb2025fa0 R15: 00007ffc1aa6a378 [ 643.618727][ T9305] [ 643.898782][ T9311] device-mapper: ioctl: name not supplied when creating device [ 644.168673][ T9315] sctp: [Deprecated]: syz.2.1123 (pid 9315) Use of int in max_burst socket option. [ 644.168673][ T9315] Use struct sctp_assoc_value instead [ 650.322257][ T9342] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1138'. [ 650.632452][ T9348] input: syz0 as /devices/virtual/input/input35 [ 650.969337][ T9353] sctp: [Deprecated]: syz.2.1140 (pid 9353) Use of int in max_burst socket option. [ 650.969337][ T9353] Use struct sctp_assoc_value instead [ 651.981510][ T9355] device-mapper: ioctl: name not supplied when creating device [ 655.233393][ T4292] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 655.244741][ T4292] CPU: 1 PID: 4292 Comm: kworker/u5:7 Not tainted syzkaller #0 [ 655.252311][ T4292] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 655.262367][ T4292] Workqueue: hci2 hci_rx_work [ 655.267054][ T4292] Call Trace: [ 655.270340][ T4292] [ 655.273292][ T4292] dump_stack_lvl+0x188/0x24e [ 655.277991][ T4292] ? show_regs_print_info+0x12/0x12 [ 655.283183][ T4292] ? load_image+0x410/0x410 [ 655.287691][ T4292] sysfs_create_dir_ns+0x26a/0x290 [ 655.292822][ T4292] ? __lock_acquire+0x7c40/0x7c40 [ 655.297844][ T4292] ? sysfs_warn_dup+0xa0/0xa0 [ 655.302534][ T4292] ? do_raw_spin_unlock+0x11d/0x230 [ 655.307745][ T4292] kobject_add_internal+0x617/0xca0 [ 655.312967][ T4292] kobject_add+0x160/0x230 [ 655.317405][ T4292] ? kobject_init+0x1c0/0x1c0 [ 655.322094][ T4292] ? __raw_spin_lock_init+0x41/0x100 [ 655.327383][ T4292] ? klist_children_get+0x50/0x50 [ 655.332416][ T4292] ? get_device_parent+0x121/0x3e0 [ 655.337546][ T4292] device_add+0x470/0x1050 [ 655.341986][ T4292] hci_conn_add_sysfs+0xd1/0x1e0 [ 655.346940][ T4292] le_conn_complete_evt+0xf93/0x15c0 [ 655.352253][ T4292] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 655.358509][ T4292] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 655.364159][ T4292] ? mutex_unlock+0x10/0x10 [ 655.368671][ T4292] ? skb_pull_data+0xec/0x1f0 [ 655.373365][ T4292] hci_le_enh_conn_complete_evt+0x185/0x460 [ 655.379275][ T4292] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 655.385713][ T4292] ? hci_remote_host_features_evt+0x230/0x230 [ 655.391794][ T4292] hci_event_packet+0x7b3/0x1290 [ 655.396747][ T4292] ? lock_chain_count+0x20/0x20 [ 655.401626][ T4292] ? bis_list+0x280/0x280 [ 655.405960][ T4292] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 655.411877][ T4292] ? kcov_remote_start+0x50f/0x810 [ 655.417006][ T4292] ? lockdep_hardirqs_on+0x94/0x140 [ 655.422355][ T4292] ? hci_send_to_monitor+0x9c/0x4a0 [ 655.427580][ T4292] hci_rx_work+0x3eb/0xd40 [ 655.432014][ T4292] ? _raw_spin_unlock+0x40/0x40 [ 655.436882][ T4292] ? process_one_work+0x7b4/0x1160 [ 655.442005][ T4292] process_one_work+0x8ab/0x1160 [ 655.446978][ T4292] ? worker_detach_from_pool+0x240/0x240 [ 655.452627][ T4292] ? _raw_spin_lock_irq+0xb7/0xf0 [ 655.457751][ T4292] ? _raw_spin_lock_irqsave+0x100/0x100 [ 655.463314][ T4292] ? wq_worker_running+0x97/0x190 [ 655.468346][ T4292] worker_thread+0xaf5/0x12a0 [ 655.473057][ T4292] kthread+0x29d/0x330 [ 655.477150][ T4292] ? worker_clr_flags+0x1a0/0x1a0 [ 655.482204][ T4292] ? kthread_blkcg+0xd0/0xd0 [ 655.486839][ T4292] ret_from_fork+0x1f/0x30 [ 655.491309][ T4292] [ 655.495975][ T4292] kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 655.509886][ T4292] Bluetooth: hci2: failed to register connection device [ 657.040443][ T4292] Bluetooth: hci0: command 0x0406 tx timeout [ 657.421770][ T9400] input: syz0 as /devices/virtual/input/input36 [ 657.555919][ T9402] sctp: [Deprecated]: syz.0.1151 (pid 9402) Use of int in max_burst socket option. [ 657.555919][ T9402] Use struct sctp_assoc_value instead [ 658.647671][ T9415] device-mapper: ioctl: name not supplied when creating device [ 663.082473][ T4292] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 663.092796][ T4292] CPU: 1 PID: 4292 Comm: kworker/u5:7 Not tainted syzkaller #0 [ 663.100378][ T4292] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 663.110443][ T4292] Workqueue: hci0 hci_rx_work [ 663.115137][ T4292] Call Trace: [ 663.118417][ T4292] [ 663.121348][ T4292] dump_stack_lvl+0x188/0x24e [ 663.126036][ T4292] ? show_regs_print_info+0x12/0x12 [ 663.131233][ T4292] ? load_image+0x410/0x410 [ 663.135749][ T4292] sysfs_create_dir_ns+0x26a/0x290 [ 663.140862][ T4292] ? __lock_acquire+0x7c40/0x7c40 [ 663.145916][ T4292] ? sysfs_warn_dup+0xa0/0xa0 [ 663.150639][ T4292] ? do_raw_spin_unlock+0x11d/0x230 [ 663.155880][ T4292] kobject_add_internal+0x617/0xca0 [ 663.161257][ T4292] kobject_add+0x160/0x230 [ 663.165733][ T4292] ? kobject_init+0x1c0/0x1c0 [ 663.170426][ T4292] ? __raw_spin_lock_init+0x41/0x100 [ 663.175713][ T4292] ? klist_children_get+0x50/0x50 [ 663.180743][ T4292] ? get_device_parent+0x121/0x3e0 [ 663.185867][ T4292] device_add+0x470/0x1050 [ 663.190292][ T4292] hci_conn_add_sysfs+0xd1/0x1e0 [ 663.195232][ T4292] le_conn_complete_evt+0xf93/0x15c0 [ 663.200537][ T4292] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 663.206795][ T4292] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 663.212435][ T4292] ? mutex_unlock+0x10/0x10 [ 663.216940][ T4292] ? skb_pull_data+0xec/0x1f0 [ 663.221618][ T4292] hci_le_enh_conn_complete_evt+0x185/0x460 [ 663.227515][ T4292] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 663.233934][ T4292] ? hci_remote_host_features_evt+0x230/0x230 [ 663.239999][ T4292] hci_event_packet+0x7b3/0x1290 [ 663.244942][ T4292] ? lock_chain_count+0x20/0x20 [ 663.249800][ T4292] ? bis_list+0x280/0x280 [ 663.254129][ T4292] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 663.260023][ T4292] ? kcov_remote_start+0x50f/0x810 [ 663.265133][ T4292] ? lockdep_hardirqs_on+0x94/0x140 [ 663.270333][ T4292] ? hci_send_to_monitor+0x9c/0x4a0 [ 663.275535][ T4292] hci_rx_work+0x3eb/0xd40 [ 663.279949][ T4292] ? _raw_spin_unlock+0x40/0x40 [ 663.284801][ T4292] ? process_one_work+0x7b4/0x1160 [ 663.289909][ T4292] process_one_work+0x8ab/0x1160 [ 663.294855][ T4292] ? worker_detach_from_pool+0x240/0x240 [ 663.300487][ T4292] ? _raw_spin_lock_irq+0xb7/0xf0 [ 663.305514][ T4292] ? _raw_spin_lock_irqsave+0x100/0x100 [ 663.311059][ T4292] ? wq_worker_running+0x97/0x190 [ 663.316081][ T4292] worker_thread+0xaf5/0x12a0 [ 663.320775][ T4292] kthread+0x29d/0x330 [ 663.324836][ T4292] ? worker_clr_flags+0x1a0/0x1a0 [ 663.329858][ T4292] ? kthread_blkcg+0xd0/0xd0 [ 663.334444][ T4292] ret_from_fork+0x1f/0x30 [ 663.338869][ T4292] [ 663.346048][ T4292] kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 663.359580][ T4292] Bluetooth: hci0: failed to register connection device [ 663.935052][ T9442] sctp: [Deprecated]: syz.9.1163 (pid 9442) Use of int in max_burst socket option. [ 663.935052][ T9442] Use struct sctp_assoc_value instead [ 665.046437][ T9449] device-mapper: ioctl: name not supplied when creating device [ 665.945512][ T9458] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1156'. [ 667.280221][ T8153] Bluetooth: hci3: command 0x0406 tx timeout [ 670.790709][ T8153] Bluetooth: hci5: Ignoring HCI_Connection_Complete for existing connection [ 671.534315][ T9507] sctp: [Deprecated]: syz.5.1175 (pid 9507) Use of int in max_burst socket option. [ 671.534315][ T9507] Use struct sctp_assoc_value instead [ 672.410428][ T8153] Bluetooth: hci2: command 0x0406 tx timeout [ 677.651484][ T9546] Bluetooth: MGMT ver 1.22 [ 680.111072][ T4292] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 680.126317][ T4292] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 680.206916][ T4292] Bluetooth: Wrong link type (-22) [ 680.212837][ T4292] Bluetooth: hci1: link tx timeout [ 680.218224][ T4292] Bluetooth: hci1: killing stalled connection 10:aa:aa:aa:aa:aa [ 680.227274][ T4292] Bluetooth: hci1: link tx timeout [ 680.232718][ T4292] Bluetooth: hci1: killing stalled connection 11:aa:aa:aa:aa:aa [ 680.244483][ T4292] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 680.908631][ T4292] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 680.917565][ T4292] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 680.926140][ T4292] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 681.124954][ T9] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 681.488800][ T9] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 683.130785][ T8153] Bluetooth: hci3: command 0x0409 tx timeout [ 683.156453][ T9] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 685.200195][ T8153] Bluetooth: hci3: command 0x041b tx timeout [ 685.581195][ T9610] FAULT_INJECTION: forcing a failure. [ 685.581195][ T9610] name failslab, interval 1, probability 0, space 0, times 0 [ 685.594991][ T9610] CPU: 1 PID: 9610 Comm: syz.0.1197 Not tainted syzkaller #0 [ 685.602408][ T9610] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 685.612559][ T9610] Call Trace: [ 685.615850][ T9610] [ 685.618795][ T9610] dump_stack_lvl+0x188/0x24e [ 685.623495][ T9610] ? show_regs_print_info+0x12/0x12 [ 685.628710][ T9610] ? load_image+0x410/0x410 [ 685.633227][ T9610] ? __might_sleep+0xd0/0xd0 [ 685.637827][ T9610] ? __lock_acquire+0x7c40/0x7c40 [ 685.642863][ T9610] ? mark_lock+0x94/0x320 [ 685.647208][ T9610] should_fail_ex+0x390/0x4c0 [ 685.651904][ T9610] should_failslab+0x5/0x20 [ 685.656410][ T9610] slab_pre_alloc_hook+0x59/0x300 [ 685.661442][ T9610] ? snd_seq_port_connect+0x67/0x420 [ 685.666814][ T9610] __kmem_cache_alloc_node+0x4f/0x270 [ 685.672201][ T9610] ? snd_seq_port_connect+0x67/0x420 [ 685.677499][ T9610] kmalloc_trace+0x26/0xe0 [ 685.681936][ T9610] snd_seq_port_connect+0x67/0x420 [ 685.687084][ T9610] ? do_raw_read_unlock+0x39/0x70 [ 685.692150][ T9610] ? _raw_read_unlock+0x24/0x40 [ 685.697018][ T9610] snd_seq_ioctl_subscribe_port+0x30a/0x6d0 [ 685.702921][ T9610] ? snd_seq_oss_midi_open+0x196/0x7f0 [ 685.708395][ T9610] ? snd_seq_ioctl_set_port_info+0x130/0x130 [ 685.714380][ T9610] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 685.720301][ T9610] ? _raw_spin_unlock+0x40/0x40 [ 685.725165][ T9610] ? chrdev_open+0x585/0x5f0 [ 685.729762][ T9610] ? path_openat+0x2674/0x2f10 [ 685.734533][ T9610] ? do_filp_open+0x1ee/0x420 [ 685.739212][ T9610] ? do_sys_openat2+0x14b/0x4f0 [ 685.744083][ T9610] snd_seq_oss_midi_open+0x4f3/0x7f0 [ 685.749384][ T9610] ? snd_seq_oss_midi_open_all+0xc0/0xc0 [ 685.755045][ T9610] snd_seq_oss_synth_setup_midi+0x129/0x520 [ 685.760967][ T9610] snd_seq_oss_open+0x932/0xf00 [ 685.765836][ T9610] ? snd_seq_oss_delete_client+0x50/0x50 [ 685.771512][ T9610] ? trace_raw_output_contention_end+0xd0/0xd0 [ 685.777697][ T9610] ? odev_open+0x58/0x90 [ 685.781952][ T9610] ? __lock_acquire+0x7c40/0x7c40 [ 685.786994][ T9610] ? snd_seq_oss_process_event+0x2910/0x2910 [ 685.792982][ T9610] ? async_call_lookup_ports+0x10/0x10 [ 685.798450][ T9610] ? do_raw_spin_unlock+0x11d/0x230 [ 685.803661][ T9610] ? soundcore_open+0x309/0x4b0 [ 685.808606][ T9610] odev_open+0x63/0x90 [ 685.812688][ T9610] chrdev_open+0x585/0x5f0 [ 685.817121][ T9610] ? cd_forget+0x160/0x160 [ 685.821548][ T9610] ? fsnotify_perm+0x39b/0x550 [ 685.826321][ T9610] ? cd_forget+0x160/0x160 [ 685.830744][ T9610] do_dentry_open+0x7dd/0x10b0 [ 685.835534][ T9610] path_openat+0x2674/0x2f10 [ 685.840154][ T9610] ? verify_lock_unused+0x140/0x140 [ 685.845365][ T9610] ? do_sys_openat2+0xdd/0x4f0 [ 685.850144][ T9610] ? do_filp_open+0x420/0x420 [ 685.854847][ T9610] do_filp_open+0x1ee/0x420 [ 685.859360][ T9610] ? vfs_tmpfile+0x470/0x470 [ 685.863979][ T9610] ? _raw_spin_unlock+0x24/0x40 [ 685.868839][ T9610] ? alloc_fd+0x590/0x640 [ 685.873190][ T9610] do_sys_openat2+0x14b/0x4f0 [ 685.877878][ T9610] ? do_sys_open+0xe0/0xe0 [ 685.882304][ T9610] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 685.888296][ T9610] ? lock_chain_count+0x20/0x20 [ 685.893161][ T9610] __x64_sys_openat+0x135/0x160 [ 685.898026][ T9610] do_syscall_64+0x4c/0xa0 [ 685.902452][ T9610] ? clear_bhb_loop+0x60/0xb0 [ 685.907135][ T9610] ? clear_bhb_loop+0x60/0xb0 [ 685.911819][ T9610] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 685.917725][ T9610] RIP: 0033:0x7f6bb1d9e159 [ 685.922151][ T9610] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 685.941762][ T9610] RSP: 002b:00007f6bb2b9e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 685.950188][ T9610] RAX: ffffffffffffffda RBX: 00007f6bb2025fa0 RCX: 00007f6bb1d9e159 [ 685.958165][ T9610] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 00000000ffffff9c [ 685.966144][ T9610] RBP: 00007f6bb1e3506b R08: 0000000000000000 R09: 0000000000000000 [ 685.974123][ T9610] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 685.982100][ T9610] R13: 00007f6bb2026038 R14: 00007f6bb2025fa0 R15: 00007ffc1aa6a378 [ 685.990109][ T9610] [ 686.003265][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.009626][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.078599][ T9] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 686.292902][ T8153] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 687.554324][ T8153] Bluetooth: hci3: command 0x040f tx timeout [ 687.568865][ T9617] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1199'. [ 687.635357][ T9573] chnl_net:caif_netlink_parms(): no params data found [ 689.600298][ T8153] Bluetooth: hci3: command 0x0419 tx timeout [ 690.977242][ T9573] bridge0: port 1(bridge_slave_0) entered blocking state [ 691.001602][ T9573] bridge0: port 1(bridge_slave_0) entered disabled state [ 691.041727][ T9573] device bridge_slave_0 entered promiscuous mode [ 691.091536][ T9573] bridge0: port 2(bridge_slave_1) entered blocking state [ 691.098693][ T9573] bridge0: port 2(bridge_slave_1) entered disabled state [ 691.191367][ T9573] device bridge_slave_1 entered promiscuous mode [ 691.489353][ T9573] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 691.546329][ T9573] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 691.611072][ T8153] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 691.635649][ T8153] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 691.647442][ T8153] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 691.662196][ T8153] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 691.671476][ T8153] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 691.678742][ T8153] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 692.117391][ T9573] team0: Port device team_slave_0 added [ 692.174953][ T9573] team0: Port device team_slave_1 added [ 692.717815][ T9573] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 692.758712][ T9573] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 692.876501][ T9573] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 692.974238][ T9573] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 693.004091][ T9573] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 693.105384][ T9573] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 693.950586][ T4293] Bluetooth: hci4: command 0x0409 tx timeout [ 694.240508][ T127] usb 6-1: new high-speed USB device number 17 using dummy_hcd [ 694.334290][ T9573] device hsr_slave_0 entered promiscuous mode [ 694.380762][ T9573] device hsr_slave_1 entered promiscuous mode [ 694.421615][ T9573] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 694.429245][ T9573] Cannot create hsr debugfs directory [ 694.535015][ T127] usb 6-1: Using ep0 maxpacket: 32 [ 694.542297][ T127] usb 6-1: config 0 has an invalid interface number: 12 but max is 0 [ 694.559324][ T127] usb 6-1: config 0 has no interface number 0 [ 694.570291][ T127] usb 6-1: config 0 interface 12 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 695.230232][ T127] usb 6-1: config 0 interface 12 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 695.240262][ T127] usb 6-1: config 0 interface 12 has no altsetting 0 [ 695.301051][ T127] usb 6-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 695.330635][ T127] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 695.338696][ T127] usb 6-1: Product: syz [ 695.475979][ T127] usb 6-1: Manufacturer: syz [ 695.497543][ T127] usb 6-1: SerialNumber: syz [ 695.681205][ T127] usb 6-1: config 0 descriptor?? [ 695.737996][ T127] f81534 6-1:0.12: unsupported endpoint max packet size [ 696.000376][ T4293] Bluetooth: hci4: command 0x041b tx timeout [ 697.218184][ T27] usb 6-1: USB disconnect, device number 17 [ 697.252319][ T9652] chnl_net:caif_netlink_parms(): no params data found [ 698.090406][ T4293] Bluetooth: hci4: command 0x040f tx timeout [ 698.156691][ T9] device hsr_slave_0 left promiscuous mode [ 698.216156][ T58] Bluetooth: hci0: Frame reassembly failed (-84) [ 698.297220][ T9] device hsr_slave_1 left promiscuous mode [ 698.352808][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 699.245269][ T9] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 700.160222][ T8153] Bluetooth: hci4: command 0x0419 tx timeout [ 700.240553][ T4293] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 700.711065][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 700.718570][ T9] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 701.137465][ T9] device bridge_slave_1 left promiscuous mode [ 701.371585][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 701.603169][ T9] device bridge_slave_0 left promiscuous mode [ 701.613514][ T9722] device-mapper: ioctl: ioctl interface mismatch: kernel(4.47.0), user(0.0.0), cmd(9) [ 701.617231][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 701.928048][ T9] device veth1_macvtap left promiscuous mode [ 701.940932][ T9] device veth0_macvtap left promiscuous mode [ 701.970606][ T9] device veth1_vlan left promiscuous mode [ 701.976612][ T9] device veth0_vlan left promiscuous mode [ 704.320367][ T9734] binder: 9733:9734 ioctl c0306201 0 returned -14 [ 704.401583][ T9735] binder_alloc: 9733: binder_alloc_buf, no vma [ 704.810360][ T8153] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 704.824288][ T8153] CPU: 1 PID: 8153 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 704.831875][ T8153] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 704.841931][ T8153] Workqueue: hci1 hci_rx_work [ 704.846633][ T8153] Call Trace: [ 704.849925][ T8153] [ 704.852857][ T8153] dump_stack_lvl+0x188/0x24e [ 704.857560][ T8153] ? show_regs_print_info+0x12/0x12 [ 704.862763][ T8153] ? load_image+0x410/0x410 [ 704.867275][ T8153] sysfs_create_dir_ns+0x26a/0x290 [ 704.872397][ T8153] ? __lock_acquire+0x7c40/0x7c40 [ 704.877421][ T8153] ? sysfs_warn_dup+0xa0/0xa0 [ 704.882120][ T8153] ? do_raw_spin_unlock+0x11d/0x230 [ 704.887320][ T8153] kobject_add_internal+0x617/0xca0 [ 704.892524][ T8153] kobject_add+0x160/0x230 [ 704.896963][ T8153] ? kobject_init+0x1c0/0x1c0 [ 704.901643][ T8153] ? __raw_spin_lock_init+0x41/0x100 [ 704.906924][ T8153] ? klist_children_get+0x50/0x50 [ 704.911944][ T8153] ? get_device_parent+0x121/0x3e0 [ 704.917067][ T8153] device_add+0x470/0x1050 [ 704.921490][ T8153] hci_conn_add_sysfs+0xd1/0x1e0 [ 704.926471][ T8153] le_conn_complete_evt+0xf93/0x15c0 [ 704.931768][ T8153] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 704.938029][ T8153] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 704.943665][ T8153] ? mutex_unlock+0x10/0x10 [ 704.948167][ T8153] ? skb_pull_data+0xec/0x1f0 [ 704.952844][ T8153] hci_le_enh_conn_complete_evt+0x185/0x460 [ 704.958745][ T8153] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 704.965170][ T8153] ? hci_remote_host_features_evt+0x230/0x230 [ 704.971236][ T8153] hci_event_packet+0x7b3/0x1290 [ 704.976176][ T8153] ? __lock_acquire+0x7c40/0x7c40 [ 704.981201][ T8153] ? bis_list+0x280/0x280 [ 704.985533][ T8153] ? skb_release_data+0x1d3/0x7e0 [ 704.990588][ T8153] hci_rx_work+0x3eb/0xd40 [ 704.995011][ T8153] ? _raw_spin_unlock+0x40/0x40 [ 704.999884][ T8153] ? process_one_work+0x7b4/0x1160 [ 705.004993][ T8153] process_one_work+0x8ab/0x1160 [ 705.009937][ T8153] ? worker_detach_from_pool+0x240/0x240 [ 705.015580][ T8153] ? _raw_spin_lock_irq+0xb7/0xf0 [ 705.020623][ T8153] ? _raw_spin_lock_irqsave+0x100/0x100 [ 705.026169][ T8153] ? wq_worker_running+0x97/0x190 [ 705.031212][ T8153] worker_thread+0xaf5/0x12a0 [ 705.035901][ T8153] ? _raw_spin_unlock_irqrestore+0xbc/0x120 [ 705.041794][ T8153] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 705.047695][ T8153] kthread+0x29d/0x330 [ 705.051774][ T8153] ? worker_clr_flags+0x1a0/0x1a0 [ 705.056794][ T8153] ? kthread_blkcg+0xd0/0xd0 [ 705.061382][ T8153] ret_from_fork+0x1f/0x30 [ 705.065824][ T8153] [ 705.079194][ T8153] kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 705.092497][ T8153] Bluetooth: hci1: failed to register connection device [ 705.831750][ T9739] ip_tables: iptables: counters copy to user failed while replacing table [ 706.003128][ T9] team0 (unregistering): Port device team_slave_1 removed [ 706.220711][ T9] team0 (unregistering): Port device team_slave_0 removed [ 707.203802][ T9] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 707.223677][ T9746] 9pnet_fd: Insufficient options for proto=fd [ 707.338033][ T9] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 711.325051][ T9] bond0 (unregistering): Released all slaves [ 711.614249][ T9761] binder: 9760:9761 ioctl c0306201 0 returned -14 [ 711.641558][ T9761] binder_alloc: 9760: binder_alloc_buf, no vma [ 711.696643][ T9715] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1216'. [ 711.834677][ T9715] team0: Port device team_slave_0 removed [ 711.963188][ T9766] tmpfs: Unknown parameter 'quota' [ 712.753684][ T8153] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 712.763332][ T8153] CPU: 1 PID: 8153 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 712.770903][ T8153] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 712.780967][ T8153] Workqueue: hci2 hci_rx_work [ 712.785684][ T8153] Call Trace: [ 712.788955][ T8153] [ 712.791897][ T8153] dump_stack_lvl+0x188/0x24e [ 712.796579][ T8153] ? show_regs_print_info+0x12/0x12 [ 712.801774][ T8153] ? load_image+0x410/0x410 [ 712.806289][ T8153] sysfs_create_dir_ns+0x26a/0x290 [ 712.811416][ T8153] ? __lock_acquire+0x7c40/0x7c40 [ 712.816485][ T8153] ? sysfs_warn_dup+0xa0/0xa0 [ 712.821200][ T8153] ? do_raw_spin_unlock+0x11d/0x230 [ 712.826401][ T8153] kobject_add_internal+0x617/0xca0 [ 712.831603][ T8153] kobject_add+0x160/0x230 [ 712.836022][ T8153] ? kobject_init+0x1c0/0x1c0 [ 712.840699][ T8153] ? __raw_spin_lock_init+0x41/0x100 [ 712.845996][ T8153] ? klist_children_get+0x50/0x50 [ 712.851016][ T8153] ? get_device_parent+0x121/0x3e0 [ 712.856133][ T8153] device_add+0x470/0x1050 [ 712.860551][ T8153] hci_conn_add_sysfs+0xd1/0x1e0 [ 712.865488][ T8153] le_conn_complete_evt+0xf93/0x15c0 [ 712.870780][ T8153] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 712.877027][ T8153] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 712.882658][ T8153] ? mutex_unlock+0x10/0x10 [ 712.887157][ T8153] ? skb_pull_data+0xec/0x1f0 [ 712.891835][ T8153] hci_le_enh_conn_complete_evt+0x185/0x460 [ 712.897744][ T8153] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 712.904161][ T8153] ? hci_remote_host_features_evt+0x230/0x230 [ 712.910238][ T8153] hci_event_packet+0x7b3/0x1290 [ 712.915204][ T8153] ? lock_chain_count+0x20/0x20 [ 712.920057][ T8153] ? bis_list+0x280/0x280 [ 712.924404][ T8153] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 712.930303][ T8153] ? kcov_remote_start+0x50f/0x810 [ 712.935415][ T8153] ? lockdep_hardirqs_on+0x94/0x140 [ 712.940612][ T8153] ? hci_send_to_monitor+0x9c/0x4a0 [ 712.945827][ T8153] hci_rx_work+0x3eb/0xd40 [ 712.950247][ T8153] ? _raw_spin_unlock+0x40/0x40 [ 712.955101][ T8153] ? process_one_work+0x7b4/0x1160 [ 712.960221][ T8153] process_one_work+0x8ab/0x1160 [ 712.965189][ T8153] ? worker_detach_from_pool+0x240/0x240 [ 712.970837][ T8153] ? _raw_spin_lock_irq+0xb7/0xf0 [ 712.975862][ T8153] ? _raw_spin_lock_irqsave+0x100/0x100 [ 712.981424][ T8153] ? wq_worker_running+0x97/0x190 [ 712.986446][ T8153] worker_thread+0xaf5/0x12a0 [ 712.991147][ T8153] ? _raw_spin_unlock_irqrestore+0xbc/0x120 [ 712.997041][ T8153] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 713.002939][ T8153] kthread+0x29d/0x330 [ 713.007004][ T8153] ? worker_clr_flags+0x1a0/0x1a0 [ 713.012034][ T8153] ? kthread_blkcg+0xd0/0xd0 [ 713.016628][ T8153] ret_from_fork+0x1f/0x30 [ 713.021054][ T8153] [ 713.032794][ T8153] kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 713.046756][ T8153] Bluetooth: hci2: failed to register connection device [ 713.582382][ T9652] bridge0: port 1(bridge_slave_0) entered blocking state [ 713.591416][ T9652] bridge0: port 1(bridge_slave_0) entered disabled state [ 713.642543][ T9652] device bridge_slave_0 entered promiscuous mode [ 713.783381][ T9652] bridge0: port 2(bridge_slave_1) entered blocking state [ 713.815025][ T9652] bridge0: port 2(bridge_slave_1) entered disabled state [ 713.873033][ T9652] device bridge_slave_1 entered promiscuous mode [ 714.159883][ T9652] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 714.241116][ T9573] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 714.297253][ T9652] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 714.348443][ T9573] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 714.412223][ T9573] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 714.485711][ T9573] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 714.537982][ T9652] team0: Port device team_slave_0 added [ 715.819437][ T9652] team0: Port device team_slave_1 added [ 715.971920][ T9652] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 715.978957][ T9652] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 716.067336][ T9652] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 716.110969][ T9795] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1238'. [ 716.199232][ T9] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 716.248702][ T9652] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 716.266364][ T9652] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 716.330032][ T9652] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 716.357936][ T9800] binder: 9799:9800 ioctl c0306201 0 returned -14 [ 716.388836][ T9800] binder_alloc: 9799: binder_alloc_buf, no vma [ 716.474384][ T9] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 716.639869][ T9] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 716.738741][ T9652] device hsr_slave_0 entered promiscuous mode [ 716.860604][ T9652] device hsr_slave_1 entered promiscuous mode [ 716.867485][ T9652] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 716.927073][ T9652] Cannot create hsr debugfs directory [ 717.089058][ T9] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 717.198910][ T9808] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1240'. [ 717.436122][ T9573] 8021q: adding VLAN 0 to HW filter on device bond0 [ 717.586187][ T4339] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 717.597076][ T4339] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 717.695196][ T9573] 8021q: adding VLAN 0 to HW filter on device team0 [ 717.785641][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 717.809932][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 717.864066][ T7428] bridge0: port 1(bridge_slave_0) entered blocking state [ 717.871295][ T7428] bridge0: port 1(bridge_slave_0) entered forwarding state [ 717.994250][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 718.035955][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 718.089093][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 718.966999][ T8153] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 719.025303][ T7428] bridge0: port 2(bridge_slave_1) entered blocking state [ 719.032562][ T7428] bridge0: port 2(bridge_slave_1) entered forwarding state [ 719.161471][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 719.194939][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 719.299025][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 719.378616][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 719.437918][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 719.485617][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 720.211958][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 720.231586][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 720.300456][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 720.349794][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 720.400665][ T7428] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 720.565845][ T9573] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 721.770951][ T4293] Bluetooth: Wrong link type (-22) [ 722.795226][ T9652] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 722.837259][ T9652] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 724.203603][ T9652] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 724.239404][ T9652] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 724.333204][ T4339] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 724.350967][ T4339] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 724.362389][ T9573] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 724.965612][ T9] device hsr_slave_0 left promiscuous mode [ 724.991125][ T9] device hsr_slave_1 left promiscuous mode [ 725.008210][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 725.037815][ T9] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 725.097955][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 725.115915][ T9] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 725.150854][ T9] device bridge_slave_1 left promiscuous mode [ 725.177521][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 725.227095][ T9] device bridge_slave_0 left promiscuous mode [ 725.250287][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 725.377932][ T9] device veth1_macvtap left promiscuous mode [ 725.390664][ T9] device veth0_macvtap left promiscuous mode [ 725.407083][ T9] device veth1_vlan left promiscuous mode [ 725.432984][ T9] device veth0_vlan left promiscuous mode [ 728.965467][ T9] team0 (unregistering): Port device team_slave_1 removed [ 729.995625][ T9] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 730.221912][ T4293] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 730.232221][ T4293] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 730.241737][ T4293] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 730.250727][ T4293] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 730.258326][ T9] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 730.270535][ T4293] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 730.293394][ T4293] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 730.842917][ T9933] device-mapper: table: 248:1: zero-length target [ 730.849641][ T9933] device-mapper: ioctl: error adding target to table [ 731.386278][ T9] bond0 (unregistering): Released all slaves [ 731.491408][ T9652] 8021q: adding VLAN 0 to HW filter on device bond0 [ 731.633000][ T9652] 8021q: adding VLAN 0 to HW filter on device team0 [ 731.640520][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 731.658646][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 731.749828][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 731.784361][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 732.687928][ T4293] Bluetooth: hci0: command 0x0409 tx timeout [ 732.712209][ T4412] bridge0: port 1(bridge_slave_0) entered blocking state [ 732.719360][ T4412] bridge0: port 1(bridge_slave_0) entered forwarding state [ 732.884066][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 732.900893][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 732.931419][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 732.952710][ T4412] bridge0: port 2(bridge_slave_1) entered blocking state [ 732.959852][ T4412] bridge0: port 2(bridge_slave_1) entered forwarding state [ 733.000498][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 733.042820][ T4406] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 733.151370][ T26] kauditd_printk_skb: 61 callbacks suppressed [ 733.151449][ T26] audit: type=1800 audit(1790817855.654:74): pid=9958 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1260" name="file" dev="configfs" ino=57902 res=0 errno=0 [ 733.189449][ T4406] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 733.210992][ T9958] mass_storage.0/lun.0: unable to open backing file: file0 [ 733.222884][ T4406] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 733.288074][ T4406] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 733.344705][ T4406] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 733.361468][ T4406] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 733.399374][ T4406] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 733.430843][ T4406] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 733.439385][ T4406] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 733.494831][ T9652] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 733.581023][ T4406] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 733.600896][ T4406] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 733.626028][ T4406] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 733.718206][ T9573] device veth0_vlan entered promiscuous mode [ 733.813028][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 733.842624][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 733.861907][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 733.869898][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 734.117498][ T9573] device veth1_vlan entered promiscuous mode [ 734.232044][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 734.247633][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 734.373663][ T9573] device veth0_macvtap entered promiscuous mode [ 734.511852][ T9573] device veth1_macvtap entered promiscuous mode [ 734.653942][ T9] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 734.680684][ T9] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 734.720854][ T4293] Bluetooth: hci0: command 0x041b tx timeout [ 734.732115][ T9923] chnl_net:caif_netlink_parms(): no params data found [ 734.764926][ T9987] 9pnet_fd: Insufficient options for proto=fd [ 734.867540][ T9] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 734.906729][ T9] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 736.800340][ T8153] Bluetooth: hci0: command 0x040f tx timeout [ 736.880650][ T4293] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 737.872447][ T9573] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 737.885345][ T9573] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 737.896402][ T9573] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 737.914434][ T9573] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 737.924775][ T9573] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 737.935452][ T9573] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 737.949190][ T9573] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 737.987253][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 737.999238][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 738.027053][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 738.027359][ T26] audit: type=1800 audit(1790817860.524:75): pid=10028 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1265" name="no_out_endpoint" dev="configfs" ino=57268 res=0 errno=0 [ 738.036605][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 738.066358][ T26] audit: type=1800 audit(1790817860.564:76): pid=10028 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1265" name="report_length" dev="configfs" ino=57953 res=0 errno=0 [ 738.075673][T10002] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1263'. [ 738.188161][ T9] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 738.207304][ T9] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 738.215147][T10030] FAULT_INJECTION: forcing a failure. [ 738.215147][T10030] name failslab, interval 1, probability 0, space 0, times 0 [ 738.233359][T10030] CPU: 1 PID: 10030 Comm: syz.2.1266 Not tainted syzkaller #0 [ 738.240888][T10030] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 738.250980][T10030] Call Trace: [ 738.254292][T10030] [ 738.255093][ T9652] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 738.257240][T10030] dump_stack_lvl+0x188/0x24e [ 738.268731][T10030] ? show_regs_print_info+0x12/0x12 [ 738.273973][T10030] ? load_image+0x410/0x410 [ 738.278527][T10030] ? __might_sleep+0xd0/0xd0 [ 738.283158][T10030] ? __lock_acquire+0x7c40/0x7c40 [ 738.288238][T10030] should_fail_ex+0x390/0x4c0 [ 738.292976][T10030] should_failslab+0x5/0x20 [ 738.297516][T10030] slab_pre_alloc_hook+0x59/0x300 [ 738.302623][T10030] ? __kernfs_new_node+0xa6/0x7f0 [ 738.307688][T10030] ? rcu_is_watching+0x11/0xa0 [ 738.310567][ T9652] device veth0_vlan entered promiscuous mode [ 738.312486][T10030] kmem_cache_alloc+0x56/0x2f0 [ 738.312513][T10030] ? __kernfs_new_node+0xe1/0x7f0 [ 738.324962][ T9652] device veth1_vlan entered promiscuous mode [ 738.328287][T10030] __kernfs_new_node+0xe1/0x7f0 [ 738.328317][T10030] ? vsnprintf+0x1b22/0x1c20 [ 738.343785][T10030] ? kernfs_new_node+0x250/0x250 [ 738.348747][T10030] ? snprintf+0xe5/0x140 [ 738.353004][T10030] ? mark_lock+0x94/0x320 [ 738.357355][T10030] ? vscnprintf+0x80/0x80 [ 738.361735][T10030] ? __lock_acquire+0x1465/0x7c40 [ 738.366808][T10030] kernfs_new_node+0x148/0x250 [ 738.371603][T10030] __kernfs_create_file+0x47/0x2e0 [ 738.376733][T10030] cgroup_addrm_files+0x80c/0xd50 [ 738.381788][T10030] ? trace_raw_output_cgroup_event+0x1e0/0x1e0 [ 738.387966][T10030] ? mark_lock+0x94/0x320 [ 738.392316][T10030] ? mark_lock+0x94/0x320 [ 738.396663][T10030] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 738.402665][T10030] ? __local_bh_enable_ip+0x136/0x1c0 [ 738.408044][T10030] ? lockdep_hardirqs_on+0x94/0x140 [ 738.413271][T10030] css_populate_dir+0x157/0x3b0 [ 738.418137][T10030] cgroup_apply_control_enable+0x641/0xb00 [ 738.423968][T10030] cgroup_mkdir+0xc7f/0xe70 [ 738.428486][T10030] ? css_task_iter_end+0x280/0x280 [ 738.433615][T10030] ? kernfs_iop_permission+0x26d/0x350 [ 738.439090][T10030] ? css_task_iter_end+0x280/0x280 [ 738.444208][T10030] kernfs_iop_mkdir+0x23d/0x3d0 [ 738.449083][T10030] vfs_mkdir+0x386/0x570 [ 738.453345][T10030] do_mkdirat+0x1d8/0x440 [ 738.457689][T10030] ? vfs_mkdir+0x570/0x570 [ 738.462120][T10030] __x64_sys_mkdirat+0x85/0x90 [ 738.466893][T10030] do_syscall_64+0x4c/0xa0 [ 738.471315][T10030] ? clear_bhb_loop+0x60/0xb0 [ 738.476000][T10030] ? clear_bhb_loop+0x60/0xb0 [ 738.480684][T10030] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 738.486595][T10030] RIP: 0033:0x7fa3a319e159 [ 738.491024][T10030] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 738.510642][T10030] RSP: 002b:00007fa3a407f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 738.519071][T10030] RAX: ffffffffffffffda RBX: 00007fa3a3425fa0 RCX: 00007fa3a319e159 [ 738.527051][T10030] RDX: 00000000000001ff RSI: 0000200000000000 RDI: ffffffffffffff9c [ 738.535036][T10030] RBP: 00007fa3a323506b R08: 0000000000000000 R09: 0000000000000000 [ 738.543016][T10030] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 738.550996][T10030] R13: 00007fa3a3426038 R14: 00007fa3a3425fa0 R15: 00007ffd62ce7a08 [ 738.558988][T10030] [ 738.564135][ T9573] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 738.573250][T10030] cgroup: cgroup_addrm_files: failed to add reset_stats, err=-12 [ 738.592552][ T9573] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 738.602695][ T9573] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 738.613187][ T9573] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 738.623513][ T9573] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 738.634300][ T9573] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 738.660338][ T9573] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 738.676619][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 738.696350][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 738.709534][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 738.727691][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 738.740318][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 738.757457][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 738.766250][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 738.782180][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 738.798356][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 740.029725][ T8153] Bluetooth: hci0: command 0x0419 tx timeout [ 740.154360][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 740.295793][ T9] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 740.346437][ T9] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 740.459451][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 740.471397][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 740.553028][ T9652] device veth0_macvtap entered promiscuous mode [ 740.666935][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 740.803300][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 740.958692][ T9652] device veth1_macvtap entered promiscuous mode [ 740.977100][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 741.005987][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 741.088400][ T9923] bridge0: port 1(bridge_slave_0) entered blocking state [ 741.111162][ T9923] bridge0: port 1(bridge_slave_0) entered disabled state [ 741.119473][ T9923] device bridge_slave_0 entered promiscuous mode [ 741.174905][ T9652] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 741.212561][ T9652] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 741.239726][ T9652] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 741.269303][ T9652] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 741.290555][ T4293] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 741.299658][ T9652] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 741.311115][ T4293] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 741.325783][ T4292] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 741.337044][ T4292] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 741.346713][ T4292] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 741.354140][ T4292] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 741.420184][ T9652] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 741.460183][ T9652] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 741.500232][ T9652] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 741.550550][ T9652] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 741.587063][ T9923] bridge0: port 2(bridge_slave_1) entered blocking state [ 741.626547][ T9923] bridge0: port 2(bridge_slave_1) entered disabled state [ 741.690252][ T9923] device bridge_slave_1 entered promiscuous mode [ 741.781537][ T4438] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 741.794780][ T4438] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 742.550478][ T9652] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 742.578315][ T9652] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 742.601641][ T9652] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 742.620457][ T9652] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 742.642245][ T9652] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 742.660243][ T9652] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 742.680358][ T9652] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 742.708027][ T9652] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 742.751661][ T9652] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 742.774822][ T9652] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 742.801287][ T9652] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 742.830225][ T9652] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 742.839025][ T9652] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 742.878431][ T9923] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 742.904837][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 742.917963][ T4412] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 743.101740][ T26] audit: type=1800 audit(1790817865.604:77): pid=10087 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1274" name="no_out_endpoint" dev="configfs" ino=58191 res=0 errno=0 [ 743.165822][ T26] audit: type=1800 audit(1790817865.624:78): pid=10087 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1274" name="report_length" dev="configfs" ino=58192 res=0 errno=0 [ 743.346957][ T9923] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 743.492357][T10091] unchecked MSR access error: WRMSR to 0x404 (tried to write 0x0000000000000003) at rIP: 0xffffffff813296b2 (__mcheck_cpu_init_clear_banks+0x102/0x1e0) [ 743.508215][T10091] Call Trace: [ 743.511535][T10091] [ 743.514512][T10091] mce_cpu_restart+0xca/0x1a0 [ 743.519246][T10091] smp_call_function_many_cond+0xbfb/0x1250 [ 743.525191][T10091] ? mce_restart+0x1a0/0x1a0 [ 743.529827][T10091] ? smp_call_function_many+0x30/0x30 [ 743.535230][T10091] ? timer_delete_sync+0x20/0x20 [ 743.540189][T10091] ? mutex_lock_nested+0x10/0x10 [ 743.545152][T10091] ? _parse_integer_limit+0x195/0x1d0 [ 743.550548][T10091] ? mce_restart+0x1a0/0x1a0 [ 743.555146][T10091] on_each_cpu_cond_mask+0x3b/0x80 [ 743.560268][T10091] mce_restart+0x13d/0x1a0 [ 743.564701][T10091] set_bank+0x27b/0x390 [ 743.568867][T10091] ? show_bank+0x290/0x290 [ 743.573299][T10091] ? sysfs_kf_write+0x183/0x2a0 [ 743.578171][T10091] ? sysfs_kf_read+0x350/0x350 [ 743.582943][T10091] kernfs_fop_write_iter+0x3a0/0x520 [ 743.588244][T10091] vfs_write+0x482/0x9a0 [ 743.592533][T10091] ? file_end_write+0x250/0x250 [ 743.597411][T10091] ? __fget_files+0x3fc/0x460 [ 743.602114][T10091] ? __fdget_pos+0x2ae/0x360 [ 743.606718][T10091] ? ksys_write+0x70/0x260 [ 743.611150][T10091] ksys_write+0x14d/0x260 [ 743.615495][T10091] ? __ia32_sys_read+0x80/0x80 [ 743.620283][T10091] ? lockdep_hardirqs_on+0x94/0x140 [ 743.625497][T10091] do_syscall_64+0x4c/0xa0 [ 743.629923][T10091] ? clear_bhb_loop+0x60/0xb0 [ 743.634612][T10091] ? clear_bhb_loop+0x60/0xb0 [ 743.639298][T10091] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 743.645212][T10091] RIP: 0033:0x7fa3a319e159 [ 743.649642][T10091] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 743.669257][T10091] RSP: 002b:00007fa3a407f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 743.677682][T10091] RAX: ffffffffffffffda RBX: 00007fa3a3425fa0 RCX: 00007fa3a319e159 [ 743.685661][T10091] RDX: 0000000000000001 RSI: 0000200000000340 RDI: 0000000000000008 [ 743.693644][T10091] RBP: 00007fa3a323506b R08: 0000000000000000 R09: 0000000000000000 [ 743.701622][T10091] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 743.709601][T10091] R13: 00007fa3a3426038 R14: 00007fa3a3425fa0 R15: 00007ffd62ce7a08 [ 743.717597][T10091] [ 743.724767][ T4292] Bluetooth: hci1: command 0x0409 tx timeout [ 743.895187][ T9923] team0: Port device team_slave_0 added [ 743.958261][ T9923] team0: Port device team_slave_1 added [ 744.049798][ T4406] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 744.079256][ T4406] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 744.108686][ T4411] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 744.129217][ T9923] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 744.138181][ T9923] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 744.173079][ T9923] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 744.243737][ T26] audit: type=1800 audit(1790817866.744:79): pid=10102 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1277" name="file" dev="configfs" ino=58218 res=0 errno=0 [ 744.313834][ T4320] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 744.314256][ T9923] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 744.341607][ T9923] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 744.358418][ T4320] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 744.420174][ T9923] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 744.451626][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 745.760475][ T4292] Bluetooth: hci1: command 0x041b tx timeout [ 746.589770][ T9923] device hsr_slave_0 entered promiscuous mode [ 746.652962][ T9923] device hsr_slave_1 entered promiscuous mode [ 746.831376][T10060] chnl_net:caif_netlink_parms(): no params data found [ 747.123168][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.129578][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.840224][ T4292] Bluetooth: hci1: command 0x040f tx timeout [ 748.238379][T10131] bridge0: port 2(bridge_slave_1) entered disabled state [ 748.246824][T10131] bridge0: port 1(bridge_slave_0) entered disabled state [ 748.953206][T10131] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 749.014276][T10131] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 750.504749][ T4292] Bluetooth: hci1: command 0x0419 tx timeout [ 751.116372][T10131] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 751.126057][T10131] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 751.138691][T10131] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 751.151394][T10131] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 752.193758][T10060] bridge0: port 1(bridge_slave_0) entered blocking state [ 752.209396][T10060] bridge0: port 1(bridge_slave_0) entered disabled state [ 752.218027][T10060] device bridge_slave_0 entered promiscuous mode [ 752.306737][ T9] device hsr_slave_0 left promiscuous mode [ 752.330174][ T4509] usb 2-1: new full-speed USB device number 10 using dummy_hcd [ 752.338108][ T9] device hsr_slave_1 left promiscuous mode [ 752.350548][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 752.358020][ T9] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 752.412217][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 752.419681][ T9] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 752.461033][ T9] device bridge_slave_1 left promiscuous mode [ 752.467373][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 753.229432][ T4509] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 753.243908][ T4509] usb 2-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xBE, skipping [ 753.340156][ T4509] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 753.392642][ T4509] usb 2-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 753.415303][ T4509] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 753.455871][ T4509] usb 2-1: Product: syz [ 753.464511][ T4509] usb 2-1: Manufacturer: syz [ 753.474821][ T4509] usb 2-1: SerialNumber: syz [ 753.500793][ T4509] usb 2-1: config 0 descriptor?? [ 753.512970][ T9] device bridge_slave_0 left promiscuous mode [ 753.519241][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 753.539231][ T4509] radio-si470x 2-1:0.0: could not find interrupt in endpoint [ 753.561787][ T4509] radio-si470x: probe of 2-1:0.0 failed with error -5 [ 753.569373][ T4509] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 753.613047][ T9] device veth1_macvtap left promiscuous mode [ 753.619213][ T9] device veth0_macvtap left promiscuous mode [ 753.633900][ T9] device veth1_vlan left promiscuous mode [ 753.651050][ T9] device veth0_vlan left promiscuous mode [ 754.184268][ T9] bond1 (unregistering): (slave veth0_to_bond): Releasing backup interface [ 754.199982][ T9] bond1 (unregistering): Released all slaves [ 755.379836][ T4509] usb 2-1: USB disconnect, device number 10 [ 756.892442][ T9] team0 (unregistering): Port device team_slave_1 removed [ 757.281241][ T9] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 758.271279][ T9] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 759.233829][ T9] bond0 (unregistering): Released all slaves [ 759.382615][T10060] bridge0: port 2(bridge_slave_1) entered blocking state [ 759.389777][T10060] bridge0: port 2(bridge_slave_1) entered disabled state [ 759.433891][T10060] device bridge_slave_1 entered promiscuous mode [ 759.663751][T10060] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 761.068929][T10060] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 761.969297][T10060] team0: Port device team_slave_0 added [ 762.052567][T10060] team0: Port device team_slave_1 added [ 763.142859][ T9923] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 763.184546][T10060] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 763.201174][T10060] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 763.275928][T10060] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 763.620017][ T9923] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 763.851360][T10060] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 763.858624][T10060] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 763.885712][T10060] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 764.023028][ T9923] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 764.058865][ T9923] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 764.165016][T10060] device hsr_slave_0 entered promiscuous mode [ 764.206498][T10060] device hsr_slave_1 entered promiscuous mode [ 764.247824][T10060] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 764.270287][T10060] Cannot create hsr debugfs directory [ 764.509526][ T9923] 8021q: adding VLAN 0 to HW filter on device bond0 [ 764.600495][ T9923] 8021q: adding VLAN 0 to HW filter on device team0 [ 764.641403][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 764.671165][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 764.834497][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 764.871125][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 764.901423][T10277] Bluetooth: MGMT ver 1.22 [ 764.906535][ T4320] bridge0: port 1(bridge_slave_0) entered blocking state [ 764.913734][ T4320] bridge0: port 1(bridge_slave_0) entered forwarding state [ 765.164366][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 765.210506][ T6874] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 765.238908][ T6874] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 765.271621][ T6874] bridge0: port 2(bridge_slave_1) entered blocking state [ 765.278766][ T6874] bridge0: port 2(bridge_slave_1) entered forwarding state [ 765.332448][ T6874] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 765.397360][ T6874] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 765.439177][ T6874] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 766.263318][ T6874] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 766.355883][ T6874] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 766.372711][ T6874] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 766.394607][ T6874] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 766.429401][ T6874] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 766.466037][ T6874] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 766.487821][ T9923] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 766.533484][ T9923] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 766.607619][ T6874] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 766.628822][ T6874] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 772.158617][T10060] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 772.313349][T10060] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 772.333019][ T4411] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 772.374338][ T4411] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 772.397817][T10060] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 772.514673][ T9923] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 772.601842][T10060] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 772.881208][T10350] loop2: detected capacity change from 0 to 7 [ 772.926585][T10350] Dev loop2: unable to read RDB block 7 [ 772.980020][T10350] loop2: AHDI p1 p2 p3 [ 773.007768][ T9] device hsr_slave_0 left promiscuous mode [ 773.053017][ T9] device hsr_slave_1 left promiscuous mode [ 773.060641][T10350] loop2: partition table partially beyond EOD, truncated [ 773.122162][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 773.132923][T10350] loop2: p1 start 1601398130 is beyond EOD, truncated [ 773.139772][T10350] loop2: p2 start 1702059890 is beyond EOD, truncated [ 773.152960][ T9] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 773.251078][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 773.258550][ T9] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 773.301758][ T9] device bridge_slave_1 left promiscuous mode [ 773.308057][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 773.403994][ T9] device bridge_slave_0 left promiscuous mode [ 773.430554][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 773.545726][ T9] device veth1_macvtap left promiscuous mode [ 773.563223][ T9] device veth0_macvtap left promiscuous mode [ 773.589760][ T9] device veth1_vlan left promiscuous mode [ 773.609989][ T9] device veth0_vlan left promiscuous mode [ 780.247174][T10392] loop2: detected capacity change from 0 to 7 [ 780.262232][T10392] Dev loop2: unable to read RDB block 7 [ 780.267989][T10392] loop2: AHDI p1 p2 p3 [ 780.280184][T10392] loop2: partition table partially beyond EOD, truncated [ 780.312478][T10392] loop2: p1 start 1601398130 is beyond EOD, truncated [ 780.330335][T10392] loop2: p2 start 1702059890 is beyond EOD, truncated [ 783.725293][T10408] ALSA: mixer_oss: invalid OSS volume '' [ 783.784955][ T9] team0 (unregistering): Port device team_slave_1 removed [ 784.070997][ T9] team0 (unregistering): Port device team_slave_0 removed [ 785.350553][ T9] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 786.330733][ T9] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 787.358876][ T9] bond0 (unregistering): Released all slaves [ 787.629289][T10060] 8021q: adding VLAN 0 to HW filter on device bond0 [ 787.720133][T10428] netlink: 'syz.1.1333': attribute type 4 has an invalid length. [ 787.727935][T10428] netlink: 17 bytes leftover after parsing attributes in process `syz.1.1333'. [ 789.236951][ T5732] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 789.268955][ T5732] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 789.309015][T10060] 8021q: adding VLAN 0 to HW filter on device team0 [ 789.372715][ T4340] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 789.412747][ T4340] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 789.471971][ T4340] bridge0: port 1(bridge_slave_0) entered blocking state [ 789.479179][ T4340] bridge0: port 1(bridge_slave_0) entered forwarding state [ 789.571723][ T4340] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 789.610991][ T4340] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 789.668117][ T4340] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 789.725409][ T4340] bridge0: port 2(bridge_slave_1) entered blocking state [ 789.732619][ T4340] bridge0: port 2(bridge_slave_1) entered forwarding state [ 789.794516][ T4340] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 789.870482][ T4340] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 789.912613][ T4340] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 789.952281][ T4340] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 790.010874][ T4340] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 790.061866][ T4340] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 790.099273][T10060] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 790.166748][T10060] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 790.353212][ T4340] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 790.411199][ T4340] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 790.486711][ T4340] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 790.531433][ T4340] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 790.558061][ T4340] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 790.586290][ T4340] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 790.888160][ T8153] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 790.906537][ T8153] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 790.918209][ T8153] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 790.927004][ T8153] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 790.935457][ T8153] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 790.943499][ T8153] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 792.839556][T10465] chnl_net:caif_netlink_parms(): no params data found [ 793.034718][T10489] EXT4-fs (sda1): shut down requested (0) [ 793.050452][ T8153] Bluetooth: hci0: command 0x0409 tx timeout [ 793.117893][ T26] audit: type=1804 audit(1790817915.614:80): pid=10491 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.1342" name="/newroot/93/mnt/syzkaller0" dev="sda1" ino=2067 res=1 errno=0 [ 793.508268][T10465] bridge0: port 1(bridge_slave_0) entered blocking state [ 793.526439][T10465] bridge0: port 1(bridge_slave_0) entered disabled state [ 793.548786][T10465] device bridge_slave_0 entered promiscuous mode [ 793.750573][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 793.758139][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 793.797515][T10465] bridge0: port 2(bridge_slave_1) entered blocking state [ 793.807820][T10465] bridge0: port 2(bridge_slave_1) entered disabled state [ 793.860357][T10465] device bridge_slave_1 entered promiscuous mode [ 794.717663][T10060] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 795.009261][T10465] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 795.026984][T10465] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 795.130754][ T8153] Bluetooth: hci0: command 0x041b tx timeout [ 795.151931][T10465] team0: Port device team_slave_0 added [ 795.211120][T10465] team0: Port device team_slave_1 added [ 795.303390][T10465] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 795.351830][T10465] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 795.490153][T10465] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 795.530831][T10465] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 795.537856][T10465] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 795.690319][T10465] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 795.886746][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 795.930600][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 796.091767][T10465] device hsr_slave_0 entered promiscuous mode [ 796.120513][T10465] device hsr_slave_1 entered promiscuous mode [ 796.140371][T10465] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 796.147976][T10465] Cannot create hsr debugfs directory [ 796.585287][ T9184] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 796.618167][ T9184] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 796.646845][ T9184] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 796.676149][ T9184] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 797.426324][ T8153] Bluetooth: hci0: command 0x040f tx timeout [ 798.762231][T10060] device veth0_vlan entered promiscuous mode [ 799.031398][T10060] device veth1_vlan entered promiscuous mode [ 799.425636][T10060] device veth0_macvtap entered promiscuous mode [ 799.440266][ T8153] Bluetooth: hci0: command 0x0419 tx timeout [ 799.459120][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 799.500703][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 799.701076][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 799.804284][T10060] device veth1_macvtap entered promiscuous mode [ 800.123724][ T5732] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 800.145710][T10060] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 800.176664][T10060] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 800.249058][T10060] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 800.261052][T10060] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 800.326874][T10060] batman_adv: batadv0: Interface activated: batadv_slave_0 SYZFAIL: posix_spawnp failed (errno 5: Input/output error) [ 801.561045][ T9184] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 801.580933][ T9184] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 801.658560][ T9] device hsr_slave_0 left promiscuous mode [ 801.730185][ T9] device hsr_slave_1 left promiscuous mode [ 801.920196][ T9] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 801.993460][ T9] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 802.173082][ T9] device bridge_slave_1 left promiscuous mode [ 802.179383][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 802.311466][ T9] device bridge_slave_0 left promiscuous mode [ 802.317770][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 802.958993][ T9] team0 (unregistering): Port device team_slave_1 removed [ 803.002410][ T9] team0 (unregistering): Port device team_slave_0 removed [ 803.043384][ T9] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 803.088244][ T9] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 803.361727][ T9] bond0 (unregistering): Released all slaves [ 805.063232][ T9] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 805.118171][ T9] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 805.170522][ T9] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 805.223760][ T9] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 805.425674][ T9] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 805.507128][ T9] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 805.601005][ T9] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 805.683096][ T9] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 808.145461][ T9] device hsr_slave_0 left promiscuous mode [ 808.151758][ T9] device hsr_slave_1 left promiscuous mode [ 808.157957][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 808.165452][ T9] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 808.174815][ T9] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 808.182966][ T9] device bridge_slave_1 left promiscuous mode [ 808.189141][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 808.197467][ T9] device bridge_slave_0 left promiscuous mode [ 808.205037][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 808.217028][ T9] device hsr_slave_0 left promiscuous mode [ 808.223415][ T9] device hsr_slave_1 left promiscuous mode [ 808.229603][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 808.237183][ T9] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 808.244811][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 808.252425][ T9] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 808.260287][ T9] device bridge_slave_1 left promiscuous mode [ 808.266470][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 808.276317][ T9] device bridge_slave_0 left promiscuous mode [ 808.282728][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 808.296698][ T9] device hsr_slave_0 left promiscuous mode [ 808.303010][ T9] device hsr_slave_1 left promiscuous mode [ 808.309234][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 808.316916][ T9] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 808.324871][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 808.332461][ T9] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 808.340436][ T9] device bridge_slave_1 left promiscuous mode [ 808.346622][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 808.354767][ T9] device bridge_slave_0 left promiscuous mode [ 808.361079][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 808.372293][ T9] device hsr_slave_0 left promiscuous mode [ 808.378639][ T9] device hsr_slave_1 left promiscuous mode [ 808.385054][ T9] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 808.392707][ T9] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 808.400786][ T9] device bridge_slave_1 left promiscuous mode [ 808.407025][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 808.415131][ T9] device bridge_slave_0 left promiscuous mode [ 808.421467][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 808.465451][ T9] device veth1_macvtap left promiscuous mode [ 808.471654][ T9] device veth0_macvtap left promiscuous mode [ 808.477721][ T9] device veth1_vlan left promiscuous mode [ 808.488507][ T9] device veth0_vlan left promiscuous mode [ 808.495145][ T9] device veth1_macvtap left promiscuous mode [ 808.501251][ T9] device veth0_macvtap left promiscuous mode [ 808.507316][ T9] device veth1_vlan left promiscuous mode [ 808.513262][ T9] device veth0_vlan left promiscuous mode [ 808.520076][ T9] device veth1_macvtap left promiscuous mode [ 808.526340][ T9] device veth0_macvtap left promiscuous mode [ 808.532567][ T9] device veth1_vlan left promiscuous mode [ 808.538331][ T9] device veth0_vlan left promiscuous mode [ 808.564245][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.571221][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 809.159959][ T9] team0 (unregistering): Port device team_slave_1 removed [ 809.202814][ T9] team0 (unregistering): Port device team_slave_0 removed [ 809.247276][ T9] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 809.291247][ T9] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 809.562726][ T9] bond0 (unregistering): Released all slaves [ 810.093873][ T9] team0 (unregistering): Port device team_slave_1 removed [ 810.135608][ T9] team0 (unregistering): Port device team_slave_0 removed [ 810.178419][ T9] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 810.221669][ T9] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 810.532931][ T9] bond0 (unregistering): Released all slaves [ 811.111985][ T9] team0 (unregistering): Port device team_slave_1 removed [ 811.178487][ T9] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface